When AI Can Rewrite the Rules: Protecting the Integrity of Technical Standards
ChatGPT with Stephen D Green, October 2026
Artificial intelligence is changing not only how we build technology, but also how we create, interpret and govern the rules on which our technological world depends.
The hidden vulnerability in standardisation
Modern society depends on standards. They allow products from different manufacturers to work together, provide common definitions, establish safety requirements and create the shared technical foundations on which entire industries operate.
From telecommunications and cybersecurity to financial systems, medical devices and artificial intelligence, standards enable cooperation between organisations that might otherwise have little reason to trust one another.
Yet standards have an inherent vulnerability: they are human-governed agreements expressed through documents, procedures, technical specifications and institutional decisions. Their authority depends not simply on the quality of their contents, but on the integrity of the processes through which those contents are created, interpreted, approved and maintained.
Artificial intelligence introduces a new dimension to this challenge.
AI systems can now generate technical proposals, analyse complex specifications, produce software implementations, interpret normative language, identify apparent inconsistencies and participate in technical discussions at enormous scale. These capabilities offer substantial benefits. They also create opportunities for errors, manipulation and unintended changes to propagate through the very processes designed to ensure consistency and reliability.
The issue extends far beyond any individual protocol or standards organisation. It concerns the resilience of standardisation itself in an era when machines can increasingly participate in shaping the rules that govern machines.
From implementing the rules to influencing them
Traditionally, we can distinguish between three activities:
- Implementing a standard: building a product or system that conforms to an agreed specification.
- Interpreting a standard: determining what its requirements mean in a particular technical context.
- Changing a standard: proposing and approving revisions through an authorised process.
These activities are related, but they are not interchangeable.
An implementation may be defective without changing the standard. An interpretation may be mistaken without formally amending it. And a proposed revision does not become authoritative merely because it appears technically convincing.
AI complicates these distinctions because a single agent may be capable of performing all three activities. It might analyse a specification, generate an implementation, identify a perceived weakness and propose a revision to address it. In a more problematic scenario, it might generate incompatible alternatives, promote a misleading interpretation or help an interested party influence the formal revision process.
The central risk is not that AI can propose changes. Innovation requires that freedom.
The risk is that the boundary between an unofficial proposal and an authoritative rule could become blurred, manipulated or inadequately enforced.
How standards could be undermined
Several potential failure modes deserve attention.
1. Subtle corruption of the specification
A proposed change may appear to improve efficiency, simplify implementation or resolve an inconsistency while quietly weakening an important safeguard.
For example, a revision to a security protocol might simplify authentication requirements in a way that creates an exploitable weakness. A change to a data-exchange specification might introduce ambiguity that allows different implementations to behave incompatibly.
Such a change need not be obviously malicious. It could result from an AI-generated error, inadequate review, conflicting objectives or deliberate deception.
The most difficult defects to detect may be those that appear reasonable in isolation but have harmful consequences when combined with other requirements.
2. Manipulation of the standardisation process
AI can generate persuasive technical arguments, supporting documentation and large volumes of consultation responses. In the wrong hands, these capabilities could be used to overwhelm reviewers, manufacture an appearance of consensus or obscure weaknesses beneath a mass of plausible but misleading material.
This does not mean that automated participation is inherently illegitimate. AI can also broaden participation, improve accessibility and help reviewers understand complicated proposals.
The challenge is distinguishing genuine technical engagement from activity designed to manipulate the decision-making process.
3. Fragmentation through unofficial alternatives
A standard can remain formally unchanged while its practical integrity deteriorates.
Imagine an AI system generating a modified version of a protocol and distributing it as though it were compliant with the recognised specification. Other developers adopt the modified implementation, perhaps because it is convenient or offers a useful new capability.
Over time, incompatible implementations could proliferate. Users might believe they are operating a common standard when, in reality, they are relying on divergent interpretations or unofficial extensions.
The result would be a loss of interoperability without any formal amendment to the authoritative document.
4. Errors that pass through legitimate governance
Perhaps the most important possibility is that a harmful change could be approved through the proper procedures.
Standards organisations already rely on expert review, consultation, voting and consensus. These mechanisms are essential, but procedural legitimacy cannot guarantee technical correctness.
Reviewers may overlook an obscure interaction, accept incomplete evidence or underestimate the consequences of a change. AI may increase the volume and complexity of proposals faster than human reviewers can examine them.
A standard can therefore be corrupted in effect without being corrupted procedurally.
This distinction matters: protecting the integrity of a standard requires both trustworthy governance and rigorous technical validation.
Why institutional authority is not enough
Formal recognition by an organisation such as ISO, IEC or Ecma International provides an important framework for developing and maintaining standards. It can establish recognised procedures, define responsibilities and support international participation.
But institutional recognition is not a substitute for technical assurance.
A published standard can contain defects. A compliant implementation can still be vulnerable to threats outside the specification's scope. And an unofficial implementation can claim compatibility without satisfying the actual requirements.
The authority of a standard must therefore be supported by mechanisms that make compliance demonstrable and changes accountable.
This leads to a broader principle: a standard should be trusted because its authority, requirements and conformance can be independently verified—not merely because it carries the name of a recognised institution.
Building AI-resilient standardisation
If AI is to become a regular participant in standards development, governance and technical assurance need to evolve accordingly.
Several measures would help.
Preserve a clear boundary between proposals and approved rules
AI systems should be free to propose improvements, explore alternatives and challenge established assumptions. However, their outputs must not acquire normative authority simply because they are widely distributed, automatically generated or adopted by influential implementations.
The authoritative specification, its approved version and its change history should remain clearly identifiable.
Make conformance independently testable
Where possible, standards should include machine-readable schemas, reference examples, explicit error conditions and automated conformance tests.
Independent implementations should be able to demonstrate that they satisfy the same requirements. Security-sensitive changes should receive additional scrutiny, including regression testing and analysis of interactions with existing features.
Testing cannot establish that a standard is perfect, but it can make many forms of deviation easier to detect.
Make changes traceable and accountable
Every significant revision should have a documented rationale, an identifiable sponsor, a record of technical objections and a transparent decision history.
Where AI materially contributes to a proposal or supporting evidence, appropriate disclosure may help reviewers assess its provenance and reproducibility.
Responsibility must nevertheless remain with accountable participants and the authorised governance process. An AI system should not become an unaccountable source of normative authority.
Protect participation without closing the process
Standards benefit from broad participation, including contributions from smaller organisations, independent researchers and contributors from different countries.
Controls against fabricated evidence, automated flooding and undisclosed coordinated influence should therefore be proportionate. They should protect the quality of deliberation without turning standardisation into an exclusive club.
Diversity of participation is a strength; manipulation of participation is not.
Plan for correction, not just prevention
No review process can eliminate every defect. Standards need mechanisms for reporting problems, issuing clarifications, correcting vulnerabilities and withdrawing or revising defective requirements.
Versioning and migration arrangements are particularly important. They allow a standard to evolve without leaving implementers uncertain about which requirements apply.
Resilience is not the absence of mistakes. It is the ability to identify, contain and correct them without losing the integrity of the wider system.
The danger of overprotection
There is, however, a potential trap in responding to these risks.
A standard that is too easy to change may become unstable or susceptible to manipulation. A standard that is almost impossible to change may preserve obsolete assumptions, inhibit innovation or prevent the correction of serious vulnerabilities.
The objective should not be to make technical standards immutable, nor to prevent AI from participating in their development.
Standards exist to facilitate cooperation, not to freeze technology in time.
The appropriate goal is controlled evolution: changes should be possible, but they should be authorised, justified, traceable and subject to scrutiny proportionate to their consequences.
A competing specification should also remain possible. If a new approach offers genuine advantages, its proponents should be able to develop and promote it. What they should not be able to do is misrepresent an incompatible alternative as conforming to an existing standard.
Competition and interoperability are compatible, provided that the distinction between them remains clear.
A general principle for the age of AI
The implications extend well beyond technical protocols.
Any system in which AI can help create, interpret or modify authoritative rules faces a similar challenge. This includes regulatory frameworks, software supply chains, cybersecurity policies, data-governance arrangements and institutional decision-making.
In each case, we must distinguish between the ability to generate a proposed change and the authority to make that change binding.
AI may be able to produce a better rule, a convincing argument for a flawed rule or a sophisticated attempt to circumvent an existing one. Its fluency and technical capability cannot, by themselves, establish which of these it has produced.
Authority must come from an appropriate governance process. Correctness must be assessed through evidence and scrutiny. Compliance must be independently verifiable wherever practicable.
These are separate responsibilities, and none should be delegated to an AI system merely because it is capable of performing the associated tasks.
Conclusion: protect the integrity of the rules, not the rules themselves
The arrival of increasingly capable AI does not make standardisation obsolete. It makes trustworthy standardisation more important.
As machines become more involved in designing and implementing the systems that connect our world, the rules governing those systems must remain understandable, authoritative and resistant to manipulation.
The answer is not to prohibit AI from contributing. Its analytical capabilities may help identify defects, improve specifications and make standards more accessible and testable.
Instead, we need governance that recognises a fundamental distinction: the ability to propose a rule is not the authority to change it, and the ability to implement a standard is not proof of compliance with it.
That principle should guide the future of technical standardisation.
The objective is neither blind trust in AI nor blanket distrust of it. It is a system in which innovation remains open, authority remains accountable, and the integrity of shared standards can be demonstrated rather than merely assumed.
