AI Attribution

A consumer has to be able to ask one question of any resource in a chart -- was this content produced by a machine? -- and get the answer without knowing what type the resource is.

That is what the AIAST security label is for. One rule, spec-wide:

The rule

Any resource whose clinical content was produced, in whole or in part, by a non-human agent carries the security label http://terminology.hl7.org/CodeSystem/v3-ObservationValue#AIAST ("Artificial Intelligence asserted") in meta.security, whatever its resource type.

This is a rule for producers, and it is not retroactive. It states what a conformant writer does from here; it says nothing about what is already stored, and nothing backfills it. A consumer reads the label as reliable evidence that a machine was involved, never as evidence that one was not -- see What a consumer must get right.

"meta": {
  "security": [
    {
      "system": "http://terminology.hl7.org/CodeSystem/v3-ObservationValue",
      "code": "AIAST",
      "display": "Artificial Intelligence asserted"
    }
  ]
}

AIAST is a standard HL7 code, not a Nexus invention, and it is the same label the HL7 AI Transparency on FHIR implementation guide uses for this purpose. Aligning on it means a consumer that already understands AI labelling from elsewhere understands this chart.

Why a label and not a lookup

The label is a discovery mechanism. It is searchable (_security=AIAST), it survives being read out of context, and it costs one comparison.

The alternatives all require work proportional to the chart. Detecting a machine producer from Composition.author, or Task.requester, means resolving or pattern-matching a reference per resource, and knowing which element carries the producer for that type. Detecting it from Provenance means a second query per resource, and Provenance is written for AI-mediated and cross-boundary writes rather than for everything -- so its absence is inconclusive.

The label does not replace either of those. It answers whether; they answer what, from where, and under whose supervision. A renderer that only needs to badge a note as machine-drafted should read the label. An audit that needs the inputs the model saw should read the Provenance.

What "in part" means

The label rides on partial authorship, not only on wholly generated content. An AI-scribed note that a clinician then edited and signed still carries it: a machine produced the text that the clinician started from, and a reader deciding how much scrutiny to apply needs to know that.

Attestation is a separate question and is answered separately. A signed note carries attester naming the human who is medico-legally responsible and AIAST saying a machine drafted it. Neither displaces the other, and the label never implies that nobody is accountable.

Where it goes

On the resource that holds the content. Not on a resource contained inside it: per dom-5 a contained resource cannot carry meta.security at all, so for a suggested-resource Task the label rides the Task, never the suggested payload inside it.

Applied across the profiles that carry machine-produced content today:

Content	Resource	Carries AIAST
A proposal a graph or rule put forward	Task	Yes, on the Task
A generated summary	Composition	Yes
An AI-scribed note, including after a clinician edits and signs it	Composition	Yes
A note a clinician typed	Composition	No
A computed risk score	RiskAssessment	Yes, where the score was computed by a non-human agent
A note or letter converted from a source EMR	Composition	No -- conversion is not authorship

The last row is the boundary worth stating plainly. Moving existing content between systems does not make it machine-produced; the label is about who or what composed the clinical statement, not about which pipeline carried it.

Who produced it

The label says a machine did. Naming which one is the producer reference, and it is type-specific: Task.requester for a proposal, Composition.author for a note or summary. In both cases a non-human producer is a logical Device reference -- Reference.identifier under the nexus-harness-graph NamingSystem, with Reference.type = "Device", needing no Device resource on the server.

Granularity is the graph or feature -- a name a clinician or an auditor would recognise.

Open: model identity and version

The producer reference names the graph, not the model that ran inside it or the version of that model. Recording model identity and version in the record is not currently required by this specification; per-agent detail stays in the harness that produced the output and is correlated by identifier.

What would decide it: a consumer that must answer "which model version produced this statement" from the record alone -- for example to withdraw or re-review every output of a model version found to be defective, without access to the producing system's own logs. External AI-transparency and clinical-decision-support standards are moving toward requiring exactly that, so this is expected to be revisited rather than to stay open indefinitely.

Operational telemetry -- token spend, latency, cost -- is out of scope in any case. It is not a clinical fact and does not belong in the record.

What a consumer must get right

1. Filter on the label, not on the producer. _security=AIAST is the portable question. Any rule that pattern-matches a reference or a display string will break on a producer it has not seen.
2. Absence of the label is not yet a claim. The intent is that an unlabelled resource asserts human authorship, but that only holds once every producer applies the rule, and it never holds for content written before the rule existed. There is no backfill: resources already in a chart carry whatever they were written with. Until a producer states otherwise, read an absent label as unknown, not as human -- and fall back to the producer reference or Provenance where the distinction matters. Provenance is written for AI-mediated and cross-boundary writes rather than for everything, so its absence is inconclusive too.
3. Do not treat the label as a warning. It is descriptive. Whether machine-produced content is shown, badged, or gated is a product decision, and this specification does not make it.
4. Preserve it. A system that reads a labelled resource and writes it onward carries the label with it. Dropping it silently converts machine-produced content into apparently human-authored content, which is the single outcome this pattern exists to prevent.

Related

• Suggested-Resource Tasks -- proposals, and why the label rides the Task rather than the payload.
• Generated Summaries -- machine-written Compositions.
• Provenance -- the inputs an agent read, the human who accepted the output, and per-statement citations for generated text.