Where a thing came from is becoming part of the thing

On 28 October 2025 the Design Tokens Community Group announced the first stable version of its format, 2025.10. It is a vendor-neutral JSON format for the decisions a design system is made of, such as colour, type, spacing and motion, so that design tools, code and documentation can all read one source.

A token file carries more than values. It holds types, descriptions and references from one token to another, which is what lets a theme, a sub-brand or a market variant be expressed as a change to a handful of tokens rather than a redraw.

What it changes: a brand system can be handed over as data with a published shape, rather than as a PDF and a component library that drift apart. What we check: that the tokens are the source and everything else is generated from them, not the other way round.

The Coalition for Content Provenance and Authenticity (C2PA) publishes an open technical standard for recording where a piece of media came from and how it was edited. The record travels with the file as Content Credentials.

For a campaign pipeline that mixes photography, illustration and generated imagery, that is a practical question as much as an ethical one: which export settings keep the credentials, which platforms strip them, and how an AI-generated asset is labelled when it ships.

What we check: that provenance survives the last step, meaning the resize, the compression and the upload, because that is where metadata is most often stripped.

ISO/IEC 42001, published in December 2023, specifies an AI management system: the policies, roles, risk and impact assessments and controls an organisation uses to run AI responsibly. Like ISO/IEC 27001 for information security, it is a standard an organisation can be certified against.

It sits well beside the NIST AI Risk Management Framework, released in January 2023, whose four functions, Govern, Map, Measure and Manage, are a useful way to organise the work whichever standard you report against. NIST added a Generative AI Profile, NIST AI 600-1, in July 2024.

Neither framework tells you which model to use. Both ask the same questions in different words: who decided, on what evidence, and who can stop it.

What we check: that every AI system in a programme appears in one register, with an owner, a purpose, the data it touches, its evaluations and the person who can switch it off.

The Green Software Foundation’s Software Carbon Intensity specification, now the international standard ISO/IEC 21031:2024, gives software a rate rather than a total.

SCI = ((E × I) + M) per R

The hard part is usually I, not E. The carbon intensity of a grid changes by region and by hour, so the same workload can score very differently depending on where and when it runs. That is also the lever: moving work that can wait to a cleaner region or hour changes the number without touching the code.

Because it is a rate, it rewards efficiency rather than shrinking the business: a service that doubles its users without doubling its emissions improves its score. What we check: that R is something the business already counts, so the number lands in a report someone reads.