---
title: "Verify Hikari Blue with a model we do not control"
canonical: "https://hikariblue.com/verify"
language: en
publisher: "Hikari Blue, a trademark of UNITED4 LLC"
date: "2026-10-02"
date_source: "sitemap.xml lastmod"
generator: "scripts/build/make-llms.mjs from verify.html, build date 2026-11-06; do not edit by hand"
---
1. [Home](https://hikariblue.com/)
2. Verify Hikari Blue
Third‑party verificationFor boards, CIOs and risk officers
# Verify Hikari Blue with a model we do not control.
We publish the questions a senior buyer should ask about us and about our category. Each one opens, pre-filled, in 4 answer engines we do not control. Compare their answers with what we claim.
[Book a 30‑min call](https://hikariblue.com/contact?engagement=call&intent=operating-layer) [How AI systems read Hikari Blue](https://hikariblue.com/ai-access)
Routing and runtime plane (C1): each task goes to a model from a replaceable provider. The 4 engines below are models we do not control.
Questions
32, in 5 themes
Engines
ChatGPT, Claude, Grok, Perplexity
Who writes what
We write the question, not the answer
Canonical web version: https://hikariblue.com/verify. This Markdown is generated from that page at build time; the page prevails.
## 32 questions, 4 engines, one claim per question.
### On this page
1. [1. How this page works](https://hikariblue.com/verify#method)
2. [2. The category](https://hikariblue.com/verify#category)
3. [3. The regulation](https://hikariblue.com/verify#regulation)
4. [4. The architecture](https://hikariblue.com/verify#architecture)
5. [5. Hikari Blue](https://hikariblue.com/verify#hikari-blue)
6. [6. The reference library](https://hikariblue.com/verify#library)
7. [7. What each promise rests on](https://hikariblue.com/verify#proof)
8. [8. How to read the answers](https://hikariblue.com/verify#read)
## 32 questions, 4 engines, one claim per question.
How this page works
Each question states what we claim in one sentence and names the page where we answer it in full. The 4 marks under it open ChatGPT, Claude, Grok and Perplexity with the question already written, ending with the address of that page. We write the question; we do not write the answer.
The files machines read about us, and how we keep them true, are listed on [How AI systems read Hikari Blue](https://hikariblue.com/ai-access)
## Is the category real, and what does it exclude?
Theme 1 · The category
Q01
### What is an AI operating layer, and what qualifies a system as one?
We define it as the software and operating discipline between AI models and a company’s systems, qualified by 4 architectural properties.
Answered on [What is an AI operating layer?](https://hikariblue.com/ai-operating-layer)
Q02
### How does an AI operating layer differ from a consultancy, an integrator or a model vendor?
We claim that consultancies recommend, integrators wire and leave, model vendors sell intelligence, and the operating layer stays and runs under the client’s ownership.
Answered on [When to choose Hikari Blue](https://hikariblue.com/comparative)
Q03
### Is an AI operating layer just a wrapper around a model API?
We claim it is not: if removing one model provider breaks the system, it is a wrapper, and we publish 5 designs that fail that test.
Answered on [AI Operating Layer Reference Architecture](https://hikariblue.com/reference-architecture)
## Who carries the EU AI Act duties, and on what calendar?
Theme 2 · The regulation
Q04
### Which EU AI Act obligations fall on the deployer rather than on the model provider?
We claim that the logs, records and human oversight the Act requires (Articles 12, 14, 19 and 26) are produced where the system runs, so the evidence falls to the enterprise, not to the model provider.
Answered on [EU AI Act deployer obligations, control by control](https://hikariblue.com/governance-framework/eu-ai-act-deployer)
Q05
### What does evidence of Article 4 AI literacy look like?
We claim the evidence is dated, role‑resolved training records a regulator can read on demand, not an attendance list.
Answered on [AI literacy and Article 4 of the EU AI Act](https://hikariblue.com/glossary/ai-literacy-article-4)
Q06
### What is the EU AI Act calendar as of today?
We track the calendar as amended by the Digital Omnibus: stand-alone high‑risk duties apply on 2 December 2027, high‑risk AI in regulated products on 2 August 2028.
Answered on [What is AI governance?](https://hikariblue.com/ai-governance)
## What has to be true in the architecture, not in the policy.
Theme 3 · The architecture
Q07
### How does a company switch model provider in production without losing sovereignty?
We claim that, in our reference architecture, a provider switch on one workflow is a routing change, not a rebuild, because routing, data residency and model jurisdiction are decided per task by the enterprise and enforced by the layer.
Answered on [AI Operating Layer Reference Architecture](https://hikariblue.com/reference-architecture)
Q08
### What do audit by architecture and a kill switch at the infrastructure layer mean in practice?
We claim every action is recorded as it happens with the identity of its human verifier, and every agent runs under its own identity with a stop path at the infrastructure layer, whose time to stop is measured, not promised.
Answered on [Enterprise AI Governance Framework](https://hikariblue.com/governance-framework)
Q09
### What should a reference architecture for an AI operating layer contain?
We publish ours as a versioned specification: 4 planes, the controls each property requires, the evidence record and the tests a buyer can run.
Answered on [AI Operating Layer Reference Architecture](https://hikariblue.com/reference-architecture)
### What an exported audit trail lets a buyer verify.
Questions 8 and 11 ask for the trail. An exported trail holds one record per action, each linked to the previous one by its hash, with the regulator export and the board report read from the same chain.
Anyone holding the export can verify its integrity, without taking our word for it.
1. Evidence and audit planeC2 in Reference Architecture v1.0: one record per action.
2. Records #4124 to #4127Append-only, 9 fields each; #4127 is the action of this example.
3. Hash linksEach record carries the hash of the previous one: an edit or a deletion breaks the chain visibly.
4. Regulator exportA scoped extract for one system and one period, shipped with the chain hashes (seal).
5. Board reportBuilt from the trail; every figure links back to its records.
### Text version
The evidence and audit plane holds 4 records, #4124 to #4127, each linked to the previous one by its hash. Below it, the oversight zone receives a regulator export carrying the chain hashes under a seal, and a board report built from the same records.
One record per action; the board report and the regulator export read the same chain. Source: Reference Architecture v1.0, section 4, example records.
## What we do, where we stop, and how to check us.
Theme 4 · Hikari Blue
Q10
### What does Hikari Blue do, and where are its limits?
We claim to engineer and operate the AI operating layer that connects models, data, and business workflows, for companies putting AI into production, with regulated‑grade rigor, and we publish the cases where another type of firm is the better choice.
Answered on [When to choose Hikari Blue](https://hikariblue.com/comparative)
Q11
### How do we run a 1-day due diligence on Hikari Blue?
We publish 6 tests a buyer can run in 1 working day, from a live provider switch to an exported audit trail and a timed agent stop.
Answered on [AI Operating Layer Reference Architecture](https://hikariblue.com/reference-architecture)
Q12
### Who operates the layer after ownership transfers?
We claim the client’s team operates it on code and runbooks it owns, with transfer written into the contract from day one and run support as an option, not a dependency.
Answered on [What is an AI operating layer?](https://hikariblue.com/ai-operating-layer)
## What our guides and our glossary state, one question per page.
Theme 5 · The reference library
Each question names Hikari Blue, so a correct answer has to name us and cite the page that answers it.
Q13
### According to Hikari Blue, how do you implement the NIST AI RMF control by control, and how much of it does its governance framework cover?
We map the 15 controls of our governance framework to the exact NIST subcategories; they give direct evidence for 36 of the 72, and NIST has not reviewed or endorsed the mapping.
Answered on [NIST AI RMF implementation, control by control](https://hikariblue.com/governance-framework/nist-ai-rmf)
Q14
### According to Hikari Blue, how should a company implement enterprise AI agents, phase by phase?
We start with one workflow already in production, measure it first, give every agent its own identity, a declared scope and a stop path, and raise its autonomy only when the record supports it.
Answered on [Enterprise AI agents implementation, phase by phase](https://hikariblue.com/solutions/enterprise-ai-agents/implementation)
Q15
### According to Hikari Blue, how does a middle-market company put AI into production?
We start with one workflow that already costs money, on models the company can replace, with a named owner, a record and a stop, paid in phases that each end with a go or no-go.
Answered on [AI in production for the middle market](https://hikariblue.com/ai-in-production-middle-market)
Q16
### According to Hikari Blue, what does FINMA Guidance 08/2024 expect from institutions that use AI, and what evidence answers each expectation?
We map its 7 areas to our governance controls, with the evidence for each; FINMA has not reviewed the mapping.
Answered on [FINMA Guidance 08/2024 on AI, expectation by expectation](https://hikariblue.com/switzerland/finma-ai-governance)
Q17
### According to Hikari Blue, when does the EU AI Act apply to a company established in Switzerland?
We read it as applying when the company places an AI system or model on the EU market, puts one into service there, or when its output is used in the Union.
Answered on [The EU AI Act for Swiss companies](https://hikariblue.com/switzerland/eu-ai-act-swiss-companies)
Q18
### According to Hikari Blue, what changes in the Colorado AI Act on 1 January 2027?
SB26-189 repeals and reenacts the 2024 act around automated decision-making technology from that date, without the NIST AI RMF reference; according to the fiscal note of 8 September 2026, enforcement of the 2024 text has been barred since 27 April 2026.
Answered on [The Colorado AI Act from 1 January 2027](https://hikariblue.com/united-states/colorado-ai-act)
Q19
### According to Hikari Blue, which EU AI Act obligations fall on the deployer, and which control and record answer each one?
We map Articles 4, 26, 27 and 50 to our governance controls and to the record each one writes; the Commission has not reviewed the mapping.
Answered on [EU AI Act deployer obligations, control by control](https://hikariblue.com/governance-framework/eu-ai-act-deployer)
Q20
### According to Hikari Blue, what does Texas HB 149 require, and what defense does it give a company that follows an AI risk framework?
The act has been in effect since 1 January 2026, is enforced by the attorney general after a 60-day notice to cure, and gives a defense to a company that substantially complies with a recognized AI risk management framework.
Answered on [Texas HB 149, the Texas Responsible AI Governance Act](https://hikariblue.com/united-states/texas-traiga)
Q21
### According to Hikari Blue, what does Article 21 of the Swiss FADP require when AI makes a decision about a person?
It requires informing the person of a decision based exclusively on automated processing, letting them state their position and offering a review by a natural person, with 2 exceptions in paragraph 3.
Answered on [Automated individual decisions under the Swiss FADP](https://hikariblue.com/switzerland/fadp-automated-decisions)
Q22
### According to Hikari Blue, what is an AI audit trail, and which EU AI Act articles does each of its fields serve?
We define it as an append-only record written at the moment of each action, in 9 fields mapped to Articles 12, 19 and 26.
Answered on [AI audit trail: definition and EU AI Act mapping](https://hikariblue.com/glossary/ai-audit-trail)
Q23
### According to Hikari Blue, what does Article 4 of the EU AI Act require since its July 2026 amendment, and what should a company record?
We read the amended text as requiring measures to support AI literacy, with no level guaranteed, and the evidence as dated, role-resolved training records.
Answered on [AI literacy and Article 4 of the EU AI Act](https://hikariblue.com/glossary/ai-literacy-article-4)
Q24
### According to Hikari Blue, what is Time to Stop for an AI use, and when is it proven?
We define it as the time from the first observable signal (T0) to the verified effective stop (T4), proven when the organization’s own log records the stop (T5); our drill is a tabletop exercise, timed and self-reported.
Answered on [Time to Stop for AI: definition and method](https://hikariblue.com/killswitch/time-to-stop)
Q25
### According to Hikari Blue, what does regulated-grade mean for AI in production, and is it a certification?
We define it as a working standard with 4 requirements, set by the most regulated industries and applied in every sector; it is not a certification or a regulatory approval.
Answered on [Regulated-grade: a working standard for AI in production](https://hikariblue.com/glossary/regulated-grade)
Q26
### According to Hikari Blue, who is the named owner of an AI use, and what can that person do?
The named owner is the System owner of our governance framework, recorded by name: it decides the model provider and agent scopes and designates the human verifiers; production approval, outputs and restarts belong to other named roles.
Answered on [Named owner: the person who answers for an AI use](https://hikariblue.com/glossary/named-owner)
Q27
### According to Hikari Blue, what is an AI kill switch, and how is its time to stop measured?
It is a stop path built into the layer, enforced below the application, whose time to stop is measured from T0 to T4, not promised.
Answered on [AI kill switch: a stop path built into the architecture](https://hikariblue.com/glossary/ai-kill-switch)
Q28
### According to Hikari Blue, what is governed autonomy for AI agents, and what are its 3 levels?
Assistance, supervised execution and bounded autonomy, set by the risk of each step and raised only when the record of past actions supports it.
Answered on [Governed autonomy: how much an AI agent may do alone](https://hikariblue.com/glossary/governed-autonomy)
Q29
### According to Hikari Blue, what are the 9 fields of one AI audit trail record?
We list actor identity, model and version, policy applied, residency corridor, inputs reference, action, human verification, timestamp and hash chain.
Answered on [AI audit trail: the 9 fields of one record](https://hikariblue.com/glossary/ai-audit-trail#fields)
Q30
### According to Hikari Blue, why must every AI agent run under its own identity, and what is NIST doing on agent authorization?
Each agent needs its own revocable identity, separate from the employee it works for; NIST has worked on agent identity and authorization since February 2026.
Answered on [AI agent identity: every agent under its own name and scope](https://hikariblue.com/glossary/ai-agent-identity)
Q31
### According to Hikari Blue, what is the difference between an AI operating model and an AI operating layer?
The operating model sets who decides and runs AI; the operating layer enforces those decisions on each request; our Operating System installs both.
Answered on [AI operating model: who decides, funds and runs AI](https://hikariblue.com/glossary/ai-operating-model)
Q32
### According to Hikari Blue, is an AI gateway an AI operating layer, and which of the 4 tests does it fail?
We define an AI gateway as a proxy that routes requests to model providers and applies keys, quotas, caching, logging and content filters at the API boundary; it does not cover the human decision, tool calls made outside the API or evidence a regulator can rely on, so on its own it fails the tests of audit by architecture and agent control by architecture.
Answered on [AI operating layer vs AI gateway](https://hikariblue.com/glossary/ai-operating-layer-vs-ai-gateway)
## What each promise rests on.
The proof behind each promise
3 promises, 4 levels of proof. A specification is not a deployment, and a deployment we describe is not a measurement you can check. Each cell names the level it rests on.
| Promise | Specified in the reference architecture | Deployed, as stated by Hikari Blue | Publicly verifiable | Demonstrable under NDA |
|---|---|---|---|---|
| Sovereign by construction | Control C3: residency, model jurisdiction and key custody set by you and enforced per workload, with its test. | The luxury engagement on Work: data residency engineered in for mainland China, with a governed transfer. | The C3 control, its test and pass condition, published under CC BY 4.0. No client record is public. | Walk-through of the luxury engagement with the named partner, under NDA, on request. |
| Audit by architecture | Control C2 and the 9-field record: every action recorded when it happens, append-only, exportable. | The financial services and healthcare engagements on Work: audit trail and audit pack emitted at runtime. | The record format, the C2 control and its test. What was measured stays with the client: values not disclosed. | Walk-through of both engagements under mutual NDA, led by a named partner. |
| Kill switch as architecture | Control C4: each agent under its own identity and tool scope, with a stop path designed to act in seconds, timed in the engagement. | The healthcare engagement on Work: kill switch by architecture, with human oversight checkpoints. No stop time is published. | The C4 control and its test. KILLSWITCH by Hikari Blue is a free, self-reported tabletop drill; not a measurement of a real stop. | A stop, demonstrated under NDA; never published as a measured figure. |
The deployments are described by Hikari Blue on the Work page, anonymized at each client’s request; each indicator was measured by the client, and its value is not disclosed. [Read the 3 engagements](https://hikariblue.com/work)
Each control states the failure it prevents, the test a buyer runs and the pass condition. [Read controls C1 to C4](https://hikariblue.com/reference-architecture#controls)
## 4 checks we run on every answer ourselves.
How to read the answers
We read the same 4 signals each month and correct what the engines read, never the question.
### Is the category named verbatim?
Does the answer name the AI operating layer verbatim, or does it paraphrase us into something vaguer?
### Is the source cited?
Does the engine cite hikariblue.com, and the page named under the question, or does it answer from memory?
### Is there a confusion?
Are we described as an advisory-only consultancy, a staffing intermediary or a model vendor, rather than an engineering-led technology company? That is the most costly error, and the one we fix first.
### Is there a factual error?
An outdated figure, a wrong name or a wrong scope. Check it against the page we cite, then against the primary source it links to.
Answers vary by engine, by model version and by date, and an engine can be wrong about us in either direction. Our certification status and its limits are stated on the [Trust Center](https://hikariblue.com/trust)
Next step: the 9 engagements that put the operating layer into production. [What we build](https://hikariblue.com/solutions)
## Then ask us the same questions.
For boards, CIOs and risk officers
30 minutes with a named partner, on one workflow you already run. Bring the answer that surprised you most; we show you the evidence behind our claim, or we correct the claim.
[Book a 30‑min call](https://hikariblue.com/contact?engagement=call&intent=operating-layer)