The quarterly index of vendor AI governance disclosure.

Why the world needs a procurement Pulse

A school district vetting an AI tutor today reads a 40-page vendor whitepaper, a HIPAA attestation, and a marketing PDF. A hospital vetting a clinical-decision-support tool does the same. A federal agency does the same. Every buyer reinvents the same review wheel because vendors don't disclose in a comparable format.

The Suite ships an open substrate that makes disclosure machine-readable. The Pulse measures who's using it — and, more importantly, who isn't. Vendors that publish appear on the public scoreboard. Vendors that don't appear on the same scoreboard with a blank cell. Buyers cite the report. Regulators reference it. The race-to-the-top mechanism has, until now, been missing.

The methodology, end-to-end

Every step is open-source. Every data point is publicly fetchable. The Pulse is reproducible by anyone who runs the same crawl against the same universe of domains on the same day.

1. Universe selection. Issue #1: Fortune 500 + top 100 K-12 EdTech vendors (from EdTech Top 40 lists) + top 50 HealthTech AI vendors (FDA-cleared SaMD + clinical-decision-support market). ~1,200 domains. Published as universe.csv alongside the issue.
2. Crawl. aeo-crawler against each domain's /.well-known/ for the eleven Suite documents. JSON Lines output, hashed for replay.
3. Validate. Every fetched document goes through aeo-validator-service. Invalid documents are flagged but counted as published for the publication-rate numerator.
4. Signature check. If a document references a signing_key_url, hash-attestation-rs verifies the ed25519 signature against the canonical-JSON hash.
5. Drift detection. Each domain's documents are re-fetched fourteen days into the quarter. Any document whose content_hash changes without a corresponding version bump is logged as a drift event.
6. Reporting. Aggregated metrics (publication rate, validity rate, signature rate, drift rate) by vertical, by spec, by signed-status. Per-vendor rows go into the premium edition; public edition reports aggregate-only.

The crawl runs from a US-East datacenter with a standard user-agent (kineticgain-pulse-crawler/1.0), respects robots.txt, rate-limits to 10 req/s per origin, and identifies itself with a contact email in the User-Agent string. No authentication. No headless browser. No vendor cooperation needed.

What this is, in one paragraph

The AI Procurement Pulse is a quarterly research publication that measures AI vendor governance disclosure using the open Kinetic Gain Protocol Suite as its substrate. It exists because AI procurement is the largest under-measured market in software, the disclosure data is publicly fetchable today, and nobody has built a recurring index of who's publishing what. We're building it. Issue #1 ships in July. Subscribe.

Buyer-side tools — evaluate one vendor depth-first

Pulse measures vendor disclosure coverage across 1,531 domains every quarter. When you (a buyer) receive a disclosure from one specific vendor and need to evaluate its depth, the apex hosts the per-vendor reading tools: