ITKIT
Artificial intelligence · 20 / 20
ITKIT Anomaly Detection
Explainable anomaly detection for customs and beyond
From the problem to how we solve it
October 2026
Interactive prototype · synthetic data only
The problem
Which one matters?
1
Under-valuation and origin fraud hide among thousands of clean declarations.
2
Black-box scores cannot be explained to an officer or a court.
3
Thresholds are changed without testing them on past data.
Thousands a day · A few stand out · Scores that explain
ITKIT · ITKIT Anomaly Detection · Prototype screens, synthetic data
The problem
Our answer
Designed to align with the NIST AI RMF and ISO/IEC 42001
A detection engine that scores declarations, cash movements and transactions and shows the factors behind every score. It works with Customs and with any ITKIT or third-party system through ITKIT ESP and Kafka, and it never acts on its own.
How it works · 1 of 6
Explainable
Score 82 · here is why
Each score shows the factors that raised it, point by point.
ITKIT · ITKIT Anomaly Detection · Prototype screens, synthetic data
How it works
How it works · 2 of 6
Limits
What it never uses
It also says what it never uses, and what it cannot see.
ITKIT · ITKIT Anomaly Detection · Prototype screens, synthetic data
How it works
How it works · 3 of 6
Human decision
The score advises. You decide.
An analyst decides, with a reason. Nothing is held or referred automatically.
ITKIT · ITKIT Anomaly Detection · Prototype screens, synthetic data
How it works
How it works · 4 of 6
Model governance
Governed and monitored
Every model has a card, an owner and a review date, and is monitored against analyst decisions.
ITKIT · ITKIT Anomaly Detection · Prototype screens, synthetic data
How it works
How it works · 5 of 6
Thresholds
Thresholds belong to the authority
Thresholds are set by the authority, back-tested and approved by a second person.
ITKIT · ITKIT Anomaly Detection · Prototype screens, synthetic data
How it works
How it works · 6 of 6
Connectors
Plugs into other systems
Other systems connect through the event bus or the API, each with a purpose and a contract.
ITKIT · ITKIT Anomaly Detection · Prototype screens, synthetic data
How it works
What it includes
3 screens and workflows in the prototype
Explained risk alert
Fraud and risk analysts
Shows why a cash declaration scored high, factor by factor, with the model’s limits, and records the analyst’s decision and reason.
Models & monitoring
Risk governance leads and model owners
Lists every detector, shows each model card, monitors alerts against analyst decisions and back-tests a review line before a change is proposed.
Connectors & score API
Integration owners and risk governance leads
Connects other systems so they can send events and receive explainable scores, each connection with a purpose, a data contract and an owner.
ITKIT · ITKIT Anomaly Detection · Prototype screens, synthetic data
What it includes
Built to standards
International standards it is built to
| Standard | What it covers in ITKIT Anomaly Detection |
|---|---|
| NIST AI RMF 1.0 (explainable and interpretable) | Every score explained |
| NIST AI RMF 1.0 (accountable and transparent) | Model cards and owners |
| NIST AI RMF 1.0 (Measure function) | Monitoring outcomes and drift |
| NIST AI RMF 1.0 (valid and reliable) | Back-testing before change |
| NIST AI RMF 1.0 (fair, harmful bias managed) | Protected attributes excluded |
| ISO/IEC 42001:2023 (AI management system) | Approval and review cycle |
| WCO Customs Risk Management Compendium | Risk analysis that supports officers |
| WTO TFA Art. 7.4 (Risk management) | Selectivity, not automatic action |
We align with these standards; certification is issued by accredited bodies, not by ITKIT.
ITKIT · ITKIT Anomaly Detection · Prototype screens, synthetic data
Built to standards
Connects to
What ITKIT Anomaly Detection works with
Customs HQ and Port Operations
Customs Bank Verify (answers as signals)
Customs Admin (threshold settings)
Any ITKIT product through ITKIT ESP / Kafka
Third-party systems through ESP adapters
ITKIT · ITKIT Anomaly Detection · Prototype screens, synthetic data
Connects to
Safeguards
What ITKIT Anomaly Detection will never do
Scores advise.
The engine never holds, seizes, blocks or refers anything; an analyst or officer decides and records why.
Thresholds belong to the authority, not to ITKIT.
ITKIT · ITKIT Anomaly Detection · Prototype screens, synthetic data
Safeguards
How delivery works
Start small, prove it, then scale and hand over
6–10 weeks
Assess
Map what already exists and decide, system by system: reuse, integrate, modernise or build.
4–6 months
Pilot
ITKIT Anomaly Detection at one authority, with real users and a measured outcome, on national infrastructure.
12–24 months
Scale
Roll out by region and service, sharing identity, integration and audit.
Agreed per contract
Operate and transfer
We run it with your team, train them, then hand over operations, code escrow and keys.
Durations are typical ranges, fixed per contract
ITKIT · ITKIT Anomaly Detection · Prototype screens, synthetic data
Delivery
Next step
Ask for an Anomaly Detection demo on your own synthetic data.
ITKIT Anomaly Detection. Systems advise. People decide.
1 · Demo
A guided session on the ITKIT Anomaly Detection prototype
2 · Assess
6–10 weeks to map what exists and fix the pilot scope
3 · Pilot
4–6 months with real users and a measured result
ITKIT · [contact name, email and phone]
Thank you