13. Relationship to existing standards
This section is informative.
OIS reuses existing standards for notation, packaging, signing and events, and adds only the link between intent and evidence.
| Standard | Role in OIS |
|---|---|
| Gherkin | Criterion notation (notation: gherkin) |
| EARS | Criterion notation (notation: ears) |
| in-toto Attestation Framework | Statement format of the Quality Passport, DigestSet format for digests |
| DSSE | Signing envelope for passports and bundles |
| Sigstore | Recommended keyless signing |
| SLSA | Build provenance for the same release; complements the passport |
| CloudEvents | Event format (section 9) |
| W3C Trace Context, OpenTelemetry | The trace field links records to distributed traces |
| JSON Schema 2020-12 | Validation (Appendix B) |
| RFC 8785 (JCS) | Canonical JSON form for digests |
| OpenAPI | Contracts recorded as artifacts of kind contract |
| JUnit XML | Common input format for Level 1 adapters |
| SPDX, CycloneDX | SBOMs state what software contains; OIS states what it must do and how that is proven |
| ISO/IEC 42001 | Records can support documentation and traceability of AI use in delivery processes |
| EU AI Act | Records can support documentation and human oversight duties where such duties apply |
| NIST AI RMF | Records provide measurable evidence for the Measure and Manage functions |
The last three rows are orientation only. They are not a legal or certification interpretation, and using OIS does not by itself establish compliance with any framework.