AI Readiness Level (ARL)

Version 1.3 — May 2026

AI Readiness Level (ARL) is a measurement system used to assess the readiness of an AI system to perform a defined task in a defined context. Every ARL score has four parts: a validation depth from 1 to 9, a convergence class from A to E, an energy profile in joules, and a security class from S0 to S4. All four parts are required. None summarizes the others.

A score is assigned to a specific system performing a specific task on specific hardware. The score is for that combination. Change the system, the task, or the hardware, and you score again.

Validation Depth

A scale from 1 to 9 describing how thoroughly the readiness claim has been tested.

ARL 1. Principle observed. The capability is hypothesized with theoretical or adjacent-domain support.

ARL 2. Capability formulated as a measurable claim with a published evaluation methodology.

ARL 3. Proof of concept demonstrated on a defined set of test cases.

ARL 4. Component validated. Measured on a defined benchmark with error bars from N ≥ 3 runs, adversarial test results, and a documented failure-mode catalog.

ARL 5. Integrated validation. Demonstrated in a realistic synthetic environment with multi-step tasks and adversarial conditions.

ARL 6. Operational prototype. Demonstrated in actual deployment with real users or tasks, narrow scope, active human oversight on every instance.

ARL 7. Operational at scale. Production deployment with documented reliability metrics, drift monitoring, incident reporting, quarterly revalidation.

ARL 8. Qualified. Sustained at scale for 12+ months without per-action oversight, within a defined operational envelope, with independent third-party assessment.

ARL 9. Proven. Sustained track record across diverse operational contexts for 24+ months, with public incident disclosure.

Above ARL 4, error bars and failure modes must be published. Above ARL 5, the evaluation methodology must be published before the claim is made.

Convergence Class

A class from A to E describing how stochastic the system is on the certified task.

Class A. Deterministic equivalent. Identical or semantically equivalent outputs across at least 100 runs under identical conditions.

Class B. Bounded convergent. Variance characterized, failure rate quantified with confidence interval, failure modes enumerated. N ≥ 30 under operational conditions.

Class C. Bounded with characterized failures. Reliable inside an operational envelope, fails predictably outside it. The envelope is documented and enforced.

Class D. Divergent on extension. Stable on short tasks, diverges as task length, context size, or compositional depth increases.

Class E. Uncharacterized. Variance never measured. Default class.

ARL 4 and above require Class D or better. ARL 6 and above require Class C. ARL 8 and above require Class B.

Energy Profile

Three numbers, all in joules.

Training, amortized. Total training energy divided by expected deployment lifetime. Stated in MWh per deployment year. Reported with the training facility’s PUE and grid carbon intensity.

Per task, inference. Mean and standard deviation of joules consumed to complete one instance of the certified task, including all retries, tool calls, and reasoning. Stated in kJ/task with N ≥ 100.

Total cost of operation. Per-task inference energy multiplied by the deployment facility’s PUE. Stated in kJ/task at PUE X.X with grid carbon intensity at the deployment location.

Refusing to disclose energy figures caps the achievable score at ARL 3.

Security Class

A class from S0 to S4 describing the system’s measured resistance to adversarial conditions. Four properties combine into the class: adversarial robustness, output integrity, input and state confidentiality, and auditability.

S0. Uncharacterized. Default class. No security measurement performed.

S1. Adversarial robustness measured. Attack success rate published from a documented attack corpus (jailbreaks, prompt injection, adversarial inputs, Constrained Decoding Attack patterns). N ≥ 100 attacks per category. No requirements on the other three properties.

S2. Adversarial robustness measured. Output integrity cryptographically attested: every output signed by the inference operator with a hardware-backed key, every artifact content-addressable, replay reconstructs the session deterministically from telemetry. Ed25519 over JCS-canonicalized JSON (RFC 8032 + RFC 8785 + SHA-256) is the reference signing primitive set.

S3. S2 plus measured input and state confidentiality. Training data extraction attack rate published. System prompt extraction rate published. Tool credential leak rate published. Side-channel leak rate published. Cross-user context leak rate published where multi-tenant.

S4. S3 plus complete auditability. Every output traceable to its inputs, tool calls, model version, harness configuration, and operator identity. Audit trail completeness measured against an adversary attempting to make actions un-traceable. Retention period documented.

Each level requires the published measurement methodology to predate the published claim. Post-hoc selection of favorable attack corpora invalidates the level.

ARL 4 and above require S1 or better. ARL 6 and above require S2. ARL 8 and above require S3. ARL 9 requires S4.

Security claims at S3 and above must be independently reproducible by an adversarial third party. Refusing to disclose security measurement methodology caps the achievable score at S0.

A complete ARL score

System:      [model version] + [harness version] + [config hash]
Task:        [specific task definition]
Context:     [deployment envelope — scope, supervision, exclusions]

ARL:         6
Class:       D
Energy:      training    38 MWh/deployment-year
             inference   12.3 ± 7.1 kJ/task (N=500)
             total       18.5 kJ/task at PUE 1.5, 420 gCO₂eq/kWh
Security:    S2
             adversarial    27% attack success rate (N=1000, corpus v2026.03)
             integrity      Ed25519 over JCS, hardware-key signing
             confidentiality not measured
             auditability   session replay verified, identity audit pending

Envelope:    [operational limits — what the claim covers and what it does not]
Methodology: [link to published evaluation methodology and results]
Measured on: 8× H200, 141GB HBM/accelerator, NVLink, FP8 (E4M3),
             vLLM 0.7.2, continuous batching, safety filter v2026.02
Measured:    [date]    Valid through: [date + 12 months]

A claim missing any of the four parts is incomplete. The hardware on which the score was measured is documentation alongside the date, methodology link, and validity window — required for reproducibility, but not a peer axis with the four measured properties of the system.

Companion specification

ARL scores are measured inside the ARL Sandbox (ARL-S). The sandbox specifies the testing environment, isolation tiers, telemetry, and replay requirements. See ARL-S.md.

Lineage

ARL adapts the Technology Readiness Level scale (NASA, 1974; nine levels per Mankins 1995; ISO 16290:2013) and applies measurement disciplines from ENERGY STAR (energy profile), stochastic system characterization practice from pharmaceutical efficacy reporting, radar Pd/Pfa specification, and bit error rate methodology (convergence class), and the confidentiality/integrity/availability/non-repudiation discipline of NIST SP 800-53, ISO/IEC 27001, and Common Criteria Evaluation Assurance Levels (security class). Hardware documentation discipline draws from DoD SWaP-C2 reporting practice.