摘要：基于用途的 AI 监管根据部署风险分配责任，但缺乏承载这些责任的证据客体。基准测试得分是模型自身的属性；而系统部署的合规性（conformance）则是在所声明的上下文分布下的故障率，受到特定范围的约束并具有时效期限。我们沿用早期研究中的委托契约（冻结配置、有界声明、可执行修订规则），深入分析了其在部署方、审计方与执法点三方策略博弈下的表现。我们探讨了以下核心问题：声明的上下文混合是否可以做到真实披露；针对能够检测评估流量的系统，审计能否保持无偏；认证错误预算是否能够支持长期部署；聚合审计能否支持针对各子群体的特定保证；以及仅统计系统故障而不计入降级回退成本的事件指标，是否能正确对各项处置方案进行排序。针对每个问题，我们均提出了一种机制并给出了相应命题：对声明混合引入严格评分惩罚（proper-scoring penalty），可在惩罚权重下将采取最佳响应的部署方的超额故障率限制在 $O(\lambda^{-1/2})$ 范围内；从实时流量中抽样的“提交-揭示”（commit-reveal）审计在设计上天然无偏，并能使用同一样本对评估者进行评分；减半错误预算会使认证覆盖率降至 $(1-p)^n$ 以下，而 $\alpha$-投资（$\alpha$-investing）机制则能在边际错误认证保证下维持该覆盖率；针对每个子群体的保障，其所需的审计规模与子群体占比呈 $1/m$ 比例缩放；任何仅统计故障的事件指标在任何回退成本下都会倾向于选择直接撤回停机，即使按总损失衡量时各方案的优劣排序完全相反。我们通过五个预注册的合成数据实验对上述命题进行了检验；研究未评估任何语言模型或生产系统。执法切入点位于分发、能力访问、商业变现与风险转移等关键卡点，合规记录的到期失效构成了一种注意义务标准（standard of care），而这种“合规即故障率分布”的构想与欧盟《人工智能法案》（EU AI Act）的静态合规评估形成了鲜明对比。

Abstract:Use-based AI regulation assigns obligations by deployment risk but lacks an evidentiary object to carry them. A benchmark score is a property of a model; conformance of a deployment is a failure rate under a declared distribution of contexts, bounded by a scope and subject to expiry. We take the delegation contract of earlier work (frozen configuration, scoped claim, executable revision rule) and study it under strategic play between a deployer, an auditor, and an enforcement point. We ask whether a declared context mixture can be made truthful; whether an audit can be unbiased against a system that detects evaluation traffic; whether a certification error budget can sustain a long-lived deployment; whether an aggregate audit can support a per-subgroup guarantee; and whether an incident metric that counts system failures but not fallback costs ranks arrangements correctly. For each we give a mechanism and a proposition: a proper-scoring penalty on the declared mixture bounds the excess failure of a best-responding deployer by $O(\lambda^{-1/2})$ in the penalty weight; a commit-reveal audit drawn from live traffic is unbiased by construction and grades the evaluator with the same sample; a halving error budget drives certification coverage below $(1-p)^n$ while $\alpha$-investing sustains it under a marginal false-certification guarantee; a per-subgroup guarantee costs audit size scaling as $1/m$ in subgroup mass; and any failure-only incident metric prefers withdrawal at every fallback cost, even when total loss ranks the arrangements oppositely. Five preregistered synthetic studies test each claim; no language model or production system is evaluated. Enforcement sits at distribution, capability-access, monetization and risk-transfer choke points, expiry of the conformance record is a standard of care, and conformance-as-a-rate is set against the EU AI Act's static conformity assessment.