AI, environmental agents and Responsibility as a Service: what the ECBYTS Seal guarantees when nobody reviews

Until 2024 an environmental report followed a known rhythm: field campaign, laboratory, spreadsheet, a handful of scenarios, review and signature. It took weeks or months.

In 2026 that rhythm broke. Monitoring data arrives every hour. A simulation runs dozens of scenarios in a single afternoon. And an artificial intelligence program writes the text, estimates what happens in the empty space between two measured points — what technicians call interpolation —, builds the risk table and suggests the decision within seconds.

Generating became cheap. Answering for it stayed expensive. That gap is the new environmental and corporate risk of the decade: we produce far faster than anyone can review, check and own what was produced.

The responsibility vacuum

The problem is not that artificial intelligence generates. The problem is what happens after it generates.

Once the text, the map and the number come out finished, it is tempting to treat the package as if it had already been reviewed. Except no program holds a professional registration with the professional council — the CREA, in the case of engineers in Brazil. No program signs the technical responsibility for what it wrote, which is the document an engineer signs and files with the council, the ART. No program answers in court, before the environmental agency or before the board of directors. And no program is called back five years later to explain why it chose that scenario instead of the most conservative one.

When everything is automatic, there is a real risk that nobody truly reviews anything.

In practice, the vacuum shows up in four ways:

• Review as theater. The report is skimmed, because the volume grew and the deadline did not. Approving turns into stamping.
• A number nobody can reproduce. Nobody knows which data version went into that figure, or which calculation rule was in force at the time. A reissued laboratory result can change the outcome without the final document ever noticing.
• The convenient scenario. With dozens of scenarios on hand, it is easy to publish the one that makes the site's numbers work, without stating which yardstick was used or how much confidence the data deserves.
• Diffuse responsibility. When everyone "used the tool", nobody answers. The error becomes the system's, the vendor's, the program's — never an identified person's.

Together, those four produce the worst possible outcome for a decision-maker: a document flawless in appearance and empty of responsibility in substance.

A number without an author is a number nobody defends. And a number nobody defends should not carry a decision.

What accountability as a service means

This is where the idea ecbyts calls Responsibility as a Service comes in.

In one sentence: it means using technology not to replace the human professional, but to show on screen, with full transparency, which part of the study is still a computer draft and which part has already been checked and signed by a flesh-and-blood specialist.

It is not a software layer that hides who wrote what. It is the opposite: it is the platform used to draw a clear line between what was generated and simulated automatically and what was actually reviewed, tested and owned by a qualified person.

The question this idea organizes is simple and uncomfortable: of this report, how much has a name, a professional registration and a date behind it? How much is still a machine draft with no owner?

Three principles hold the proposal together:

1. Generating and signing are different things. The platform may generate, simulate and suggest as much as it wants. Signing is a human act: it has a name, a professional registration and consequences. No artificial intelligence assistant steps into the place of the technical manager, the independent auditor or the legal manager. It helps analyze, never take on.
2. Responsibility is piece by piece, not a stamp at the end. Every figure, every observation and every band of the result carries its own state: reviewed by whom, under which yardstick, on which data version.
3. What has no owner yet is shown. The uncovered part is not buried in a footnote. It is displayed as part of the result, because hiding what was not reviewed is the fastest way to turn a simulation into a promise.

It is less a product and more a reading contract: anyone who receives the result can see where the automated calculation ends and where human responsibility begins, without depending on the publisher's goodwill.

How the ECBYTS Seal shows this in practice

The ECBYTS Seal is that idea turned into something you can see. It is read from the outside in, and each layer answers a different question. Five mechanisms do the heavy lifting.

1. A tamper seal that warns when a number changes

Think of the plastic seal that closes a cargo truck, or the seal a notary public puts on a document: if someone opens the box, the seal gives it away. Here it is the same — if anyone swaps a comma after the engineer has signed, the seal breaks.

An issued seal is bound to the exact version of the data used that day, identified by a kind of fingerprint of the file, what technicians call a hash. If anything changes — a new campaign lands, a parameter is corrected, the laboratory reissues its result, a new scenario is run — the previous seal immediately reads OUTDATED. And the system can point to exactly which piece changed, the way a book's index points to a page without rereading the whole book.

The essential part is what does not happen: no number changes underneath the signature of whoever reviewed it. A signature never silently starts covering data it never saw. To publish the new figure you must issue a new seal version, and that requires fresh acceptance from the responsible parties. The earlier version stays available for consultation, marked as superseded — like an account book where the next line is only ever written in ink, on the line below, with no eraser.

In a world where data changes every hour, that is the difference between a system that follows the change and a system that falsifies it.

2. The three colored bands: who has signed and what is missing

The seal's three outer bands are not decoration. Each is painted in the exact proportion of what someone has already taken on, and the percentage is written on top of it.

• Grey band: how much of the measurements has a responsible engineer, with the technical responsibility signature filed with the professional council, the ART.
• Gold band: how much went through an independent external audit.
• Blue band: how much carries an official document from the environmental agency, attached by the legal manager.

The part left white is the report's most honest answer: it is what still has no signature, no audit and no official document. None of it is hidden.

Two locks keep coverage from looking larger than it is. Audit and agency documents only count where a technical responsibility signature already exists — there is no point auditing a number no responsible professional has taken on. And each band measures what was actually taken on, not what was generated.

3. The calculation yardstick: GAIA and AURUM

Picture two masons measuring the same plot of land: one uses a tape measure in meters, the other measures in paces. Both arrive at a number, but the numbers are not comparable. The same happens with environmental reports.

When dozens of alternative scenarios are available, choosing the most convenient one is a technical decision with legal consequences. So the seal records which yardstick was used in the calculation, with name and version: GAIA for contaminated sites and AURUM for the catalog's default rule. The seal also records the confidence level of the data behind the conclusion, measured by the indicator ecbyts calls EIS.

Without that declaration, two reports reaching the same conclusion may have been produced with incompatible yardsticks — and the comparison becomes noise. With the yardstick declared and the version recorded, you can tell whether two results are comparable or simply live in different worlds. And nobody gets to test twenty scenarios, pick the prettiest and stay silent about which criterion they used.

4. The automatic check in the back office, in shadow mode

Declaring the yardstick is only worth something if someone can check the math. That is why ecbyts keeps a second calculation running on the server.

It works like a second supermarket cashier, who re-adds the total on its own and never sees the customer. After the seal is issued, the browser itself sends the server a copy of the model data — with no personal data at all, only what is needed to redo the calculation. The server redoes the math with the same engine that runs in the seal and compares the outcome with the figures recorded in the registry at issuance time. The comparison is always against the registry, never against what arrives in the message: if the browser lied about the figures, the server would not believe it.

The verdict of each check is simple: the math matches or it does not. And the server stores little by principle: the first write is the one that stays, and the received data is discarded once checked — only its fingerprint remains.

The honesty lies in the mode this runs in today: shadow mode. The recompute audits and records divergences, but it still does not block publication of the seal and does not change the result the public sees when verifying it. That is deliberate, until both engines are calibrated in the field. In other words: independent verification already exists and already collects evidence; what does not exist yet is the lock that halts publication when the math diverges.

5. Artificial intelligence with a privacy filter and an off switch

The other side of the same discipline is what happens when the product uses artificial intelligence. At ecbyts, every conversation with an AI provider goes through its own guard.

Before any text leaves the browser, the system automatically hides the Brazilian taxpayer number (the CPF), the e-mail address and the phone number. A neutral label takes the data's place, such as [CPF_1], [EMAIL_1] or [TEL_1]. If the same piece of data appears twice in one message, it gets the same label, so the assistant still understands who is being discussed without ever seeing the real data.

The filter's rule is deliberately asymmetric: when in doubt, it protects. Only an explicit off command turns the filter off; if the setting is missing, empty, unreadable or fails to load, protection stays on. An error never lets personal data leave unfiltered.

And there is the final lock: a master off switch that shuts the artificial intelligence assistant down entirely, with no need to release a new version of the system. With it engaged, the panel opens by no path at all and no text leaves the building.

Together, the two guarantees state what artificial intelligence does and does not do inside the ECBYTS Seal: it assists the analysis, under a personal-data filter and with immediate shutdown available, and it never signs in a person's place. Acceptance remains with the technical manager and their filed signature, the independent auditor and the legal manager.

What the seal does not solve

Honesty about limits, because it is easy to promise too much here. There are three groups.

What the seal does not do, by definition:

• It does not attest compliance with the law, and it does not replace the environmental agency's opinion or the technical report.
• It is not an accounting provision and does not serve as an environmental claim to end consumers.
• The ECBT % basis can still vary between different models, so the seal is not for ranking or for comparing companies.

What it does not do yet in this version:

• The server checks the yardstick, the responsible parties and the documents, and it publishes the recomputed math. That recompute runs in shadow mode: it audits and records whether the server's math matches the math recorded at issuance, but it does not block publication yet and does not alter the seal's public verification result. The figures the public checks today are still those computed in the publisher's browser.

What is still being calibrated:

• Parity between the engine that runs in the seal and the engine that runs on the server is still being measured in the field. Until it is stable, shadow mode accumulates evidence instead of halting publication.

What the seal delivers is more modest and more useful than it sounds: a record anyone can check, stating who reviewed, under which yardstick and on which data version — and showing what is still uncovered.

Conclusion

In a world flooded with machine-made text, maps and models, the scarcest asset is not one more report. Generation became cheap merchandise: any assistant delivers thirty plausible pages before coffee.

The scarce and expensive asset is proving who reviewed, under which yardstick, and who takes responsibility for each decision. That is what an environmental agency will ask. That is what a judge will ask. That is what a board of directors will ask. And it is the one question no program answers on its own.

The ECBYTS Seal exists so that this answer travels attached to the result itself, instead of depending on the memory of whoever was in the room.

Take the guided tour of the ECBYTS Seal

If you work in investigation, remediation or licensing: in your last report, could you say what percentage of the conclusions had a qualified human behind them?