Code of practice readiness
A briefing on how your notices, records and controller information compare with what the Internet Transparency Code of Practice asks for, and what to change first. A readiness view, not a certification.
Work with TCIEG
We help organisations make transparency operational. The accountable party is identified before the person, the person keeps a record of what they were told, and a regulator can reconstruct what governed the interaction.
Service
Cross-border notice and consent readiness check, scoped to Levels 0 to 1
For organisations that transfer or disclose personal data across borders and need to know whether what they publish would hold up. The check covers two levels, and nothing beyond them.
Level 0, become transparent. Provide a standard online notice and add a signal. We check that your notice follows a standard structure; that it identifies the controller before a person is asked to identify; that it states the recipient jurisdictions, the transfer mechanism relied on, and the risks of access by public authorities in those jurisdictions; that it is versioned, so a change of recipients or jurisdictions is recorded as a material change; and that a signal points to it, so people and systems can find and check the notice.
Level 1, provide a receipt. Whether a person receives a record they can keep, showing which notice version was presented, when, and by whom; and whether a consent relied on for a transfer could show that it was explicit, specific and free, and given after the person was informed of the risks, as Convention 108+ Article 14(4)(a) and GDPR Article 49(1)(a) require.
Findings are set against six transparency risks: identification, notice, transfer and jurisdiction, authorization state, inference, and reconstruction. Each finding names the record that would treat the risk and what to change first.
Fixed scope, with a written report. The check reviews public notices and records and is not an assessment of internal processing. It is a readiness view, not a certification, an audit opinion or legal advice.
Service
AI transparency readiness: Article 50 and the AI Transparency Profile
For providers and deployers of generative AI and AI agents. Article 50 of the EU AI Act asks providers to mark outputs in a machine-readable format, and deployers to disclose. A mark travels inside the content and can be stripped with it. A receipt, published by the accountable party, still resolves after the content has moved on.
We help you settle three questions: which of your systems make you a provider, including any open model you run in house; where you rely on editorial responsibility, who holds it and whether a reader can find out; and, if your marks are stripped, what record remains to show what you disclosed and when.
We then map your notices to the AI Transparency Profile of the proposed Internet Transparency Code of Practice: notice given by each participant in the chain for its own scope of work, an AI notice record, an AI Undermark on what you publish, and a published answer to who stands behind your agents and what they are authorised to do.
A readiness view, not legal advice or a conformity assessment.
Service
Identity and personal data control architecture review
For digital identity, verification and age assurance providers, and the services that rely on them. Most identity systems move the person to the data: each service asks the person to identify and keeps a copy. We review whether your design can work the other way round.
We look at four things. Whether the controller is identified, with a published Controller Identity Record, before the person is asked to identify. Whether the organisation that already holds an attribute can answer on the person’s behalf, for example “over 18”, instead of the attribute being copied. Whether a relying party can verify that answer from public records. And whether the person controls the authorization: when they withdraw or change it, the change is recorded against the notice version, and anything derived from it stops working.
We map the design to the ANCR extension to ISO/IEC TS 27560:2023, Release 1, and say plainly where it relies on work beyond Release 1.
Engagements
Four more ways to work with us.
Briefings for regulators and institutions
Evidence that can be inspected after the fact: cross-border consent formed against a recorded notice, and lawful access that is credentialed, logged, approved and time limited, for regulators, public bodies and policy teams.
Standards and regulatory advisory
Ongoing advice on the notice, consent and transparency standards in development at ISO/IEC and Kantara, and on what regulators are likely to ask for. Offered as a retainer.
Pilot partners and sponsors
Take part in test projects that show interoperable transparency evidence working in real systems, starting with age assurance, and including consent, digital identification and AI interactions.
How it works
On enquiry
Every engagement is scoped to the organisation. Write to info@tcieg.org with a line about what you need, and we will reply with a proposal, timing and fees.
Engagements are contracted with Transparency and Consent Interoperability Expert Group, LLC, a Florida limited liability company. What we do with the details you send is set out in our Transparency Policy.
TCIEG does not certify organisations. The Internet Transparency Code of Practice and its AI Transparency Profile are proposed, and REALconsent is a framework under development, not a conformity mark.