Commitments should be open to examination.

Transparency provides information. Accountability connects information to responsibility, explanation, review, and correction.

A company may publish large quantities of data while making it impossible to determine who approved a harmful decision, whether a commitment was breached, why an exception was granted, what happened after a failure, whether anyone had authority to intervene, or whether the same failure is likely to recur.

We should report not only what happened, but where appropriate why it happened, who was responsible, which policy applied, whether it was followed, what consequences followed, and what will change.

Four forms of reporting

Not every matter requires the same level of disclosure.

Reporting failures, not only achievements

To raise a complaint, privacy concern, security issue, protected disclosure or urgent safety concern, email founders@k4m2.ai and identify the category in the subject line. We will publish dedicated reporting channels as the organisation's operating systems are established.

Policies cannot anticipate every future circumstance, and exceptions may sometimes be necessary. A significant exception should record the policy being departed from, the reason, who approved it, which interests were affected, whether conflicts of interest existed, how long the exception applies, what safeguards were added, and whether the decision will be reviewed.

A policy that is frequently overridden without explanation is not functioning as a policy.

Employees, contractors, contributors, clients, users, and affected people should have a way to raise serious concerns, whether about safety, privacy, security, misleading claims, financial irregularity, conflicts of interest, discrimination or retaliation, misuse of AI systems, breach of governance commitments, misuse of foundation resources, concealment of significant failures, or work that conflicts with our stated boundaries.

Reports should be accepted through more than one channel where practical. At least one route should allow a concern to bypass the person or team directly involved.

A person should not be punished for raising a concern in good faith. Retaliation may include termination, loss of work, reduction of responsibility, exclusion from information, damage to compensation or participation, threats, harassment, unfair performance assessment, informal reputational punishment, or pressure to withdraw a report.

A concern may ultimately prove incorrect without having been raised dishonestly. Protection should depend on good faith, not on whether every allegation is confirmed.

Knowingly false or malicious reports may be addressed separately through a fair process.

Significant concerns should be examined by people with sufficient independence, competence, and authority. An investigation may require preservation of relevant records, interviews, technical analysis, financial review, legal advice, security expertise, independent domain expertise, protection of affected people, temporary restrictions on a system or decision, and recusal of conflicted leaders.

The person whose conduct is being examined should not control the investigation.

People affected by our products or systems should have a practical way to report incorrect outputs, harmful outcomes, privacy concerns, security vulnerabilities, misleading disclosures, inability to obtain human review, use outside the stated purpose, difficulty leaving or exporting data, and manipulative or dependency-forming behaviour.

A complaint process should explain where to report, what information is useful, when a response can be expected, how urgent risks are handled, whether the decision can be reviewed, and what further escalation is available.

A feedback form that no accountable person reviews is not an accountability mechanism.

We should maintain a clear process for security researchers and users to report vulnerabilities, stating the systems covered, how to report securely, what testing is permitted, what information should not be accessed or retained, how the company will respond, whether recognition or rewards are available, and how disclosure will be coordinated.

People reporting vulnerabilities responsibly should not be threatened merely for identifying a weakness.

Independent accountability

Internal review may be insufficient where the company's own interests are directly involved. Independent review may be requested or required by the governing board, K4M2A Foundation, a protected committee, external auditors, legal or regulatory authorities, independent technical experts, public-interest advisors, or representatives of affected people.

Independent review should not be used only after public controversy. It may be appropriate before deploying systems with substantial consequences.

The role of K4M2A Foundation

The Foundation has a particular role in reviewing whether K4M2 AI remains aligned with its protected purpose. It may review changes to mission or governance, compliance with protected profit commitments, strategic asset decisions, serious conflicts between profit and purpose, material departures from the Responsible AI Standard, related-party transactions, misuse of foundation resources, and significant risks of mission drift.

The Foundation should not be the only source of accountability. It must also report on its own conduct, conflicts, independence, and use of resources.

Some information should not be published. Legitimate reasons may include personal privacy, employee records, client confidentiality, security, active legal proceedings, protected legal advice, unreleased product plans, trade secrets, contractual obligations, sensitive research, and information whose release could create serious misuse risk.

Confidentiality should protect legitimate interests. It should not become a general explanation for withholding information that is embarrassing, inconvenient, or relevant to a public commitment.

Where full disclosure is not possible, we should consider whether we can publish aggregated information, a summary, redacted findings, the category of issue, the decision process, the corrective action, or an independent reviewer's conclusion.

Accountability should not require exposing individual people. Reports should avoid unnecessary disclosure of personal financial information, household circumstances, health information, private communications, the identity of complainants, sensitive employment details, and personal data of users or clients.

Information should be aggregated or anonymized where possible. Anonymization should not be claimed where people can easily be identified from context.

Accountability reports should not be written as marketing material. They should avoid selecting only favorable measurements, changing definitions between reporting periods without explanation, presenting intention as completed practice, combining unrelated metrics to create a positive impression, hiding negative outcomes in broad averages, counting ordinary commercial activity as public benefit without justification, describing a policy as binding when it is voluntary, and using vague language where a specific fact is available.

The report should distinguish clearly between what is legally required, what is contractually committed, what is established policy, what is currently practiced, what remains an intention, and what is still being designed.

Where possible, reports should use consistent definitions so that performance can be compared from one year to another. When a metric or definition changes, we should explain what changed, why, whether previous figures have been restated, how the change affects comparison, and whether the new method creates a more favorable result.

The objective is not to preserve an unsuitable measure forever. It is to prevent changing the measure whenever the result becomes uncomfortable.

We may publish future targets concerning profit contributions, open-source releases, evaluation coverage, incident response, employee participation, public-interest access, governance development, and environmental or operational impact. A target should identify the measurement, the starting point, the intended result, the period, the person or body responsible, and any important conditions. A broad aspiration should not be presented as a measurable commitment. Where a target is missed, we should explain why and what follows.

As the company grows, some reporting may require independent verification, which may be appropriate for financial statements, profit transfers, related-party transactions, security controls, privacy practices, responsible AI evaluations, governance compliance, public-benefit claims, and ownership and participation records.

Obtaining a certificate should not replace responsibility for the underlying practice.

A young company should not create a reporting system so burdensome that it prevents useful work. At the same time, early stage should not become an excuse for making strong public promises without evidence. Reporting should grow with revenue, team size, number of users, the consequence of deployed systems, the amount transferred to the Foundation, external investment, public dependence on our technology, and the complexity of governance.

During the early stage, we should aim to publish at least our current governance structure, the legally established relationship with K4M2A Foundation, which mission protections are binding, the finalized profit-sharing mechanism, material changes to those arrangements, the categories of work we will not undertake, major open-source and public-interest contributions, material incidents affecting public commitments, and an annual account of progress, limitations, and next steps.

Reporting has little value if repeated failures produce no institutional consequence. Depending on the matter, consequences may include correcting a system, compensating affected people, changing a process, restricting or withdrawing a product, ending a client engagement, revising incentives, removing decision authority, disciplinary action, leadership change, independent monitoring, amendment of governance mechanisms, and public acknowledgment of failure.

Accountability is incomplete when an institution explains a failure but continues unchanged.