One open language for the risk of AI agents and robots
RPS describes what a system is allowed to do, how dangerous it can be, how it is supervised and how an incident is proven. Insurers, operators and regulators can then speak about the same thing.
Three classes, typical triggers
| Class | Systems | Example triggers |
|---|---|---|
| 1 · AI & Software Agents | LLM agents for customers and operations; financial and trading agents; multi-agent and Web3 systems | Action outside mandate (payment above limit); confirmed data leak; breach of risk limits; base model or provider outage longer than N hours |
| 2 · Industrial & Logistics Robotics | Industrial manipulators; collaborative robots; mobile AGV/AMR | Human contact above the ISO/TS 15066 threshold with emergency stop; collision; unplanned downtime longer than N hours |
| 3 · Next-Gen Automated Systems | Humanoid robots; unmanned aerial, ground and marine systems | Loss of link or navigation; fall; geofence breach; kinetic damage to third parties |
Fleet risk is handled separately: simultaneous failure of more than X% of systems after a software or model update.
Eight parameters instead of a missing loss history
Every system gets a profile. Until the registry has enough statistics, the profile is what an underwriter prices.
Autonomy
Share of decisions taken without a human, L0 to L5.
Mandate
What the system may do: payment limits, access rights, force, speed.
Kinetic energy
The physical harm the system is able to cause.
Environment
Closed cell, shared zone or public space.
Oversight
Human in the loop, on the loop or after the fact; time to stop.
Provenance
Base model, version and vendor, to account for correlation.
Evaluation
ISO 10218, ISO 13482, ISO/IEC 42001, red-teaming results.
Logging
Ability to prove what happened, from local logs to signed, attested records.
When a trigger may enter the standard
A parametric policy pays when a defined event happens. That only works if the event is real and provable.
- Observable: the event leaves measurable traces.
- Independently confirmable: at least one source outside the operator can verify it.
- Linked to real loss: the trigger correlates with actual damage, and the remaining basis risk is disclosed before purchase.
Requirements for data sources
- Hardware attestation of telemetry (TPM or TEE).
- Trusted time via PTP (IEEE 1588) or GNSS, with RFC 3161 timestamps.
- Quorum of independent oracles, M of N.
- Independent calculation agent and a dispute window of 7 to 30 days.
- A ledger may be used as a tamper-evident journal, never as the source of truth.
Three levels
RPS Ready
The RPS profile of the system is complete and published to the insurer or partner.
RPS Verified
An accredited auditor has checked the profile, the logging and the oracle set-up.
RPS Insured
A licensed insurer has issued a policy based on RPS triggers for this system.
Versioned in public
The technical council has quotas for insurance, operators and manufacturers, science and civil society; no group has a majority. Versions are numbered RPS-1.0, 1.1 and so on, and each goes through at least 60 days of public consultation.
Compatible with the EU AI Act (logging, human oversight), NIST AI RMF, ISO/IEC 42001, ISO 10218, ISO/TS 15066 and AIUC-1.
RPS-1 v0.1 is a working draft for public comment. The full text and the Agent Incident Record schema are published on GitHub and archived with DOI 10.5281/zenodo.23476666. Comment via GitHub issues or write to info@roboins.org.