When a machine must act faster than permission, who is responsible?
An aircraft with its own AI carries temperature-sensitive medicine from Shenzhen to Hong Kong. An unidentified object enters the corridor at the border. Three systems see it, three mandates apply, and the aircraft has 17 seconds to act. The authority that must answer needs 30.
Three systems, three truths
The sender's radar estimates 2.1% risk and says continue. The aircraft's own AI estimates 6.8% and says continue with limits. The destination's safety system estimates 6.8% and says hold. Each is right by its own rule.
The sky moves faster than permission
The aircraft must decide in 17 seconds. The authority responds in 30. Whose silence has legal meaning? There is no neutral default: every path creates a different record and leaves responsibility open.
Afterwards, nobody can replay it
When the flight is over, each party holds its own log. Whether the override was legitimate, whether the aircraft exceeded its mandate, who bears the financial consequence: someone has to be believed. Nothing can be checked by all sides.
A mandate before takeoff, a reference for every decision, a seal at the end
Every mission carries a mandate to act and a boundary to respect. Every decision leaves a reference in a journal that can only grow. When the mission ends, the journal is sealed. Anyone can replay it; nobody can change it.
Sensing is not estimate, estimate is not policy, policy is not authority: the record keeps them apart, so that responsibility can be answered later, on evidence.
Accountability for autonomous machines across a border
For the regulatorA replayable record of who saw what, decided what, and by whose authority
What each system observed, what it estimated, which policy it applied and which authority it claimed, kept separate and time-stamped. Sensing ≠ estimate ≠ policy ≠ authority. Verified by the regulator itself, not reported by a party.
For the operator and the mission issuerThe mandate is written before takeoff
An aircraft that stayed within its boundary is shown to have stayed within it. An exception is bounded, visible and reviewable, not buried in a log. The identity of the software that flew is a recorded fact, not a memory.
For the destination authorityIts threshold and its hold stand in the record unchanged
A hold is recorded as a hold. A late answer is recorded as a late answer. Whether silence meant refusal is a question the review answers from evidence, not from whoever tells the story best.
For insurers and courtsWho bears the consequence, answered from a sealed record
The financial and legal questions are decided on a journal that anyone can verify. A copy with one changed entry fails the check at once, and the genuine one passes.
Shenzhen to Hong Kong. 17 seconds. Three truths.
An 11-minute medical flight carrying €1.8 million of personalised medicine with 48 minutes of viability. An unidentified object appears at the border. Three systems disagree. You choose the path, approve the exception and seal the record, then replay it and test a tampered twin.
Three claims, side by side
Radar, on-board optics and the destination's fused track: three readings, three thresholds, three decisions. Continue, continue with limits, hold. Each with its policy and its claimed authority.
The 17-second clock
The border clock runs against a 30-second authority response. Four paths, none neutral. One of them opens a bounded Emergency Data Window on human approval, and the destination estimate falls to 3.2%, below its unchanged 5% threshold.
The seal and the tampered twin
The journal closes with a digital seal. The verifier checks the signer, the event count, the fingerprint chain, the root and the signature. A tampered copy fails at once. Five questions stay open for the Accord Review.
The flight, the sensing, the mandates, the authorities, the model and the receipts are simulated; the journal, the seal, the proof and the replay are real and run in your browser with a local signature, and there is no server and no connection to the NEO rail.
ACCORD 17 — a COTRUGLI Tech scenario of accountable autonomy across a border: a mandate before takeoff, a reference for every decision, a seal at the end, and a review that stays open until people answer who was responsible. Runs in your browser at cotrugli.tech/demo/accord17/.