Skip to content

Regulated AI Navigator

Turn an AI use case into its full regulatory footprint — every domain it touches, from AI law and data protection to cyber, product safety and sector rules — with the obligations, the architecture and the evidence you owe, in about two minutes.

Community-curated knowledge graph — every claim carries its citation across law, engineering and governance. Every change traceable →

Start where you stand →Browse 78 profiles
← Back
Media & Platforms (Age Assurance)

Facial Age Estimation for Platform Sign-Up & Age-Gating

Limited Risk (Transparency)UnverifiedDiscuss / dispute
✓ Confirm✗ Dispute+ Add sourceSign in to validate — every vote requires a source

A facial age-estimation model runs on a selfie at account sign-up, and again when behaviour signals suggest misdeclared age, to infer an age band and gate access to age-restricted platform features or block underage accounts.

Consensus classification rationale: Sits at the intersection of platform minors'-protection duties (DSA Art. 28 for EU platforms accessible to minors; the GB Online Safety Act's Art. 12 age-assurance duty; Australia's social-media minimum-age law, which directly mandates 'reasonable steps' including age assurance) and biometric-processing rules (GDPR Art. 9, since a facial estimate can qualify as biometric data). AI Act Annex III point 1(b) classification is genuinely contested for age-band-only categorisation (narrower than the 'sensitive or protected attribute' reading) — recorded here as limited-risk with the ambiguity noted rather than asserted as settled.
Evaluate risk & value →Send to stack advisor →Open in graph
This profile is incomplete:no threats modelled. That is a gap in the graph, not a statement that nothing applies — propose the missing links →
Decision attributes in force
Autonomyfully-autonomous — Drives the human-oversight duties (Art. 14, Art. 26(2)) and Art. 50 disclosure.
Profiling of natural personsyes — Feeds the Art. 6(3) second-subparagraph override directly — profiling makes the derogation categorically unavailable.
Affected subjectsnatural-person — Instruments scoped to natural persons drop out of scope when only legal entities are assessed.
Deployer typeprivate-enterprise — Selects between the recorded alternate classification readings.
Role in the value chaindeployer — Splits provider duties, deployer duties and upstream GPAI duties.
Consequential scoringno — Consequential scoring of natural persons requires intrinsic interpretability, not post-hoc explanation only.

Indicative decision support, not legal advice. Risk classification depends on your concrete deployment context and can change with scope drift — validate the result with qualified counsel.

Target market(s)European UnionUnited States (federal)change

Changes which instruments below count as in scope for this profile.

Target market(s)

Where will this system be used or placed on the market? The conclusion is derived for these jurisdictions — instruments that bind only elsewhere are left out.

Europe
North America
Latin America
Asia-Pacific
Middle East
Africa

Selected: European Union, United States (federal) · thin-coverage jurisdictions need verification

Target markets: European Union, United States (federal)

Regulatory footprint

3 instruments across 2 of 7 regulatory domains, plus 1 standards reference
  • AI lawnone triggered
  • Data protectionnone triggered
  • Cyber & resiliencenone triggered
  • Online safety & platforms2 instruments
  • Product safetynone triggered
  • Financial servicesnone triggered
  • Sector & employment1 instrument
  • Standards1 reference

By jurisdiction

  • EU1European UnionDigital Services Act
  • GB1United KingdomOnline Safety Act 2023 (GB)
  • AU1AustraliaOnline Safety Amendment (Social Media Minimum Age) Act 2024 (AU)

The AI Act is one dimension of this footprint, not the whole of it — every domain above carries its own obligations and deadlines. See the instruments in the graph →

Confidence in this chain of evidenceConfidence: Robust

Every hop of this derivation rests on a primary source with a recently verified status. Read it as a defensible starting position, still not legal advice.

Computed weakest-link over 7 evaluated hops across 1 target market: a chain is only as strong as its weakest step, so the band follows the worst hop rather than an average that would hide it. Five factors per hop — source tier, verification age, status certainty, community hardening, derivation kind — all read from graph data, never from a hand-set score.

Why this band3 factors lowered the band — each links to the claim behind it

Compliance brief

This use case is limited-risk under the EU AI Act (Limited Risk (Transparency)); transparency obligations apply.

What is owed

  • Art. 50. Disclose AI interaction to natural persons; machine-readable marking of synthetic content; deepfake labelling; emotion-recognition disclosure.
  • Art. 4. Providers and deployers must ensure sufficient AI literacy of staff dealing with AI systems.

Dates that bind

  • 2024-08-01 — AI Act enters into force. Regulation (EU) 2024/1689 in force; countdown for all staged obligations starts.
  • 2025-02-02 — Prohibitions + AI literacy. Art. 5 prohibited practices ban applies (manipulation, social scoring, untargeted face scraping, workplace emotion recognition); Art. 4 AI literacy duty.

Maximum exposure

  • Online Safety Amendment (Social Media Minimum Age) Act 2024 (AU): Civil penalty of up to 30,000 penalty units for non-compliant providers.

First five actions

  1. Confirm in writing whether this organisation builds/places the system on the market (provider) or only operates it (deployer), since the role is not yet established.
  2. Commission and confirm the Art. 50, Art. 4 obligations named above as active workstreams with an accountable owner.
  3. Design and document a human-oversight procedure appropriate to how this system is used.
  4. Produce the technical documentation and evidence artefacts already mapped to this use case (Synthetic-Content Labelling / Watermarking, Interface Transparency & Content-Marking Layer, Output Rails / Groundedness Check) before they are requested.
  5. Put 2024-08-01 — AI Act enters into force — into the compliance calendar with an owner and lead time.

Terms used above: · · ·

This brief is based on partial coverage — no threat profile is mapped yet.

Classification precedent

Consensus reading: Limited Risk (Transparency) open in the graph →

Sits at the intersection of platform minors'-protection duties (DSA Art. 28 for EU platforms accessible to minors; the GB Online Safety Act's Art. 12 age-assurance duty; Australia's social-media minimum-age law, which directly mandates 'reasonable steps' including age assurance) and biometric-processing rules (GDPR Art. 9, since a facial estimate can qualify as biometric data). AI Act Annex III point 1(b) classification is genuinely contested for age-band-only categorisation (narrower than the 'sensitive or protected attribute' reading) — recorded here as limited-risk with the ambiguity noted rather than asserted as settled.

What the reading rests on — the provisions this classification actually pulls in:

No dissenting reading is recorded for this case. That means nobody has filed one yet — not that the classification is beyond argument. file a dissent with a source →

Baseline: of 100+, 40% were not definitively classifiable (18% clearly high-risk, 42% clearly low-risk). appliedAI Institute — AI Act risk classification of AI systems from a practical perspective

Applicable Regulations (3)

Digital Services Act (Regulation (EU) 2022/2065)
in-force · verified 2026-09-05 source EUR-Lex in force EU
Intermediary services: recommender-system transparency, risk assessments for very large platforms.
Online Safety Act 2023 (GB)
in-force · verified 2026-08-11 source ofcom.org.uk in force GB
Online safety duties; per Ofcom guidance these apply to generative-AI chatbots. Ofcom codes phased 2025–26.
Online Safety Amendment (Social Media Minimum Age) Act 2024 (AU) (Online Safety Amendment (Social Media Minimum Age) Act 2024 (No. 127, 2024), inserting Part 4A into the Online Safety Act 2021)
in-force · verified 2026-09-18 in force AU
Requires providers of age-restricted social media platforms to take reasonable steps to prevent Australian children under 16 from having accounts, with limits on what verification data may be collected for compliance.
Sanctions: Civil penalty of up to 30,000 penalty units for non-compliant providers.

Legal Obligations (2)

density
Art. 50 — Transparency Duties
Disclose AI interaction to natural persons; machine-readable marking of synthetic content; deepfake labelling; emotion-recognition disclosure.
in-force · verified 2026-08-16 source (as amended) EUR-Lexconvenience mirror — not updated artificialintelligenceact.euAmended by Regulation (EU) 2026/1744. Verified 16 Aug 2026: the popular mirrors have not yet been updated — artificialintelligenceact.eu still serves the unamended 13 June 2024 text with no disclaimer, and the Commission's AI Act Service Desk pages still show pre-omnibus text with a visible omnibus disclaimer. Read the OJ or consolidated text on EUR-Lex.
Art. 4 — AI Literacy
Providers and deployers must ensure sufficient AI literacy of staff dealing with AI systems. In force since 2 Feb 2025.
unverified · no verification date source (as amended) EUR-Lexconvenience mirror — not updated artificialintelligenceact.euAmended by Regulation (EU) 2026/1744. Verified 16 Aug 2026: the popular mirrors have not yet been updated — read the OJ or consolidated text on EUR-Lex.

Control Objectives (1)

obligation (article) → operationalized_by → control objective → satisfied_by → component/pattern; control objective → evidenced_by → evidence artifact
Art. 50
AI Interaction & Content Disclosure
Natural persons are informed they interact with an AI system, and generated/manipulated content carries both human-visible labels and machine-readable provenance (C2PA-class) that survives publication pipelines. Testable: disclosure presence across all interaction surfaces; watermark validity sampling post-publication; deepfake-path red-team (does stripped metadata get caught at the gate?).
satisfied by: Synthetic-Content Labelling / WatermarkingOutput Rails / Groundedness CheckInterface Transparency & Content-Marking Layer
evidenced by: Guardrail Telemetry & Sanitization Records
Art. 4
control layer: community mandate — propose objectives
Take this into your GRC tooling
A control mapping your ISO/IEC 42001 or CSA AICM workbook can ingest, and an Annex IV skeleton to start the technical file from. Indicative mappings only — cells we are not confident about are exported empty rather than filled in.

Standards & Evidence

C2PA Content Credentials
Open technical standard for cryptographically signed content provenance: manifests binding origin, toolchain and edit history to media assets. The de-facto machine-readable implementation path for Art. 50 synthetic-content marking (machine-readable format + detectability duty) — visible labels satisfy the human side, C2PA manifests the machine side. Verification at publication gates produces the disclosure evidence stream.
published · verified 2026-08-17 status unsourced publisher c2pa.org
evidence for: Art. 50

Evidence you will need (3)

The concrete deliverables this use case's obligations ask for — grouped by what kind of artifact they are. Documentation is the largest single conformity cost block, so the list is a work plan, not a reading list. Full evidence matrix →

Documents & files (1)

Written deliverables an authority or auditor can request as a file.

Instructions for Use / Transparency Docstext-derivedserves 2 obligations
Art. 13 deployer-facing documentation: intended purpose, capabilities, limitations, expected accuracy, oversight measures — plus Art. 50 user-facing disclosures.
verifiability: documented artefact — verifiable on inspection
chain: Art. 13 — Transparency to Deployers · Art. 50 — Transparency Duties · Generative Asset Production & Virtual Try-On · Omnichannel Virtual Support & Voice Bots
open in the graph →

Log records (1)

Machine-generated records produced while the system runs.

Guardrail Telemetry & Sanitization Recordspractice-derived — dispute welcomeserves 3 obligations
Control-level evidence for the OWASP mappings: guardrail trigger records, blocked-prompt statistics (LLM01), runtime output-sanitization logs (LLM05), groundedness-check outcomes — the empirical proof that declared controls actually execute.
verifiability: tamper-evident
chain: Art. 15 — Accuracy, Robustness, Cybersecurity · Art. 50 — Transparency Duties → CO: AI Interaction & Content Disclosure · Art. 15 — Accuracy, Robustness, Cybersecurity → CO: Runtime Injection Defense · Dynamic Deal Desk & Quoting Engine · Enterprise Marketing Disclosure Compliance · LLM01 Prompt Injection · +3 more
open in the graph →dispute welcome →

Process records (1)

Traces that a process actually happened, and who did it.

AI Literacy Training Recordspractice-derived — dispute welcomeserves 2 obligations
Art. 4 evidence: role-based training curricula and completion records for staff dealing with AI systems — the one obligation that applies at every risk level.
verifiability: documented artefact — verifiable on inspection
chain: Art. 4 — AI Literacy · Art. 14 — Human Oversight → CO: Oversight Competence & Authority
open in the graph →dispute welcome →

Architecture Blueprint

Local Edge Biometric Inference
Templates and embeddings are computed and matched on the device at the door; no raw image leaves the sensor boundary and none is centrally retained. The central system sees a match/no-match event and an enrolment reference, which is what shrinks both the GDPR Art. 9 footprint and the breach blast radius.

Required Technical Components (7)

Synthetic-Content Labelling / Watermarking
Synthetic-content labelling & watermarking: visible disclosure plus machine-readable provenance (C2PA Content Credentials) embedded in generated images, audio and video; metadata identifying artificial origin survives common transformations. Discharges Art. 50(2)/(4) for deepfakes and synthetic media; verification telemetry (watermark presence/validity checks at publication gates) is the corresponding evidence stream.
from: Art. 50
Interface Transparency & Content-Marking Layer
The disclosure surface at the engagement layer: an AI-interaction notice on every channel a natural person can reach (web, app, voice, chat, social, marketplace), machine-readable provenance marking on generated or manipulated output, and a disclosure record per interaction that can be produced on request. Sits at the interface, not in the model — a model-side label that the frontend drops is not a disclosure.
from: Art. 50
Output Rails / Groundedness Check
Faithfulness scoring of answers against retrieved sources; deterministic fallback instead of hallucination; schema-validated structured output.
from: Online Safety Act 2023 (GB)
Input Rails / Prompt Shields
Pre-model validation of user input: injection detection, topic blocking, encoding checks.
from: Online Safety Act 2023 (GB)
Secure Boot & Hardened Runtime
Verified boot chain and hardened runtimes for edge/IoT deployments per CRA security-by-design.
from: Local Edge Biometric Inference
PII Scrubbing / DLP-NER Layer
Automated detection, pseudonymisation and blocking of personal data in inputs, retrievals and outputs.
from: Local Edge Biometric Inference
WORM / Immutable Audit Vault
Append-only, hash-chained audit vault (WORM object-lock storage, AES-256 at rest, TLS 1.3 in transit). Guarantees tamper-evidence within the organization's trust domain — which stops your own team, but not an admin who can rebuild the vault. Pair with an external trust anchor and key ceremonies outside the operating team for evidence that holds against the insider scenario.
from: Local Edge Biometric Inference

Build or Buy — Vendor Layer (5)

The graph models vendor CATEGORIES as first-class nodes and keeps named vendors as community-maintained, disputable desc content with lastVerified dates. A category is stable; a vendor list is a currency-layer object like any standard node.
Regulated Foundation-Model Platforms
Frontier commercial APIs and open-weight models under enterprise controls: zero-data-retention tiers, data isolation, fine-tuning governance, safety alignment documentation, EU-sovereign options. Named products live in marketExamples, where the deployment model is recorded in the hosting field rather than asserted in prose. What the class buys you: a model supply relationship with contractual data handling and documentation you can pass to a customer. GPAI-chapter duties and provider due diligence attach at this layer. Selection metrics: see meta.marketLandscape.selectionMetrics.models.
unverified · verified 2026-08-18 community-maintained
selection metrics: ZDR enterprise tiers, data isolation, EU-sovereign options, fine-tuning controls, safety alignment documentation
supplies: Synthetic-Content Labelling / Watermarking
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
ExampleSub-categoryWhat it doesHostingClaimed alignments
OpenAI (Enterprise / API)proprietary frontierEnterprise tiers offer zero-data-retention and no-training commitments over the commercial API. Typical: general copilots, document reasoning.not checkedSOC 2 (claimed)ISO 27001 (claimed)zero-data-retention tier (claimed)GDPR-positioned
Anthropic Claude (Enterprise)proprietary frontierEnterprise/ZDR tiers with published safety and model documentation practice. Typical: regulated assistants, long-context analysis.not checkedSOC 2 (claimed)ISO 27001 (claimed)zero-data-retention tier (claimed)HIPAA-eligible (claimed)
Google Gemini Enterpriseproprietary frontierVertex-hosted frontier models with regional grounding and customer-managed keys. Typical: enterprise search, multimodal workflows.not checkedSOC 2 (claimed)ISO 27001 (claimed)HIPAA-eligible (claimed)EU data-boundary positioning
Cohereproprietary frontierPrivate-cloud and on-prem deployment of retrieval-oriented models. Typical: private RAG, enterprise search.self-hostableSOC 2 (claimed)

and 7 more in the stack advisor →

Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.

Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.

open in graphdispute / propose change
Runtime Security & Guardrail Vendors
First-line inline enforcement: single-pass parallel input/output evaluation proxies, injection and exfiltration defense, PII masking, grounding checks, SecOps routing. Named products live in marketExamples; prose here describes the class. What the class buys you: a policy decision point in the request path that fails closed and emits telemetry an auditor can read. Selection metrics: single-pass latency (<20 ms class), catch rates, policy-version telemetry into the AI-BOM. Consolidation matters commercially: a guardrail acquired by a platform vendor tends to follow that platform's roadmap, which is a lock-in question rather than a security one — reported acquisitions are recorded per entry as reported, not asserted here.
unverified · verified 2026-08-18 community-maintained
selection metrics: single-pass parallel evaluation latency (<20 ms class), injection/hallucination catch rates, SecOps/SIEM routing, policy versioning surfaced into the AI-BOM
supplies: Interface Transparency & Content-Marking Layer · Output Rails / Groundedness Check · Input Rails / Prompt Shields
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
ExampleSub-categoryWhat it doesHostingClaimed alignments
Lakeraguardrail proxyInline prompt-injection and content detection at request time. Typical: injection defence, content filtering.not checkedSOC 2 (claimed)supports Art. 15 robustness measures (claimed)
HiddenLayermodel/agent detection & responseModel-layer detection and response with adversarial-attack telemetry. Typical: model threat detection, red-team telemetry.not checkedSOC 2 (claimed)supports Art. 15 robustness measures (claimed)
Palo Alto Prisma AIRSnetwork-integrated AI securityAI runtime security folded into an existing enterprise network security estate. Typical: enterprise rollout, egress control.not checkedSOC 2 (claimed)enterprise security integration (claimed)
Cisco AI Defensenetwork-integrated AI securityDiscovery of AI usage plus inline enforcement across the corporate network. Typical: shadow-AI discovery, inline enforcement.not checkedenterprise security integration (claimed)

and 4 more in the stack advisor →

Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.

Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.

open in graphdispute / propose change
Public Transparency Registers & System Cards
Authoring and publishing the outward-facing record: public AI registers, system and model cards, conformity declarations and plain-language notices, with versioning so a published statement can be tied to the system version it described. The register content is produced elsewhere; this class is the publication and version-control surface for it. Selection metrics: see meta.marketLandscape.selectionMetrics.transparency.
unverified · verified 2026-08-17 community-maintained
selection metrics: Versioning of published statements against the system version they describe; whether a card is generated from your governance record or re-authored by hand; language coverage and accessibility of the published surface; export and self-hosting of the public register; whether unpublishing leaves an auditable trail.
supplies: Interface Transparency & Content-Marking Layer
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
ExampleSub-categoryWhat it doesHostingClaimed alignments
Saidotpublic AI registerAI register with published system cards and regulation-mapped documentation workflows. Typical: public AI register, system cards. Scope overlap: Its documentation and register scope overlaps this platform's own; we have a commercial interest in the comparison.SaaS (vendor cloud)EU AI Act documentation positioningISO 42001 alignment (claimed)

Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.

Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.

open in graphdispute / propose change
Runtime Guardrails & Enforcement
Policy enforcement in the request path: input/output validation, injection and exfiltration defence, structured-output constraints and action blocking. Distinct from observability layers because these products are in-line and can refuse. Selection questions: added latency at p95, whether enforcement is fail-open or fail-closed, whether policies are versioned artefacts, and whether the layer can be self-hosted inside your data boundary.
unverified · verified 2026-08-18 community-maintained
selection metrics: Where enforcement sits (inline proxy, sidecar, SDK) and the added latency at your token volumes; whether policy is versioned and testable as code; fail-open vs. fail-closed behaviour under guardrail outage; language and modality coverage; whether every block writes an evidence record you can cite later.
supplies: Output Rails / Groundedness Check · Input Rails / Prompt Shields
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
ExampleSub-categoryWhat it doesHostingClaimed alignments
Guardrails AIvalidation frameworkOpen-source validator framework for structured output and content policies in the request path. Typical: output validation, structured output.open sourcesupports Art. 15 robustness measures (claimed)
NVIDIA NeMo Guardrailsdialogue policy railsProgrammable dialogue and topic rails placed around an LLM application. Typical: topic control, dialogue policy.open sourcesupports Art. 50 interaction disclosure patterns (claimed)
Lakera AIguardrail proxyInline prompt-injection and content detection at request time. Typical: injection defence, content filtering.SaaS (vendor cloud)SOC 2 (claimed)supports Art. 15 robustness measures (claimed)
Credal AIenterprise access & policy layerPermission-aware access layer with data-loss controls in front of enterprise assistants. Typical: access control, DLP.SaaS (vendor cloud)SOC 2 (claimed)

Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.

Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.

open in graphdispute / propose change
Cryptographic Evidence & Audit Ledger
Tamper-evident recording of what a system did: content-addressed decision records, hash chains and external anchoring, so a log can be shown not to have been rewritten after the fact. This is the layer that turns Art. 12 logging and Art. 19 retention from a storage question into an evidentiary one. AI Verify is carried in RAIN as a STANDARD node (sg-ai-verify), not duplicated here as a vendor.
unverified · verified 2026-08-18 community-maintained
selection metrics: Append-only guarantees and who can rotate or delete (including the vendor); anchoring mechanism (qualified timestamp, transparency log, notarisation) and whether verification works without the vendor; retention and export in a readable format at end of contract; throughput and cost at your event volume.
supplies: WORM / Immutable Audit Vault
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
ExampleSub-categoryWhat it doesHostingClaimed alignments
Fact0cryptographic evidence ledgerPositions itself as a tamper-evident ledger for AI decision records. Typical: decision records, audit trail.not checkedsupports Art. 12 record-keeping (claimed)
Tracciaaudit trail & traceabilityPositions itself around traceability of AI pipeline steps and artefacts. Typical: traceability, artifact lineage.not checkedsupports Art. 12 record-keeping (claimed)

Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.

Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.

open in graphdispute / propose change
Procurement rule: Derived from three-lines-of-defense separation: the second-line GRC platform must be procured and deployed independently of any first-line runtime or model vendor — a governance tool that only sees its own vendor's models cannot govern a multi-model estate, and closed third-party SaaS AI can only be governed contractually (intake, attestation, AI-BOM disclosure), never by inline inspection.
Outsourced delivery BPO · SaaS · Service-as-a-Software caveats

Delivery Model — BPO · SaaS · Service-as-a-Software

Spectrum
BPO: input-priced (billable hours/FTEs), linear headcount scaling, human error & attrition as primary risk
SaaS: capability-priced (software access), client operates the workload, implementation/adoption failure as primary risk
Service-as-a-Software: outcome-priced (SLA on completed work), provider-managed AI executes 60–80% of cognitive tasks with specialist supervision, algorithmic bias & non-compliance as primary risk
Caveats in regulated markets
— Outcome SLAs move compliance risk onto the provider — but NOT the buyer's deployer duties: Art. 26 oversight, log retention and FRIA obligations stay with the enterprise even when execution is outsourced.
— Provider role analysis is the central legal question: a productized platform that fine-tunes, re-purposes or chains models can flip into the Art. 25 provider role with full high-risk obligations.
— Certified operations (ISO 42001) function as a procurement moat and shortcut third-party risk assessment — but organizational certificate ≠ product conformity (never conflate, see meta.assuranceEcosystem).
— The buyer's evidence chain must reach into the provider: contractually mandated AI-BOM disclosure, ZDR certificates, bias-audit reports and logging-ledger access are the artifacts that make an outsourced workflow auditable.
Service-as-a-Software patternCO: Embedded-AI vendor governance

Threat Profile

No elevated threat is modelled for this use case yet.

Propose a threat →