◎ OS PUB Apache 2.0 ← All specifications

P143 — AIEP — Regulatory Compliance Proof Protocol

Publication Date: 2026-04-12 Status: Open Source Prior Art Disclosure Licence: Apache License 2.0 Author/Organisation: Phatfella Ltd Schema: AIEP_OS_SPEC_TEMPLATE v1.0.1 — https://aiep.dev/schemas/aiep-os-spec-template/v1.0.1

Field of the Invention

[0001] The disclosure relates to regulatory compliance verification systems within computing environments.

[0002] More particularly, the disclosure concerns a regulatory compliance proof protocol for use within an Architected Instruction and Evidence Protocol (AIEP) system, enabling AI systems to generate cryptographically bound compliance proof artefacts that demonstrate adherence to specific regulatory frameworks without requiring human attestation at the point of proof generation.

Framework Context

[0003] This invention operates within an Architected Instruction and Evidence Protocol (AIEP) environment as defined in United Kingdom patent application number GB2519711.2, filed 20 November 2025, the entire contents of which are incorporated herein by reference.

[0004] The present invention extends automated regulatory compliance certification mechanisms defined in P92, jurisdiction-specific compliance packaging mechanisms defined in P93, and meta-governance reasoning mechanisms defined in P141 while remaining independently implementable as described herein.

Background

[0005] Regulatory frameworks require AI systems to demonstrate compliance at the point of audit, not merely assert it. Existing compliance reporting systems produce self-attestation documents without cryptographic evidence binding, preventing independent verification.

[0006] There exists a need for a compliance proof mechanism that maps regulatory requirements to evidence artefacts, computes cryptographically bound compliance proof records, and produces proofs that auditors can independently verify against the evidence artefacts without access to the system that generated them.

Summary of the Disclosure

[0007] A computer-implemented regulatory compliance proof protocol comprises: receiving a ComplianceProofRequest specifying a regulatory framework identifier, a framework version, and an audit scope; retrieving the RegulatoryRequirementSet for the specified framework and version from the compliance registry; for each requirement in the RegulatoryRequirementSet, identifying the evidence artefacts that satisfy it; computing a RequirementSatisfactionHash as H(requirement_id || evidence_artefact_hashes || satisfaction_rule_id); generating a ComplianceProofRecord containing the regulatory framework identifier, framework version, RequirementSatisfactionHashes for all requirements, and a ComplianceProofHash computed as H(all_requirement_satisfaction_hashes || framework_id || framework_version); and returning the ComplianceProofRecord as a verifiable artefact.

[0008] Requirements for which no satisfying evidence artefacts exist produce a non-satisfied outcome within the ComplianceProofRecord without omission. A ComplianceProofRecord with any non-satisfied requirement is non-compliant; no partial compliance is reported.

[0009] The technical effect is modification of computing system behaviour by enforcing evidence-bound regulatory compliance proof generation, enabling auditor-verifiable compliance records without reliance on system self-attestation.

Claims

[0010] A computer-implemented method for regulatory compliance proof generation comprising: receiving a ComplianceProofRequest; retrieving a RegulatoryRequirementSet; mapping requirements to evidence artefacts; computing RequirementSatisfactionHashes; generating a ComplianceProofRecord; and returning the record as a verifiable artefact.

[0011] The method of claim 1 wherein unsatisfied requirements are recorded explicitly within the ComplianceProofRecord without omission.

[0012] The method of claim 1 wherein partial compliance is not reported — a ComplianceProofRecord containing any non-satisfied requirement carries a non-compliant status.

[0013] A system for regulatory compliance proof generation comprising one or more processors and a non-transitory computer-readable medium storing instructions to execute the method of any preceding claim.