| # Regulatory β Ξ-Axis Mapping Reference |
| ## Doctrine v6 Β· R3 Vertical Governance Receipts |
|
|
| > **Purpose**: Comprehensive cross-reference of all 10 Doctrine v6 Ξ-axes to their primary regulatory grounding across the 10 vertical policy domains. Each axis lists 3β5 representative regulations with precise citations. Weight annotation (β
= high, β = medium, Β· = advisory). |
|
|
| --- |
|
|
| ## Doctrine v6 Ξ-Axis Definitions |
|
|
| | ID | Axis | Description | |
| |-----|----------------|------------------------------------------------------------------------| |
| | Ξ1 | Transparency | Obligations to disclose AI system capabilities, limitations, and logic | |
| | Ξ2 | Accountability | Assignment of legal and operational responsibility for AI decisions | |
| | Ξ3 | Privacy | Protection of personal and sensitive data processed by AI systems | |
| | Ξ4 | Fairness | Non-discrimination, equity, and representative coverage requirements | |
| | Ξ5 | Safety | Prevention of physical, operational, and systemic harm | |
| | Ξ6 | Security | Protection against unauthorized access, adversarial manipulation | |
| | Ξ7 | Auditability | Tamper-evident logging and verifiable record-keeping | |
| | Ξ8 | Robustness | Resistance to distribution shift, adversarial perturbation, failure | |
| | Ξ9 | Explainability | Human-interpretable rationale for AI outputs | |
| | Ξ10 | Sovereignty | Jurisdictional control over data and AI system deployment | |
|
|
| --- |
|
|
| ## Ξ1 β Transparency |
|
|
| **Core Obligation**: AI systems must disclose their nature, capabilities, limitations, and decision logic to affected parties and regulators. |
|
|
| | Regulation | Citation | Vertical | Weight | Mechanism | |
| |-----------|----------|----------|--------|-----------| |
| | EU AI Act Art. 13 β Transparency for deployers | Regulation (EU) 2024/1689 Art. 13 | LegalTech, Pharma | β
mandatory | Instructions-for-use document; capabilities/limitations disclosure; IFU hash in receipt | |
| | GDPR Art. 5(1)(a) β Lawfulness and transparency | Regulation (EU) 2016/679 Art. 5(1)(a) | LegalTech, Academic | β
mandatory | Privacy notice; algorithmic transparency statement; processing basis disclosure | |
| | SOX Β§ 404 β Internal controls transparency | Pub. L. 107-204 Β§ 404; 17 CFR Β§ 240.13a-15(f) | Financial | β
mandatory | ICFR documentation; AI model control evidence in Merkle DAG | |
| | DO-178C Β§ 5.5 β Traceability | RTCA DO-178C Β§ 5.5; SAE ARP4754B Β§ 5.2 | Aviation | β
mandatory | Requirements-to-code traceability matrix; receipt annotation | |
| | NIST SP 800-171 Rev 3 Β§ 3.12.4 β System Security Plans | NIST SP 800-171 Rev 3 Control 3.12.4 | Defense | β mandatory | AI system security plan; architecture and provenance documentation | |
|
|
| **Ξ1 Receipt Requirements**: Receipt chain entry must include `disclosure_hash` (SHA3-256 of disclosure document), `disclosure_type` enum, and `target_audience` field. |
|
|
| --- |
|
|
| ## Ξ2 β Accountability |
|
|
| **Core Obligation**: Named human or institutional principals must be legally responsible for AI system decisions; accountability must be traceable through the receipt chain. |
|
|
| | Regulation | Citation | Vertical | Weight | Mechanism | |
| |-----------|----------|----------|--------|-----------| |
| | SOX Β§ 302 β CEO/CFO certification | Pub. L. 107-204 Β§ 302; 17 CFR Β§ 240.13a-15 | Financial | β
mandatory | Named signatory in receipt chain root; qualified electronic signature | |
| | COPE AI Authorship (2023) β Disclosure of AI use | COPE Position Statement (2023) | Academic | β
mandatory | AI system version + inference timestamp in authorship disclosure receipt | |
| | eIDAS 2.0 Art. 25 β QES legal equivalence | Regulation (EU) 2024/1183 Art. 25 | LegalTech | β
mandatory | QES via EUDIW; certificate hash in receipt leaf node | |
| | 21 CFR Β§ 11.50 β Electronic signature manifestations | 21 C.F.R. Β§ 11.50 | Pharma | β
mandatory | Name, date/time, and signature meaning in receipt metadata | |
| | SAE J3016 Level 4 ADS accountability | SAE J3016_202104 Β§ 3.14 | Automotive | β
mandatory | ADS as accountable entity; scene hash + fallback state in decision receipt | |
| |
| **Ξ2 Receipt Requirements**: Receipt must carry `principal_id` (DID or X.509 distinguished name), `role` (operator/provider/deployer), `signature_algorithm`, and `delegation_chain` if accountability is delegated. |
|
|
| --- |
|
|
| ## Ξ3 β Privacy |
|
|
| **Core Obligation**: Personal and sensitive data processed by AI systems must be subject to purpose limitation, data minimisation, consent, and access controls. |
|
|
| | Regulation | Citation | Vertical | Weight | Mechanism | |
| |-----------|----------|----------|--------|-----------| |
| | HIPAA 45 CFR Β§ 164.502 β PHI use and disclosure | 45 C.F.R. Β§ 164.502(a) | Healthcare | β
mandatory | Minimum-necessary gating on AI inference; purpose-limited receipt | |
| | HIPAA 45 CFR Β§ 164.514(b) β De-identification | 45 C.F.R. Β§ 164.514(b) | Healthcare | β
mandatory | Expert Determination or Safe Harbor; re-ID risk β€ 0.05 | |
| | GDPR Art. 5 β Data protection principles | Regulation (EU) 2016/679 Art. 5(1)(c)(e) | LegalTech | β
mandatory | Data minimisation; storage limitation; processing basis receipt | |
| | Common Rule 45 CFR Β§ 46.111(a)(7) β Privacy safeguards | 45 C.F.R. Β§ 46.111(a)(7) | Academic | β
mandatory | k-anonymity kβ₯5 or DP Ξ΅β€1.0; privacy parameter receipt per dataset epoch | |
| | ISO TR 4804:2020 β In-vehicle telemetry GDPR compliance | ISO TR 4804:2020 Β§ 6.3 | Automotive | β mandatory | Consent-receipted trip data; pseudonymisation before ML training | |
|
|
| **Ξ3 Receipt Requirements**: Receipt must include `lawful_basis` (Art. 6 / Art. 9 basis or HIPAA exception), `data_category`, `retention_limit_days`, and `de_id_method` where applicable. |
|
|
| --- |
|
|
| ## Ξ4 β Fairness |
|
|
| **Core Obligation**: AI systems must not discriminate against protected groups; training data and model outputs must demonstrate representative and equitable coverage. |
|
|
| | Regulation | Citation | Vertical | Weight | Mechanism | |
| |-----------|----------|----------|--------|-----------| |
| | ECOA/FCRA Adverse Action β Credit decisions | 15 U.S.C. Β§ 1681m; 12 CFR Β§ 202.9 | Financial | β
mandatory | Machine-readable reason codes; CFPB guidance on AI credit models | |
| | Common Rule 45 CFR Β§ 46.111 β Equitable subject selection | 45 C.F.R. Β§ 46.111(a)(3) | Academic | β
mandatory | Demographic stratification; IRB equity review; receipt with demographic hash | |
| | EU AI Act Art. 53 β GPAI fairness for research | Regulation (EU) 2024/1689 Art. 53 | Academic, LegalTech | β mandatory | Training data summary; evaluation results published; EU AI Act database | |
| | ISO 21448:2022 Β§ 8 β SOTIF triggering conditions (pedestrian bias) | ISO 21448:2022 Β§ 8 | Automotive | Β· recommended | Pedestrian detection equity across skin tone/age; bias receipts | |
| | DOE AI Strategy 2024 Β§ 3.2 β Energy equity | U.S. DOE AI Strategy (2024) Β§ 3.2 | Energy | Β· recommended | Demand response equity; census-tract metadata in receipt | |
|
|
| **Ξ4 Receipt Requirements**: Receipt must include `fairness_metric` (e.g., demographic_parity, equalized_odds), `protected_attributes` list, `metric_value` (float), and `test_dataset_hash`. |
|
|
| --- |
|
|
| ## Ξ5 β Safety |
|
|
| **Core Obligation**: AI systems must identify, assess, and mitigate risks of physical, operational, or systemic harm to humans or critical infrastructure. |
|
|
| | Regulation | Citation | Vertical | Weight | Mechanism | |
| |-----------|----------|----------|--------|-----------| |
| | ISO 26262-4:2018 Β§ 7 β Technical safety requirements | ISO 26262-4:2018 Β§ 7; ISO 26262-3:2018 Β§ 7 | Automotive | β
mandatory | ASIL-D safety goals; probability of failure < 10^-8/h; safety case receipt | |
| | DO-178C Β§ 6.4 / DO-333 β Structural coverage (MC/DC) | RTCA DO-178C Β§ 6.4; RTCA DO-333 Β§ FM.6.4 | Aviation | β
mandatory | MC/DC coverage for DAL-B; formal method proofs; coverage receipt | |
| | E.O. 14110 Β§ 4.2 β National security AI safety | E.O. 14110 Β§ 4.2 (Oct 2023) | Defense | β
mandatory | Human-on-the-loop kill switch; HotL token in autonomous decision receipt | |
| | NERC CIP-009-6 R1 β BES recovery plans | NERC CIP-009-6 Requirement R1 | Energy | β
mandatory | AI-assisted restoration with human override; operator confirmation token | |
| | HITECH Act Β§ 13402 / 45 CFR Β§ 164.400 β Breach notification | Pub. L. 111-5 Β§ 13402 | Healthcare | β mandatory | AI re-identification anomaly detection; 60-day notification trigger | |
|
|
| **Ξ5 Receipt Requirements**: Receipt must include `hazard_id`, `safety_integrity_level` (ASIL/DAL), `risk_reduction_factor`, and `verification_method` (testing/formal_proof/analysis). |
| |
| --- |
| |
| ## Ξ6 β Security |
| |
| **Core Obligation**: AI systems and their data must be protected against unauthorized access, adversarial manipulation, supply-chain compromise, and cyber incidents. |
| |
| | Regulation | Citation | Vertical | Weight | Mechanism | |
| |-----------|----------|----------|--------|-----------| |
| | HIPAA 45 CFR Β§ 164.312(a)(2)(i) β Unique user ID | 45 C.F.R. Β§ 164.312(a)(2)(i) | Healthcare | β
mandatory | Cryptographically bound identity token in receipt chain per PHI access | |
| | NERC CIP-007-6 R4 β Security event monitoring | NERC CIP-007-6 Requirement R4; 18 CFR Β§ 40.7 | Energy | β
mandatory | Anomaly detection receipts within 15 min; Merkle DAG integrity | |
| | DFARS 252.204-7012 β Covered defense information | DFARS 252.204-7012(b); 48 CFR Β§ 252.204-7012 | Defense | β
mandatory | 72-hour incident reporting; AI IOC hash receipt within 1 hour | |
| | UNECE R 155 β Automotive CSMS | UNECE Regulation No. 155 (2021) | Automotive | β
mandatory | TARA for AI attack surfaces; threat analysis security receipt | |
| | 21 CFR Β§ 11.10(e) β Secure audit trails | 21 C.F.R. Β§ 11.10(e) | Pharma | β
mandatory | Tamper-evident TAI64N-timestamped Merkle DAG | |
| |
| **Ξ6 Receipt Requirements**: Receipt must include `threat_model_version`, `authentication_method` (FIDO2/PIV/password), `encryption_algorithm`, `key_rotation_epoch`, and `incident_id` if triggered. |
|
|
| --- |
|
|
| ## Ξ7 β Auditability |
|
|
| **Core Obligation**: AI systems must maintain tamper-evident, time-stamped logs of all significant events; records must be verifiable by external auditors and regulators. |
|
|
| | Regulation | Citation | Vertical | Weight | Mechanism | |
| |-----------|----------|----------|--------|-----------| |
| | HIPAA 45 CFR Β§ 164.312(b) β Audit controls | 45 C.F.R. Β§ 164.312(b) | Healthcare | β
mandatory | Merkle DAG; p50 write β€ 5 Β΅s per Doctrine v6 Β§4.7 | |
| | SOX Β§ 802 / 18 USC Β§ 1519 β Document integrity | Pub. L. 107-204 Β§ 802; 18 U.S.C. Β§ 1519 | Financial | β
mandatory | Append-only SHA3-256 Merkle DAG; cryptographic non-alteration proof | |
| | NERC CIP-010-4 R1 β Configuration change management | NERC CIP-010-4 Requirement R1 | Energy | β
mandatory | Pre/post-update configuration diff receipts | |
| | DO-178C Β§ 12.3 / Table A-10 β Configuration management | RTCA DO-178C Β§ 12.3 | Aviation | β
mandatory | DER-signed change-control receipts; configuration baseline | |
| | 21 CFR Β§ 11.10(e) β Time-stamped audit trails | 21 C.F.R. Β§ 11.10(e) | Pharma | β
mandatory | GAMP 5 Category 5 validation; audit trail per user/system action | |
|
|
| **Ξ7 Receipt Requirements**: Receipt must include `event_type`, `actor_id`, `timestamp_tai64n`, `prev_receipt_hash` (chain link), `merkle_root`, and `quorum_signatures` array. |
|
|
| --- |
|
|
| ## Ξ8 β Robustness |
|
|
| **Core Obligation**: AI systems must withstand distribution shift, adversarial perturbation, hardware faults, and operational stress without unsafe degradation. |
|
|
| | Regulation | Citation | Vertical | Weight | Mechanism | |
| |-----------|----------|----------|--------|-----------| |
| | SR 11-7 β Model validation and ongoing monitoring | Federal Reserve SR 11-7 Β§ III.CβD | Financial | β
mandatory | Independent adversarial robustness testing; validation epoch in receipt | |
| | DO-178C Β§ 6.4 / DO-333 FM.6.3.2 β Formal proof completeness | RTCA DO-178C Β§ 6.4; RTCA DO-333 Β§ FM.6.3.2 | Aviation | β
mandatory | Lipschitz bounds; formal proof receipts for inference guarantees | |
| | 21 CFR Β§ 11.10(a) β GxP system validation | 21 C.F.R. Β§ 11.10(a) | Pharma | β
mandatory | ISPE GAMP 5 Category 5; validation protocol hash in receipt | |
| | NERC CIP-013-2 R1 β Supply chain risk | NERC CIP-013-2 Requirement R1 | Energy | β
mandatory | AI model SBOM receipts; provenance verification before BES deployment | |
| | CMMC L3 / NIST 800-171 Β§ 3.11.2 β Vulnerability scanning | NIST SP 800-171 Rev 3 Control 3.11.2 | Defense | β
mandatory | Quarterly adversarial robustness scans; scan result commitment receipts | |
|
|
| **Ξ8 Receipt Requirements**: Receipt must include `robustness_metric` (e.g., PGD_Ξ΅, Lipschitz_bound), `test_methodology`, `dataset_hash`, `pass_threshold`, and `result` (pass/fail/conditional). |
|
|
| --- |
|
|
| ## Ξ9 β Explainability |
|
|
| **Core Obligation**: AI outputs affecting human interests must be accompanied by interpretable, human-understandable explanations at a level of detail proportionate to the decision stakes. |
|
|
| | Regulation | Citation | Vertical | Weight | Mechanism | |
| |-----------|----------|----------|--------|-----------| |
| | GDPR Art. 22 / EDPB Guidelines 1/2022 β Automated decision-making | Regulation (EU) 2016/679 Art. 22 | LegalTech | β
mandatory | Meaningful explanation per EDPB Β§ 58; logic + significance + envisaged consequences | |
| | ECOA / FCRA 15 USC Β§ 1681m β Adverse action notices | 15 U.S.C. Β§ 1681m(a); 12 C.F.R. Β§ 202.9 | Financial | β
mandatory | Principal reason codes; CFPB AI explanation guidance; reason-code receipt | |
| | EU AI Act Art. 13 β Transparency for deployers | Regulation (EU) 2024/1689 Art. 13 | All high-risk | β
mandatory | IFU with interpretability method; explanation receipt per inference | |
| | ISO 26262-6:2018 Β§ 9 β ML explainability for ASIL-B+ | ISO 26262-6:2018 Β§ 9; ISO TR 29119-11 | Automotive | β
mandatory | Saliency maps or decision trees as explanation receipts | |
| | EASA CP No. 2 (2023) β ML explanation for aviation | EASA Concept Paper on ML (Oct 2023) | Aviation | β
mandatory | Level 1/2 ML explanation; operational scenario coverage documented | |
|
|
| **Ξ9 Receipt Requirements**: Receipt must include `explanation_method` (SHAP/LIME/IntGrad/decision_tree), `explanation_hash`, `target_audience` (regulator/operator/subject), and `fidelity_score` (float in [0,1]). |
|
|
| --- |
|
|
| ## Ξ10 β Sovereignty |
|
|
| **Core Obligation**: Data and AI system deployment must respect jurisdictional boundaries; data subjects and nation-states retain control over cross-border data flows. |
|
|
| | Regulation | Citation | Vertical | Weight | Mechanism | |
| |-----------|----------|----------|--------|-----------| |
| | GDPR Art. 44β49 β International transfers | Regulation (EU) 2016/679 Art. 44β49 (SCCs, BCRs, adequacy) | LegalTech | β
mandatory | Transfer mechanism documented in receipt; SCCs/BCR reference | |
| | DFARS 252.204-7012 β CUI jurisdictional control | DFARS 252.204-7012; 48 CFR Β§ 252.204-7012 | Defense | β
mandatory | CUI enclave attestation; jurisdiction token in receipt chain | |
| | ISPS Code Part A Β§ 9.4 β SSP flag-state jurisdiction | ISPS Code Part A Β§ 9.4 | Maritime | β
mandatory | Data residency receipt specifying IMO flag-state; SSP access log | |
| | Dodd-Frank Β§ 1033 / CFPB Rule 1033 β Consumer data portability | Pub. L. 111-203 Β§ 1033; 12 CFR Β§ 1033.201 | Financial | β
mandatory | Consumer-authorized scope token in export receipt | |
| | eIDAS 2.0 Art. 3 β European Digital Identity Wallet sovereignty | Regulation (EU) 2024/1183 Art. 3 | LegalTech | β
mandatory | EUDIW-bound QES; wallet jurisdiction assertion in receipt | |
|
|
| **Ξ10 Receipt Requirements**: Receipt must include `jurisdiction_code` (ISO 3166-1 alpha-2), `transfer_mechanism` (adequacy/SCC/BCR/none), `data_residency_region`, and `sovereignty_assertion_hash`. |
|
|
| --- |
|
|
| ## Cross-Vertical Coverage Matrix |
|
|
| | Vertical | Ξ1 | Ξ2 | Ξ3 | Ξ4 | Ξ5 | Ξ6 | Ξ7 | Ξ8 | Ξ9 | Ξ10 | Count | |
| |-----------------|----|----|----|----|----|----|----|----|----|----|-------| |
| | Healthcare | β | β
| β
| Β· | β | β
| β
| β | Β· | β | 9 | |
| | Financial | β
| β
| β | β
| β | β
| β
| β
| β
| β
| 10 | |
| | Defense | β
| β
| β | β | β
| β
| β
| β
| Β· | β
| 9 | |
| | Aviation | β
| β
| β | Β· | β
| β | β
| β
| β
| Β· | 8 | |
| | Automotive | β
| β
| β | β | β
| β
| β
| β
| β
| β
| 10 | |
| | Pharmaceutical | β
| β
| β | β
| β
| β
| β
| β
| β
| β
| 10 | |
| | Energy | β | β
| Β· | Β· | β
| β
| β
| β
| Β· | β
| 8 | |
| | Maritime | β | β
| β | Β· | β
| β
| β
| β
| β
| β
| 9 | |
| | LegalTech | β
| β
| β
| β
| β | β
| β
| β
| β
| β
| 10 | |
| | Academic | β
| β
| β
| β
| β | β | β
| Β· | β | β | 8 | |
| | **Axis total** | 9 | 10 | 8 | 8 | 9 | 10 | 10 | 9 | 8 | 9 | | |
|
|
| β
= mandatory, β = recommended, Β· = advisory, β = not applicable |
|
|
| --- |
|
|
| *Generated: Doctrine v6 R3 Adversarial Receipts Β· Receipt chain: SHA3-256 Merkle DAG* |
|
|
