Skip to content

SOP-032 — AI-regulatory compliance register

Guide

<!-- last-reviewed: 2026-06-01 · owner: Legal & Compliance (Legal Director) -->

SOP-032 — AI-regulatory compliance register

SOP · owner: Legal & Compliance (Legal Director). Layer: SOP/Runbook (docs/canon.md). Procedure for maintaining docs/legal/ai-compliance.md — the register of AI-regulatory and model-provider obligations. Checklist-level tracking is the Compliance Analyst’s SOP-033 (docs/sop/SOP-033-compliance-checklist.md).

Interface Contract

  • Inputs: compliance checklist + evidence ← from Compliance Analyst · trigger: “scan complete”
  • Inputs: data-handling question ← from Personal Assistant · trigger: “personal-data scoped”
  • Outputs: compliance requirements → to Engineering Director · trigger: “requirements issued”
  • Outputs: approved compliance register → to Archivist · trigger: “artifact approved”
  • Handoff trigger (in): a new regulation passes, a model provider updates terms, a new AI capability is proposed, or a periodic review is due
  • Handoff trigger (out): the register is updated with status + next-review date, and any blocker is escalated to the Principal
  • Definition of Done before handoff:
    • [ ] Each applicable regulation has a row: status · open obligation · next review
    • [ ] EU AI Act system classification recorded with rationale
    • [ ] Model-provider terms (Anthropic Usage Policy) reflected
    • [ ] Any feature-blocking obligation escalated to the Principal immediately
    • [ ] Register Principal-approved; learnings captured if any

Trigger note. requirements issued, personal-data scoped, and scan complete (shared with SOP-031/033/034) are registered verbatim phrases (Wave 1 additions, Operations-approved 2026-06-01) in docs/handoff-triggers.md — draw from the registry, do not invent inline.

Purpose

Hold every AI-regulatory and model-provider obligation in one tracked register so a regulatory change or a provider terms update is assessed within one session and never silently strands a feature.

When to use

When a regulation passes (EU AI Act milestone, a US state AI statute), when Anthropic updates its Usage Policy, when a new AI capability is proposed, or on periodic review. As of 2026-06-01 docs/legal/ai-compliance.md does not exist; the obligations currently live only inside ADR-0017 prose — the first run consolidates them into the register.

Flow

flowchart LR
  A["Identify applicable<br/>regs + provider terms"] --> B["Classify<br/>(EU AI Act tier)"]
  B --> C["Record status +<br/>open obligation"]
  C --> D{"Blocks a<br/>feature?"}
  D -->|yes| E["Escalate to<br/>Principal now"]
  D -->|no| F["Set next-review<br/>date"]
  E --> G["Update register<br/>→ Principal → Archivist"]
  F --> G
  classDef s fill:#1d4ed8,color:#fff,stroke:#1e3a8a
  classDef d fill:#0f766e,color:#fff,stroke:#134e4a
  class A,B,C,E,F,G s
  class D d

Text fallback: identify the applicable regulations and provider terms → classify (e.g. EU AI Act risk tier) → record status and open obligations → if anything blocks a current/planned feature, escalate to the Principal immediately; otherwise set a next-review date → update the register, route to Principal, then Archivist.

Steps

  1. Identify applicable frameworks: EU AI Act, US state AI statutes (CO AI Act, CA), Anthropic Usage Policy, plus the data-handling obligations already in ADR-0017.
  2. Classify the system under each (provisional EU AI Act posture: limited-risk transparency tier for an LLM-assisted learning tool — reassess if any feature does automated decisioning).
  3. Record each as a row: regulation · current status · open obligation · next review.
  4. Pull in checklist evidence from the Compliance Analyst (SOP-033 (docs/sop/SOP-033-compliance-checklist.md)).
  5. Escalate blockers to the Principal immediately; issue any technical requirement to Engineering (requirements issued).
  6. Update docs/legal/ai-compliance.md, route to Principal, then Archivist.

Roles / approvers

Authored and run by the Legal Director; evidence from the Compliance Analyst; register approved by the Principal.

Guardrails

  • Read primary regulatory/provider text; date every consultation.
  • No security controls / no code — issue requirements; Security/Engineering implement.
  • No internal rules — legal backing only; Golden Rule/HR own internal policy.
  • Honest uncertainty on unsettled AI law — frame risk, name the defensible posture.

See also: SOP-033 (docs/sop/SOP-033-compliance-checklist.md) · charter (docs/units/legal-compliance/charter.md) · ADR-0017 (source obligations) · docs/legal/ai-compliance.md (to be created).