CONFORMANCE TERMS
Conformance Agreement
EFFECTIVE: JANUARY 2026
This Agreement governs the relationship between Sentinel Authority (“SA”) and organizations seeking ODD Conformance Determination (ODDC) for autonomous systems.
NATURE AND SCOPE OF DETERMINATION
ODDC attests that a system operates within defined boundaries with non-bypassable enforcement at the time of determination.
ODDC IS NOT
Regulatory approval, safety attestation, product attestation
Guarantee of performance, insurance, or warranty
Applicant remains solely responsible for system behavior and all consequences of operation
CONTENTS
01SCOPE OF DETERMINATION
SA will evaluate and determine conformance based on:
ODD Specification
The Operational Design Domain as specified by Applicant
ENVELO Compliance
Runtime assurance architecture meeting ENVELO requirements
CAT-72 Evidence
Successful completion of CAT-72 cumulative enforcement verification period
Architectural Review
System architecture verified to support specified enforcement and boundary implementation
02APPLICANT OBLIGATIONS
2.1 APPLICATION REQUIREMENTS
Provide complete and accurate application materials
Disclose all relevant system specifications and operational parameters
Identify all boundaries, tolerances, and constraints in the ODD specification
Submit documentation of ENVELO-compliant assurance architecture
2.2 TESTING REQUIREMENTS
Deploy the ENVELO Interlock as configured by SA
Conduct CAT-72 sustained cumulative verification of assurance mechanisms across active operational intervals within the declared ODD
Not modify system configuration or enforcement settings during testing
Report any test interruptions, violations, or anomalies
2.3 POST-CONFORMANCE — UPTIME REQUIREMENTS
Minimum 99% monthly uptime required. Outages under 1 hour require no action. Extended outages exceeding 1 hour trigger automated notification. Cumulative downtime exceeding 24 hours per calendar month may result in non-conformance determination.
2.4 POST-CONFORMANCE REQUIREMENTS
Maintain ENVELO Interlock in continuous operation during attested system operation
Not bypass, disable, or tamper with assurance mechanisms
Notify SA of any system modifications affecting ODD or enforcement
Complete renewal testing prior to conformance expiration
Use the ODDC mark only in accordance with mark usage guidelines
03SA OBLIGATIONS
Review applications within stated timelines
Conduct scope assessment and provide fee quotation
Administer CAT-72 testing per documented procedures
Issue conformance determination based on evidentiary record
Maintain attestation records per retention requirements
Provide attestation verification services
SA DOES NOT
Implement, operate, or monitor runtime systems
Certify implementation correctness or validate code
Warrant system behavior or performance
Provide regulatory approval or compliance attestation
Sentinel Authority maintains strict separation between standard-setting and conformance determination, consistent with ISO/IEC 17065 conformance assessment principles.
04CONFORMANCE TERMS
4.1 TERM DURATION
6–24 months based on operational domain risk profile, ODD complexity, and applicant conformance history. Term duration specified in the conformance determination.
4.2 RENEWAL
Renewal requires CAT-72 re-completion. Streamlined renewal (minimum 48 cumulative assurance hours) may be available for applicants with clean conformance history and no system modifications.
4.3 MODIFICATIONS
Any modification to ODD specification, enforcement architecture, or underlying simulation requires:
Notification to SA within 5 business days
Evaluation of modification impact
Potential re-assessment if modification affects conformance basis
05NON-CONFORMANCE
Material misrepresentation in application materials
Unauthorized modification to attested system
Disabling, bypassing, or tampering with ENVELO assurance
Failure to maintain ENVELO Interlock operation
Non-payment of fees — see Section 11 for phased procedures
Violation of this Agreement
Non-conformance is recorded in the SA registry and reflected in verification results.
06NON-CONFORMANCE & REINSTATEMENT
6.1 AUTOMATIC NON-CONFORMANCE TRIGGERS
ENVELO Interlock downtime exceeds 24 cumulative hours per calendar month
Violation metrics exceed thresholds defined in the applicable conformance determination
Interlock unreachable for more than 72 consecutive hours
6.2 REINSTATEMENT
1stRestore interlock operation and pass 24-hour verification check
2ndAbove plus written remediation plan
3rdFull CAT-72 re-assessment required
Reinstatement fees apply on a tiered basis: $2,500 following the first non-conformance event; $7,500 following the second; full CAT-72 re-assessment ($75,000) required following the third. Conformance fees are non-refundable during non-conformance periods.
07LIABILITY & INDEMNIFICATION
SA’s total liability shall not exceed fees paid for the specific attestation at issue. SA is not liable for indirect, incidental, consequential, special, or punitive damages.
SA has no liability for the behavior, performance, or consequences of operation of any system, whether attested or not.
Applicant shall indemnify, defend, and hold harmless SA from any claims, damages, losses, or expenses arising from operation of Applicant’s systems or violation of this Agreement.
08CONFIDENTIALITY
SA will maintain confidentiality of technical documentation and application materials, except:
Certificate information is publicly verifiable
Disclosure required by law or valid legal process
Aggregate, anonymized data for research or reporting
09INTELLECTUAL PROPERTY
Applicant retains all rights to its systems, documentation, and intellectual property. SA retains all rights to ODDC methodology, ENVELO specifications, CAT-72 procedures, and related IP. Nothing in this Agreement grants either party rights to the other’s intellectual property except as expressly stated.
10GENERAL PROVISIONS
10.1 GOVERNING LAW
This Agreement is governed by the laws of the Province of Ontario, Canada. Disputes shall be resolved in the courts of Ontario, Canada.
10.2 ENTIRE AGREEMENT
This Agreement, together with the Terms of Use and applicable fee schedules, constitutes the entire agreement between the parties.
10.3 AMENDMENTS
SA may amend this Agreement by providing thirty (30) days written notice. Amendments apply prospectively only. Prior versions are archived upon revision. Continued participation following the notice period constitutes acceptance of the amended terms.
10.4 SEVERABILITY
If any provision is found unenforceable, the remaining provisions remain in effect.
10.5 SURVIVAL
Sections 7 (Liability and Indemnification), 8 (Confidentiality), 9 (Intellectual Property), 10.1 (Governing Law), and 12.6 (Interlock Safety Commitment) survive termination or expiration of this Agreement.
10.6 FORCE MAJEURE
Neither party shall be liable for delays or failures in performance resulting from causes beyond its reasonable control, including acts of God, governmental action, natural disaster, or failure of third-party infrastructure.
10.7 ASSIGNMENT
Applicant may not assign this Agreement without SA’s prior written consent. SA may assign this Agreement in connection with a merger, acquisition, or reorganization, provided the successor assumes all obligations herein.
10.8 DISPUTE RESOLUTION
The parties submit to the exclusive jurisdiction of the courts of Ontario, Canada. Each party waives any objection to venue in such courts. The prevailing party in any dispute shall be entitled to recover reasonable legal fees and costs.
11FEE NON-PAYMENT PROCEDURES
11.1 GUIDING PRINCIPLES
SA’s non-payment procedures are governed by three principles: (a) Safety Independence — the ENVELO Interlock is a safety enforcement mechanism and SA will not disable, degrade, or override it as a billing enforcement tool; (b) Registry Integrity — the public registry is SA’s primary enforcement instrument and will be updated accurately at each escalation stage; (c) Proportionality — consequences escalate in stages, providing reasonable opportunity to cure before more serious consequences follow.
11.2 FEE OBLIGATIONS
Fees are due on the date specified in the applicable invoice or, where no date is specified, thirty (30) days following invoice date. If Applicant disputes an invoice in good faith, written notice specifying the amount and basis of dispute must be provided within fifteen (15) days of the invoice date. Undisputed amounts remain due on the original due date. SA will not initiate escalation with respect to a bona fide disputed amount while the dispute is under review.
11.3 ESCALATION PHASES
Phase 1 — Grace Period (Days 1–30)
Certificate status active and unchanged. Registry unaffected. ENVELO Interlock continues normal operation. SA issues written notice on Day 1 and reminder on Day 15.
Phase 2 — Non-Conformant: Payment Delinquent (Days 31–60)
System transitions to Non-Conformant status. Registry updated to “Non-Conformant: Payment Delinquent” — publicly visible to regulators, fleet operators, and the public. ENVELO Interlock continues enforcing ODD limits unchanged. Applicant must immediately cease representing the system as Conformant and update all public-facing materials.
Phase 3 — Non-Conformant: Fees Outstanding (Days 61–90)
System remains Non-Conformant. Registry updated to “Non-Conformant: Fees Outstanding.” ENVELO Interlock locked to its last-validated ODD configuration; SA does not alter, disable, or interfere with the Interlock. Applicant must cease all use of the ODDC mark and notify regulators and principal customers within five (5) business days.
Phase 4 — Non-Conformant: Permanent (Day 91+)
Non-Conformant status is permanent for the current term. Registry updated to “Non-Conformant: Permanent.” Re-engagement requires a new application and full CAT-72 re-assessment. SA reserves all rights to pursue outstanding fees by legal means.
11.4 CURE AND REINSTATEMENT
Payment in full during Phase 1 or 2 immediately restores Conformant status with no re-assessment required. Payment in full during Phase 3, plus any applicable reinstatement fee, restores Conformant status; SA will update the registry within two (2) business days of confirmed receipt. The original conformance term is not extended by the Non-Conformant period. There is no reinstatement following Phase 4 — a new application is required.
11.5 REGISTRY TRANSPARENCY
SA maintains an accurate, publicly accessible registry and will not suppress or delay registry updates for commercial or relational reasons. SA’s obligation to maintain registry accuracy is independent of and not subject to any commercial arrangement with Applicant.
12SA ENFORCEMENT POWERS
DESIGN PRINCIPLE
SA will never disable, deactivate, or bypass the ENVELO Interlock’s ODD enforcement functions. All SA enforcement actions operate through certificate status, registry transparency, and ODD configuration — not through removal of safety constraints. SA’s enforcement actions will never introduce a safety hazard into a conformant system.
12.1 ENFORCEMENT INSTRUMENTS
Non-Conformance Determination and Registry Action
SA may determine a system Non-Conformant and update the public registry accordingly. This is SA’s primary enforcement instrument, available in all triggering circumstances. Registry updates take effect immediately upon SA’s determination.
ODD Configuration Authority
SA retains the right to push ODD configuration updates through the ENVELO Interlock update channel, including a null ODD configuration that restricts the system to a zero-boundary operating domain. A null ODD does not disable the Interlock — the Interlock continues enforcing; the boundaries are set to zero. SA exercises this authority only upon the triggering conditions in 12.2. All configuration actions move in one direction only: toward more restrictive operation.
Mandatory Offline Directive (MOD)
SA may issue a MOD requiring Applicant to take the conformant system offline pending re-assessment or resolution of a triggering condition. A MOD does not alter the Interlock configuration but creates a binding contractual obligation. Continued operation following a MOD constitutes material breach and entitles SA to immediate Non-Conformance determination and regulatory referral.
12.2 TRIGGERING CONDITIONS FOR ODD CONFIGURATION AUTHORITY
SA may exercise ODD Configuration Authority only upon one or more of the following. SA shall document the specific triggering condition(s) in a written Enforcement Notice issued concurrently with or prior to any configuration action.
Material Fraud
SA has reasonable grounds to conclude that Applicant made a material misrepresentation in application materials, ODD declaration, or simulation data.
Unauthorized ODD Modification
Applicant has modified the conformant system’s ODD specification, enforcement architecture, or underlying simulation in a material way without SA’s prior written approval.
Interlock Malfunction
The ENVELO Interlock is malfunctioning in a manner that SA reasonably determines creates a risk that the system will operate outside its certified ODD without enforcement.
Regulatory Direction
A government authority or regulator with jurisdiction has directed SA in writing to take action with respect to the conformant system.
Illegal Operation
SA has reasonable grounds to conclude the system is being operated in a jurisdiction, domain, or manner that is expressly excluded from the certified ODD or that constitutes a violation of applicable law.
12.3 ENFORCEMENT PROCEDURE
Notice: SA shall provide twenty-four (24) hours written Enforcement Notice specifying the triggering condition(s), proposed action, and Applicant’s right to respond, except where SA reasonably determines immediate action is necessary to prevent imminent harm, in which case SA may act immediately and provide notice concurrently.
Applicant Response: Within the notice period, Applicant may provide written evidence that the triggering condition does not exist or has been remedied. SA will consider such evidence in good faith. Provision of false or misleading evidence constitutes independent grounds for immediate Non-Conformance determination.
Reversal: SA will reverse any ODD configuration action and restore Applicant’s conformant configuration within two (2) business days of: (a) Applicant demonstrating the triggering condition no longer exists; (b) completion of any required re-assessment; and (c) payment of any applicable reinstatement fees.
12.4 APPLICANT OBLIGATIONS UPON ENFORCEMENT ACTION
Immediately notify operations team and any third parties with operational authority over the conformant system
Cooperate fully with SA’s investigation, including providing system logs, ODD telemetry, and operational records within 48 hours of request
Refrain from any action intended to interfere with, circumvent, or reverse the configuration action taken by SA
Notify regulators and principal customers of the enforcement action within five (5) business days, unless SA directs otherwise in writing
Comply with any Mandatory Offline Directive for its full duration
12.5 SA LIABILITY FOR ENFORCEMENT ACTIONS
SA’s exercise of enforcement powers in good faith in accordance with the procedures herein shall not give rise to liability for loss of revenue, operational downtime, contractual penalties, or consequential loss. SA’s liability in connection with any enforcement action is limited to direct damages arising from SA’s gross negligence or wilful misconduct, and shall not exceed the fees paid for the specific conformance at issue.
12.6 INTERLOCK SAFETY COMMITMENT (SURVIVES TERMINATION)
SA will never disable, deactivate, or interfere with the Interlock’s ODD enforcement functions as a consequence of non-payment or any commercial dispute
SA will never modify the Interlock’s enforcement behaviour in a manner that expands or relaxes ODD limits during any enforcement event
Upon Non-Conformance determination, the Interlock is locked to the last-validated configuration — the system continues to operate within its most recently verified ODD boundaries
These obligations survive the termination or expiration of conformance and are binding on SA’s successors and assigns
QUESTIONS ABOUT THIS AGREEMENT
Contact our conformance team for clarification.
CONFORMANCE@SENTINELAUTHORITY.ORG →