GAISSF Ecosystem Licence — GEL v1.0

Preliminary: Entity Definition

“ODA³ Institute” is the market-facing brand name of ODA3 Pvt Ltd, a private limited company incorporated under the Companies Act, 2013, in India (CIN: U62011BR2026PTC083871). “ODA³ Institute” is used in all research, market-facing, and framework-related communications. “ODA3 Pvt Ltd” appears only in legal notices, corporate filings, and where the registered legal entity must be identified. Both names refer to the same legal entity and are used interchangeably within this Licence for legal purposes.

1. Purpose

This Licence governs access to and use of the GAISSF Ecosystem developed and maintained by ODA³ Institute (ODA3 Pvt Ltd). The GAISSF Ecosystem includes:

• GAISSF (Global AI Safety and Security Framework)
• UAIF (Unified AI Incident Framework)
• AI-IRF (AI Incident Response Framework)
• PAI-SF (Physical AI Security Framework)
• Control catalogues, domains, taxonomies, classifications, mappings, methodologies, maturity models, compliance structures, reference architectures, documentation, and related materials
• All updates, versions, and future extensions published by ODA³ Institute

2. Licence Classification

This Licence is:

• Source-available
• Not open-source
• Not compatible with OSI-approved licenses
• Non-commercial by default
• Commercial-use restricted

No rights are granted except as explicitly stated in this Licence.

3. Definitions

3.1 Licensed Material

All GAISSF Ecosystem materials published under this Licence, including framework text, taxonomies, control catalogues, mappings, methodologies, maturity models, compliance structures, reference architectures, and documentation.

3.2 Organisation

A legal entity (corporation, university, NGO, government body, or partnership), including its employees and contractors acting solely on its behalf, and its wholly-owned subsidiaries. Partially-owned affiliates are excluded unless separately licensed.

Excludes: clients or customers of the Organization; unrelated third parties; downstream recipients of services.

Contractors may use the Licensed Material only for the internal purposes of the engaging Organization and may not reuse it for any other entity. Sub-contractors engaged by a contractor are bound by the same restriction and do not acquire independent rights under this Licence.

3.3 Internal Use

Use solely within an Organization that does not produce any deliverable — in any form, regardless of how it is labelled or billed — provided to any external party. Internal Use includes governance and risk management, internal compliance mapping, internal training and education for employees and contractors of the same Organization, internal research and evaluation, and non-public implementation within the Organization’s own systems.

For the avoidance of doubt, the following are not Internal Use and constitute Commercial Use: producing any report, assessment, framework output, or deliverable shared with any external client, customer, or third party, regardless of whether a fee is charged specifically for access to the Licensed Material; and using the Licensed Material as the basis of any work product delivered outside the Organization’s own legal boundary.

Government Procurement Note. Where a government body uses the Licensed Material for its own Internal Use, no commercial licence is required. However, any commercial vendor, systems integrator, or contractor engaged by a government body to implement, deploy, or operationalize the Licensed Material on that government body’s behalf must hold a separate commercial license from ODA³ Institute.

Solo Practitioner / Fractional Executive Clarification. Independent consultants, fractional executives (including fractional CISOs, fractional DPOs, and similar roles), and solo practitioners who use the Licensed Material to advise, support, or deliver services to any external client are engaged in Commercial Use and require a separate commercial license, regardless of whether they operate as a sole proprietorship or single-person entity.

Contractor Engagement Clarification. Where an Organisation engages a contractor, consultant, or third-party firm to perform any activity using the Licensed Material, and that activity would constitute Commercial Use if performed directly by the Organisation, that engagement constitutes Commercial Use. The contractor must hold a separate commercial licence from ODA³ Institute.

The Organisation’s own Internal Use rights do not extend to cover the commercial activities of contractors engaged on its behalf.

3.4 Commercial Use

Any use intended to generate revenue, commercial advantage, or paid services.

Commercial Use includes, without limitation: consulting, advisory, or implementation services; audits, assessments, or compliance services; certification or accreditation services; SaaS or software integration; paid training or workshops; managed services; redistribution in commercial products; derivative commercial frameworks; client delivery or monetized services; and using the Licensed Material as the primary or supporting methodology, framework, or deliverable basis in any paid engagement, regardless of whether a direct fee is charged specifically for access to the Licensed Material itself.

For the avoidance of doubt, indirect compensation that is not genuinely incidental — including winning paid contracts, generating billable work, or achieving competitive advantage — constitutes Commercial Use. Only purely incidental benefit such as academic reputation, research funding unrelated to the specific use of Licensed Material, or institutional visibility not tied to a specific paid engagement is excluded.

3.5 Software Derivatives and Independent Modules

Any software, script, tool, application, API, or automated system that implements, automates, operationalizes, or is substantially derived from the Licensed Material — including GAISSF control logic, UAIF classification taxonomies, AI-IRF response procedures, or PAI-SF physical-AI security controls — constitutes a derivative work and is subject to the same restrictions as the Licensed Material under this Licence. Distribution or commercial deployment of such software requires a separate commercial license from ODA³ Institute.

Independent Modules Carve-Out. Independently written software code that merely interfaces with, calls, or references the Licensed Material without reproducing its substantive content is not itself a derivative work under this Licence, provided that: (a) the Licensed Material remains separately identifiable and is not embedded or reproduced within the software; (b) the software does not distribute or make available any portion of the Licensed Material beyond what is strictly necessary for interoperability; and (c) the software clearly identifies which portions of its operation are governed by this Licence.

This carve-out does not permit commercial use of the Licensed Material itself when embedded within such software.

3.6 AI and Machine-Readable Ingestion

Using the Licensed Material, or any substantial portion thereof, as training data, fine-tuning data, evaluation data, or prompt corpus for any artificial intelligence or machine learning model intended for commercial deployment or commercial benefit constitutes Commercial Use under this Licence and requires a separate written commercial licence from ODA³ Institute.

Use for purely academic or non-commercial research purposes, with appropriate attribution, is permitted under the standard non-commercial grant.

4. Licence Grant

ODA³ Institute grants a worldwide, non-exclusive, non-transferable licence to: access and use Licensed Material; reproduce and store copies for Internal Use; use for Internal Use only; conduct academic, research, and evaluation activities (non-commercial); cite and reference publicly with attribution; and create internal modifications for Internal Use.

No ownership rights are transferred.

Standards Development Organisation Carve-Out. Notwithstanding the foregoing, ODA³ Institute expressly retains the right to grant separate, specific royalty-free licenses to recognized Standards Development Organizations (SDOs) — including but not limited to ISO/IEC JTC 1/SC 42, IEEE, and NIST — and to their members solely to the extent required by the applicable SDO’s then-current intellectual property rights policy for the purpose of publishing the standard and permitting members to implement the standard as formally adopted.

Any such grant: (a) is made at ODA³ Institute’s sole discretion; (b) does not extend beyond the scope strictly required by the applicable SDO IPR policy; and (c) does not grant any SDO member the right to commercialize the Licensed Material independently of the adopted standard.

5. Usage Model

5.1 Internal Modifications (Allowed)

Organizations may modify, extend, translate, or adapt the Licensed Material strictly for Internal Use. Internal modifications must not be commercially distributed or used to produce deliverables for external parties.

Permitted: internal frameworks and mappings; internal compliance systems; internal research adaptations.

Prohibited: Commercial Use of modifications (including client-facing deliverables derived from modifications); external distribution of modifications, whether commercial or non-commercial, except as permitted by Section 5.2.

5.1a Internal-to-Public Release Rule

Modifications created under Section 5.1 may be publicly released under Section 5.2, provided: all conditions of Section 5.2 are met at the time of release; and the modification was not previously used commercially in any form prior to public release.

A modification that was used to generate commercial deliverables, integrated into commercial products, or otherwise used in Commercial Use activities may not subsequently be released under Section 5.2 without a separate commercial licence authorizing such release.

Users are encouraged to notify ODA³ Institute via the official website within 30 calendar days (IST) of first public release, for ecosystem tracking purposes only. This notification does not constitute approval, review, or endorsement by ODA³ Institute.

5.2 Non-Commercial Redistribution

Users may publicly share unmodified Licensed Material, or modified material distributed under this Licence (GEL v1.0).

Conditions: attribution required (see Section 6); licence notice must be retained in full; modifications must be clearly indicated with a description of changes made; use must remain strictly non-commercial.

For purposes of this Licence, “non-commercial” means the Licensed Material is not used as part of a paid product, service, or offering, and no fee is charged specifically for access, redistribution, or use of the Licensed Material. Indirect or incidental benefit is limited to genuine academic reputation, research funding not tied to the specific use of the Licensed Material, or institutional visibility not connected to a specific paid engagement.

Using the Licensed Material as the primary or supporting methodology in any paid engagement is Commercial Use regardless of whether the material itself is separately billed.

Public redistribution does not grant any third party Commercial Use rights.

Failure to include this disclaimer in any publicly redistributed modified version constitutes a material breach of this Licence.

5.3 Commercial Use (Prohibited Without Licence)

Any Commercial Use requires a separate written commercial licence from ODA³ Institute. Proceeding with Commercial Use without such a licence constitutes a material breach of this Licence.

5.4 Downstream Rights Clarification

For the avoidance of doubt, redistribution under Section 5.2 does not grant any recipient Commercial Use rights. Any Commercial Use by any recipient requires a separate commercial licence from ODA³ Institute.

6. Attribution

Required attribution for unmodified material:

Modified versions must additionally state:

Short-form attribution (acceptable in space-constrained contexts such as software documentation, slide footers, or academic citations):

7. Term, Termination, and Cure

7.1 Irrevocability

This Licence is irrevocable except upon breach as specified below.

7.2 Termination

Rights terminate automatically upon: material breach (as defined in Section 7.2a); intentional misuse of the Licensed Material, meaning deliberate circumvention of the restrictions of this Licence, including structural or technical workarounds to avoid the Commercial Use definition, or falsely representing use as Internal Use to avoid licensing obligations; unauthorized Commercial Use; or trademark misuse or false certification claims.

7.2a Material Breach Definition

Material breach includes, without limitation: unauthorized Commercial Use; failure to provide required attribution; unauthorized distribution of modified Licensed Material outside the terms of Section 5.2; misuse of GAISSF trademarks or false certification claims; and use of Licensed Material as training data for commercial AI models without a commercial licence.

7.3 Cure Period

For non-material breaches, a 30-day cure period applies following written notice from ODA³ Institute. Rights are reinstated automatically upon verified cure within that period.

7.4 First Instance Commercial Breach Exception

A first instance of unauthorized Commercial Use may be cured within 15 days of written notice from ODA³ Institute, with full reinstatement of rights upon verified cure, provided all of the following conditions are met: the breach has not been repeated on any prior occasion (this exception may be invoked only once per licensee); cure is completed within the 15-day period and consists of (a) verified cessation of all unauthorized Commercial Use, and (b) irreversible destruction or removal of all commercial deliverables derived from the Licensed Material, confirmed in writing to ODA³ Institute via the official contact channel specified in Section 18; and the breach does not involve misuse of GAISSF trademarks, false certification claims, or AI training data ingestion without authorization, for which no cure right exists and termination is immediate upon notice.

No assessment of willfulness or intent is required for this exception to apply. ODA³ Institute retains the right to refuse reinstatement only where the conditions above are not fully satisfied within the 15-day period.

8. Contributions (Contributor Licence Agreement)

By submitting any contribution to the GAISSF Ecosystem, you explicitly and irrevocably grant ODA³ Institute (ODA3 Pvt Ltd): a perpetual, worldwide, irrevocable, royalty-free, sub-licensable, and fully transferable commercial licence to use, reproduce, modify, distribute, sublicense, and commercialize your contribution in any form, including the right to incorporate your contribution into proprietary or commercial products and services without further obligation to the contributor.

Your own rights to use your contribution are governed by this Licence and remain non-commercial unless you separately obtain a commercial licence from ODA³ Institute. Contributors who wish to retain commercial rights in their own contributions should contact ODA³ Institute to discuss alternative arrangements before submitting.

8.1 Contributor Warranty

By contributing, you warrant that: you have full legal authority to grant the rights described in Section 8; your contribution does not infringe any third-party intellectual property rights; your contribution does not contain confidential information belonging to any third party; and the CLA rights granted to ODA³ Institute survive any termination of your own licensee rights under Section 7.

9. Trademark, Branding, and Visual Identity

9.1 Protected Marks

9.2 Logo and Visual Identity

The ODA³ Institute logo, ODA³ brand color palette, and all associated visual identity elements are proprietary design assets of ODA3 Pvt Ltd, protected under applicable copyright law and common law trademark rights. No trademark registration for the logo has been applied for as of the effective date of this Licence. No license to use the ODA³ Institute logo, color palette, or visual identity elements is granted under this Licence.

9.3 Restrictions

No rights are granted under this Licence to: use any protected mark in a manner that implies endorsement, certification, or official status without written authorization from ODA³ Institute; reproduce or display the ODA³ Institute logo or visual identity in any context; or use GAISSF, UAIF, AI-IRF, PAI-SF, ODA³, or ODA³ Institute as part of any product name, service name, or domain name without written authorization from ODA³ Institute.

10. GAISSF Governance Authority

10.1 Sole Authority

ODA³ Institute is the sole authority over: GAISSF framework interpretation and versioning; UAIF classifications and taxonomies; AI-IRF response models and procedures; PAI-SF physical-AI security architecture and controls; control definitions and mappings; and alignment determinations with external standards (including NIST AI RMF, ISO/IEC 42001, and others).

10.2 Version Control

ODA³ Institute may update, modify, or deprecate any part of the GAISSF Ecosystem without backward compatibility guarantees. Rights granted under a specific version of the Licensed Material persist for that version subject to the terms of this Licence. Users who require version stability for regulatory mapping or compliance purposes are advised to retain local copies of applicable versions.

10.3 Conformance Safe Harbor

Statements of factual alignment (e.g., “implements GAISSF control X” or “maps to UAIF Category Y”) are not certification claims and do not imply official compliance, endorsement, audit, or approval by ODA³ Institute. Such statements are permitted and encouraged for ecosystem interoperability.

10.4 Anti-Fragmentation Clause

No party may knowingly represent any modified version of the GAISSF Ecosystem as official, endorsed, certified, or authoritative. A good-faith statement of factual alignment under Section 10.3 does not constitute a violation of this clause. Internal forks are permitted under Section 5.1. Public redistribution is permitted only under Section 5.2 and must not imply authority or endorsement.

Knowingly misrepresenting a modified version as official or ODA³-endorsed constitutes a material breach and grounds for immediate termination under Section 7.2.

10.5 Certification Authority

All certification, accreditation, and audit authority is exclusively reserved by ODA³ Institute / ODA3 Pvt Ltd. No third party may offer GAISSF-, UAIF-, AI-IRF-, or PAI-SF-branded certification, audit, or accreditation services without a separate written commercial licence from ODA³ Institute.

11. Statutory Rights Carve-Out

Nothing in this Licence limits or waives statutory rights that cannot be contracted away under applicable law, including but not limited to: fair use and fair dealing rights; quotation rights for criticism, commentary, or review; academic citation rights; temporary reproduction and caching; and other non-waivable rights under applicable law in the licensee’s jurisdiction.

12. Disclaimer of Warranty

THE LICENSED MATERIAL IS PROVIDED “AS IS” WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, ACCURACY, COMPLETENESS, OR NON-INFRINGEMENT. ODA³ INSTITUTE DOES NOT WARRANT THAT THE LICENSED MATERIAL IS SUITABLE FOR ANY SPECIFIC COMPLIANCE REQUIREMENT, REGULATORY PURPOSE, OR OPERATIONAL OUTCOME.

LICENSEES ARE SOLELY RESPONSIBLE FOR EVALUATING THE APPROPRIATENESS OF THE LICENSED MATERIAL FOR THEIR SPECIFIC USE CASE AND REGULATORY CONTEXT.

13. Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, ODA³ INSTITUTE (ODA3 PVT LTD) SHALL NOT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES ARISING FROM OR RELATED TO USE OF THE LICENSED MATERIAL, INCLUDING BUT NOT LIMITED TO LOSS OF DATA, LOSS OF REVENUE, LOSS OF BUSINESS, COMPLIANCE FAILURES, OR REGULATORY SANCTIONS, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

IN NO EVENT SHALL ODA³ INSTITUTE’S AGGREGATE LIABILITY TO ANY LICENSEE EXCEED INR 500,000 OR THE TOTAL FEES PAID BY THE LICENSEE TO ODA³ INSTITUTE FOR THE LICENSED MATERIAL OR ASSOCIATED SERVICES IN THE PRECEDING 12 MONTHS, WHICHEVER IS GREATER. FOR LICENSEES WHO HAVE PAID NO FEES (NON-COMMERCIAL USERS), THE AGGREGATE LIABILITY CAP IS INR 10,00,000.

NOTHING IN THIS SECTION LIMITS ODA³ INSTITUTE’S LIABILITY FOR FRAUD, WILLFUL MISCONDUCT, OR GROSS NEGLIGENCE TO THE EXTENT SUCH LIMITATION IS NOT PERMITTED UNDER APPLICABLE INDIAN LAW.

The INR 10,00,000 aggregate cap specified in this Section applies solely to non-commercial licensees under this Licence. Nothing in this Section restricts the liability terms of any separate commercial licence agreement entered into by ODA³ Institute. Liability provisions applicable to paid commercial engagements are separately negotiated and documented in the applicable commercial licence instrument.

14. Governing Law and Dispute Resolution

This Licence is governed by and construed in accordance with the laws of the Republic of India, without regard to its conflict of law provisions.

Dispute resolution procedure:

• The parties shall first attempt resolution through good-faith negotiation for a minimum period of 30 days following written notice of dispute.
• Any dispute not resolved through negotiation shall be referred to binding arbitration under the Arbitration and Conciliation Act, 1996 (India), as amended. The arbitral tribunal shall consist of a sole arbitrator appointed by mutual agreement of the parties. Failing agreement within 15 days of a written request for arbitration, the sole arbitrator shall be appointed in accordance with the rules of the Delhi International Arbitration Centre (DIAC).
• The DIAC Rules in force at the date of commencement of arbitration shall govern the proceedings.
• The seat and venue of arbitration shall be Delhi, New Delhi, India. All proceedings shall be conducted in English.
• Either party may seek interim or injunctive relief from any court of competent jurisdiction without waiving the right to arbitration.

15. Rights Per Version

Rights granted under this Licence apply perpetually to the specific version of the Licensed Material obtained by the licensee, subject only to termination for breach under Section 7. Future versions of the GAISSF Ecosystem may be released under different or successor licence terms. Such release does not affect rights already granted under GEL v1.0 for the version of the Licensed Material obtained under this Licence.

16. Source Availability

ODA³ Institute shall maintain public availability of the then-current major version of the GAISSF Ecosystem, at no cost, under this Licence or a successor licence on no more restrictive non-commercial terms, for a minimum period of 24 months following the release of any subsequent major version. This obligation is legally binding and may be enforced by any licensee who has obtained rights under this Licence, subject to the exit event qualification below.

Exit Event Qualification. This obligation shall be suspended and converted to a best-efforts archive deposit obligation if ODA³ Institute experiences any defined exit event: (a) insolvency proceedings under applicable Indian law; (b) dissolution or winding up by court order or voluntary resolution; (c) a public announcement that it will no longer maintain or develop the GAISSF Ecosystem; or (d) acquisition where the acquirer gives written notice within 90 days that it will not continue the public availability commitment.

Upon any exit event, ODA³ Institute shall use reasonable efforts to deposit the then-current major version in a publicly accessible archive (such as Zenodo or the Internet Archive) prior to or within 30 days of the exit event.

For the avoidance of doubt: this obligation applies to the major version in use at the time of any new major release; ODA³ Institute may publish minor updates or patches without triggering a new 24-month period; and a change of registered jurisdiction or corporate restructuring that does not result in a defined exit event does not suspend this obligation.

Users who depend on the GAISSF Ecosystem for compliance or governance purposes are strongly advised to retain local copies of the applicable version in use, as an additional safeguard.

17. Commercial Licensing

Commercial rights may be granted separately by written agreement with ODA³ Institute. Available commercial licence categories include:

• Consulting, advisory, and client delivery rights
• Certification and audit authority rights
• SaaS integration and software embedding rights
• Enterprise-scale deployment rights
• Authorized training partner and reseller programmes
• AI model training and machine-readable ingestion rights

All commercial licensing inquiries must be directed to ODA³ Institute via the official website at oda3.org.

18. Assignment

Licensor Assignment. ODA³ Institute (ODA3 Pvt Ltd) may assign, transfer, novate, or delegate this Licence and all rights and obligations hereunder, in whole or in part, to: (a) any wholly-owned affiliate or subsidiary of ODA3 Pvt Ltd; (b) any successor entity resulting from a merger, acquisition, restructuring, or re-domiciliation; or (c) any acquirer of substantially all of the assets of ODA3 Pvt Ltd related to the GAISSF Ecosystem.

Such assignment shall not affect the rights of existing licensees under GEL v1.0 for the version of the Licensed Material they obtained prior to the assignment, subject to the terms of this Licence.

Licensee Assignment. Licensees may not assign, transfer, sublicense, or delegate this Licence or any rights granted hereunder to any third party without the prior written consent of ODA³ Institute. Any purported assignment without such consent is null and void.

Section 16 Binding on Assignees. Any assignee of ODA³ Institute’s rights under this Licence shall be bound by the source availability obligation in Section 16 as if originally named therein, and shall not acquire the right to suspend or terminate public availability of the Licensed Material except upon the occurrence of a defined exit event as set out in Section 16.

19. Severability

If any provision of this Licence is held by a court or arbitral tribunal of competent jurisdiction to be invalid, illegal, or unenforceable under applicable law, that provision shall be modified to the minimum extent necessary to make it valid and enforceable, and the remaining provisions of this Licence shall remain in full force and effect and shall not be affected or impaired by such modification.

For the avoidance of doubt, a finding that the liability cap in Section 13 is unenforceable in a particular jurisdiction does not affect the validity of any other provision of this Licence.

If modification of the invalid provision is not possible, it shall be severed from this Licence without affecting the validity and enforceability of the remaining provisions.

20. Contact

All licensing, certification, partnership, commercial, and trademark inquiries must be directed to:

Where AI Governance meets Operational Reality