Robot Risk Passport and Registry — Data Schema

Foreword. This Standard specifies the structure of the Robot Risk Passport and the Registry that holds Passport records. It is a draft issued for review and does not yet constitute a published Veyrum Standard. Requirements use “shall” for mandatory provisions and “should” for recommendations.

Re-designation notice (2026-09-03): this document was drafted as “VRS-001” before the VRS designation system existed. It is re-designated VRS-GEN-009 under VRS-GEN-002 (Designation, Drafting and Style Rules), exercising the one-time pre-publication re-designation window (Framework Design Brief D2, CEO 2026-09-02). “VRS-001” was never published and shall not be cited. Rating semantics conform to the canonical IR/AR definition as amended 2026-09-02 (AR letters C < B < A < AA < AAA; IR edition-stamped).

Introduction

A rating is only usable by an underwriter or a lender if, on the day of reliance, they can retrieve which rating applies to which robot, on what basis, at what tier, and whether it still stands. This Standard fixes the container that carries that answer — the Robot Risk Passport — and the Registry that administers Passport records over time. It defines structure and recording rules only: the meaning of the values it holds lives in their single-source documents (IR in VRS-GEN-005, AR in VRS-GEN-006, evidence and privacy in VRS-GEN-012, rating lifecycle in VRS-GEN-008), which this Standard references and never restates.

Every recorded rating carries a tier — Unverified, Verified or Certified — and the edition it was determined under (for example VRS 2026). The tier records how the evidence was obtained: Unverified from public evidence assembled by Veyrum, Verified from a manufacturer evidence pack, Certified from a witnessed demonstration (VRS-GEN-003 §6). A rating does not carry an interval or a draft-quality flag; it carries its tier and its edition, and drafts carry the document status: Draft.

Two established models are reused so that a Passport interoperates with tooling insurers and lenders already run. The Registry is a metadata registry in the sense of ISO/IEC 11179-3:2023 — each Passport is an administered item with a registration status, held by a registration authority, and versioned rather than overwritten. A Passport may additionally be expressed as a portable, machine-verifiable verifiable credential per the W3C Verifiable Credentials Data Model 2.0, so that a relying party can check issuer, subject and status without a live call to the Registry. Dates follow ISO 8601-1:2019 and identifiers follow the globally-unique-and-permanent principle of ISO/IEC 15459-1:2014. Passports and ratings are not published at this stage, and nothing recorded under this Standard may imply that a real robot holds a Veyrum rating.

1 Scope

This Standard defines: Passport identity and identification (Clause 4); the Passport record structure (Clause 5); the Registry and registration status (Clause 6); dates and derived quantities (Clause 7); the machine-readable serialization and field schema (Clause 8); portability and verification (Clause 9); and retention, immutability and privacy (Clause 10); with a worked example (Clause 11). It applies to any robot assessed under the Veyrum rating methodology at any tier. It excludes how ratings are computed (VRS-GEN-005/006), how evidence is assessed (VRS-GEN-012), the Unverified procedure (VRS-GEN-204), and what happens to a rating after issuance (VRS-GEN-008), each cross-referenced here and never restated.

2 Normative references

• VRS-GEN-001, Vocabulary and Terminology (undated) — the primary term home; robot terms follow ISO 8373:2021.
• VRS-GEN-005, IR Methodology; VRS-GEN-006, AR Scheme (undated) — the meaning of the IR points and AR letters recorded in the ratings block, the per-criterion point-sum and company-wide fallback (VRS-GEN-005 §6), and the “no applicable pool” rule (VRS-GEN-006 §5).
• VRS-GEN-008, Application of Ratings (undated) — the lifecycle states that the status block records, and the refresh, change and withdrawal rules it points to.
• VRS-GEN-010, Conformity Mark Rules (undated) — the mark form (tier + edition) a Passport backs.
• VRS-GEN-012, Evidence and Data Requirements (undated) — the evidence-record schema, the per-criterion evidence bar, and the no-PII rules the evidence block points to.
• ISO/IEC 11179-3:2023, Metadata registries — Part 3: Metamodel for registry common facilities — the administered-item and registration-status model the Registry adopts.
• ISO 8601-1:2019, Date and time — Representations for information interchange — Part 1: Basic rules — the date format for every recorded date.

3 Terms and definitions

For the purposes of this document the terms in VRS-GEN-001 apply — including tier, edition stamp, contributor and applicable pool — together with the following.

Passport (Robot Risk Passport)

The per-unit container holding a robot’s current Veyrum rating (IR points and AR letters), its tier and edition, its history and its evidence references (VRS-GEN-001 §3.4.4). The Passport is a container, not a rating.

Registry

The administered collection of Passport records, structured as a metadata registry per ISO/IEC 11179-3:2023, with a registration authority, per-record registration status, and versioned (never overwritten) records.

administered item

A Passport record under the control of the Registry, uniquely identified and carrying a registration status, in the ISO/IEC 11179-3:2023 sense.

model-level record

A Passport record for a robot model where no deployed unit is in scope (for example an Unverified assessment from public evidence); recorded as a declared deviation from the per-unit default (§4.4), never silently substituted for it.

4 Passport identity and identification

4.1 Each Passport shall be identified by a Veyrum passport identifier that is globally unique and permanent for the life of the record, following the unique-identifier principle of ISO/IEC 15459-1:2014; the identifier shall not be reused or reassigned once issued.

4.2 Each Passport shall identify the robot model it describes and, where a deployed unit is in scope, the individual unit; a unit is the subject of a Passport record, never of its own rating (VRS-GEN-001 §3.4.2).

4.3 Each Passport shall record the manufacturer of record for the model, the hardware revision assessed, and the software version range the rating applies to (for example ≥ 3.2.0, < 4.0.0), so that a relying party can tell whether a given unit falls inside the assessed configuration.

4.4 Where no deployed unit is observed, the Passport shall be marked a model-level record and the deviation from the per-unit default shall be recorded explicitly; per-unit issuance begins when deployment evidence exists. The absence of a unit shall not be silently substituted with a per-unit record.

5 Passport record structure

5.1 Each Passport shall comprise, at minimum, the following blocks: identification (Clause 4), ratings, evidence, certification, status, and history. The machine-readable key names are fixed once in the serialization of Clause 8 and are not duplicated in prose.

5.2 The ratings block shall record, for the IR: the IR value in points, the edition it was earned under (for example IR 296 (VRS 2026)), the tier, the methodology version applied (VRS-GEN-005 and its data twin), the per-criterion points whose sum reproduces the IR (VRS-GEN-005 §6), the not-applicable set of criteria that did not apply to the model, and the contributors used where a criterion was satisfied by a company-wide record (VRS-GEN-005 §6). For each assessed sector it shall record the AR letter on the canonical scale (C < B < A < AA < AAA), the sector, the assessment protocol and version, the classes assessed, the AR tier (which shall not exceed the IR tier), and — where the sector has no applicable pool (VRS-GEN-006 §5), rendered distinctly from a letter. The ratings block shall not display an IR as if it were sector-specific, nor an AR without its sector and tier.

5.3 The evidence block shall reference the evidence records supporting the rating by identifier and record, per criterion, whether the evidence bar was met at the recorded tier (VRS-GEN-012 §4), together with the no-PII assertion; it shall not embed the evidence content or any personal information (VRS-GEN-012 §8.3). Evidence grade labels, where carried, are a data-quality vocabulary only and shall not be read as a rating (VRS-GEN-012 §4).

5.4 The certification block, present only where the tier is Certified, shall reference the Session Record produced by the witnessed demonstration, the route used (in-person witness, remote live-video witness, or independent laboratory — all evidentially equivalent, VRS-GEN-003 §6), and the demonstration protocol and version; it shall not restate the demonstration procedure.

5.5 The status block shall record the current tier and edition, the issue date, the publication-hold status (held or released), the current lifecycle state using the state vocabulary of VRS-GEN-008, the field-record annotation (published incidents and recalls, maintained independently of the score), and, where the rating is Unverified, the notice-and-comment timeline (notice, engagement close, results notice, comment close, publication) recorded per VRS-GEN-204. Where the rating has been withdrawn it shall record the withdrawal with reason and date. The semantics of each lifecycle state are owned by VRS-GEN-008 and are not redefined here.

5.6 The history block shall retain superseded ratings, refresh events, change declarations and withdrawals with their dates and authority, so that the record’s evolution is auditable.

6 The Registry and registration status

6.1 The Registry shall administer each Passport as an administered item with a registration status, in the ISO/IEC 11179-3:2023 metamodel sense; the registration authority is the body operating the Registry under VRS-GEN-003 governance.

6.2 Each Passport record shall carry the schema version under which it was written (this Standard’s edition, for example VRS-GEN-009:1.0), so that a reader can resolve the record against the correct field definitions.

6.3 Records shall be append-only: a change to a rating shall create a new record version that supersedes the prior version, and the superseded version shall be retained, not overwritten. A withdrawn record’s history shall be retained (the record is never erased), consistent with VRS-GEN-008.

6.4 On refresh (re-Verification or re-Certification, VRS-GEN-008), the new record version shall carry a change declaration mapping each declared change to the criteria it affects; unaffected criteria carry their points forward and affected Certified criteria carry forward only if their demonstration steps are re-run. Where a Passport is extended to a variant as a derived rating, the derived record shall link to its parent record’s identifier and shall not be recorded as an independent first-assessment record.

7 Dates and derived quantities

7.1 Every date recorded in a Passport — issue date, state-change date, notice-and-comment timeline dates, refresh and withdrawal dates, history entries — shall be recorded to day precision in the ISO 8601-1:2019 extended format YYYY-MM-DD.

7.2 A rating does not expire: the record shall show its issue date and edition, and the Registry shall expose the days since issue as a derived integer, so that an underwriter or lender can monitor a rating’s age and schedule a re-Verification or re-Certification review against the current edition (VRS-GEN-008). No validity window or expiry date is recorded, and none shall be restated as a constant in this Standard or in a Passport record; edition currency is single-sourced in VRS-GEN-004.

8 Machine-readable serialization and field schema

8.1 A Passport shall have a machine-readable serialization whose field keys match the dataset vocabulary (VRS-GEN-012 twin) exactly; the descriptive names in Clause 5 map to those keys 1:1. The field schema below is the authoritative minimum.

8.2 A record missing any shall field shall be inadmissible to the Registry and shall be logged with the missing field named, so that the gap is auditable rather than silent.

A minimal serialization (fictional; illustrates structure only):

{
  "_schema": "VRS-GEN-009:1.0",
  "passport_id": "VP-2026-000142",
  "identification": { "model": "Meridian Forge MF-9 (fictional)", "unit": "MF9-SN0311",
                      "manufacturer_of_record": "Meridian Forge (fictional)",
                      "hardware_revision": "rev-C", "software_version_range": ">=3.2.0,<4.0.0" },
  "ratings": {
    "IR": { "points": 296, "edition": "VRS 2026", "tier": "Verified",
            "methodology": "VRS-GEN-005:2026 + data twin v1.2",
            "criteria_points": { "SF-1": 92, "RL-1": 74, "SV-1": 68, "MS-1": 62 },
            "na_set": ["EC-3"], "contributors": ["MS-1 (company-wide)"] },
    "AR": { "IND": { "letter": "AA", "state": "rated", "tier": "Verified",
                     "protocol": "VRS-IND-201 v1.0 · classes: mobile-logistics" },
            "SVC": { "letter": null, "state": "not-applicable" } }
  },
  "evidence": { "records": 37, "bar_met": { "SF-1": true, "RL-1": true }, "pii": "none" },
  "certification": null,
  "status": { "tier": "Verified", "edition": "VRS 2026", "issued": "2027-05-12",
              "publication_hold": "held", "state": "current",
              "field_record": { "incidents": 0, "recalls": 0 }, "withdrawal": null },
  "history": [ { "date": "2027-05-12", "event": "issued (initial)", "authority": "assessment run" } ]
}

9 Portability and verification

9.1 Where a Passport is issued as a portable credential, it shall be expressible as a W3C Verifiable Credentials Data Model 2.0 verifiable credential, with the issuer (the registration authority), the credential subject (the model or unit), and a credential status; this lets a relying party verify a rating cryptographically without a live Registry call.

9.2 The credential status shall map to the VRS-GEN-008 lifecycle state and carry the tier and edition, so that a withdrawn rating presents as invalid to a verifier and a tier is never read above the one issued.

9.3 No Passport, serialization or credential shall be published while its publication-hold status is held, and none shall imply that a real robot holds a Veyrum rating, until the scheme publishes (VRS-GEN-008; CEO deferral 2026-09-05).

10 Retention, immutability and privacy

10.1 No personal information shall be stored in a Passport or its evidence references; operator identities are referenced by verification status, not identity (VRS-GEN-012 §8.3). Retention beyond the consent/rights basis recorded under VRS-GEN-012 §8 shall not occur.

10.2 Registry records shall be immutable once written: corrections, refreshes and withdrawals create new versions (§6.3); the integrity of a record version should be protected by a content hash so that tampering is detectable.

11 Worked example

Illustrative only; no real robot holds a Veyrum rating. A manipulator model earns IR 296 (VRS 2026) at the Verified tier. The registration authority issues Passport VP-2026-000142 (§4.1), records the model, its serial unit, hardware revision rev-C and software range >=3.2.0,<4.0.0 (§4.2–§4.3), and writes the ratings block: the IR in points, the edition VRS 2026, the tier Verified, and the per-criterion points that reproduce the IR by addition — 92 + 74 + 68 + 62 = 296 (§5.2, VRS-GEN-005 §6). One criterion (EC-3) is recorded in the not-applicable set, and MS-1 is flagged as satisfied from a company-wide record. The sector rating is written as IND AR: AA (VRS 2026) — Verified with its protocol and classes, while SVC records — because the sector has no applicable pool (§5.2, VRS-GEN-006 §5). The evidence block references 37 evidence records, the per-criterion bar results, and pii: none (§5.3, §10.1). Because the tier is Verified, the certification block is null (§5.4). The status block records current, publication_hold: held, an issue date 2027-05-12 to day precision (§7.1) and no expiry; the Registry exposes days since issue as a derived integer (§7.2). The record is stamped _schema: VRS-GEN-009:1.0 (§6.2).

The manufacturer later schedules a witnessed demonstration and the rating is re-Certified. The Registry appends a new version (§6.3) with a change declaration mapping the software change to its affected criteria (§6.4); the certification block now references the Session Record and the remote live-video route (§5.4). Later a supplier test report is retracted; VRS-GEN-008 withdraws the rating. The Registry appends a further version setting the withdrawal record with reason and date and annotating the field record, while retaining every prior version (§6.3, §10.2) — no value is overwritten. A verifier presented with the withdrawn Passport as a W3C VC 2.0 credential reads the credential status as invalid (§9.2) and does not rely on it as current. Every transition is an append-only Registry event; no constant lived in, or was changed in, the Passport record.

Bibliography

• ISO/IEC 11179-3:2023, Information technology — Metadata registries (MDR) — Part 3: Metamodel for registry common facilities (Edition 4; Amendment 1:2026, item-mapping enhancements). https://www.iso.org/standard/78915.html
• ISO 8601-1:2019, Date and time — Representations for information interchange — Part 1: Basic rules (with Amd 1:2022). https://www.iso.org/standard/70907.html
• ISO/IEC 15459-1:2014, Information technology — Automatic identification and data capture techniques — Unique identification — Part 1: Individual transport units (Edition 3). https://www.iso.org/standard/54779.html
• W3C, Verifiable Credentials Data Model 2.0, W3C Recommendation, 15 May 2025 (v2.1 in progress). https://www.w3.org/TR/vc-data-model-2.0/
• ISO/IEC 29100:2024, Information technology — Security techniques — Privacy framework (Edition 2) — the privacy terminology behind the no-PII / consent rules cross-referenced from VRS-GEN-012. https://www.iso.org/standard/85938.html
• ISO 8373:2021, Robotics — Vocabulary — the robot-term base used across the VRS. https://www.iso.org/standard/75539.html

Change history