]> Individual Contributor

abaris@null.net

Applications Independent Submission AI disclosure http content transparency machine-readable metadata This document proposes a machine-readable Hypertext Transfer Protocol (HTTP) response header field, AI-Disclosure, to disclose the presence and degree of Artificial Intelligence (AI) generated or AI-assisted content in web responses. The header is designed for compatibility with HTTP structured field syntax and provides metadata for user agents, bots, and archiving systems. It supports layered disclosure strategies alongside human-readable and structured metadata formats.

Introduction As AI-generated content proliferates across the web, users , platforms, and regulators increasingly demand transparent disclosure of algorithmic involvement in content creation . Existing approaches to disclosure (e.g., HTML disclaimers) lack machine-readability , making automation, indexing, and compliance challenging. Regulatory initiatives like the EU Artificial Intelligence Act include transparency obligations for AI-generated or manipulated content, and the European Commission is developing a Code of Practice on marking and labelling AI-generated content to support compliance with those obligations EU-AI-Act. A lightweight, machine-readable HTTP signal can complement these efforts by enabling automated detection and disclosure in web delivery. This document defines the AI-Disclosure HTTP header field, providing a lightweight, machine-readable mechanism focused specifically on signaling the presence and mode of AI involvement in the generation of an HTTP response's content. It utilizes HTTP Structured Fields to offer a simple dictionary format directly within the HTTP response headers. The goal of AI-Disclosure is to offer a low-overhead, easily parsable signal primarily for automated systems like web crawlers, archiving tools, or user agents that may need a quick indication of AI usage without processing complex manifests. This header is intended to be applied at the entire response level. It is important to distinguish this mechanism from more comprehensive content provenance and authenticity frameworks like the Coalition for Content Provenance and Authenticity (C2PA) specification . C2PA provides richer, cryptographically signed assertions about content provenance, potentially covering detailed creation/modification history and applying to specific regions within an asset ("Regions of Interest"). C2PA information can be linked via methods including the HTTP Link header pointing to an associated manifest. AI-Disclosure can be seen as complementary to such systems within a layered disclosure strategy. While C2PA offers strong, verifiable, and granular provenance, AI-Disclosure provides a simpler, advisory signal directly in the HTTP interaction for basic AI involvement awareness. Systems requiring high assurance or sub-resource granularity should utilize frameworks like C2PA.

Terminology

Acronyms and Abbreviations AI: Artificial Intelligence HTTP: Hypertext Transfer Protocol C2PA: Content Provenance and Authenticity, refers to the specification developed by the Coalition for Content Provenance and Authenticity

Conventions and Definitions The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 when, and only when, they appear in all capitals, as shown here.

Field Definition The AI-Disclosure field is defined as a Structured Field of type Dictionary, as described in .

Header Field Name	Structured Type	Template	Protocol	Status	Reference
AI-Disclosure	Dictionary	(blank)	http	provisional	[this document]

Field Syntax The AI-Disclosure field value MUST conform to the syntax for Dictionary structures defined in Section 3.2 of . Each key in the dictionary conveys a distinct aspect of AI disclosure.

Example

Field Keys

Key	Type	Description
mode	Token	Indicates the nature of AI involvement: none, ai-modified, ai-originated, machine-generated
model	String	Identifier of the AI model used (e.g., gpt-4)
provider	String	Organization providing the AI system
reviewed-by	String	Entity or team who reviewed the AI content
date	Date	Generation timestamp as a numeric epoch value, conforming to RFC9651.

Semantics The AI-Disclosure header field is an optional and advisory header providing information about the use of AI in generating the response content. Its presence indicates voluntary disclosure by the server. Absence of the header implies nothing about AI usage. The meaning of the header is primarily defined by the mode key, whose possible values are described below:

Mode Value	Description
none	Indicates that AI was not used in the creation or substantive modification of the content.
ai-modified	Indicates AI was used to assist with or modify content primarily created by humans. The source material was not AI-generated. Examples include AI-based grammar checking, style suggestions, or generating highlights or summaries of human-written text.
ai-originated	Indicates the core content was initially generated by AI but subsequently reviewed, edited, or significantly guided by humans. This suggests human oversight for accuracy or appropriateness, even if the originality for copyright purposes might be affected.
machine-generated	Indicates the content was primarily or entirely generated by AI with minimal or no human intervention or review post-generation. AI may be responsible for substantive assertions or conclusions.

Other keys like model, provider, reviewed-by, and date provide optional, additional context about the AI model used, the provider, human review, or the generation time, respectively. Recipients should treat this header as informational only and refer to the Security Considerations (Section 7) regarding its trustworthiness. Note: The AI-Disclosure header applies to the entire content of the HTTP response payload. The ai-modified and ai-originated values indicate AI involvement, but this header does not provide information about specific locations or the exact nature of the partial involvement. For expressing provenance information about specific parts of a resource, more comprehensive mechanisms such as C2PA should be used. The distinction between ai-modified and ai-originated aims to address whether the foundational content was human or AI, reflecting concerns about originality and the nature of the transformation. The distinction between ai-originated and machine-generated primarily reflects the level of human review or intervention post-generation.

Security Considerations The AI-Disclosure field is intended to provide advisory metadata about AI-generated or AI-assisted content and does not include any form of integrity protection. As such, the field can be trivially spoofed or altered by intermediaries unless the response is delivered over a secure transport such as HTTPS. Clients and intermediaries MUST NOT rely on the presence, absence, or value of the AI-Disclosure field for making security-critical decisions. The field is not authenticated and SHOULD be treated as untrusted input. This document does not define any mechanisms for cryptographic verification or provenance validation of the header's content. Implementations that require trustworthy disclosure metadata SHOULD rely on additional application-layer integrity mechanisms or signed metadata systems, such as those defined by C2PA .

IANA Considerations IANA is requested to register the AI-Disclosure header field in the "Hypertext Transfer Protocol (HTTP) Field Name Registry" maintained at https://www.iana.org/assignments/http-fields/, according to the procedures outlined in .

Header Field Name	Applicable Protocol	Status	Reference	Structured Type	Notes
AI-Disclosure	http	provisional	[this document]	Dictionary	Discloses AI involvement in content creation

References Normative References The Hypertext Transfer Protocol (HTTP) is a stateless application-level protocol for distributed, collaborative, hypertext information systems. This document describes the overall architecture of HTTP, establishes common terminology, and defines aspects of the protocol that are shared by all versions. In this definition are core protocol elements, extensibility mechanisms, and the "http" and "https" Uniform Resource Identifier (URI) schemes. This document updates RFC 3864 and obsoletes RFCs 2818, 7231, 7232, 7233, 7235, 7538, 7615, 7694, and portions of 7230. This document describes a set of data types and associated algorithms that are intended to make it easier and safer to define and handle HTTP header and trailer fields, known as "Structured Fields", "Structured Headers", or "Structured Trailers". It is intended for use by specifications of new HTTP fields. This document obsoletes RFC 8941. In many standards track documents several words are used to signify the requirements in the specification. These words are often capitalized. This document defines these words as they should be interpreted in IETF documents. This document specifies an Internet Best Current Practices for the Internet Community, and requests discussion and suggestions for improvements. RFC 2119 specifies common key words that may be used in protocol specifications. This document aims to reduce the ambiguity by clarifying that only UPPERCASE usage of the key words have the defined special meanings. This specification defines a model for the relationships between resources on the Web ("links") and the type of those relationships ("link relation types"). It also defines the serialisation of such links in HTTP headers with the Link header field. Informative References Coalition for Content Provenance and Authenticity (C2PA) Partnership on AI Big Valley Marketing European Commission European Union

Acknowledgments The author thanks Michael Andrews from Teradata for helpful comments and feedback on early staging of this document.