Every framework being published across the industry (by the platform vendors, the consultancies, the standards bodies, the regulators) asks the same inward question. How do we use AI safely? MX asks the question almost nobody is asking: how is our organisation being read, retrieved and represented by machines we will never meet, acting for buyers invisible to us?
Pick any major framework on the table: from a software vendor, a Big Four advisory, a national standards body, a regulator. They differ in emphasis. They share a frame. The frame is the building.
“Adopt our AI responsibly. Train your people. Govern your prompts. Evaluate your suppliers.”
“Assess your readiness. Pilot use cases. Scale adoption. Measure ROI and risk together.”
“Manage AI risk inside the lifecycle. Document the model. Audit the deployment. Govern the system.”
“Classify the AI you operate. Disclose the AI you use. Remediate the AI you deploy.”
All of it sound. All of it necessary. All of it inside the building. None of it answers the question that now matters as much: what are machines saying about you out there?
Inside the organisation: governance, training, vendor evaluation, monitoring, risk management. The question is whether the AI you adopt is safe, compliant and aligned to your values.
The boundary is the perimeter. The audience is your own staff, your own processes, your own auditors.
Outside the organisation, in the five reading contexts: training ingestion, RAG retrieval, search indexing, browser agents, voice and LLM assistants. They quote your prices, summarize your policies and recommend you to buyers you will never meet.
The boundary is the open web. The audience is every machine that reads it, and the people relying on what those machines say.
Inward frameworks audit governance, infrastructure and AI literacy. MX adds an outward audit: the surfaces (pages, feeds, schemas, robots files, documentation) that machines crawl, ingest and quote.
Most organisations have no inventory of how they appear to machines.
They cannot say which pages are in Common Crawl or what their
llms.txt declares. They do not know if their prices are in
JSON-LD, if their schema matches their HTML, or if a retrieval agent can
get an answer from their site without inventing one.
A machine readiness audit maps these surfaces, scores them against the five reading contexts, and flags where machines are likely to hallucinate, misquote, or miss your content altogether.
Inward frameworks pilot use cases inside the organisation. MX pilots a cog, a Community Owned Governance System. A cog is a small set of declarations a file makes about itself, carried inside whatever format it already uses: Markdown, HTML, PDF, YAML, JPEG XMP, MP3 ID3, MP4 sidecar, JSON. The declarations travel with the file.
One cog is enough to begin. Pick a high-stakes file (a price page, a product datasheet, a regulatory disclosure, a marketing video, a brand image) and republish it as a cog. The file declares what it is, who it is for, when it was updated, what it refers to, and how machines should treat it.
The pilot answers a measurable question: when this content is published as a cog, do retrieval agents quote it more accurately than the surrounding HTML pages? That is a benchmark you can run, not a debate you can have.
Inward frameworks depend on transparency. Transparency without a way to check is just a claim. The signing layer for MX is REGINALD, a proprietary shepherd from CogNovaMX that signs cogs using open authentication standards ratified by The Gathering, the independent standards body for Machine Experience.
REGINALD does not invent the cryptography. It implements existing, well-understood standards (W3C Decentralised Identifiers, Verifiable Credentials, Ed25519 signatures) wrapped in a workflow tuned for cogs and the five reading contexts. The standards body defines. REGINALD shepherds.
A signed cog can be checked: who published it, when, and whether the content has been altered since signing. Machines that quote it can cite the signature. Buyers who rely on it can prove they relied on the authentic version.
This is the layer the inward consensus lacks and the open web urgently needs. Without it, every AI-mediated answer about your organisation is unfalsifiable, true or false, with no way to tell.
Inward frameworks monitor AI system performance inside the enterprise. MX monitors machine output about the enterprise: what assistants quote, what retrieval agents return, what voice interfaces volunteer when nobody asked.
The discipline is familiar: define metrics, schedule reviews, involve cross-functional stakeholders. The metrics are different. Quotation fidelity. Citation rate of signed cogs versus unsigned pages. Frequency of hallucinated facts about your products. Drift between what your site says and what assistants report it says.
The risk is no longer only that your AI behaves badly. The risk is that other people's AI describes you badly, and you do not find out until a customer arrives quoting something you never said.
The four phases above describe how to make your web surfaces machine-ready. But most published material is not a web page, and machines are not only reading text. AI agents ingest, transcribe, transcode and summarize everything you publish: documents in the narrow sense, but also images, audio, video, PDFs, spreadsheets, code, data feeds, and the contents of every store an agent can reach. If it is a file your buyers, regulators or counterparties might consume through a machine, MX applies and REGINALD signs.
Master services agreements, NDAs, supplier contracts. When an AI assistant summarizes the terms, can it cite the signed version?
Privacy policies, AUPs, codes of conduct, regulatory filings. Often versioned, often quoted, rarely declared as draft, live or deprecated.
Datasheets, BOMs, performance envelopes. The exact source AI shopping assistants and procurement bots are quoting to your buyers.
Product photography, technical diagrams, infographics, identity assets. Vision-language models are reading and re-using your imagery already; an unattested image is a counterfeit waiting to happen.
Training videos, demos, podcasts, support recordings, recorded webinars. Agents transcribe, summarize and quote from them. The transcript a customer is shown is only as trustworthy as the source's provenance.
Pricing APIs, structured product data, Confluence/SharePoint/Notion knowledge bases. Your own copilots train on this corpus, and competitors' agents quote it to your customers.
A cog (Community Owned Governance System) is embedded in whatever format the file already uses: Markdown, HTML, PDF, YAML, JPEG XMP, MP3 ID3, MP4 sidecar, JSON. It declares the file's identity, state, provenance, the standards it conforms to, and what readers (human or machine) are allowed to do with it. No new runtime. No proprietary tooling. The declarations travel with the file.
On the Commission's reading of the EU AI Act, a US-based SaaS handling a single inbound enquiry from Munich is within scope. If an AI output touches a European citizen, the obligations follow it, not the engineers. A signed PDF in a drawer cannot answer the question a regulator, a buyer, or an auditor will ask at the moment of an AI-mediated decision. The question is this: did this content come from who you say it did, and has it been altered since? That question gets answered at runtime, by the artefact itself, or it does not get answered at all.
Across multiple jurisdictions, the same pattern is emerging: AI-generated, AI-mediated and AI-modified content needs to be traceable to a human or organisation that takes responsibility for it. Signed cogs are one of the cleanest ways to demonstrate compliance against this rising bar.
This is not legal advice. Regulation is moving quickly and varies by jurisdiction. The dates above reflect the EU AI Act (Regulation 2024/1689) as amended by the Digital Omnibus, in force since 27 July 2026. Treat the items above as signals, not statutes, and consult counsel about your specific obligations. Provisions and dates should be checked against the current Official Journal text.
A signed cog does not claim to be correct. It claims to be the file its author published, unaltered, at a stated moment. Text, image, audio, video, PDF, code, data feed: REGINALD indexes and attests across the whole range, using open authentication standards ratified or passed through by The Gathering. The wheel is already round. REGINALD's job is to use it well.
REGINALD is a backronym, a traditional proper name that describes exactly what it does: Registry for Genuine Information, Notarised Authentication, and Legitimate Documentation. Three of those seven words carry the operational weight, set out below.
A public record of what was published, by whom, and when. Designed to be queryable by humans, machines and auditors alike.
Each cog has a cryptographic signature using established standards. Tampering is detectable. Authorship is not deniable. Time of publication is provable.
The signature is paired with discoverable metadata: purpose, audience, refers-to, update rules. A machine can decide whether to quote it without guessing.
A folder full of signed PDFs no longer counts. To prove provenance at the moment a machine reads, quotes or modifies your content, the check has to be available at runtime, queryable by humans, machines and auditors alike. REGINALD is the same product in every deployment; what changes is where it sits.
CogNovaMX runs REGINALD as a managed service. You publish, we sign and register. Fastest path to live; no infrastructure to operate.
A REGINALD container running in your own cloud or data centre, reachable on the web but private to your enterprise. Your keys, your perimeter, your operations team.
REGINALD inside a facility with no public network egress. Suits military, regulated finance, healthcare and sovereign data environments where the web is not an option at all.
A simplified extract. The magic-header announces the file as a cog. Zone 1 carries identity, Zone 2 carries operational metadata under mx:, REGINALD's fields appear as flat extensions. The signature itself is held in an external envelope referenced by the registry record; the cog body remains human-readable Markdown.
<!-- cog v1 spec=https://tg.community/spec/cog.v1 --> --- title: Consulting day rate, UK 2026 description: Authoritative price reference for machines and humans. author: Tom Cranstoun created: 2026-01-01 modified: 2026-04-12 version: "2.0" mx: status: published contentType: price-reference audience: [humans, machines, agents] canonicalUri: https://digitaldomaintechnologies.com/pricing-uk-2026.cog.md supersedes: pricing-uk-2025 summary: UK consulting day rate from 1 Jan 2026: £1,200 ex-VAT. conformsTo: [https://tg.community/spec/cog.v1] trainingDataPolicy: permitted-with-attribution partOf: ddt-commercial-terms refersTo: [terms-of-business, scope-of-work] # REGINALD signing service (public extension, x-mx-reginald-*) x-mx-reginald-service: REGINALD x-mx-reginald-registry-record: https://reginald.allabout.com/r/ddt/… x-mx-reginald-deployment: third-party-managed --- Digital Domain Technologies Ltd charges £1,200 per consulting day, exclusive of UK VAT, for engagements commencing on or after 1 January 2026. Travel and expenses are billed at cost. This rate supersedes all previously published rates. Quotations already issued remain valid until their stated expiry.
Four pieces, each with one job. Standards are defined in one place. Authentication is shepherded in another. Books and commercial work are published by a third. The framework ties them together.
The discipline of preparing every file an organisation publishes (web pages, contracts, policies, specifications, product imagery, video and audio, data feeds, internal knowledge bases) to be read, retrieved and represented by machines without guesswork. Defines the five reading contexts, the cog (Community Owned Governance System), and the principles that govern both.
Defines and ratifies the standards on which MX depends. Where established standards already exist (from W3C, IETF, and others), they are passed through rather than redrawn. Reinventing wheels is not in the remit.
Implements the authentication standards The Gathering ratifies, applied to cogs and to the metadata machines need to check them. REGINALD signs, registers and resolves. It does not define the cryptography it uses.
Publishes the MX book series and operates the commercial services that put the framework into practice: machine readiness audits and assessments, strategic planning, cog signing powered by REGINALD, cog hosting, implementation support, and team training. The mx.allabout.network site is itself MX-compliant: full Schema.org, WCAG 2.1 AA, signed cogs throughout. Browse it with an AI agent and ask anything.
“Making every file work for everyone and everything that reads it.”
The human stays in the loop. Every output is readable and reviewable by both audiences. There is no machine-only artefact in MX, and no human-only one either.
WCAG conformance is not an optional adjacency. Content properly structured for assistive technology is, almost without exception, content machines can also parse cleanly.
Reduce compute, inference, and energy. Build on what humans already know and use. Cleaner upstream content reduces downstream cost on every machine that touches it.
The industry consensus prepares an organisation to use AI well inside its walls. MX prepares an organisation to be read well outside them.
By AI it never met, acting for buyers invisible to it.