AI-Assisted Patent Drafting, Prosecution & Inventorship Analysis

Legal & Compliance (IP)

AI-Assisted Patent Drafting, Prosecution & Inventorship Analysis

✓ Confirm✗ Dispute+ Add sourceSign in to validate — every vote requires a source

AI used by patent attorneys, IP legal-process outsourcers and in-house IP teams for drafting specifications and claims from invention disclosures, answering examiner rejections with Office-action responses, running prior-art and freedom-to-operate searches, tracking patent-office deadlines and recording or assessing inventorship. Scope: decision support for a human practitioner or inventor who reviews, signs and files; it does not file papers, name inventors or decide patentability on its own, and it makes no decision about any person.

Consensus classification rationale: Drafting and prosecuting patents with AI is not an AI Act high-risk area when a practitioner or IP team uses it (no Annex III point lists it; point 8(a) reaches AI used by or on behalf of a judicial authority, a second reading recorded on this node); the binding regime is patent-office practice law. For a USPTO matter, whoever presents a paper certifies under 37 CFR 11.18(b) that a reasonable inquiry was made, and the Office's 2024 notice says that simply relying on the accuracy of an AI tool is not one; the duty of candor (37 CFR 1.56) and client confidentiality (37 CFR 11.106) apply to AI-assisted work, and the Office's November 2025 inventorship guidance treats AI systems as instruments used by human inventors and states that only natural persons can be inventors. The 2024 notice also warns that AI tools may use servers outside the United States, so that data entered may be exported, potentially in violation of export administration and national security regulations or secrecy orders, and that certain activities related to the use of US-hosted AI systems by non-US persons may be deemed an export; 35 U.S.C. 184 and 37 CFR 5.11 add a foreign-filing licence for inventions made in the United States, and the six-month provisions of 37 CFR 5.11(c) and 5.11(e)(2) are stated for foreign filings and for exports made for a foreign application. At the European Patent Office every application must designate the inventor (Art. 81 and Rule 19 EPC), the EPO checks that the designated inventor is a natural person (Guidelines 2026, A-III, 5.3, citing J 8/20), and the Guidelines make the parties responsible for the content of their submissions however prepared (General Part 5). Whether entering an unfiled invention into a third-party AI service is itself a public disclosure is not settled by any of these sources and is left as an open question.

Evaluate risk & value →Send to stack advisor →Open in graph

Decision attributes in force

Autonomyhuman-in-the-loop — Drives the human-oversight duties (Art. 14, Art. 26(2)) and Art. 50 disclosure.

Profiling of natural personsno — Feeds the Art. 6(3) second-subparagraph override directly — profiling makes the derogation categorically unavailable.

Affected subjectsnatural-person — Instruments scoped to natural persons drop out of scope when only legal entities are assessed.

Deployer typeprivate-enterprise — Selects between the recorded alternate classification readings.

Role in the value chaindeployer — Splits provider duties, deployer duties and upstream GPAI duties.

Consequential scoringno — Consequential scoring of natural persons requires intrinsic interpretability, not post-hoc explanation only.

if deployerEntityType = judicial-bodyHigh Risk — Annex III point 8(a) — administration of justice: assisting a judicial authority in researching and interpreting facts and the law and in applying the law to a concrete set of facts.

Indicative decision support, not legal advice. Risk classification depends on your concrete deployment context and can change with scope drift — validate the result with qualified counsel.

Target market(s)European UnionUnited States (federal)change

Changes which instruments below count as in scope for this profile.

Target market(s)

Where will this system be used or placed on the market? The conclusion is derived for these jurisdictions — instruments that bind only elsewhere are left out.

Europe

North America

Latin America

Asia-Pacific

Middle East

Africa

Selected: European Union, United States (federal) · thin-coverage jurisdictions need verification

Target markets: European Union, United States (federal)

Regulatory footprint

5 instruments across 3 of 7 regulatory domains, plus 5 standards references

AI law1 instrument
Data protection1 instrument
Cyber & resiliencenone triggered
Online safety & platformsnone triggered
Product safetynone triggered
Financial servicesnone triggered
Sector & employment3 instruments
Standards5 references

By jurisdiction

EU2European UnionEU AI Act, GDPR
US2United States (federal)US Foreign-Filing Licence & Export Control of Patent Technical Data, USPTO Practice Rules & Inventorship Guidance for AI-Assisted Filings (US)
GLOBAL1Cross-jurisdictionEPC Inventor Designation & EPO Guidelines on AI-Assisted Submissions

The AI Act is one dimension of this footprint, not the whole of it — every domain above carries its own obligations and deadlines. See the instruments in the graph →

Confidence in this chain of evidenceConfidence: Check-worthy

The chain holds, but at least one hop rests on a secondary source, an ageing verification or a practice-derived step. Check the flagged hops before you rely on them.

Computed weakest-link over 21 evaluated hops across 1 target market: a chain is only as strong as its weakest step, so the band follows the worst hop rather than an average that would hide it. Five factors per hop — source tier, verification age, status certainty, community hardening, derivation kind — all read from graph data, never from a hand-set score.

Why this band7 factors lowered the band — each links to the claim behind it

Source tier: EPC Inventor Designation & EPO Guidelines on AI-Assisted Submissions carries no resolvable citation — the claim is uncited. open node →
Source tier: JTC 21 Technical Package (prEN 18228/18229/18281–83) rests on a secondary source (tracker or summary), not on the primary text. open node → primary source →
Source tier: IEEE CertifAIEd™ carries no resolvable citation — the claim is uncited. open node →
Source tier: prEN 18229-1 (Trustworthiness Framework, part 1) rests on a secondary source (tracker or summary), not on the primary text. open node → primary source →
Status certainty: JTC 21 Technical Package (prEN 18228/18229/18281–83) is "draft", not settled in-force law. open node → primary source →
Status certainty: prEN 18229-1 (Trustworthiness Framework, part 1) is "enquiry", not settled in-force law. open node → primary source →
Verification age: IEEE CertifAIEd™ has no recorded verification date. open node →

Compliance brief

This use case is minimal-risk under the EU AI Act (Minimal Risk); no product-specific obligations beyond general AI literacy apply.

What is owed

Art. 4. Providers and deployers must ensure sufficient AI literacy of staff dealing with AI systems.
GDPR Art. 22. Right not to be subject to solely automated decisions with legal/similar effect; requires meaningful human involvement or explicit legal basis + safeguards.
GDPR Art. 27. A controller or processor not established in the Union that falls within Art.
GDPR Art. 17. Right to erasure collides with AI Act Art.
GDPR Art. 25. Privacy by design & default: minimisation, pseudonymisation, PII filters in pipelines and vector stores.

Dates that bind

2024-08-01 — AI Act enters into force. Regulation (EU) 2024/1689 in force; countdown for all staged obligations starts.
2025-02-02 — Prohibitions + AI literacy. Art. 5 prohibited practices ban applies (manipulation, social scoring, untargeted face scraping, workplace emotion recognition); Art. 4 AI literacy duty.

Maximum exposure

EU AI Act: Tiered: €35m / 7% (prohibited practices); €15m / 3% (Art. 9–15 high-risk obligations incl. data governance, documentation, logging); €7.5m / 1% (Art. 99(5) — incorrect, incomplete or misleading information to notified bodies or national competent authorities)
USPTO Practice Rules & Inventorship Guidance for AI-Assisted Filings (US): A paper presented in breach of the reasonable-inquiry certification of 37 CFR 11.18(b)(2) is, after notice and a reasonable opportunity to respond, subject to sanctions the USPTO Director deems appropriate, which may include striking the paper, referring a practitioner to the Office of Enrollment and Discipline, precluding a party or practitioner from submitting a paper or presenting or contesting an issue, affecting the weight given to the paper, or terminating the proceedings in the Office (37 CFR 11.18(c)); a practitioner may also face disciplinary action (11.18(d)), and knowing and wilful false statements fall under 18 U.S.C. 1001 (11.18(b)(1)). Under 37 CFR 1.56(a) no patent will be granted on an application in connection with which fraud on the Office was practiced or attempted or the duty of disclosure was violated through bad faith or intentional misconduct. The November 2025 guidance states that a rejection under 35 U.S.C. 101 and 115, or other appropriate action, should be made for all claims in any application that lists an AI system or other non-natural person as an inventor or joint inventor (90 FR 54637, Section IV).
US Foreign-Filing Licence & Export Control of Patent Technical Data: 35 U.S.C. 185: a person who, without the licence prescribed in section 184, makes, or consents to or assists another's making, application in a foreign country for a patent on the invention shall not receive a US patent for it, and a US patent issued to such a person is invalid unless the failure to procure the licence was through error and the patent does not disclose subject matter within the scope of section 181. 35 U.S.C. 186: whoever wilfully, in violation of section 184, files or causes or authorises to be filed in a foreign country an application on an invention made in the United States is, on conviction, fined not more than $10,000 or imprisoned for not more than two years, or both. Export of technical data outside a licence is governed by the export regulations named in 37 CFR 5.11(c), whose penalties are not summarised here.
EPC Inventor Designation & EPO Guidelines on AI-Assisted Submissions: If the designation of the inventor has not been made in accordance with Rule 19, the EPO informs the applicant that the application will be refused unless the designation is made within sixteen months of the filing date or, where priority is claimed, of the priority date (Rule 60(1)); a deficiency found in the Art. 81 examination that is not corrected leads to refusal of the application (Art. 90(3) and (5)). J 8/20 dismissed the appeal against such a refusal.
GDPR: Up to €20m or 4% of worldwide annual turnover

First five actions

Confirm in writing whether this organisation builds/places the system on the market (provider) or only operates it (deployer), since the role is not yet established.
Commission and confirm the Art. 4, GDPR Art. 22, GDPR Art. 27 obligations named above as active workstreams with an accountable owner.
Design and document a human-oversight procedure appropriate to how this system is used.
Produce the technical documentation and evidence artefacts already mapped to this use case (HITL Escalation Queue & Review UI, Adverse-Decision Reason Generator, Bitemporal Memory (GDPR×Art.12)) before they are requested.
Put 2024-08-01 — AI Act enters into force — into the compliance calendar with an owner and lead time.

Terms used above: · · ·

Classification precedent

Consensus reading: Minimal Risk open in the graph →

Drafting and prosecuting patents with AI is not an AI Act high-risk area when a practitioner or IP team uses it (no Annex III point lists it; point 8(a) reaches AI used by or on behalf of a judicial authority, a second reading recorded on this node); the binding regime is patent-office practice law. For a USPTO matter, whoever presents a paper certifies under 37 CFR 11.18(b) that a reasonable inquiry was made, and the Office's 2024 notice says that simply relying on the accuracy of an AI tool is not one; the duty of candor (37 CFR 1.56) and client confidentiality (37 CFR 11.106) apply to AI-assisted work, and the Office's November 2025 inventorship guidance treats AI systems as instruments used by human inventors and states that only natural persons can be inventors. The 2024 notice also warns that AI tools may use servers outside the United States, so that data entered may be exported, potentially in violation of export administration and national security regulations or secrecy orders, and that certain activities related to the use of US-hosted AI systems by non-US persons may be deemed an export; 35 U.S.C. 184 and 37 CFR 5.11 add a foreign-filing licence for inventions made in the United States, and the six-month provisions of 37 CFR 5.11(c) and 5.11(e)(2) are stated for foreign filings and for exports made for a foreign application. At the European Patent Office every application must designate the inventor (Art. 81 and Rule 19 EPC), the EPO checks that the designated inventor is a natural person (Guidelines 2026, A-III, 5.3, citing J 8/20), and the Guidelines make the parties responsible for the content of their submissions however prepared (General Part 5). Whether entering an unfiled invention into a third-party AI service is itself a public disclosure is not settled by any of these sources and is left as an open question.

What the reading rests on — the provisions this classification actually pulls in:

Art. 4 — AI Literacy
EU AI Act (Regulation (EU) 2024/1689)
USPTO Practice Rules & Inventorship Guidance for AI-Assisted Filings (US) (37 CFR § 1.56 (duty to disclose information material to patentability); 37 CFR § 11.18 (signature and certificate for correspondence filed in the Office); 37 CFR § 11.106 (confidentiality of information) and the competence, diligence and supervision rules cited in the notice (37 CFR §§ 11.101, 11.103, 11.501-11.503); 35 U.S.C. § 100(f) (definition of 'inventor'); as applied to AI tools by USPTO 'Guidance on Use of Artificial Intelligence-Based Tools in Practice Before the United States Patent and Trademark Office', 89 FR 25609 (11 April 2024), and 'Revised Inventorship Guidance for AI-Assisted Inventions', 90 FR 54636 (28 November 2025))
US Foreign-Filing Licence & Export Control of Patent Technical Data (35 U.S.C. §§ 184-186 (filing of application in foreign country; patent barred for filing without licence; penalty); 37 CFR § 5.11 (licence for filing in, or exporting to, a foreign country an application on an invention made in the United States or technical data relating thereto), which refers to 22 CFR Parts 120-130 (ITAR), 15 CFR Parts 730-774 (EAR) and 10 CFR Part 810)
EPC Inventor Designation & EPO Guidelines on AI-Assisted Submissions (European Patent Convention (EPC 2000), Art. 60(1) (right to a European patent), Art. 81 and Rule 19 (designation of the inventor), Art. 90(3) and (5) and Rule 60(1) (examination and refusal); Guidelines for Examination in the European Patent Office, 2026 edition, General Part 5 (The use of artificial intelligence) and Part A-III, 5 (Designation of inventor); Legal Board of Appeal decision J 8/20 (DABUS) of 21 December 2021)
GDPR (Regulation (EU) 2016/679)

No dissenting reading is recorded for this case. That means nobody has filed one yet — not that the classification is beyond argument. file a dissent with a source →

Baseline: of 100+, 40% were not definitively classifiable (18% clearly high-risk, 42% clearly low-risk). appliedAI Institute — AI Act risk classification of AI systems from a practical perspective

Applicable Regulations (5)

EU AI Act (Regulation (EU) 2024/1689)

unverified · verified 2026-08-12 source (as amended) EUR-LexAmended by Regulation (EU) 2026/1744. Verified 16 Aug 2026: the popular mirrors have not yet been updated — artificialintelligenceact.eu still serves the unamended 13 June 2024 text with no disclaimer, and the Commission's AI Act Service Desk pages still show pre-omnibus text with a visible omnibus disclaimer. Read the OJ or consolidated text on EUR-Lex. in force EU

Horizontal, risk-based product-safety law for AI systems and GPAI models. Extraterritorial market-place principle. Staged applicability 2025–2030 (Digital Omnibus: Art. 50 → 2 Aug 2026, Annex III → 2 Dec 2027, Annex I → 2 Aug 2028). (Digital Omnibus: Regulation (EU) 2026/1744, in force 27 July 2026).

Sanctions: Tiered: €35m / 7% (prohibited practices); €15m / 3% (Art. 9–15 high-risk obligations incl. data governance, documentation, logging); €7.5m / 1% (Art. 99(5) — incorrect, incomplete or misleading information to notified bodies or national competent authorities)

USPTO Practice Rules & Inventorship Guidance for AI-Assisted Filings (US) (37 CFR § 1.56 (duty to disclose information material to patentability); 37 CFR § 11.18 (signature and certificate for correspondence filed in the Office); 37 CFR § 11.106 (confidentiality of information) and the competence, diligence and supervision rules cited in the notice (37 CFR §§ 11.101, 11.103, 11.501-11.503); 35 U.S.C. § 100(f) (definition of 'inventor'); as applied to AI tools by USPTO 'Guidance on Use of Artificial Intelligence-Based Tools in Practice Before the United States Patent and Trademark Office', 89 FR 25609 (11 April 2024), and 'Revised Inventorship Guidance for AI-Assisted Inventions', 90 FR 54636 (28 November 2025))

in-force · verified 2026-09-22 source Cornell LII in force US

The USPTO applies its existing practice rules to AI-assisted work rather than creating AI-specific ones. (1) Any paper presented to the Office is certified under 37 CFR 11.18(b) by the party presenting it as true to that party's knowledge and supported by a reasonable inquiry; the April 2024 guidance states that simply relying on the accuracy of an AI tool is not a reasonable inquiry, that statements, citations and IDS entries an AI tool produced must be checked before filing, and that only a natural person may sign. (2) The duty of candor and good faith (37 CFR 1.56, 11.303, 42.11) extends to the actions individuals take with AI tools, and the notice states that the duty of disclosure cannot be transferred to an AI tool. On disclosure of AI use, the notice states that there is not presently a general duty to inform the USPTO that an AI tool was used in the drafting of a paper unless specifically requested by the USPTO (III.A.1), and that if the use of an AI tool is material to patentability as defined in 37 CFR 1.56(b), the use must be disclosed (III.A.2). (3) Practitioners must keep client information confidential and make reasonable efforts to prevent inadvertent or unauthorised disclosure (37 CFR 11.106); the guidance warns that AI systems may retain what is entered, use it to train their models or pass it to third parties, and it reminds practitioners of their competence, diligence and supervision duties. (4) Inventorship: only natural persons can be inventors (35 U.S.C. 100(f); Thaler v. Vidal, 43 F.4th 1207 (Fed. Cir. 2022), as cited by the USPTO). The November 2025 guidance rescinds the February 2024 guidance, treats AI systems as instruments used by human inventors, applies the ordinary conception standard, applies the Pannu factors only between multiple natural persons, states that the USPTO presumes the inventors named on the application data sheet or oath or declaration are the actual inventors, states that a rejection under 35 U.S.C. 101 and 115, or other appropriate action, should be made for all claims in any application that lists an AI system or other non-natural person as an inventor, and states that a priority claim to a foreign application that names an AI tool as the sole inventor will not be accepted (Section VI).

Sanctions: A paper presented in breach of the reasonable-inquiry certification of 37 CFR 11.18(b)(2) is, after notice and a reasonable opportunity to respond, subject to sanctions the USPTO Director deems appropriate, which may include striking the paper, referring a practitioner to the Office of Enrollment and Discipline, precluding a party or practitioner from submitting a paper or presenting or contesting an issue, affecting the weight given to the paper, or terminating the proceedings in the Office (37 CFR 11.18(c)); a practitioner may also face disciplinary action (11.18(d)), and knowing and wilful false statements fall under 18 U.S.C. 1001 (11.18(b)(1)). Under 37 CFR 1.56(a) no patent will be granted on an application in connection with which fraud on the Office was practiced or attempted or the duty of disclosure was violated through bad faith or intentional misconduct. The November 2025 guidance states that a rejection under 35 U.S.C. 101 and 115, or other appropriate action, should be made for all claims in any application that lists an AI system or other non-natural person as an inventor or joint inventor (90 FR 54637, Section IV).

US Foreign-Filing Licence & Export Control of Patent Technical Data (35 U.S.C. §§ 184-186 (filing of application in foreign country; patent barred for filing without licence; penalty); 37 CFR § 5.11 (licence for filing in, or exporting to, a foreign country an application on an invention made in the United States or technical data relating thereto), which refers to 22 CFR Parts 120-130 (ITAR), 15 CFR Parts 730-774 (EAR) and 10 CFR Part 810)

in-force · verified 2026-09-22 source eCFR in force US

A person may not file, or cause or authorise to be filed, in a foreign country prior to six months after filing in the United States an application for patent in respect of an invention made in the United States unless licensed (35 U.S.C. 184(a)). 37 CFR 5.11(a) requires the licence for a foreign filing of an invention made in the United States where a US application was filed less than six months earlier or none was filed, and 5.11(e)(2) requires no licence under 5.11(a) where the corresponding US application is not subject to a secrecy order and was filed at least six months before the foreign filing; 5.11(f) states that an authorisation to file a foreign application resulting from the passage of six months may be revoked by the imposition of a secrecy order. The licence also authorises the export of technical data abroad for purposes related to the preparation, filing or possible filing, and prosecution of a foreign application (37 CFR 5.11(b)); where technical data are exported for those purposes without that licence, or on an invention not made in the United States, the ITAR, the EAR and 10 CFR Part 810 must be complied with unless a licence is not required because a US application was on file at the time of export for at least six months without a secrecy order (37 CFR 5.11(c)). The USPTO's April 2024 AI guidance warns that AI tools may use servers outside the United States, raising the likelihood that data entered may be exported outside the United States, potentially in violation of existing export administration and national security regulations or secrecy orders, and that certain activities related to the use of AI systems hosted on US servers by non-US persons may be deemed an export (III.D). It also states that a USPTO foreign filing licence does not authorise the export of subject matter abroad for the preparation of patent applications to be filed in the United States, and points applicants considering that to the Bureau of Industry and Security (II.D). Neither the II.D statement on export abroad to prepare a US application nor the III.D warning mentions a six-month period.

Sanctions: 35 U.S.C. 185: a person who, without the licence prescribed in section 184, makes, or consents to or assists another's making, application in a foreign country for a patent on the invention shall not receive a US patent for it, and a US patent issued to such a person is invalid unless the failure to procure the licence was through error and the patent does not disclose subject matter within the scope of section 181. 35 U.S.C. 186: whoever wilfully, in violation of section 184, files or causes or authorises to be filed in a foreign country an application on an invention made in the United States is, on conviction, fined not more than $10,000 or imprisoned for not more than two years, or both. Export of technical data outside a licence is governed by the export regulations named in 37 CFR 5.11(c), whose penalties are not summarised here.

EPC Inventor Designation & EPO Guidelines on AI-Assisted Submissions (European Patent Convention (EPC 2000), Art. 60(1) (right to a European patent), Art. 81 and Rule 19 (designation of the inventor), Art. 90(3) and (5) and Rule 60(1) (examination and refusal); Guidelines for Examination in the European Patent Office, 2026 edition, General Part 5 (The use of artificial intelligence) and Part A-III, 5 (Designation of inventor); Legal Board of Appeal decision J 8/20 (DABUS) of 21 December 2021)

in-force · verified 2026-09-22 in force GLOBAL

The EPC, an international treaty and not EU law, requires the European patent application to designate the inventor (Art. 81): in the request for grant or, where the applicant is not the inventor or not the sole inventor, in a separate document stating the inventor's name and residence and the origin of the applicant's right (Rule 19(1)). The EPO does not verify the accuracy of the designation (Rule 19(2)). In J 8/20 the Legal Board of Appeal dismissed the appeal against the refusal of an application that named an AI system as inventor; the catchword of the decision is that a machine is not an inventor within the meaning of the EPC, and the Guidelines 2026 (A-III, 5.1 and 5.3) state that the EPO checks that the designated inventor is a natural person. General Part 5 of the Guidelines adds that the parties are responsible for the content of their patent applications and submissions to the EPO, and for complying with the EPC and/or PCT, regardless of whether a document was prepared with an AI tool. The Guidelines are primarily for EPO examiners and formalities officers and are also intended to serve parties and practitioners; they are general instructions and do not constitute legal provisions (General Part 3.4): the ultimate authority is the EPC itself, including the international treaties it refers to, and its Implementing Regulations, and then the boards of appeal's interpretation of the Convention.

Sanctions: If the designation of the inventor has not been made in accordance with Rule 19, the EPO informs the applicant that the application will be refused unless the designation is made within sixteen months of the filing date or, where priority is claimed, of the priority date (Rule 60(1)); a deficiency found in the Art. 81 examination that is not corrected leads to refusal of the application (Art. 90(3) and (5)). J 8/20 dismissed the appeal against such a refusal.

GDPR (Regulation (EU) 2016/679)

in-force · verified 2026-09-05 source EUR-Lex in force EU

Applies unchanged next to the AI Act for all personal data in training, fine-tuning, RAG and inference. Key friction points: Art. 22 automated decisions, Art. 17 erasure vs. AI Act logging, Art. 35 DPIA.

Sanctions: Up to €20m or 4% of worldwide annual turnover

Legal Obligations (10)

density

Art. 4 — AI Literacy

Providers and deployers must ensure sufficient AI literacy of staff dealing with AI systems. In force since 2 Feb 2025.

unverified · no verification date source (as amended) EUR-Lex convenience mirror — not updated artificialintelligenceact.euAmended by Regulation (EU) 2026/1744. Verified 16 Aug 2026: the popular mirrors have not yet been updated — read the OJ or consolidated text on EUR-Lex.

GDPR Art. 22 — Automated Decisions

Right not to be subject to solely automated decisions with legal/similar effect; requires meaningful human involvement or explicit legal basis + safeguards.

unverified · no verification date read the article EUR-Lex

GDPR Art. 27 — EU Representative

A controller or processor not established in the Union that falls within Art. 3(2) scope (offering goods or services to, or monitoring the behaviour of, data subjects in the Union) must designate in writing a representative established in a Member State where the relevant data subjects are. The representative is mandated to be addressed by supervisory authorities and data subjects, in addition to or instead of the controller/processor, on all compliance issues — without prejudice to legal action against the controller/processor itself. Exempt: (a) occasional processing that does not involve large-scale special-category or criminal-conviction data and is unlikely to result in a risk to individuals, or (b) public authorities or bodies.

in-force · verified 2026-09-10 read the article EUR-Lex

GDPR Art. 17 — Erasure

Right to erasure collides with AI Act Art. 12 immutable logging — resolved architecturally via bitemporal data modelling + physical partition scrub.

unverified · no verification date read the article EUR-Lex

GDPR Art. 25 — Data Protection by Design

Privacy by design & default: minimisation, pseudonymisation, PII filters in pipelines and vector stores.

unverified · no verification date read the article EUR-Lex

GDPR Art. 35 — DPIA

Data-protection impact assessment for high-risk processing — pairs with AI Act fundamental-rights impact assessment (Art. 27) for public-facing high-risk systems.

unverified · no verification date read the article EUR-Lex

GDPR Art. 33/34 — Personal-Data Breach Notification

Notification of a personal-data breach to the supervisory authority and, where the risk to individuals is high, to the affected individuals themselves.

in-force · verified 2026-08-11 read the article EUR-Lex

GDPR Art. 32 — Security of Processing

Controller and processor implement technical and organisational measures appropriate to the risk, including pseudonymisation and encryption, and measures ensuring the ongoing confidentiality, integrity, availability and resilience of processing systems. Access to personal data by an unauthorised recipient — including one reached through a derived index such as a vector store — is the harm this article addresses.

in-force · verified 2026-08-17 read the article EUR-Lex

GDPR Art. 9 — Special Categories of Personal Data

Processing of health, biometric and other special-category data is prohibited unless one of the Art. 9(2) conditions applies; where it is permitted, the appropriate safeguards travel with it. This is the anchor for de-identification of clinical imaging and for the minimisation of health data in training and retrieval corpora.

in-force · verified 2026-08-17 read the article EUR-Lex

GDPR Art. 88 — Processing in the Employment Context

Opening clause: Member States may provide more specific rules for processing employees' personal data in the employment context, by law or by collective agreement, including suitable safeguards for human dignity, legitimate interests and fundamental rights, with particular regard to monitoring systems at the workplace. It is the bridge through which national employment rules — in Germany the BetrVG co-determination right and § 26 BDSG — govern workplace AI alongside the GDPR itself.

in-force · verified 2026-08-17 read the article EUR-Lex

Control Objectives (2)

obligation (article) → operationalized_by → control objective → satisfied_by → component/pattern; control objective → evidenced_by → evidence artifact

Art. 4

control layer: community mandate — propose objectives

GDPR Art. 22

control layer: community mandate — propose objectives

GDPR Art. 27

control layer: community mandate — propose objectives

GDPR Art. 17

control layer: community mandate — propose objectives

GDPR Art. 25

Vector & Chunk-Level Access Control

Practice-derived control objective (not named by any provision's own text): the requesting principal's read rights on every retrieved source segment are enforced before generation. Token- or claim-based ACL filtering is applied twice — at the chunker, which writes the source ACL into chunk metadata at ingestion, and at query time in the vector store, which filters candidates by the caller's entitlements — and a response-grounding check re-validates the caller's rights on each cited segment BEFORE the answer is composed. Testable: retrieval probe with a low-privilege principal against a restricted corpus; ACL drift reconciliation between source system and index; red-team reconstruction attempt from similarity results alone.

ISO/IEC 42001 clause A.7 (indicative)

evidenced by: Vector ACL Verification Report

GDPR Art. 35

control layer: community mandate — propose objectives

GDPR Art. 33/34

control layer: community mandate — propose objectives

GDPR Art. 32

Vector & Chunk-Level Access Control

ISO/IEC 42001 clause A.7 (indicative)

evidenced by: Vector ACL Verification Report

GDPR Art. 9

control layer: community mandate — propose objectives

GDPR Art. 88

control layer: community mandate — propose objectives

Take this into your GRC tooling

A control mapping your ISO/IEC 42001 or CSA AICM workbook can ingest, and an Annex IV skeleton to start the technical file from. Indicative mappings only — cells we are not confident about are exported empty rather than filled in.

Standards & Evidence

ISO/IEC 42005 (AI Impact Assessment)

Guidance for AI system impact assessments — supports DPIA/FRIA-style analyses.

unverified · no verification date publisher ISO

evidence for: GDPR Art. 35

ISO/IEC 27001:2022 + A.8.28

Information-security management; control A.8.28 (secure coding) is the natural anchor for AI code-generation and QA workflows alongside ISO 42001.

unverified · no verification date publisher ISO

evidence for: GDPR Art. 32

JTC 21 Technical Package (prEN 18228/18229/18281–83)

CEN-CENELEC JTC 21 technical package under standardisation request M/593 (prEN 18228 trustworthiness, 18229 risk management, 18281–83 CV/NLP evaluation et al.); staged drafts, none OJEU-cited yet — Annex III applicability (Dec 2027) is Omnibus-coupled to their availability.

draft · verified 2026-08-17 status unsourced publisher cencenelec.eu

evidence for: EU AI Act

IEEE CertifAIEd™

Ethics certification (transparency, accountability, algorithmic bias, privacy) for products and professionals; interfaces with the EU ALTAI assessment list.

unverified · no verification date

evidence for: EU AI Act

prEN 18229-1 (Trustworthiness Framework, part 1)

Part 1 of the JTC 21 trustworthiness deliverable — the framework layer other prEN 18xxx documents build on.

enquiry · verified 2026-08-11 status unsourced publisher kla.digital

evidence for: EU AI Act

Evidence you will need (10)

The concrete deliverables this use case's obligations ask for — grouped by what kind of artifact they are. Documentation is the largest single conformity cost block, so the list is a work plan, not a reading list. Full evidence matrix →

Assessments (2)

A structured judgement about risk, rights or a management system.

FRIA / AI Impact Assessment (AIIA)text-derivedserves 3 obligations

Fundamental-rights impact assessment (Art. 27, deployer-side) generalized to the AI Impact Assessment: societal, legal and operational risk evaluation per ISO/IEC 42005 and ISO 42001 Clause 8.2, defining HITL intervention parameters and acceptable-use bounds. Cadence: pre-deployment, refreshed annually and on major model updates — a stale AIIA is a finding, not a document.

verifiability: documented artefact — verifiable on inspection

chain: Art. 26 — Deployer Obligations · Art. 27 — Fundamental Rights Impact Assessment · EU AI Act · Clinical Imaging Triage & Patient Follow-Up

open in the graph →

Data Protection Impact Assessment (DPIA)text-derivedserves 2 obligations

GDPR Art. 35 assessment for high-risk processing; supervisory-authority consultation where residual risk stays high. ISO/IEC 42005 provides the AI-specific method.

verifiability: documented artefact — verifiable on inspection

chain: § 26 Abs. 1 S. 1 — Erforderlichkeit für Begründung, Durchführung, Beendigung · GDPR Art. 35 — DPIA

open in the graph →

Test reports (2)

Measured results from testing, evaluation or red-teaming.

Accuracy, Robustness & Red-Teaming Reportspractice-derived — dispute welcomeserves 2 obligations

Art. 15 evidence: declared accuracy metrics, adversarial and corruption robustness results (DIN SPEC 92001-2, ISO 24029), penetration and jailbreak-resistance testing, groundedness evaluation scores.

verifiability: independently-attested

chain: Art. 15 — Accuracy, Robustness, Cybersecurity · Art. 15 — Accuracy, Robustness, Cybersecurity → CO: Adversarial Robustness Verified · Enterprise SDLC Code Automation & QA · LLM01 Prompt Injection

open in the graph →dispute welcome →

Vector ACL Verification Reportpractice-derived — dispute welcome

Practice-derived artifact: the measured result of probing the retrieval path with low-privilege principals, the ACL reconciliation between source repositories and the index, and the outcome of the response-grounding rights re-check. Records which corpora were probed, which principals were used and every segment that was returned without an entitlement.

verifiability: self-asserted

chain: GDPR Art. 32 — Security of Processing → CO: Vector & Chunk-Level Access Control

open in the graph →dispute welcome →

Log records (2)

Machine-generated records produced while the system runs.

Event Logs & Decision Tracestext-derivedserves 17 obligations

The single highest-leverage artifact: hash-chained, WORM-stored logs with structured decision traces. Required capability fields per FprEN ISO/IEC 24970: input/output traces, execution timestamps, acting user/agent identity, referenced sources, human overrides. Audit-packet spec per event: model version, system-prompt/context hash, hyper-parameters (temperature, top-p), output payload, confidence score, active policy-ruleset versions, human override record. Simultaneously serves AI Act Art. 12, GDPR accountability, DORA incident reporting, NIS2 logging, PLD disclosure duties and its rebuttable defect presumption; financial-sector regimes push retention to 7 years (SEC 17a-4-class WORM rules). Credibility bar: anchor hash-chain heads externally (qualified timestamp / eIDAS ledger) so integrity survives an insider with admin rights.

verifiability: externally-anchored

chain: Art. 12 — Record-Keeping / Logging · CRA Art. 14 — Vulnerability & Severe-Incident Reporting · DORA Art. 19 — Major ICT-Incident Reporting · GDPR Art. 33/34 — Personal-Data Breach Notification · HIPAA Breach Notification Rule · NIS2 Art. 23 — Significant-Incident Reporting · +21 more

open in the graph →

Guardrail Telemetry & Sanitization Recordspractice-derived — dispute welcomeserves 3 obligations

Control-level evidence for the OWASP mappings: guardrail trigger records, blocked-prompt statistics (LLM01), runtime output-sanitization logs (LLM05), groundedness-check outcomes — the empirical proof that declared controls actually execute.

verifiability: tamper-evident

chain: Art. 15 — Accuracy, Robustness, Cybersecurity · Art. 50 — Transparency Duties → CO: AI Interaction & Content Disclosure · Art. 15 — Accuracy, Robustness, Cybersecurity → CO: Runtime Injection Defense · Dynamic Deal Desk & Quoting Engine · Enterprise Marketing Disclosure Compliance · LLM01 Prompt Injection · +3 more

open in the graph →dispute welcome →

Process records (4)

Traces that a process actually happened, and who did it.

Human-Oversight Protocol & Intervention Recordspractice-derived — dispute welcomeserves 5 obligations

Art. 14 evidence: documented oversight design (gates, thresholds, veto powers), reviewer qualification, and the record of actual approvals, overrides and escalations — also the GDPR Art. 22 meaningful-human-involvement proof.

verifiability: documented artefact — verifiable on inspection

chain: Art. 11 — automated individual decision-making · Art. 14 — Human Oversight · GDPR Art. 22 — Automated Decisions · Art. 12 — Record-Keeping / Logging → CO: Log Access & Retention Governance · Art. 14 — Human Oversight → CO: Oversight Competence & Authority · Clinical Imaging Triage & Patient Follow-Up

open in the graph →dispute welcome →

Individual Explanation Letters & Counterfactual Recordspractice-derived — dispute welcomeserves 5 obligations

Practice-derived artifact: the issued adverse-decision explanations together with the attribution run, model version and counterfactual scenario that each letter rested on, so an authority or a court can check that the stated reasons are the reasons the system actually used.

verifiability: self-asserted

chain: Art. 11 — automated individual decision-making · Art. 18 — Obligation to assess the creditworthiness of the consumer · Art. 21 — examination of an application · Art. 86 — Right to explanation of individual decision-making · GDPR Art. 22 — Automated Decisions

open in the graph →dispute welcome →

AI Literacy Training Recordspractice-derived — dispute welcomeserves 2 obligations

Art. 4 evidence: role-based training curricula and completion records for staff dealing with AI systems — the one obligation that applies at every risk level.

verifiability: documented artefact — verifiable on inspection

chain: Art. 4 — AI Literacy · Art. 14 — Human Oversight → CO: Oversight Competence & Authority

open in the graph →dispute welcome →

Personal-Data Breach Notification Recordtext-derivedserves 2 obligations

The GDPR Art. 33(5) record of every personal-data breach: facts, effects, remedial action, plus the notification sent to the supervisory authority and, where required, the data subjects.

verifiability: tamper-evident

chain: GDPR Art. 33/34 — Personal-Data Breach Notification · HIPAA Breach Notification Rule

open in the graph →

Architecture Blueprint

Grounded Citational RAG

Retrieval architecture built for citability: temperature zeroised for the synthesis step, every factual sentence verified against its retrieved chunk by an NLI entailment check before it is emitted, and each source carried as an id plus a SHA-256 content hash so the exact text a claim rested on can be re-fetched and compared. Unentailed sentences are dropped or marked, never smoothed.

Guarded RAG Pattern

For limited-risk conversational/generative systems: deterministic RAG with input rails (DLP/NER, injection blocking), retrieval rails (relevance, freshness, ACL) and output rails (groundedness check with deterministic fallback), plus synthetic-content labelling.

Human-in-the-Loop Core Pattern

For high-risk decision support over people (HR, credit, benefits): confidence-thresholded escalation queues, WORM audit vault, bias testing per ISO 5259 — the human decision is architecturally enforced. CORRECTED 2026-08-15: this pattern previously recommended a post-hoc explainability API (SHAP/LIME or CoT traces) as the explanation mechanism for consequential scoring of natural persons. That is the wrong default. Post-hoc local explainers are sampling-unstable, vary with perturbation choice and are susceptible to fairwashing, and an adverse-action reason that would not change the outcome if the applicant remediated it is not a defensible reason. For consequential scoring (credit, insurance pricing, tenant screening, employment scoring) use intrinsic interpretability — glass-box additive models with monotonic constraints — and keep post-hoc methods as a supplementary diagnostic only.

Required Technical Components (24)

HITL Escalation Queue & Review UI

HITL escalation queue & review UI ('Human-as-a-Tool': the agent calls the human like any other tool via propose-action objects). Confidence- and risk-threshold routing, SLA timers, structured accept/modify/reject verdicts with digital reviewer signature at gate release — each verdict is itself Art. 14 evidence and feeds the active-learning loop.

from: GDPR Art. 22 · Human-in-the-Loop Core Pattern

Adverse-Decision Reason Generator

Practice-derived component: converts feature attributions (SHAP or an equivalent attribution method) into an individually understandable, legally defensible explanation of an adverse decision — the role the AI system played, the main elements the decision rested on, and counterfactual scenarios stating what would have had to differ for a different outcome. Reason codes are generated from the decisioning path, not from a marketing template, and every issued letter is retained with the model version and the attribution run behind it. Honesty condition: a reason is only usable if acting on it would actually change the outcome, which non-monotonic feature interactions can break (see the post-hoc instability threat).

from: GDPR Art. 22

Bitemporal Memory (GDPR×Art.12)

valid_from/valid_to + transaction time on every record: GDPR erasure removes data from the active retrieval path while the HMAC-chained immutable log survives for Art. 12 / PLD defence; tenant-scoped partitions allow physical scrub of PII.

from: GDPR Art. 17

PII Scrubbing / DLP-NER Layer

Automated detection, pseudonymisation and blocking of personal data in inputs, retrievals and outputs.

from: GDPR Art. 25 · Guarded RAG Pattern

Per-Tenant Retrieval Segmentation

Retrieval is scoped by tenant and by caller entitlement at query time, preventing cross-client and cross-role leakage through shared indexes.

from: GDPR Art. 25

Segmented Vector Store (RBAC + CMEK)

Vector indexes, embeddings and document stores are logically and physically partitioned per client, with role-based access and customer-managed encryption keys.

from: GDPR Art. 25 · GDPR Art. 32 · Grounded Citational RAG

PII/PHI Redaction & Tokenisation Engine

The engine behind inline tokenisation: pre-model interception that replaces identifiers with reversible tokens before a payload leaves the isolation boundary, plus a detokenisation gate that re-identifies only for authorised callers inside the boundary and logs every re-identification. Complements the DLP/NER scrubbing layer, which blocks or masks rather than preserving reversible reference.

from: GDPR Art. 25

DICOM De-Identification Pipeline

Practice-derived component: removal and replacement of identifying attributes in imaging studies before they leave the clinical system — header attributes per the DICOM confidentiality profiles, burned-in pixel text detected and masked, private tags dropped rather than trusted, and a consistent pseudonym per patient so longitudinal studies stay linkable without re-identifying anyone. Re-identification risk on the de-identified corpus is measured, not assumed.

from: GDPR Art. 25 · GDPR Art. 9

Live Risk Register / Posture Management

Continuously updated risk register wired to runtime posture: threat-model deltas, open defects, control status, exposure per system. Includes Shadow-AI discovery — continuous scanning for unsanctioned agents, MCP servers and AI API usage outside the register; an unregistered agent is an unmanaged Art. 12/26 liability and the empirical driver of proportionate (not blanket) controls.

from: GDPR Art. 35

Unified Incident-Response Runbook

One procedure reconciling AI Act Art. 73, GDPR Art. 33 (72h), DORA and NIS2 (24h/72h) timelines and recipients.

from: GDPR Art. 33/34

Retrieval Rails (ACL-aware RAG)

Relevance, freshness and per-user permission checks on every retrieved chunk; curated, versioned index.

from: GDPR Art. 32 · Grounded Citational RAG · Guarded RAG Pattern

Supervisor Attribution Chain

Every model inference, data interaction and client-facing artefact is bound to an authorised supervising natural person — never to a shared service account. Required for SEC Rule 204-2 attribution, SOX segregation of duties and AI Act Art. 26 deployer oversight records.

from: Grounded Citational RAG

Confidence Scoring & Threshold Gate

Computes a probabilistic confidence score for every output and holds the transaction when the score falls below the workflow's regulatory threshold.

from: Grounded Citational RAG · Human-in-the-Loop Core Pattern

Output Rails / Groundedness Check

Faithfulness scoring of answers against retrieved sources; deterministic fallback instead of hallucination; schema-validated structured output.

from: Grounded Citational RAG · Guarded RAG Pattern

Input Rails / Prompt Shields

Pre-model validation of user input: injection detection, topic blocking, encoding checks.

from: Guarded RAG Pattern

Synthetic-Content Labelling / Watermarking

Synthetic-content labelling & watermarking: visible disclosure plus machine-readable provenance (C2PA Content Credentials) embedded in generated images, audio and video; metadata identifying artificial origin survives common transformations. Discharges Art. 50(2)/(4) for deepfakes and synthetic media; verification telemetry (watermark presence/validity checks at publication gates) is the corresponding evidence stream.

from: Guarded RAG Pattern

Dual-Gate Validation Pipeline

Input and output validation as two independent gates (MLCommons-hazard-class semantic filters, groundedness checks, structural validators: LLM Guard sub-ms–10 ms, Llama Guard <90 ms, NeMo <50 ms, Guardrails AI 50–200 ms). Latency economics decide the architecture: sequential gate chains add 300–800 ms per agent action; parallel evaluation collapses total added latency to the slowest single check — run independent checks concurrently, reserve sequential ordering for true dependencies.

from: Guarded RAG Pattern

Explainability API (SHAP/LIME/CoT)

Feature attributions for classical ML, reasoning-trace summaries for GenAI — feeds the human reviewer and the technical file.

from: Human-in-the-Loop Core Pattern

WORM / Immutable Audit Vault

Append-only, hash-chained audit vault (WORM object-lock storage, AES-256 at rest, TLS 1.3 in transit). Guarantees tamper-evidence within the organization's trust domain — which stops your own team, but not an admin who can rebuild the vault. Pair with an external trust anchor and key ceremonies outside the operating team for evidence that holds against the insider scenario.

from: Human-in-the-Loop Core Pattern

Bias Testing & Data Quality Pipeline

Representativeness checks, bias metrics and mitigation per ISO/IEC 5259; versioned datasets with lineage.

from: Human-in-the-Loop Core Pattern

Durable Checkpointing (Pause & Resume)

At oversight gates the complete operational state — working memory, conversation history, tool arguments, intermediate artifacts — is serialized into a durable checkpoint (fast KV store for sub-ms lookups, transactional backend as recovery anchor, vector store for semantic caching of past human decisions). On approval the agent deserializes and resumes at the exact step; matched precedents can shortcut re-planning entirely.

from: Human-in-the-Loop Core Pattern

Kill Switch / Graceful Degradation

Operator stop controls and degraded-mode fallbacks; real-time override (veto) channels for HOTL operation.

from: Human-in-the-Loop Core Pattern

Trust & Risk Dual Scoring

Escalation triggers built from two independent signals, because raw model confidence is uncalibrated: calibrated trust scores (prompt relevance, similarity to historic successes, cross-model consistency) plus deterministic risk scores (sensitive categories, transaction value, protected data) — either crossing its threshold forces human review.

from: Human-in-the-Loop Core Pattern

Active-Learning Feedback Loop

Human corrections at oversight gates are serialized as structured data — original context, model proposal, human edit, rationale — and fed into fine-tuning pipelines and prompt registries, systematically reducing future escalation rates instead of dying in review UIs.

from: Human-in-the-Loop Core Pattern

Build or Buy — Vendor Layer (10)

The graph models vendor CATEGORIES as first-class nodes and keeps named vendors as community-maintained, disputable desc content with lastVerified dates. A category is stable; a vendor list is a currency-layer object like any standard node.

Agent Orchestration & SDLC Toolkits

Developer middleware for multi-agent networks, tool-use chains, RAG abstraction, state and memory persistence, and model routing. Named products live in marketExamples; prose here describes the class. Regulatory posture: orchestration code is where autonomy tiering, propose-action objects and fallback routing get implemented — the framework choice constrains which controls are cheap and which are retrofits. Selection metrics: see meta.marketLandscape.selectionMetrics.orchestration.

unverified · verified 2026-08-18 community-maintained

selection metrics: broad model-API abstraction, state/memory management, error recovery, fallback routing hooks

supplies: HITL Escalation Queue & Review UI

EU data boundary requiredFilters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.

Example	Sub-category	What it does	Hosting	Claimed alignments
LangChain / LangGraph	agent framework	Graph-structured agent runtime; interrupt/pause nodes support implementing human approval at defined steps. Typical: multi-step agents, approval workflows.	not checked	supports implementing Art. 14 oversight (claimed)supports Art. 12 step logging (claimed)
LlamaIndex	RAG framework	Indexing and query abstractions over documents and structured sources. Typical: enterprise RAG, document agents.	open source	retrieval-governance positioning
Microsoft AutoGen	multi-agent framework	Conversational multi-agent patterns with pluggable tool executors. Typical: multi-agent research, code agents.	not checked	research/OSS, no vendor certification
CrewAI	multi-agent framework	Role-based agent teams with task delegation and process templates. Typical: process automation, role-based agents.	not checked	vendor-stated security posture

and 6 more in the stack advisor →

Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.

Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.

open in graph dispute / propose change

Agent Observability & Model Risk Management

Tracing, evaluation, drift monitoring and model-validation records. This layer is where Art. 12 record-keeping becomes technically real (step-level traces, prompt/response records, retention control) and where model-risk practice in the SR 11-7 tradition — validation evidence, performance and drift monitoring, challenger comparison — is operated. Gateways and tracing tools produce the logs; the retention, integrity and access regime around them is still yours.

unverified · verified 2026-08-18 community-maintained

selection metrics: Trace completeness per agent step; log retention and immutability options; drift/quality metrics available out of the box; evaluation dataset support; export into your audit vault; self-host option.

supplies: Adverse-Decision Reason Generator · Confidence Scoring & Threshold Gate · Dual-Gate Validation Pipeline · Explainability API (SHAP/LIME/CoT) · Bias Testing & Data Quality Pipeline

EU data boundary requiredFilters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.

Example	Sub-category	What it does	Hosting	Claimed alignments
LangSmith	agent tracing & evaluation	Trace capture and evaluation over LangChain/LangGraph runs with dataset-based scoring. Typical: step tracing, regression evaluation.	not checked	SOC 2 (claimed)supports Art. 12 record-keeping (claimed)
Langfuse	agent tracing & evaluation	Open-source tracing, prompt management and evaluation; self-hostable for retention control. Typical: self-hosted tracing, cost/latency analytics.	open source	GDPR-positioned supports Art. 12 record-keeping (claimed)
Arize AI / Phoenix	ML & LLM observability	Production monitoring with drift and performance analysis; Phoenix is the open-source tracing side. Typical: drift monitoring, production analytics.	not checked	SOC 2 (claimed)drift-monitoring positioning (SR 11-7 style, claimed)
Helicone	LLM gateway & logging	Proxy-level logging of prompts, costs and latency across providers. Typical: gateway logging, cost control.	not checked	SOC 2 (claimed)supports Art. 12 record-keeping (claimed)

and 11 more in the stack advisor →

open in graph dispute / propose change

AI GRC & Governance Platforms

Second-line systems of record: model/agent inventory incl. third-party SaaS AI, automated risk tiering, policy administration, cross-framework mapping and control deduplication, audit-evidence generation, intake workflows. Named products live in marketExamples, which is the single source of truth for this layer — prose here describes the class, not the field. What the class buys you: one register a second line can defend, and evidence assembled once and reused across frameworks. Selection metrics: see meta.marketLandscape.selectionMetrics.grc. One compilation-reported item is deliberately kept as unverified: a claimed updated US banking model-risk guidance 'SR 26-2'. Two secondary compilations repeating it is corroboration of the rumour, not of the guidance; it stays flagged pending verification against Federal Reserve primary sources, and a curator verification proposal is filed. All alignments in this layer are vendor-positioned claims, never certifications.

unverified · verified 2026-08-18 community-maintained

selection metrics: multi-model/multi-cloud cataloging incl. third-party SaaS, automated risk tiering, regulatory reporting, independent-2nd-line deployability, cross-framework control deduplication

supplies: Adverse-Decision Reason Generator · Live Risk Register / Posture Management · Supervisor Attribution Chain

EU data boundary requiredFilters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.

Example	Sub-category	What it does	Hosting	Claimed alignments
Credo AI	AI governance platform	Policy packs, risk tiering and evidence workflows mapped across frameworks. Typical: AI registry, policy administration. Scope overlap: Its scope overlaps this platform's own; we have a commercial interest in the comparison.	not checked	ISO 42001 alignment (claimed)EU AI Act readiness positioning
Holistic AI	AI governance & audit	Risk assessment, bias auditing and regulatory reporting workflows. Typical: bias audit, regulatory reporting. Scope overlap: Its scope overlaps this platform's own; we have a commercial interest in the comparison.	not checked	NYC LL144 audit support (claimed)EU AI Act readiness positioning
IBM watsonx.governance	AI governance platform	Governance, factsheets and monitoring integrated with the IBM stack. Typical: factsheets, model monitoring. Scope overlap: Its scope overlaps this platform's own; we have a commercial interest in the comparison.	not checked	ISO 42001 alignment (claimed)Art. 11 documentation support (claimed)
ModelOp	AI/model governance	Model and agent inventory with automated lifecycle controls for large estates. Typical: model inventory, control automation. Scope overlap: Its scope overlaps this platform's own; we have a commercial interest in the comparison.	not checked	model-risk positioning (SR 11-7 style, claimed)ISO 42001 alignment (claimed)

and 3 more in the stack advisor →

open in graph dispute / propose change

Grounding, Retrieval & Agent Memory

The grounding layer between raw sources and the model: document parsers, embedding models, vector databases and — new in the agentic era — persistent agent memory stores. Memory is the hard part: once a personal fact is embedded, GDPR Art. 17 erasure has to reach the vector and the memory record, not just the source row, and embeddings are partially reconstructable (see IronCore in the privacy layer). Retrieval quality is also a data-governance question under Art. 10: what got parsed, chunked and indexed is what the system 'knows'.

unverified · verified 2026-08-18 community-maintained

selection metrics: Parsing fidelity on your worst document class; retrieval precision/recall on a labelled set; tenant and ACL isolation model; per-vector encryption and erasure path; memory TTL and record semantics; self-host option.

supplies: Bitemporal Memory (GDPR×Art.12) · Per-Tenant Retrieval Segmentation · Segmented Vector Store (RBAC + CMEK) · Retrieval Rails (ACL-aware RAG)

EU data boundary requiredFilters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.

Example	Sub-category	What it does	Hosting	Claimed alignments
Docling	document parser	Open-source layout-aware parsing of PDFs and office formats into structured chunks. Typical: RAG ingestion, air-gapped pipelines.	self-hostable	EU sovereignty positioning
LlamaParse	document parser	Managed parsing service tuned for tables and complex documents feeding RAG. Typical: RAG ingestion, table extraction.	not checked	SOC 2 (claimed)
Amazon Textract	document parser	OCR and form/table extraction with per-page pricing inside AWS. Typical: document intake, claims processing.	not checked	SOC 2 (claimed)HIPAA-eligible (claimed)ISO 27001 (claimed)
Diffbot	web/knowledge extraction	Structured extraction and knowledge-graph construction from web sources. Typical: market monitoring, entity resolution.	not checked	vendor-stated security posture

and 12 more in the stack advisor →

open in graph dispute / propose change

Confidential Computing & Privacy Engines

Data-in-use protection and pre-model privacy interception: enclave and runtime encryption, key management, tokenisation vaults, PII detection and redaction, application-layer and vector encryption. Named products live in marketExamples; prose here describes the class. Select on: enclave attestation support, key custody model (external HSM / BYOK), detokenisation audit trail, latency added per call, and coverage of the identifier classes your regime actually names. Selection metrics: see meta.marketLandscape.selectionMetrics.privacy.

unverified · verified 2026-08-18 community-maintained

selection metrics: enclave attestation support, key custody (external HSM / BYOK), detokenisation audit trail, added latency per call, coverage of the identifier classes your regime names, in-boundary deployment option

supplies: PII/PHI Redaction & Tokenisation Engine · DICOM De-Identification Pipeline

EU data boundary requiredFilters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.

Example	Sub-category	What it does	Hosting	Claimed alignments
Anjuna	confidential computing	Runs workloads inside hardware enclaves without application rewrites. Typical: data-in-use protection, regulated inference.	not checked	confidential-computing positioningDORA-positioned (claimed)
Fortanix	confidential computing & KMS	Enclave runtime plus key management and tokenisation services. Typical: key management, data-in-use protection.	not checked	FIPS 140-2 (claimed)DORA-positioned (claimed)HIPAA-positioned (claimed)
Skyflow	privacy vault	Polymorphic data vault de-identifying records before they reach a model. Typical: PII vaulting, pre-model redaction.	not checked	SOC 2 (claimed)HIPAA-positioned GDPR-positioned
Private AI	PII detection & redaction	Detection and redaction of identifiers across text, documents and audio. Typical: inline redaction, document de-identification.	not checked	GDPR-positioned HIPAA-positioned

and 1 more in the stack advisor →

open in graph dispute / propose change

Secure Data Infrastructure & Vector Storage

Governed retrieval substrate: vector databases, lakehouses and catalogs with tenant/namespace isolation, RBAC and client-managed keys (CMEK), lineage into RAG chunks, air-gap options, and code-level data and AI lineage. Named products live in marketExamples; prose here describes the class. What the class buys you: retrieval that can be scoped per requester and traced back to a source record. The Art. 10 runtime data-governance duties land here. Selection metrics: see meta.marketLandscape.selectionMetrics.data.

unverified · verified 2026-08-18 community-maintained

selection metrics: namespace/tenant isolation, RBAC + CMEK, lineage into RAG chunks, SOC 2 / ISO 27001 attestations, air-gap capability

supplies: Retrieval Rails (ACL-aware RAG)

EU data boundary requiredFilters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.

Example	Sub-category	What it does	Hosting	Claimed alignments
Azure AI Search	managed retrieval	Managed hybrid search with security trimming against tenant identities. Typical: ACL-aware RAG, enterprise search.	not checked	ISO 27001 (claimed)SOC 2 (claimed)
Databricks Unity Catalog	governed lakehouse	Catalog and lineage spanning tables, features and RAG chunks. Typical: lineage evidence, governed RAG.	not checked	SOC 2 (claimed)lineage/Art. 10 support (claimed)
Relyance AI	code-level data & AI lineage	Parses source repositories to map data and inference flows at code level, with CI checks on changes to those flows. Typical: data lineage, shift-left privacy review. Scope overlap: Its AI-governance reporting scope overlaps this platform's own; we have a commercial interest in the comparison.	SaaS (vendor cloud)	GDPR programme tooling (claimed)EU AI Act readiness positioning
Snowflake Cortex	governed lakehouse	Model calls inside the warehouse boundary with masking and clean rooms. Typical: in-warehouse inference, governed analytics.	not checked	SOC 2 (claimed)ISO 27001 (claimed)HIPAA-eligible (claimed)

open in graph dispute / propose change

Cryptographic Evidence & Audit Ledger

Tamper-evident recording of what a system did: content-addressed decision records, hash chains and external anchoring, so a log can be shown not to have been rewritten after the fact. This is the layer that turns Art. 12 logging and Art. 19 retention from a storage question into an evidentiary one. AI Verify is carried in RAIN as a STANDARD node (sg-ai-verify), not duplicated here as a vendor.

unverified · verified 2026-08-18 community-maintained

selection metrics: Append-only guarantees and who can rotate or delete (including the vendor); anchoring mechanism (qualified timestamp, transparency log, notarisation) and whether verification works without the vendor; retention and export in a readable format at end of contract; throughput and cost at your event volume.

supplies: Supervisor Attribution Chain · WORM / Immutable Audit Vault

EU data boundary requiredFilters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.

Example	Sub-category	What it does	Hosting	Claimed alignments
Fact0	cryptographic evidence ledger	Positions itself as a tamper-evident ledger for AI decision records. Typical: decision records, audit trail.	not checked	supports Art. 12 record-keeping (claimed)
Traccia	audit trail & traceability	Positions itself around traceability of AI pipeline steps and artefacts. Typical: traceability, artifact lineage.	not checked	supports Art. 12 record-keeping (claimed)

open in graph dispute / propose change

Runtime Security & Guardrail Vendors

First-line inline enforcement: single-pass parallel input/output evaluation proxies, injection and exfiltration defense, PII masking, grounding checks, SecOps routing. Named products live in marketExamples; prose here describes the class. What the class buys you: a policy decision point in the request path that fails closed and emits telemetry an auditor can read. Selection metrics: single-pass latency (<20 ms class), catch rates, policy-version telemetry into the AI-BOM. Consolidation matters commercially: a guardrail acquired by a platform vendor tends to follow that platform's roadmap, which is a lock-in question rather than a security one — reported acquisitions are recorded per entry as reported, not asserted here.

unverified · verified 2026-08-18 community-maintained

selection metrics: single-pass parallel evaluation latency (<20 ms class), injection/hallucination catch rates, SecOps/SIEM routing, policy versioning surfaced into the AI-BOM

supplies: Output Rails / Groundedness Check · Input Rails / Prompt Shields · Dual-Gate Validation Pipeline

EU data boundary requiredFilters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.

Example	Sub-category	What it does	Hosting	Claimed alignments
Lakera	guardrail proxy	Inline prompt-injection and content detection at request time. Typical: injection defence, content filtering.	not checked	SOC 2 (claimed)supports Art. 15 robustness measures (claimed)
HiddenLayer	model/agent detection & response	Model-layer detection and response with adversarial-attack telemetry. Typical: model threat detection, red-team telemetry.	not checked	SOC 2 (claimed)supports Art. 15 robustness measures (claimed)
Palo Alto Prisma AIRS	network-integrated AI security	AI runtime security folded into an existing enterprise network security estate. Typical: enterprise rollout, egress control.	not checked	SOC 2 (claimed)enterprise security integration (claimed)
Cisco AI Defense	network-integrated AI security	Discovery of AI usage plus inline enforcement across the corporate network. Typical: shadow-AI discovery, inline enforcement.	not checked	enterprise security integration (claimed)

and 4 more in the stack advisor →

open in graph dispute / propose change

Runtime Guardrails & Enforcement

Policy enforcement in the request path: input/output validation, injection and exfiltration defence, structured-output constraints and action blocking. Distinct from observability layers because these products are in-line and can refuse. Selection questions: added latency at p95, whether enforcement is fail-open or fail-closed, whether policies are versioned artefacts, and whether the layer can be self-hosted inside your data boundary.

unverified · verified 2026-08-18 community-maintained

selection metrics: Where enforcement sits (inline proxy, sidecar, SDK) and the added latency at your token volumes; whether policy is versioned and testable as code; fail-open vs. fail-closed behaviour under guardrail outage; language and modality coverage; whether every block writes an evidence record you can cite later.

supplies: Output Rails / Groundedness Check · Input Rails / Prompt Shields

EU data boundary requiredFilters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.

Example	Sub-category	What it does	Hosting	Claimed alignments
Guardrails AI	validation framework	Open-source validator framework for structured output and content policies in the request path. Typical: output validation, structured output.	open source	supports Art. 15 robustness measures (claimed)
NVIDIA NeMo Guardrails	dialogue policy rails	Programmable dialogue and topic rails placed around an LLM application. Typical: topic control, dialogue policy.	open source	supports Art. 50 interaction disclosure patterns (claimed)
Lakera AI	guardrail proxy	Inline prompt-injection and content detection at request time. Typical: injection defence, content filtering.	SaaS (vendor cloud)	SOC 2 (claimed)supports Art. 15 robustness measures (claimed)
Credal AI	enterprise access & policy layer	Permission-aware access layer with data-loss controls in front of enterprise assistants. Typical: access control, DLP.	SaaS (vendor cloud)	SOC 2 (claimed)

open in graph dispute / propose change

Regulated Foundation-Model Platforms

Frontier commercial APIs and open-weight models under enterprise controls: zero-data-retention tiers, data isolation, fine-tuning governance, safety alignment documentation, EU-sovereign options. Named products live in marketExamples, where the deployment model is recorded in the hosting field rather than asserted in prose. What the class buys you: a model supply relationship with contractual data handling and documentation you can pass to a customer. GPAI-chapter duties and provider due diligence attach at this layer. Selection metrics: see meta.marketLandscape.selectionMetrics.models.

unverified · verified 2026-08-18 community-maintained

selection metrics: ZDR enterprise tiers, data isolation, EU-sovereign options, fine-tuning controls, safety alignment documentation

supplies: Synthetic-Content Labelling / Watermarking

EU data boundary requiredFilters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.

Example	Sub-category	What it does	Hosting	Claimed alignments
OpenAI (Enterprise / API)	proprietary frontier	Enterprise tiers offer zero-data-retention and no-training commitments over the commercial API. Typical: general copilots, document reasoning.	not checked	SOC 2 (claimed)ISO 27001 (claimed)zero-data-retention tier (claimed)GDPR-positioned
Anthropic Claude (Enterprise)	proprietary frontier	Enterprise/ZDR tiers with published safety and model documentation practice. Typical: regulated assistants, long-context analysis.	not checked	SOC 2 (claimed)ISO 27001 (claimed)zero-data-retention tier (claimed)HIPAA-eligible (claimed)
Google Gemini Enterprise	proprietary frontier	Vertex-hosted frontier models with regional grounding and customer-managed keys. Typical: enterprise search, multimodal workflows.	not checked	SOC 2 (claimed)ISO 27001 (claimed)HIPAA-eligible (claimed)EU data-boundary positioning
Cohere	proprietary frontier	Private-cloud and on-prem deployment of retrieval-oriented models. Typical: private RAG, enterprise search.	self-hostable	SOC 2 (claimed)

and 7 more in the stack advisor →

open in graph dispute / propose change

Procurement rule: Derived from three-lines-of-defense separation: the second-line GRC platform must be procured and deployed independently of any first-line runtime or model vendor — a governance tool that only sees its own vendor's models cannot govern a multi-model estate, and closed third-party SaaS AI can only be governed contractually (intake, attestation, AI-BOM disclosure), never by inline inspection.

Outsourced delivery BPO · SaaS · Service-as-a-Software caveats

Delivery Model — BPO · SaaS · Service-as-a-Software

Spectrum

BPO: input-priced (billable hours/FTEs), linear headcount scaling, human error & attrition as primary risk

SaaS: capability-priced (software access), client operates the workload, implementation/adoption failure as primary risk

Service-as-a-Software: outcome-priced (SLA on completed work), provider-managed AI executes 60–80% of cognitive tasks with specialist supervision, algorithmic bias & non-compliance as primary risk

Caveats in regulated markets

— Outcome SLAs move compliance risk onto the provider — but NOT the buyer's deployer duties: Art. 26 oversight, log retention and FRIA obligations stay with the enterprise even when execution is outsourced.

— Provider role analysis is the central legal question: a productized platform that fine-tunes, re-purposes or chains models can flip into the Art. 25 provider role with full high-risk obligations.

— Certified operations (ISO 42001) function as a procurement moat and shortcut third-party risk assessment — but organizational certificate ≠ product conformity (never conflate, see meta.assuranceEcosystem).

— The buyer's evidence chain must reach into the provider: contractually mandated AI-BOM disclosure, ZDR certificates, bias-audit reports and logging-ledger access are the artifacts that make an outsourced workflow auditable.

Service-as-a-Software pattern CO: Embedded-AI vendor governance

Threat Profile

LLM01 Prompt Injection

Direct or indirect (RAG/files/web) instructions override system prompts — the primary attack vector on the perception layer.

mitigate with: Input Rails / Prompt Shields, Guardrail Sidecar / Interception, Trinity Defense (TCB + Command Gates + IFC), Divided-Focus Memory Tiering, Dual-Gate Validation Pipeline

LLM02 Sensitive Info Disclosure

Leakage of PII, trade secrets or system prompts in outputs.

mitigate with: PII Scrubbing / DLP-NER Layer, Output Rails / Groundedness Check, PII/PHI Redaction & Tokenisation Engine

LLM09 Misinformation

Hallucinated or wrong outputs create liability and decision risk.

mitigate with: Output Rails / Groundedness Check, Explainability API (SHAP/LIME/CoT)