The Model Attestation Interface (MAI-1): A Normative Profile and Conformance Protocol for Foundation Model Governance

The deployment of foundation models into regulated, safety-critical, and liability-bearing contexts has exposed a fundamental governance gap: no standardized, machine-verifiable mechanism exists to prove that a specific model was operating in a certified internal state at the moment of inference. Current governance artifacts — model cards, training logs, static benchmarks — are descriptive rather than prescriptive and fundamentally non-verifiable. With total enforcement exposure now exceeding $2 billion across settlements, fines, and verdicts, and the insurance market shifting from silent coverage to explicit AI exclusions, the gap between governance aspiration and governance infrastructure has become financially untenable.This document defines the Model Attestation Interface (MAI-1), a normative IETF RATS-conformant attestation profile that composes three verification layers — hardware-rooted platform attestation, continuous model state invariants, and cryptographic supply chain provenance — into a single verifiable artifact for foundation-scale models. MAI-1 builds upon the theoretical foundations of the Model State Attestation Framework (MSAF; Fields, 2026) and specifies: a canonical attestation endpoint encoded as a CBOR/COSE-signed Entity Attestation Token (RFC 9711), required evidence fields including five mandatory health invariants (entropy floor, gradient stability, distribution drift, structural coherence, and SRAM thermal integrity), cryptographic binding rules for decision receipts linking outputs to governance proofs, and a three-level conformance test suite (MAI-C0/C1/C2) with strictly binary pass/fail semantics modeled on FIPS 140-3 and Common Criteria precedent.The interface is mapped to specific evidence requirements across seven regulatory frameworks (EU AI Act, SR 11-7, FDA SaMD PCCP, OMB M-25-21, OMB M-26-04, FY2026 NDAA §1513, AI Insurance), three CEN/CENELEC harmonized standards currently in Enquiry (prEN 18282, prEN 18229-2, prEN 18286), and the specialist AI insurance underwriting requirements of Armilla AI, Munich Re aiSure, Testudo, AIUC-1, and Lloyd's syndicates. Copy-pasteable procurement clauses are provided for federal RFPs, EU conformity assessment, insurance applications, and enterprise vendor risk management.Every component required for foundation model attestation exists individually — EAT, measured-component, CoRIM, SCITT, CMW Collections — but no system composes them into a unified, conformance-testable artifact. MAI-1 is that composition layer. The honest framing: MAI-1 provides accountability infrastructure and probabilistic risk reduction, not behavioral safety guarantees. This is analogous to financial auditing, which certifies process compliance without guaranteeing future solvency. The building blocks exist. The regulatory pull is strong. The standards window is open.