Provenance: four records clients can ask for

On 28 October 2025 the Design Tokens Community Group announced the first stable version of its format, 2025.10. It is a vendor-neutral JSON format for design decisions such as colour, type, spacing and motion. That lets design tools, code and documentation read from one source.

A token file carries more than values. It holds types, descriptions and references between tokens. That is what lets a theme, sub-brand or market variant be made by changing a few tokens instead of redrawing.

What it changes: a brand’s design decisions can be handed over as data in a published format, instead of a PDF and a component library that fall out of step. What we check: that the tokens are the source and everything else is generated from them.

The Coalition for Content Provenance and Authenticity (C2PA) publishes an open standard for recording where media came from and how it was edited. The record travels with the file as Content Credentials.

For campaigns that mix photography, illustration and AI-generated images, this is a practical question as well as an ethical one. Which export settings keep the credentials? Which platforms strip them? How is AI-generated work labelled at release?

What we check: that provenance survives resizing, compression and upload, the steps where metadata is most often stripped.

ISO/IEC 42001, published in December 2023, specifies an AI management system. It covers the policies, roles, risk and impact assessments and controls an organisation uses to run AI responsibly. Like ISO/IEC 27001 for information security, it is a standard organisations can be certified against.

It pairs well with the NIST AI Risk Management Framework, released in January 2023. NIST’s four functions (Govern, Map, Measure and Manage) help organise the work, whichever standard you report against. NIST added a Generative AI Profile, NIST AI 600-1, in July 2024.

Neither framework tells you which model to use. Both ask the same questions in different words: who decided, on what evidence and who can stop it.

What we check: one register of every AI system in a programme, each with an owner, purpose, data used, evaluations and the person who can switch it off.

The Green Software Foundation’s Software Carbon Intensity specification, now the international standard ISO/IEC 21031:2024, gives software a rate rather than a total.

SCI = ((E × I) + M) per R

The hard part is usually I, not E. A grid’s carbon intensity varies by region and by hour, so the same workload can score differently depending on where and when it runs. That is also the lever: moving work that can wait to a cleaner region or hour lowers the number without touching the code.

Because it is a rate, it rewards efficiency: a service that doubles its users without doubling its emissions improves its score. What we check: that R is something the business already counts, so the number lands in a report someone reads.