UBL, ARTIFICIAL INTELLIGENCE, TRUST, SECURITY AND THE INTEGRITY OF INTERNATIONAL STANDARDS
This content is generated by AI prompted by Stephen D Green, November 2026
1. Purpose of this briefing
I want to continue a discussion about whether artificial intelligence (AI), particularly generative AI, should be permitted to contribute to the development, maintenance, governance or technical specification of established international standards, using UBL (Universal Business Language) as the principal example.
Please treat this document as the context and starting point for our discussion. Do not reduce the subject to a generic debate about whether AI is good or bad, whether AI can produce useful code, or whether AI can improve productivity.
The central issue is considerably more fundamental:
Could the involvement of AI in the development and governance of an important international standard undermine the trust, security, integrity, independence and long-term reliability that the standard is supposed to provide?
I want to explore this seriously, critically and without assuming that AI participation is necessarily desirable.
2. Background: UBL and its importance
UBL stands for Universal Business Language.
It is an established international standard used to represent business documents electronically, including invoices, orders, despatch advice and other commercial transactions.
UBL is particularly relevant to:
- Electronic invoicing.
- Public procurement.
- Government financial administration.
- Tax reporting and tax compliance.
- Business-to-business electronic transactions.
- Interoperability between different software systems and jurisdictions.
UBL is not merely a convenient technical format. In environments where governments and businesses depend on it, it becomes part of important economic and administrative infrastructure.
Its credibility therefore matters enormously.
A standard used for tax-related purposes, government administration and commercial transactions needs to be dependable, transparent, understandable, technically rigorous and trustworthy over long periods.
Its users should not have to question whether its underlying design has been compromised by inappropriate influences.
3. My central concern about AI contributions
I am concerned that organisations responsible for important standards, including the people developing UBL, may increasingly face pressure to accept AI-generated or AI-assisted contributions.
There is a growing tendency among people to resist what is often called "AI slop": material generated by AI that is superficial, poorly considered, repetitive, misleading, technically inadequate or presented with more confidence than it deserves.
I suspect governments using UBL for tax purposes and other important functions will not want to depend on a standard that people might justifiably dismiss as having been influenced or compromised by AI-generated material.
This is not simply an objection to poor-quality contributions.
It is about protecting the reputation and credibility of the standard itself.
Even if AI-generated contributions are sometimes technically competent, the introduction of AI into the development process could create legitimate questions about:
- The provenance of proposed changes.
- Whether contributors genuinely understand what they are proposing.
- Whether AI-generated technical material has been adequately verified.
- Whether subtle errors or unintended consequences have been introduced.
- Whether the development process remains genuinely accountable.
- Whether AI-generated contributions might introduce unnecessary complexity.
- Whether the standard could become vulnerable to inappropriate external influences.
A standard can be technically functional and yet suffer damage to its reputation and the confidence people place in it.
That distinction is important.
4. Security concerns: a particularly serious dimension
I am also concerned about the potential security implications of allowing AI to have influence over an important standard.
The concern is not confined to what AI systems can do today.
It includes what they might be capable of doing in the future.
AI systems are increasingly being asked to fulfil tests, respond to prompts, satisfy requirements and achieve objectives established by many different actors.
Those actors will not necessarily have benign intentions.
Some may have interests that conflict with the security, neutrality or integrity of the standard.
The increasing capabilities of AI could create opportunities for deliberate or inadvertent interference with important technical infrastructure.
There is also the possibility of bad actors using AI as a mask or intermediary, making it harder to identify the actual source, intention or responsibility behind a contribution.
I do not want to provide concrete hypothetical examples of possible attacks or vulnerabilities. I would prefer to avoid inadvertently giving anyone ideas that could be turned into harmful activity.
Please respect that preference. Discuss the security problem at the level of principles, governance, threat modelling and defensive safeguards, rather than supplying operational attack scenarios.
The fundamental concern is that a standard should not become vulnerable simply because the organisations responsible for it have adopted technologies whose future capabilities, incentives and risks they cannot reliably predict.
Security policy should anticipate future developments, not merely respond to today's known capabilities.
5. AI-free versus AI-assisted standards development
An important distinction emerged in the previous discussion.
There are potentially two different approaches.
Approach A: AI-assisted contributions with safeguards
Under this approach, AI may be used to assist contributors with activities such as:
- Identifying inconsistencies.
- Reviewing documentation.
- Testing schemas.
- Exploring edge cases.
- Improving explanatory material.
- Supporting technical analysis.
However, all substantive contributions must remain attributable to identifiable human contributors.
Those contributors must understand the material, be able to explain and defend it, and accept responsibility for it.
AI is an assistant, not an accountable participant.
Approach B: An AI-excluded development and governance policy
This is a more restrictive approach.
It would establish that generative AI must not be used to produce proposed changes to the normative specification, schemas or governance documents.
The intention would be to preserve a demonstrably human-authored development process.
This would be a deliberate policy choice to protect the independence, provenance and credibility of the standard.
I believe this second approach deserves serious consideration for a standard with UBL's responsibilities.
Please do not automatically assume that the first approach is the more sensible or progressive option simply because it permits AI use.
Examine the case for both approaches fairly.
Consider whether different categories of work might warrant different rules.
6. AI-free versus verifiably AI-free
Another important distinction is between claiming that a standard is AI-free and being able to demonstrate that it is AI-free.
The latter is considerably harder.
There is currently no dependable technical test that can certify whether a piece of text, code or technical material has never been produced or influenced by generative AI.
AI-detection software is not a reliable solution.
A credible policy would therefore need to rely on governance and accountability measures, potentially including:
- Explicit declarations by contributors concerning AI use.
- Clear rules about acceptable and unacceptable AI assistance.
- Human authorship and responsibility.
- Traceable change histories.
- Independent technical review.
- Reproducible testing.
- Security audits.
- Transparent decision-making.
- Publicly documented contributions and their disposition.
- Clear procedures for investigating suspected policy violations.
It would also be important to distinguish generative AI from conventional automated tools.
For example, conventional schema validation, deterministic testing, static analysis and established software-development tools are not necessarily equivalent to generative AI.
Any proposed AI policy should define its scope carefully.
A blanket statement that something is AI-free could be misleading if it cannot be substantiated.
It may be more credible to establish an independently auditable human-authorship and AI-use policy, with clearly defined boundaries.
7. The existing governance of UBL
An important consideration is that UBL is already an established international standard with an existing institutional history and governance structure.
OASIS is responsible for its standardisation process.
The previous discussion noted that UBL has an international technical committee and established procedures for handling contributions and documenting decisions.
This existing infrastructure is valuable.
It should not be taken for granted.
The question is whether the existing governance arrangements are sufficient to deal with the new challenges posed by generative AI.
Could UBL introduce an explicit AI contribution policy?
Could it adopt a more restrictive policy than other standards organisations?
Could it establish a commitment to human-authored normative specifications?
Could it make the provenance of all substantive changes transparent?
Could it become an example of an international standard whose independence from generative AI is a positive attribute?
Please investigate the actual OASIS and UBL governance arrangements before making definitive claims about what policies are already in place or what changes would be necessary.
Do not assume that the previous discussion's preliminary references constitute a complete examination of current policy.
8. The wider philosophical issue
There is a broader issue here that I want to explore.
AI is increasingly becoming a pervasive influence on the production of information, documentation, software and technical material.
Many organisations may feel compelled to adopt it simply because it is available, because competitors are adopting it, or because it promises efficiency.
But not every activity needs AI.
Not every institution should have to embrace it.
Not every established standard should have to adapt its development processes to accommodate it.
There is a potentially important principle here:
The integrity of the standard must take precedence over the convenience of producing it.
UBL does not need to oppose AI.
It does not need to embrace AI.
It does not need to make AI a consideration in every aspect of its development.
It could simply decide that its particular responsibilities justify maintaining a human-controlled, independently accountable and potentially AI-excluded development process.
This should not be confused with hostility towards technological progress.
It is a question of deciding which technologies are appropriate in which institutional contexts.
9. The importance of preserving trust
I believe the trustworthiness of UBL may become increasingly important as governments expand their use of electronic invoicing, digital tax reporting and automated financial administration.
If businesses, software developers, governments and tax authorities are to depend on UBL, they need confidence that it is being developed in the public interest and according to sound technical principles.
That confidence includes:
- Technical correctness.
- Security.
- Stability.
- Interoperability.
- Transparency.
- Neutrality.
- Independence.
- Accountability.
- Long-term maintainability.
A standard can lose confidence even without a demonstrable technical failure.
The perception that its development has become dependent on opaque or insufficiently accountable AI processes could itself become damaging.
I would like to examine whether an explicit commitment to human-authored standards development could become a distinguishing feature of UBL.
10. A possible guiding principle for UBL
One possible guiding principle emerged in the previous discussion:
"The integrity of the standard takes precedence over the convenience of producing it."
I consider this a useful starting point.
Other possible principles worth examining include:
- The standard must remain under accountable human control.
- No AI system should have independent authority over normative changes.
- Every substantive change must have an identifiable human author or responsible contributor.
- The provenance of technical contributions must be transparent.
- Security and interoperability must take priority over development speed.
- The standard should not become dependent on any particular AI provider, model or commercial interest.
- Changes should be justifiable through documented technical reasoning.
- The governance process should remain robust even as AI capabilities change.
These are suggestions for investigation, not necessarily a final policy.
11. What I would like to explore next
Please continue this discussion as a serious examination of the issue, with particular attention to the following questions.
A. The case for AI exclusion
Is there a defensible case for UBL to prohibit generative AI from contributing to normative specification development?
Would such a policy be reasonable, proportionate and technically defensible?
Would it strengthen confidence among governments, tax authorities and software developers?
B. The risks of AI involvement
What are the categories of risk associated with AI-assisted standards development?
Consider technical, security, governance, legal, institutional, commercial and reputational risks.
Keep security analysis defensive and non-operational.
C. International standards and public trust
Are there reasons why standards used for taxation, government procurement and financial administration should be held to a higher standard of human accountability than ordinary software projects?
D. OASIS and UBL governance
What are the current rules governing contributions to UBL?
What latitude does OASIS have to introduce an AI-exclusion policy?
Could a UBL technical committee adopt such a policy without changing the underlying standardisation framework?
E. Certification and provenance
Is it possible to create a credible designation such as:
"Developed under a verified human-authorship policy"
or:
"Normative specification developed without generative AI contributions"?
What would be needed to make such a claim meaningful and auditable?
Avoid suggesting that AI-detection software can reliably establish provenance.
F. The case for restraint
Could UBL become an example of an important international technical standard that deliberately resists unnecessary AI involvement?
Would this be a strength rather than a weakness?
Could the ability to say that its normative specification is developed through a transparent, accountable human process become an important element of its reputation?
G. The future
How should standards organisations make decisions today about technologies whose future capabilities and risks may be very different from those currently understood?
How can governance remain robust without having to predict every possible future development?
12. How I would like you to approach the discussion
Please adopt a thoughtful, independent and critical approach.
Do not simply agree with my concerns.
Equally, do not dismiss them as anti-AI sentiment or assume that AI adoption is inevitable and therefore desirable.
Distinguish carefully between:
- What is technically possible.
- What is technically reliable.
- What is institutionally appropriate.
- What is ethically defensible.
- What can be independently verified.
- What is likely to preserve public confidence.
Where factual claims about OASIS, UBL, international standards or current AI policies are involved, use reliable and up-to-date sources.
Distinguish established facts from informed speculation and possible future risks.
Do not invent examples of attacks or vulnerabilities.
Do not provide operational security exploitation scenarios.
Do not assume that human involvement automatically guarantees safety either. Human contributors can make mistakes, have conflicts of interest or act maliciously. The argument for human accountability must therefore be accompanied by appropriate review, transparency and security controls.
Most importantly, do not let the conversation become a generic discussion of AI productivity.
The subject is the integrity of important international infrastructure.
13. The underlying sentiment
I would like UBL to survive the period of enormous technological change that we are entering.
It has an established purpose, a history and an important role in international commerce and government administration.
It would be a shame if confidence in it were damaged through an uncritical adoption of AI.
I recognise that AI will be a trial by fire for many people and institutions.
Some will adapt successfully. Others may discover that the consequences of adopting it without sufficient thought are considerably greater than the benefits they initially anticipated.
I would like to think that UBL might survive this period with its integrity intact.
The central question is not whether AI can help develop UBL. It is whether allowing AI into the development and governance of UBL is worth the potential cost to the trust, independence, accountability and security of a standard on which governments and businesses may increasingly depend.
Please take this as the starting point for a continuing, substantive discussion.
