Three states have enacted IVO frameworks. A federal bill would mandate semi-annual verification. This guide explains how Independent Verification Organizations use SWT3 to produce tamper-evident, jurisdiction-portable assessment artifacts.
Who this is for: IVO candidates evaluating evidence infrastructure for state licensing, assessment firms expanding into AI verification, compliance officers at AI developers preparing for IVO assessments, state regulators designing IVO program requirements, and legal counsel advising on AI liability and evidentiary standards.
Critical Assessor Notice: Boundaries of Cryptographic Evidence
SWT3 witness anchors prove that specific operational controls were active at a specific point in time. They do not replace the IVO's independent judgment, assessment methodology, or regulatory authority. IVOs must apply their own evaluation criteria as defined in their memorandum of understanding with the authorizing state.
| Virginia SB 384/HB 797 | Signed April 13, 2026. JCOTS study of IVO framework. Bipartisan (84-14, 40-0). |
| Connecticut SB5 Section 47 | Enacted 2026. IVO pilot program: up to 5 IVOs, July 1 2027 to June 30 2030. Evidentiary support in civil litigation. |
| California SB 813 | Passed legislature August 31, 2026. Awaiting Governor Newsom signature. First-in-nation comprehensive IVO framework. |
| FRONTIER Act (H.R. 9925) | Federal bill introduced 2026. Bipartisan (Reps. Obernolte R-CA, Trahan D-MA). Semi-annual IVO verification for frontier developers. |
| IVO Definition | Independent, expert-led organizations licensed by a state or federal authority to verify whether AI systems meet defined safety and risk-mitigation benchmarks. |
| Fathom (nonprofit) | Developer of the IVO marketplace model. $25M funded. Championed VA, CT, CA, and FRONTIER Act legislation. |
| SWT3 Procedures Mapped | 18 procedures across 8 IVO assessment areas |
Governor Spanberger signed SB 384/HB 797 on April 13, 2026, directing the Joint Commission on Technology and Science (JCOTS) to evaluate a framework for Independent Verification Organizations. The legislation passed with strong bipartisan support. Virginia established the legislative precedent that independent AI verification is a governance function, not a market function.
Connecticut SB5 Section 47 authorizes a multi-year pilot program administered by the Department of Consumer Protection. Up to five IVOs will be approved to evaluate whether AI systems satisfy specified risk-mitigation and safety benchmarks. Each IVO operates under a memorandum of understanding that defines permitted scope, assessment methodologies, reporting requirements, and internal governance standards. The pilot runs from July 1, 2027 to June 30, 2030, with UConn's Institute for Municipal and Regional Policy evaluating whether to make the program permanent.
SB 813 (authored by Senator McNerney, sponsored by Fathom) passed both chambers of the California Legislature on August 31, 2026, and now awaits Governor Newsom's signature. If signed, California becomes the anchor state for independent AI verification with the nation's first comprehensive IVO framework. IVOs under SB 813 are qualified outside experts that independently assess the risk of AI models and systems using credible testing and analysis.
H.R. 9925 (Representatives Obernolte R-CA and Trahan D-MA) creates a federal system of licensed IVOs under a new Under Secretary of Commerce for AI Security. Large frontier developers ($50M+ revenue, $1B+ AI development expenditure over 36 months) must retain a licensed IVO to verify compliance and assess catastrophic risk mitigation every six months. The Department of Commerce sets IVO licensing standards. This bill would create the first recurring federal mandate for independent AI verification.
Four legislative vehicles across three states and the federal government arrived at the same conclusion within 14 months: AI systems need independent verification by qualified third parties, not self-attestation by the developer. The IVO model is the assessor class. What every IVO needs is an evidence protocol that produces artifacts meeting three requirements: verifiability (anyone can check the evidence), tamper-evidence (the provider cannot retroactively modify assessments), and portability (evidence produced for Connecticut is usable in California).
An IVO assessment produces a determination: this AI system does or does not meet the safety benchmarks defined by the authorizing state. That determination must be backed by evidence that a third party (a court, a regulator, another IVO) can independently verify. The evidence cannot depend on the IVO's word alone, just as a financial audit cannot depend solely on the auditor's assertion that they checked the books.
Both the AI developer and the IVO have incentives to present favorable results. The evidence protocol must make it structurally impossible for either party to retroactively modify assessment records. Timestamped cryptographic fingerprints, stored on infrastructure neither party controls, satisfy this requirement.
Under the Connecticut pilot, IVO verification evidence can be presented in civil litigation. A court will need to verify the evidence independently. Under the FRONTIER Act, the Department of Commerce sets IVO standards and may audit IVO assessments. In both cases, the evidence must be reproducible: given the same inputs and the same verification procedure, any party must reach the same conclusion about whether the evidence is valid.
The Connecticut pilot includes a provision for UConn to evaluate reciprocity with other states. If an IVO produces evidence for a Connecticut assessment, that evidence should be usable in a California proceeding without re-assessment. This requires a jurisdiction-neutral evidence format with metadata fields that indicate which state's benchmarks were evaluated.
SWT3 satisfies all four IVO evidence requirements:
Every SWT3 witness anchor carries a cryptographic fingerprint computed using SHA-256("WITNESS:{tenant}:{procedure}:{fa}:{fb}:{fc}:{ts_ms}"). Any party can recompute the fingerprint from the anchor payload and verify it matches. The public verification endpoint allows instant, free verification without authentication.
Anchors are stored on SWT3 infrastructure that neither the AI developer nor the IVO controls. Daily Merkle rollups produce a cryptographic root hash over all anchors minted that day for each tenant. Modifying any anchor after minting would change the Merkle root, making the tampering detectable.
The fingerprint formula is published and locked across 7 SDK languages (Python, TypeScript, Rust, C#, Ruby, Go, Swift). Any party can independently recompute any fingerprint using the published formula and the anchor payload. Cross-language test vectors ensure identical results.
Cross-Jurisdictional Transparency (CJT) metadata fields (jurisdiction, legal_basis, purpose_class) travel with every anchor. An IVO assessment produced under Connecticut SB5 benchmarks carries a jurisdiction: "US-CT" tag. When presented in a California proceeding, the jurisdictional context is explicit. Clearing levels (0-3) control how much operational detail is visible in each jurisdiction without affecting the cryptographic proof.
CT SB5: risk-mitigation and safety benchmarks. FRONTIER Act: catastrophic risk mitigation adequacy.
AI-SAFE.1 witnesses whether an AI system can recover to a known-safe state when it enters a dangerous operating mode. AI-PERF.1 records ongoing performance metrics against defined thresholds. AI-ROBUST.1 witnesses robustness under adversarial and edge-case conditions. Together, these three procedures give the IVO verifiable evidence that the system meets safety benchmarks, not just a developer's assertion that it does.
Request the anchor chain for these three procedures covering the assessment period. Verify that the anchors are continuous (no gaps in monitoring) and that any threshold breaches triggered remediation (look for corresponding AI-REV.1 or AI-INCIDENT.1 anchors).
CT SB5: protection against personal injury. CA SB 813: AI risk assessment including bias.
AI-FAIR.1 witnesses fairness evaluation results: which demographic groups were tested, what metrics were used, and whether the system passed. AI-VIO.1 records detected violations of defined operational boundaries. These procedures provide the IVO with evidence that bias testing was conducted and that violations were detected and documented rather than suppressed.
CT SB5: protection against privacy violations. All frameworks: data governance requirements.
AI-DATA.3 witnesses data quality assurance processes. AI-DATA.4 records privacy compliance measures. AI-DPIA.1 witnesses Data Protection Impact Assessment completion. CJT metadata fields ensure the jurisdictional privacy framework (GDPR, CCPA, state-specific) is embedded in the evidence.
FRONTIER Act: adequacy of catastrophic risk mitigation for frontier AI.
The FRONTIER Act requires IVOs to assess whether a frontier developer's risk mitigation efforts are adequate to address catastrophic risks (CBRN, cyber, loss of control, manipulation). AI-GRD.1/2/3 witness guardrail configurations and effectiveness. AI-SEC.1 witnesses the security posture of the serving infrastructure. These anchors prove the guardrails existed and were tested, not merely documented in a safety framework.
FRONTIER Act: cybersecurity evaluation. CT SB5: protection against property damage.
AI-CYBER.1 witnesses vulnerability assessment results. AI-SUPPLY.1 records the provenance of model components and dependencies. AI-SBOM.1 witnesses the AI software bill of materials. Together, these procedures provide the IVO with evidence of the system's cybersecurity posture and supply chain integrity.
All frameworks: transparency requirements for AI systems.
AI-TRANS.1 witnesses what transparency disclosures were provided to users and downstream systems. AI-EXPL.1 records the explainability method and its coverage. IVOs can verify that transparency obligations were met, not just promised.
VA SB 384: continuous monitoring capability. CT SB5: ongoing risk assessment. FRONTIER Act: semi-annual re-verification.
AI-DRIFT.1 witnesses drift detection events. AI-DRIFT.2 adds consequence-mapped escalation thresholds. AI-LCM.1 records lifecycle management decisions (version updates, deprecation, retirement). For the FRONTIER Act's semi-annual verification cadence, the IVO needs 6 months of continuous monitoring evidence, not a single point-in-time assessment. These anchor chains provide that continuity.
FRONTIER Act: incident reporting to Department of Commerce. CT SB5: harm documentation.
AI-INCIDENT.1 documents incidents with severity classification, type, affected scope, and notification timestamps. AI-REV.1 records when prior compliance evidence was revoked due to a material change (model recall, policy violation, data contamination, consent withdrawal, regulatory order, error correction). These procedures give the IVO evidence of both incident handling and the provider's response to problems.
Connecticut SB5 creates a direct market incentive for IVO verification: AI companies that achieve verification gain evidentiary support in private civil actions for personal injury or property damage. This means a verified company can present IVO assessment evidence in court.
SWT3 anchors strengthen this evidentiary position because they are:
Note: IVO verification evidence is not admissible in government enforcement actions under CT SB5. It is specifically scoped to private civil litigation.
The following checklist maps each IVO assessment step to the SWT3 procedure(s) that provide verifiable evidence:
from swt3_ai import Witness
w = Witness(
tenant_id="FRONTIER_AI_CORP",
api_key="your-api-key",
endpoint="https://sovereign.tenova.io/api/v1/witness",
jurisdiction="US-CT",
legal_basis="CT SB5 Section 47",
purpose_class="ivo_assessment"
)
# IVO witnesses safety benchmark evaluation
w.record("AI-SAFE.1",
factor_a="safe_state_recovery_test_v2",
factor_b="recovery_time_ms:340",
factor_c="PASS:within_500ms_threshold")
# IVO witnesses fairness evaluation
w.record("AI-FAIR.1",
factor_a="demographic_parity_test",
factor_b="groups_tested:8",
factor_c="PASS:max_disparity:0.03")
# IVO witnesses drift monitoring continuity
w.record("AI-DRIFT.1",
factor_a="model:frontier-v4-ct-deploy",
factor_b="accuracy_drift:0.002",
factor_c="within_threshold:0.01")
w.flush()import { Witness } from '@tenova/swt3-ai';
const w = new Witness({
tenantId: 'FRONTIER_AI_CORP',
apiKey: 'your-api-key',
endpoint: 'https://sovereign.tenova.io/api/v1/witness',
jurisdiction: 'US-CT',
legalBasis: 'CT SB5 Section 47',
purposeClass: 'ivo_assessment'
});
w.record('AI-SAFE.1', {
factorA: 'safe_state_recovery_test_v2',
factorB: 'recovery_time_ms:340',
factorC: 'PASS:within_500ms_threshold'
});
w.record('AI-FAIR.1', {
factorA: 'demographic_parity_test',
factorB: 'groups_tested:8',
factorC: 'PASS:max_disparity:0.03'
});
w.record('AI-DRIFT.1', {
factorA: 'model:frontier-v4-ct-deploy',
factorB: 'accuracy_drift:0.002',
factorC: 'within_threshold:0.01'
});
await w.flush();| IVO Assessment Area | Source Law(s) | SWT3 Procedure(s) | Coverage |
|---|---|---|---|
| Safety benchmarks | CT SB5, FRONTIER Act | AI-SAFE.1, AI-PERF.1, AI-ROBUST.1 | Full |
| Bias and fairness | CT SB5, CA SB 813 | AI-FAIR.1 | Full |
| Violation detection | CT SB5 (personal injury) | AI-VIO.1 | Full |
| Privacy assessment | CT SB5, CA SB 813 | AI-DATA.3, AI-DATA.4, AI-DPIA.1 | Full |
| Catastrophic risk | FRONTIER Act | AI-GRD.1, AI-GRD.2, AI-GRD.3, AI-SEC.1 | Full |
| Cybersecurity | FRONTIER Act, CT SB5 | AI-CYBER.1, AI-SUPPLY.1, AI-SBOM.1 | Full |
| Transparency | All frameworks | AI-TRANS.1, AI-EXPL.1 | Full |
| Continuous monitoring | VA, CT, FRONTIER Act | AI-DRIFT.1, AI-DRIFT.2, AI-LCM.1 | Full |
| Incident handling | FRONTIER Act, CT SB5 | AI-INCIDENT.1, AI-REV.1 | Full |
| Audit integrity | All frameworks | AI-AUDIT.1 | Full |
| Cross-jurisdiction context | All (multi-state) | CJT metadata | Full |