Spaces:
Running
Running
| # Regulatory → Λ-Axis Mapping Reference | |
| ## Doctrine v6 · R3 Vertical Governance Receipts | |
| > **Purpose**: Comprehensive cross-reference of all 10 Doctrine v6 Λ-axes to their primary regulatory grounding across the 10 vertical policy domains. Each axis lists 3–5 representative regulations with precise citations. Weight annotation (★ = high, ○ = medium, · = advisory). | |
| --- | |
| ## Doctrine v6 Λ-Axis Definitions | |
| | ID | Axis | Description | | |
| |-----|----------------|------------------------------------------------------------------------| | |
| | Λ1 | Transparency | Obligations to disclose AI system capabilities, limitations, and logic | | |
| | Λ2 | Accountability | Assignment of legal and operational responsibility for AI decisions | | |
| | Λ3 | Privacy | Protection of personal and sensitive data processed by AI systems | | |
| | Λ4 | Fairness | Non-discrimination, equity, and representative coverage requirements | | |
| | Λ5 | Safety | Prevention of physical, operational, and systemic harm | | |
| | Λ6 | Security | Protection against unauthorized access, adversarial manipulation | | |
| | Λ7 | Auditability | Tamper-evident logging and verifiable record-keeping | | |
| | Λ8 | Robustness | Resistance to distribution shift, adversarial perturbation, failure | | |
| | Λ9 | Explainability | Human-interpretable rationale for AI outputs | | |
| | Λ10 | Sovereignty | Jurisdictional control over data and AI system deployment | | |
| --- | |
| ## Λ1 — Transparency | |
| **Core Obligation**: AI systems must disclose their nature, capabilities, limitations, and decision logic to affected parties and regulators. | |
| | Regulation | Citation | Vertical | Weight | Mechanism | | |
| |-----------|----------|----------|--------|-----------| | |
| | EU AI Act Art. 13 — Transparency for deployers | Regulation (EU) 2024/1689 Art. 13 | LegalTech, Pharma | ★ mandatory | Instructions-for-use document; capabilities/limitations disclosure; IFU hash in receipt | | |
| | GDPR Art. 5(1)(a) — Lawfulness and transparency | Regulation (EU) 2016/679 Art. 5(1)(a) | LegalTech, Academic | ★ mandatory | Privacy notice; algorithmic transparency statement; processing basis disclosure | | |
| | SOX § 404 — Internal controls transparency | Pub. L. 107-204 § 404; 17 CFR § 240.13a-15(f) | Financial | ★ mandatory | ICFR documentation; AI model control evidence in Merkle DAG | | |
| | DO-178C § 5.5 — Traceability | RTCA DO-178C § 5.5; SAE ARP4754B § 5.2 | Aviation | ★ mandatory | Requirements-to-code traceability matrix; receipt annotation | | |
| | NIST SP 800-171 Rev 3 § 3.12.4 — System Security Plans | NIST SP 800-171 Rev 3 Control 3.12.4 | Defense | ○ mandatory | AI system security plan; architecture and provenance documentation | | |
| **Λ1 Receipt Requirements**: Receipt chain entry must include `disclosure_hash` (SHA3-256 of disclosure document), `disclosure_type` enum, and `target_audience` field. | |
| --- | |
| ## Λ2 — Accountability | |
| **Core Obligation**: Named human or institutional principals must be legally responsible for AI system decisions; accountability must be traceable through the receipt chain. | |
| | Regulation | Citation | Vertical | Weight | Mechanism | | |
| |-----------|----------|----------|--------|-----------| | |
| | SOX § 302 — CEO/CFO certification | Pub. L. 107-204 § 302; 17 CFR § 240.13a-15 | Financial | ★ mandatory | Named signatory in receipt chain root; qualified electronic signature | | |
| | COPE AI Authorship (2023) — Disclosure of AI use | COPE Position Statement (2023) | Academic | ★ mandatory | AI system version + inference timestamp in authorship disclosure receipt | | |
| | eIDAS 2.0 Art. 25 — QES legal equivalence | Regulation (EU) 2024/1183 Art. 25 | LegalTech | ★ mandatory | QES via EUDIW; certificate hash in receipt leaf node | | |
| | 21 CFR § 11.50 — Electronic signature manifestations | 21 C.F.R. § 11.50 | Pharma | ★ mandatory | Name, date/time, and signature meaning in receipt metadata | | |
| | SAE J3016 Level 4 ADS accountability | SAE J3016_202104 § 3.14 | Automotive | ★ mandatory | ADS as accountable entity; scene hash + fallback state in decision receipt | | |
| **Λ2 Receipt Requirements**: Receipt must carry `principal_id` (DID or X.509 distinguished name), `role` (operator/provider/deployer), `signature_algorithm`, and `delegation_chain` if accountability is delegated. | |
| --- | |
| ## Λ3 — Privacy | |
| **Core Obligation**: Personal and sensitive data processed by AI systems must be subject to purpose limitation, data minimisation, consent, and access controls. | |
| | Regulation | Citation | Vertical | Weight | Mechanism | | |
| |-----------|----------|----------|--------|-----------| | |
| | HIPAA 45 CFR § 164.502 — PHI use and disclosure | 45 C.F.R. § 164.502(a) | Healthcare | ★ mandatory | Minimum-necessary gating on AI inference; purpose-limited receipt | | |
| | HIPAA 45 CFR § 164.514(b) — De-identification | 45 C.F.R. § 164.514(b) | Healthcare | ★ mandatory | Expert Determination or Safe Harbor; re-ID risk ≤ 0.05 | | |
| | GDPR Art. 5 — Data protection principles | Regulation (EU) 2016/679 Art. 5(1)(c)(e) | LegalTech | ★ mandatory | Data minimisation; storage limitation; processing basis receipt | | |
| | Common Rule 45 CFR § 46.111(a)(7) — Privacy safeguards | 45 C.F.R. § 46.111(a)(7) | Academic | ★ mandatory | k-anonymity k≥5 or DP ε≤1.0; privacy parameter receipt per dataset epoch | | |
| | ISO TR 4804:2020 — In-vehicle telemetry GDPR compliance | ISO TR 4804:2020 § 6.3 | Automotive | ○ mandatory | Consent-receipted trip data; pseudonymisation before ML training | | |
| **Λ3 Receipt Requirements**: Receipt must include `lawful_basis` (Art. 6 / Art. 9 basis or HIPAA exception), `data_category`, `retention_limit_days`, and `de_id_method` where applicable. | |
| --- | |
| ## Λ4 — Fairness | |
| **Core Obligation**: AI systems must not discriminate against protected groups; training data and model outputs must demonstrate representative and equitable coverage. | |
| | Regulation | Citation | Vertical | Weight | Mechanism | | |
| |-----------|----------|----------|--------|-----------| | |
| | ECOA/FCRA Adverse Action — Credit decisions | 15 U.S.C. § 1681m; 12 CFR § 202.9 | Financial | ★ mandatory | Machine-readable reason codes; CFPB guidance on AI credit models | | |
| | Common Rule 45 CFR § 46.111 — Equitable subject selection | 45 C.F.R. § 46.111(a)(3) | Academic | ★ mandatory | Demographic stratification; IRB equity review; receipt with demographic hash | | |
| | EU AI Act Art. 53 — GPAI fairness for research | Regulation (EU) 2024/1689 Art. 53 | Academic, LegalTech | ○ mandatory | Training data summary; evaluation results published; EU AI Act database | | |
| | ISO 21448:2022 § 8 — SOTIF triggering conditions (pedestrian bias) | ISO 21448:2022 § 8 | Automotive | · recommended | Pedestrian detection equity across skin tone/age; bias receipts | | |
| | DOE AI Strategy 2024 § 3.2 — Energy equity | U.S. DOE AI Strategy (2024) § 3.2 | Energy | · recommended | Demand response equity; census-tract metadata in receipt | | |
| **Λ4 Receipt Requirements**: Receipt must include `fairness_metric` (e.g., demographic_parity, equalized_odds), `protected_attributes` list, `metric_value` (float), and `test_dataset_hash`. | |
| --- | |
| ## Λ5 — Safety | |
| **Core Obligation**: AI systems must identify, assess, and mitigate risks of physical, operational, or systemic harm to humans or critical infrastructure. | |
| | Regulation | Citation | Vertical | Weight | Mechanism | | |
| |-----------|----------|----------|--------|-----------| | |
| | ISO 26262-4:2018 § 7 — Technical safety requirements | ISO 26262-4:2018 § 7; ISO 26262-3:2018 § 7 | Automotive | ★ mandatory | ASIL-D safety goals; probability of failure < 10^-8/h; safety case receipt | | |
| | DO-178C § 6.4 / DO-333 — Structural coverage (MC/DC) | RTCA DO-178C § 6.4; RTCA DO-333 § FM.6.4 | Aviation | ★ mandatory | MC/DC coverage for DAL-B; formal method proofs; coverage receipt | | |
| | E.O. 14110 § 4.2 — National security AI safety | E.O. 14110 § 4.2 (Oct 2023) | Defense | ★ mandatory | Human-on-the-loop kill switch; HotL token in autonomous decision receipt | | |
| | NERC CIP-009-6 R1 — BES recovery plans | NERC CIP-009-6 Requirement R1 | Energy | ★ mandatory | AI-assisted restoration with human override; operator confirmation token | | |
| | HITECH Act § 13402 / 45 CFR § 164.400 — Breach notification | Pub. L. 111-5 § 13402 | Healthcare | ○ mandatory | AI re-identification anomaly detection; 60-day notification trigger | | |
| **Λ5 Receipt Requirements**: Receipt must include `hazard_id`, `safety_integrity_level` (ASIL/DAL), `risk_reduction_factor`, and `verification_method` (testing/formal_proof/analysis). | |
| --- | |
| ## Λ6 — Security | |
| **Core Obligation**: AI systems and their data must be protected against unauthorized access, adversarial manipulation, supply-chain compromise, and cyber incidents. | |
| | Regulation | Citation | Vertical | Weight | Mechanism | | |
| |-----------|----------|----------|--------|-----------| | |
| | HIPAA 45 CFR § 164.312(a)(2)(i) — Unique user ID | 45 C.F.R. § 164.312(a)(2)(i) | Healthcare | ★ mandatory | Cryptographically bound identity token in receipt chain per PHI access | | |
| | NERC CIP-007-6 R4 — Security event monitoring | NERC CIP-007-6 Requirement R4; 18 CFR § 40.7 | Energy | ★ mandatory | Anomaly detection receipts within 15 min; Merkle DAG integrity | | |
| | DFARS 252.204-7012 — Covered defense information | DFARS 252.204-7012(b); 48 CFR § 252.204-7012 | Defense | ★ mandatory | 72-hour incident reporting; AI IOC hash receipt within 1 hour | | |
| | UNECE R 155 — Automotive CSMS | UNECE Regulation No. 155 (2021) | Automotive | ★ mandatory | TARA for AI attack surfaces; threat analysis security receipt | | |
| | 21 CFR § 11.10(e) — Secure audit trails | 21 C.F.R. § 11.10(e) | Pharma | ★ mandatory | Tamper-evident TAI64N-timestamped Merkle DAG | | |
| **Λ6 Receipt Requirements**: Receipt must include `threat_model_version`, `authentication_method` (FIDO2/PIV/password), `encryption_algorithm`, `key_rotation_epoch`, and `incident_id` if triggered. | |
| --- | |
| ## Λ7 — Auditability | |
| **Core Obligation**: AI systems must maintain tamper-evident, time-stamped logs of all significant events; records must be verifiable by external auditors and regulators. | |
| | Regulation | Citation | Vertical | Weight | Mechanism | | |
| |-----------|----------|----------|--------|-----------| | |
| | HIPAA 45 CFR § 164.312(b) — Audit controls | 45 C.F.R. § 164.312(b) | Healthcare | ★ mandatory | Merkle DAG; p50 write ≤ 5 µs per Doctrine v6 §4.7 | | |
| | SOX § 802 / 18 USC § 1519 — Document integrity | Pub. L. 107-204 § 802; 18 U.S.C. § 1519 | Financial | ★ mandatory | Append-only SHA3-256 Merkle DAG; cryptographic non-alteration proof | | |
| | NERC CIP-010-4 R1 — Configuration change management | NERC CIP-010-4 Requirement R1 | Energy | ★ mandatory | Pre/post-update configuration diff receipts | | |
| | DO-178C § 12.3 / Table A-10 — Configuration management | RTCA DO-178C § 12.3 | Aviation | ★ mandatory | DER-signed change-control receipts; configuration baseline | | |
| | 21 CFR § 11.10(e) — Time-stamped audit trails | 21 C.F.R. § 11.10(e) | Pharma | ★ mandatory | GAMP 5 Category 5 validation; audit trail per user/system action | | |
| **Λ7 Receipt Requirements**: Receipt must include `event_type`, `actor_id`, `timestamp_tai64n`, `prev_receipt_hash` (chain link), `merkle_root`, and `quorum_signatures` array. | |
| --- | |
| ## Λ8 — Robustness | |
| **Core Obligation**: AI systems must withstand distribution shift, adversarial perturbation, hardware faults, and operational stress without unsafe degradation. | |
| | Regulation | Citation | Vertical | Weight | Mechanism | | |
| |-----------|----------|----------|--------|-----------| | |
| | SR 11-7 — Model validation and ongoing monitoring | Federal Reserve SR 11-7 § III.C–D | Financial | ★ mandatory | Independent adversarial robustness testing; validation epoch in receipt | | |
| | DO-178C § 6.4 / DO-333 FM.6.3.2 — Formal proof completeness | RTCA DO-178C § 6.4; RTCA DO-333 § FM.6.3.2 | Aviation | ★ mandatory | Lipschitz bounds; formal proof receipts for inference guarantees | | |
| | 21 CFR § 11.10(a) — GxP system validation | 21 C.F.R. § 11.10(a) | Pharma | ★ mandatory | ISPE GAMP 5 Category 5; validation protocol hash in receipt | | |
| | NERC CIP-013-2 R1 — Supply chain risk | NERC CIP-013-2 Requirement R1 | Energy | ★ mandatory | AI model SBOM receipts; provenance verification before BES deployment | | |
| | CMMC L3 / NIST 800-171 § 3.11.2 — Vulnerability scanning | NIST SP 800-171 Rev 3 Control 3.11.2 | Defense | ★ mandatory | Quarterly adversarial robustness scans; scan result commitment receipts | | |
| **Λ8 Receipt Requirements**: Receipt must include `robustness_metric` (e.g., PGD_ε, Lipschitz_bound), `test_methodology`, `dataset_hash`, `pass_threshold`, and `result` (pass/fail/conditional). | |
| --- | |
| ## Λ9 — Explainability | |
| **Core Obligation**: AI outputs affecting human interests must be accompanied by interpretable, human-understandable explanations at a level of detail proportionate to the decision stakes. | |
| | Regulation | Citation | Vertical | Weight | Mechanism | | |
| |-----------|----------|----------|--------|-----------| | |
| | GDPR Art. 22 / EDPB Guidelines 1/2022 — Automated decision-making | Regulation (EU) 2016/679 Art. 22 | LegalTech | ★ mandatory | Meaningful explanation per EDPB § 58; logic + significance + envisaged consequences | | |
| | ECOA / FCRA 15 USC § 1681m — Adverse action notices | 15 U.S.C. § 1681m(a); 12 C.F.R. § 202.9 | Financial | ★ mandatory | Principal reason codes; CFPB AI explanation guidance; reason-code receipt | | |
| | EU AI Act Art. 13 — Transparency for deployers | Regulation (EU) 2024/1689 Art. 13 | All high-risk | ★ mandatory | IFU with interpretability method; explanation receipt per inference | | |
| | ISO 26262-6:2018 § 9 — ML explainability for ASIL-B+ | ISO 26262-6:2018 § 9; ISO TR 29119-11 | Automotive | ★ mandatory | Saliency maps or decision trees as explanation receipts | | |
| | EASA CP No. 2 (2023) — ML explanation for aviation | EASA Concept Paper on ML (Oct 2023) | Aviation | ★ mandatory | Level 1/2 ML explanation; operational scenario coverage documented | | |
| **Λ9 Receipt Requirements**: Receipt must include `explanation_method` (SHAP/LIME/IntGrad/decision_tree), `explanation_hash`, `target_audience` (regulator/operator/subject), and `fidelity_score` (float in [0,1]). | |
| --- | |
| ## Λ10 — Sovereignty | |
| **Core Obligation**: Data and AI system deployment must respect jurisdictional boundaries; data subjects and nation-states retain control over cross-border data flows. | |
| | Regulation | Citation | Vertical | Weight | Mechanism | | |
| |-----------|----------|----------|--------|-----------| | |
| | GDPR Art. 44–49 — International transfers | Regulation (EU) 2016/679 Art. 44–49 (SCCs, BCRs, adequacy) | LegalTech | ★ mandatory | Transfer mechanism documented in receipt; SCCs/BCR reference | | |
| | DFARS 252.204-7012 — CUI jurisdictional control | DFARS 252.204-7012; 48 CFR § 252.204-7012 | Defense | ★ mandatory | CUI enclave attestation; jurisdiction token in receipt chain | | |
| | ISPS Code Part A § 9.4 — SSP flag-state jurisdiction | ISPS Code Part A § 9.4 | Maritime | ★ mandatory | Data residency receipt specifying IMO flag-state; SSP access log | | |
| | Dodd-Frank § 1033 / CFPB Rule 1033 — Consumer data portability | Pub. L. 111-203 § 1033; 12 CFR § 1033.201 | Financial | ★ mandatory | Consumer-authorized scope token in export receipt | | |
| | eIDAS 2.0 Art. 3 — European Digital Identity Wallet sovereignty | Regulation (EU) 2024/1183 Art. 3 | LegalTech | ★ mandatory | EUDIW-bound QES; wallet jurisdiction assertion in receipt | | |
| **Λ10 Receipt Requirements**: Receipt must include `jurisdiction_code` (ISO 3166-1 alpha-2), `transfer_mechanism` (adequacy/SCC/BCR/none), `data_residency_region`, and `sovereignty_assertion_hash`. | |
| --- | |
| ## Cross-Vertical Coverage Matrix | |
| | Vertical | Λ1 | Λ2 | Λ3 | Λ4 | Λ5 | Λ6 | Λ7 | Λ8 | Λ9 | Λ10 | Count | | |
| |-----------------|----|----|----|----|----|----|----|----|----|----|-------| | |
| | Healthcare | ○ | ★ | ★ | · | ○ | ★ | ★ | ○ | · | ○ | 9 | | |
| | Financial | ★ | ★ | ○ | ★ | ○ | ★ | ★ | ★ | ★ | ★ | 10 | | |
| | Defense | ★ | ★ | – | ○ | ★ | ★ | ★ | ★ | · | ★ | 9 | | |
| | Aviation | ★ | ★ | – | · | ★ | ○ | ★ | ★ | ★ | · | 8 | | |
| | Automotive | ★ | ★ | ○ | ○ | ★ | ★ | ★ | ★ | ★ | ★ | 10 | | |
| | Pharmaceutical | ★ | ★ | ○ | ★ | ★ | ★ | ★ | ★ | ★ | ★ | 10 | | |
| | Energy | ○ | ★ | · | · | ★ | ★ | ★ | ★ | · | ★ | 8 | | |
| | Maritime | ○ | ★ | ○ | · | ★ | ★ | ★ | ★ | ★ | ★ | 9 | | |
| | LegalTech | ★ | ★ | ★ | ★ | ○ | ★ | ★ | ★ | ★ | ★ | 10 | | |
| | Academic | ★ | ★ | ★ | ★ | ○ | ○ | ★ | · | ○ | ○ | 8 | | |
| | **Axis total** | 9 | 10 | 8 | 8 | 9 | 10 | 10 | 9 | 8 | 9 | | | |
| ★ = mandatory, ○ = recommended, · = advisory, – = not applicable | |
| --- | |
| *Generated: Doctrine v6 R3 Adversarial Receipts · Receipt chain: SHA3-256 Merkle DAG* | |