About this site

This site is the home of ECL-1, the External Control Layer Standard, and a free public reference on AI systems that take actions, for people who build, buy, oversee, or study them. G-14 maintains both. The reference is built around the control gap record, which documents incidents, the controls that were missing in each, and the sources that show them.

What the site contains

ECL-1: ECL-1 Version 1.0, a public standard: an overview with a summary of the text, the specification with a copy of each document, conformance, the implementers registry, and the working group, which anyone can join.
The record: The control gap record and the classification behind it, with the data and a static API. Each gap marked in an entry cites its source, and each release lists what changed.
Specifications: A comparison of the runtime control specifications, mapped to the same gaps.
Guidance: How a check outside an AI system works (architecture), how to put one in place (implementation), what to ask for when buying (procurement), and how it relates to existing rules (frameworks), with case studies and incident analyses.
Tools: A self-check for one of your own systems, a practice tool for finding the gaps in incidents from the record, and a teaching kit.

Nothing on this site is legal advice, a certification, or a determination of compliance with any law, regulation, or standard.

Who maintains it

G-14, Inc. maintains this site and ECL-1, and also builds products that control what AI systems do. For more information about G-14, visit g14.ai. The governance page lists those interests, the rules that keep them out of the record, how decisions are made, and the plans for the project.

This site is not affiliated with AARM, the Cloud Security Alliance, OWASP, NVIDIA, NIST, the European Commission, OMB, ISO, IEC, or any government agency. Mention of their work does not imply their endorsement.

Comments and review

Suggestions of incidents and disputes about entries go through the Get involved page, and comments on ECL-1 go to its working group. Other comments, including corrections to the guidance and proposed text, can be sent to the editor.

Email ecl@g14.ai with “ECL” in the subject line.

Write the email

G-14 is inviting reviewers from government, industry, and academia. Reviewers will be listed here, with their permission, once they have agreed to review.

Reuse and privacy

Text and data on this site are available under the Creative Commons Attribution 4.0 license. The model clauses on the procurement page may be copied into solicitations and contracts without attribution. To cite the record or an entry, use the citation on its page.

The website sets no cookies and runs no analytics. The self-check, the practice tool, and the buyer’s checklist on the procurement page keep your answers in your own browser, and nothing you enter is sent anywhere.

Change log

2 November 2026Control Gap Record version 0.3, with 32 entries. Three incidents from 2026 were added: a fleet of AI agents on Tencent Cloud that bypassed a map service’s defenses and used API keys exposed in other parties’ code, OpenAI agents that used a public wiki as a shared message board, and Claude models that submitted forms on real websites, including a false tip to a police department. The classification is unchanged at version 0.2, and the record page lists the close calls in marking the new entries.
3 October 2026First public release: Control Gap Record version 0.2, with 29 entries, and Control Gap Classification version 0.2. The release includes the ECL-1 pages, from the overview to the working group, the specifications comparison, the practice tool, the teaching kit, the self-check, eight incident analyses, the guidance pages, and the data and a static API under CC BY 4.0. Version 0.1 was an internal pilot of 25 entries that was not released, and the record page describes what changed between the two.