Eight principles. Thirty-two checks.

Users can tell what the AI did, what it didn't, and what to do next.

First-run, recovery and dead-end paths are intentional, not accidents.

Your ToS, disclaimers and scope statements match what the product actually does.

You can answer a regulator's questions in writing, today.

An attacker with curl and a Saturday afternoon can't break it.

You know when the model gets worse, before users do.

Users, press and partners get the same risk language.

Switching, downgrading or losing a provider is a Tuesday, not a crisis.