Compliance

Top-level compliance-posture coordinator — single source of truth for "what regulatory regime is this deployment running under?".

b.compliance.set("hipaa") cascades the posture into every framework primitive that owns a posture-conditioned default: b.retention (TTL floors), b.audit (ML-DSA-87 chain-signing), b.db (column-policy enforcement), b.cryptoField (vacuum-after- erase). Each primitive merges the matching POSTURE_DEFAULTS entry into its own state and emits a compliance.posture.cascade.applied audit row so operators can confirm the cascade landed.

Posture overlays follow a union-of-bars rule: when a primitive knob has different floors per regime (TLS minimum, retention ceiling, hash-algorithm minimum), the strictest applicable bar wins. Operators running under a single posture get that posture's floor; operators running multi-tenant deployments compose per-tenant by reading postureDefault(posture, key) per request instead of pinning a single global.

Boot-time only — set() MUST run before the primitives it coordinates are first used. Runtime switches throw compliance/already-set because partial cascades produce half-set state across already-initialized primitives.

Audit emissions: compliance.posture.set on success, compliance.posture.set_rejected on unknown / already-set, compliance.posture.cascade.applied / .skipped per primitive, compliance.posture.cleared on clear(). Grep audit chain to reconstruct posture history per deployment.

b.compliance.aiAct.fundamentalRightsImpactAssessment(opts) #

{
  {
    systemId:               string,           // operator's high-risk system identifier
    systemDescription:      { ... },          // forwarded to classify() for risk-tier verdict
    deploymentContext:      { purpose, sector, geography, scale },
    affectedPersons:        { categories: string[], estimatedCount: number },
    risksToFundamentalRights: string[],       // operator-identified risks
    mitigations:            string[],         // mitigations + monitoring per risk
    humanOversight:         { roles: string[], escalationPath: string },
    residualRisks:          string[],
    reviewCadence:          string,            // e.g. "quarterly"
  }
}

EU AI Act Article 27 — Fundamental Rights Impact Assessment (FRIA). Mandatory for deployers of high-risk AI systems listed in Annex III §5 (creditworthiness scoring, life/health insurance risk), §6 (law enforcement), §7 (migration/asylum), §8 (justice admin), public authorities, and any private body providing public services. Must be completed BEFORE the first use of the high-risk system, kept updated, and notified to the national market-surveillance authority.

Returns the structured FRIA document scaffold — operator fills in the per-deployment specifics; the framework auto-populates the fields it can derive (system identification, GPAI classification if applicable, Annex IV reference, deployment-context audit hooks).

var fria = b.compliance.aiAct.fundamentalRightsImpactAssessment({
  systemId: "credit-scoring-v3",
  deploymentContext: { purpose: "loan approval", sector: "financial",
                       geography: "EU", scale: "1M decisions/year" },
  affectedPersons:   { categories: ["EU consumers"], estimatedCount: 1000000 },
  risksToFundamentalRights: ["discriminatory denial", "right to explanation"],
  mitigations:       ["bias audit every 6 months", "human review threshold"],
  humanOversight:    { roles: ["credit officer"], escalationPath: "ombudsman" },
  reviewCadence:     "semi-annual",
});

b.compliance.aiAct.gpai.trainingDataSummary(opts) #

{
  modelId:           string,    // required
  modelVersion:      string,    // optional
  provider:          object,    // { name, address, contact }
  dataCategories:    string[],  // ["web-crawl", "books", "code", "synthetic", ...]
  modalities:        string[],  // ["text", "image", "audio", "video"]
  sources:           object[],  // { identifier, url, type, licenseStatus, size, collectedFrom, collectedTo }
  copyrightStatus:   object,    // { respectsRightReservations, machineReadableSignalsObserved, tdmExceptionUsed }
  biasMitigation:    object,    // { methodsApplied, auditCadence, remediations }
  contentProvenance: object,    // { synthIdEmbed, c2paManifestEmbed, watermarkProvider }
}

EU AI Act Article 53(1)(d) — GPAI training-data summary template compliant with the AI Office's template format (published in 2024, mandatory from 2026-08-02). The template requires categories of data, modalities, source provenance, copyright + licensing status, dataset sizes, dates of collection, and steps taken to identify + mitigate biases.

Returns the JSON document operators publish under their /.well-known/ ai-training-data-summary endpoint or attach to model cards.

var summary = b.compliance.aiAct.gpai.trainingDataSummary({
  modelId:        "acme-llm-7b",
  modelVersion:   "1.0",
  provider:       { name: "Acme AI", address: "1 St", contact: "ai@acme.example" },
  dataCategories: ["web-crawl", "books", "code"],
  modalities:     ["text"],
  sources: [
    { identifier: "CommonCrawl-2024", type: "web-crawl", licenseStatus: "permitted" },
  ],
  biasMitigation: { methodsApplied: ["demographic-balance"], auditCadence: "quarterly" },
});

b.compliance.aiAct.crossWalkIso42001(aiActCitation?) #

Map AI Act articles to ISO/IEC 42001:2023 Annex A controls (and the matching ISO/IEC 23894:2023 risk-management clauses where they overlap). Returns the full cross-walk table when called with no arguments, or the entry for a specific AI Act citation when passed a string. Returns null for unknown citations. Useful for operators chasing ISO 42001 certification while running under the AI Act — the table tracks the regulatory text and updates with the framework rather than going stale in operator code.

var rows = b.compliance.aiAct.crossWalkIso42001();
rows[0].aiAct;        // → "Art. 9 (Risk management system)"
rows[0].iso42001;     // → ["A.6.1.1 AI risk-management process", ...]

var art10 = b.compliance.aiAct.crossWalkIso42001("Art. 10 (Data and data governance)");
art10.iso42001;       // → ["A.7.2 Data quality for AI systems", ...]

b.compliance.aiAct.crossWalkIso42001("not-a-real-citation");
// → null

b.compliance.aiAct.crossWalkIso23894() #

Same cross-walk shape filtered to entries that map to an ISO/IEC 23894:2023 clause. Used by operators whose audit scope is the AI-risk-management standard specifically (ISO 23894 is the companion to ISO 42001 focused purely on risk).

var rows = b.compliance.aiAct.crossWalkIso23894();
rows.forEach(function (r) {
  console.log(r.aiAct, "→", r.iso23894);
});

b.compliance.aiAct.gpai.adherenceForm(opts) #

{
  modelId:        string,     // required — provider's model identifier
  modelVersion:   string,     // required — model version
  provider:       object,     // { name, address, contact }
  trainingFlops:  number,     // cumulative training compute (Art. 51(2) presumption at >= 1e25)
  isSystemicRisk: boolean,    // operator-asserted systemic-risk designation (Art. 51(1)(b))
  designatedSystemicRisk: boolean,  // AI-Office-designated systemic risk
  copVersion:     string,     // GPAI Code of Practice release label, "YYYY-MM" (default "2025-07")
  commitments:    object[],   // [{ article, statement, evidenceHash }] — evidenceHash is SHA3-512 hex
  trainingDataSummary: object,// Art. 53(1)(d) public-summary pointer (b.compliance.aiAct.gpai.trainingDataSummary)
  generatedAt:    string,     // ISO 8601 UTC; defaults to now
  validityMs:     number,     // declaration validity window; default 90 days
}

Build the unsigned GPAI Code-of-Practice adherence document for a general-purpose AI model. The obligation set is DERIVED from the regulation via the GPAI classifier (Reg (EU) 2024/1689 Art. 53(1)(a-d) always; Art. 55 when the model is a systemic-risk model under Art. 51(2)), never taken from an operator-supplied list. Each obligation is paired with the operator's commitment + evidence hash; the evidence hash is validated against the SHA3-512 hex shape so a hollow attestation (junk "hash") is refused at build time (CWE-345 insufficient verification of data authenticity).

This is the document declareAdherence signs; most operators call declareAdherence directly. The form is exposed for operators who want to inspect or persist the derived obligation set before signing.

var hash = b.crypto.sha3Hash("eval-report-2026.pdf");
var form = b.compliance.aiAct.gpai.adherenceForm({
  modelId:      "acme-llm-7b",
  modelVersion: "1.0",
  commitments:  [{ article: "Art. 53(1)(a)", statement: "Annex XI docs maintained", evidenceHash: hash }],
});
form.commitments.length;       // 4 — the four Art. 53 obligations (no systemic-risk chapter)
form.commitments[0].evidenced; // true (Art. 53(1)(a) has a bound commitment)
form.commitments[1].evidenced; // false (no commitment supplied yet)

b.compliance.aiAct.gpai.declareAdherence(opts) #

{
  modelId:        string,     // required
  modelVersion:   string,     // required
  provider:       object,     // { name, address, contact }
  trainingFlops:  number,     // cumulative training compute; Art. 51(2) presumption at >= 1e25 FLOP
  isSystemicRisk: boolean,    // operator-asserted systemic-risk designation (Art. 51(1)(b))
  designatedSystemicRisk: boolean,  // AI-Office-designated systemic risk
  copVersion:     string,     // Code of Practice release label "YYYY-MM" (default "2025-07")
  commitments:    object[],   // [{ article, statement, evidenceHash }]; evidenceHash is b.crypto.sha3Hash output
  trainingDataSummary: object,// Art. 53(1)(d) public-summary pointer (b.compliance.aiAct.gpai.trainingDataSummary)
  validityMs:     number,     // validity window; default 90 days
  privateKeyPem:  string,     // required — ML-DSA-87 signing key (b.crypto.generateSigningKeyPair)
  serialNumber:   string,     // urn:uuid:...; defaults to a fresh UUIDv4
  audit:          boolean,    // emit compliance.aiact.gpai.declareadherence audit event; default true
}

Emit a SIGNED, tamper-evident GPAI Code-of-Practice adherence declaration (Reg (EU) 2024/1689 Art. 53(1)(a-d); Art. 55 when the model is a systemic-risk model under Art. 51(2)). The Code of Practice (10 July 2025) is the AI Office's voluntary compliance instrument; this primitive binds the adherence to the model + the derived obligation set + the per-commitment evidence hashes inside a CycloneDX 1.6 ML-BOM signed with ML-DSA-87 (FIPS 204) via b.ai.modelManifest.build + sign. There is no unsigned return path on the happy path: the declaration always ships inside the signature envelope.

Two compliance-theater shapes are refused structurally rather than trusted:

- Obligation-set downgrade: the in-scope obligations are DERIVED from the classifier (kind injected as "gpai"), never accepted from the operator. A 10^25-FLOP+ model that omits the Art. 55 systemic-risk chapter is refused — the classifier puts Art. 55 in scope, the declaration must cover it. - Hollow attestation: every commitment's evidenceHash is checked against the SHA3-512 hex shape (128 hex chars, b.crypto.sha3Hash output). A junk "hash" cannot bind — CWE-345 (insufficient verification of data authenticity) / CWE-347 (improper verification of cryptographic signature).

The signed envelope is verified with b.compliance.aiAct.gpai.verifyAdherence(envelope, publicKeyPem), which re-canonicalizes before trusting any field (never trusts an embedded signed-bytes value — the xml-crypto signature-substitution class, CVE-2025-29774 / CVE-2025-29775) and rejects an expired declaration (generatedAt + validityMs < now) so a stale adherence cannot be replayed past its window.

var pair = b.crypto.generateSigningKeyPair("ml-dsa-87");
var hash = b.crypto.sha3Hash("annex-xi-technical-documentation-v1");
var env = b.compliance.aiAct.gpai.declareAdherence({
  modelId:       "acme-llm-7b",
  modelVersion:  "1.0",
  commitments:   [{ article: "Art. 53(1)(a)", statement: "Annex XI docs maintained", evidenceHash: hash }],
  privateKeyPem: pair.privateKey,
});
typeof env.signature;   // "string"

b.compliance.aiAct.gpai.verifyAdherence(envelope, publicKeyPem, opts?) #

{
  now:    number,     // override the comparison clock (ms epoch); default Date.now()
  audit:  boolean,    // emit compliance.aiact.gpai.verifyadherence audit event; default true
}

Verify a signed GPAI Code-of-Practice adherence declaration produced by declareAdherence. Delegates the cryptographic check to b.ai.modelManifest.verify, which re-canonicalizes the BOM with canonical-JSON-1785 before trusting any field and NEVER trusts an embedded signed-bytes value (the xml-crypto signature-substitution class, CVE-2025-29774 / CVE-2025-29775). On a valid signature it additionally enforces the validity window: a declaration whose generatedAt + validityMs is in the past is rejected with reason: "expired" so a stale adherence cannot be replayed past its auditor-review window. Returns { valid, adherence, reason }; never throws (the documented contract mirrors b.ai.modelManifest.verify).

var result = b.compliance.aiAct.gpai.verifyAdherence(env, pair.publicKey);
if (result.valid) result.adherence.requiredArticles;   // ["Art. 53(1)(a)", ...]
else              result.reason;                        // "signature-invalid" | "expired" | ...

b.compliance.set(posture) #

Pin the deployment's compliance posture and cascade the matching defaults into every primitive that owns posture-conditioned state (b.retention, b.audit, b.db, b.cryptoField). Throws compliance/unknown-posture for names outside KNOWN_POSTURES, compliance/already-set if a different posture is already pinned (runtime switches are forbidden — they create half-set state across already-initialized primitives). Idempotent for the same posture: calling set("hipaa") a second time after set("hipaa") is a no-op, no audit row, no cascade.

Operators wiring multiple regimes pick the strictest single posture here and read per-regime knobs via postureDefault(posture, key) for tenant-level overrides — see the @intro union-of-bars note.

Emits compliance.posture.set (success), compliance.posture.set_rejected (unknown/already-set), compliance.posture.cascade.applied/.skipped per primitive, compliance.posture.tz_warning when process.env.TZ is set to a non-UTC value under a regulated posture (HIPAA / PCI-DSS / SOX / GDPR / SOC2 / FDA 21 CFR 11).

b.compliance.set("hipaa");
b.compliance.current();   // → "hipaa"

// Calling again with the same posture is idempotent:
b.compliance.set("hipaa");   // no-op, no audit row

// Switching to a different posture throws:
try {
  b.compliance.set("pci-dss");
} catch (e) {
  e.code;   // → "compliance/already-set"
}

b.compliance.current() #

Read the currently-pinned posture, or null if set() has not yet run. Cheap; pure read of internal state. Operators rendering an admin-UI banner ("running under HIPAA posture") call this once per page render — no caching needed.

b.compliance.current();   // → null
b.compliance.set("hipaa");
b.compliance.current();   // → "hipaa"

b.compliance.assert(posture) #

Throw compliance/assertion-failed if the currently-pinned posture differs from posture. Use at the top of a request handler that is only safe to run under a specific regime — fails closed with a stack trace that names the mismatch instead of silently serving under the wrong posture.

b.compliance.set("hipaa");
b.compliance.assert("hipaa");   // → no throw

try {
  b.compliance.assert("pci-dss");
} catch (e) {
  e.code;   // → "compliance/assertion-failed"
}

b.compliance.clear() #

Reset the pinned posture to null and emit a compliance.posture.cleared audit row carrying the previous posture. Reserved for tests + operator-controlled tear-down — the primitives that were cascaded into do not roll back their merged defaults, so production code that called set() should not call clear() mid-life.

b.compliance.set("hipaa");
b.compliance.clear();
b.compliance.current();   // → null

b.compliance.describe(posture) #

Resolve a posture name to its human-readable record: { name, citation, jurisdiction, domain }. Returns null for unknown postures. Operators rendering "we run under {name} ({citation})" in admin UI / generated audit reports reach for this instead of hand-rolling a lookup; the values track the regulatory text and update with the framework rather than going stale in operator code.

var meta = b.compliance.describe("hipaa");
meta.name;           // → "Health Insurance Portability and Accountability Act"
meta.citation;       // → "Pub. L. 104-191; 45 CFR Parts 160, 162, 164"
meta.jurisdiction;   // → "US"
meta.domain;         // → "health"

b.compliance.describe("not-a-real-posture");   // → null

b.compliance.postureDefault(posture, key) #

Look up a single posture-conditioned default without pinning the posture globally. Returns null for unknown postures, unknown keys, or empty/non-string inputs. Used by primitives that need to read a regime's floor per-tenant in a multi-tenant deployment where set() would over-pin the process.

Recognised keys per posture include backupEncryptionRequired, auditChainSignedRequired, tlsMinVersion, requireVacuumAfterErase, and sealEnvelopeFloor — the floors enforced by b.backup, b.audit, the TLS minimum-version gate, b.cryptoField's residual-erasure pass, and b.cryptoField's field-level seal-envelope gate. Keys not declared for a posture return null (no floor), so reading sealEnvelopeFloor for a posture that doesn't pin one is the back-compat no-op signal.

b.compliance.postureDefault("hipaa", "tlsMinVersion");
// → "TLSv1.3"

b.compliance.postureDefault("hipaa", "backupEncryptionRequired");
// → true

b.compliance.postureDefault("soc2", "requireVacuumAfterErase");
// → false

b.compliance.postureDefault("hipaa", "no-such-key");
// → null

b.compliance.postureDefault("not-a-real-posture", "tlsMinVersion");
// → null

b.compliance.posturesByDomain(domain) #

Return every posture name whose REGIME_MAP[p].domain equals domain, in canonical KNOWN_POSTURES order. Returns [] for empty/non-string inputs and for domains with no matches. Operators rendering compliance dashboards grouped by domain (privacy / health / payment / cybersecurity / etc.) iterate the domain list once and read posture sets from here.

b.compliance.posturesByDomain("privacy");
// → ["ccpa", "gdpr", "lgpd-br", ...] — every posture whose
//    domain is "privacy" (the full set grows as regimes are added)

b.compliance.posturesByDomain("health");
// → ["hipaa", "wmhmda", ...] — every "health"-domain posture

b.compliance.posturesByDomain("not-a-domain");
// → []

b.compliance.posturesByJurisdiction(jurisdiction) #

Return every posture whose REGIME_MAP[p].jurisdiction equals jurisdiction, in canonical KNOWN_POSTURES order. Jurisdiction values are ISO 3166 alpha-2 codes (US, BR, CA, JP, CN, SG, UK) plus EU and international, and US--prefixed state codes (US-CA, US-IL, US-WA). Returns [] for empty/non-string inputs and unknown jurisdictions.

b.compliance.posturesByJurisdiction("EU");
// → ["gdpr", "dora", "nis2", ...] — every EU-jurisdiction posture
//    (the full set grows as regimes are added)

b.compliance.posturesByJurisdiction("US");
// → ["hipaa", "soc2", "sox", ...] — every US-jurisdiction posture

b.compliance.posturesByJurisdiction("US-CA");
// → ["ccpa", ...] — every US-CA (California) posture

b.compliance.posturesByJurisdiction("XX");
// → []

b.compliance.list() #

Return every documented posture as a { posture, name, citation, jurisdiction, domain } record array, in canonical KNOWN_POSTURES order. Postures present in KNOWN_POSTURES but missing from REGIME_MAP (sectoral identifiers such as fapi-2.0 or ny-2-d) are skipped — list() is the "regimes with full metadata" view; full naming awaits the regime map gaining those rows. Useful for admin UIs that render the full set as a dropdown / table without hand-rolling iteration over REGIME_MAP.

var rows = b.compliance.list();
rows[0].posture;        // → "hipaa"
rows[0].jurisdiction;   // → "US"
rows[0].domain;         // → "health"

// Render as a dropdown:
var options = rows.map(function (r) {
  return { value: r.posture, label: r.name + " (" + r.jurisdiction + ")" };
});

b.compliance.artifactStandards() #

Return the set of SBOM / VEX artifact standards the framework can emit. These are FORMAT FAMILIES, not regulatory regimes — pinning one of these names as the deployment's compliance posture conflates "format I emit" with "regulatory floor I meet". Pin the regulatory regime (FedRAMP / SSDF / HIPAA / etc.) via b.compliance.set() and surface the emitted artifact standards via this read-only catalog.

b.compliance.artifactStandards();
// → ["cyclonedx-v1.6", "spdx-v3.0", "vex-csaf-2.1"]

b.compliance.fipsMode(enable?) #

Get or set the FIPS-mode flag. When enable === true, the framework's audit-chain signing path (b.audit.sign) switches from the PQC-first default (SLH-DSA-SHAKE-256f) to a FIPS-140-3 validated AES-GCM + SHA-384 path so a FedRAMP / CMMC L3 boundary can pin the audit signer to a validated module.

Call BEFORE b.compliance.set() so the fips_conflict audit warning doesn't fire at posture-set time. Cannot be toggled after posture is pinned — runtime switches create half-set crypto state. Returns the current flag value when called with no argument.

b.compliance.fipsMode(true);          // opt into FIPS-validated path
b.compliance.set("fedramp-rev5-moderate");
b.compliance.fipsMode();              // → true

b.compliance.isCrossBorderRegulated(posture) #

Returns true when posture is one of the cross-border regulated postures (gdpr / uk-gdpr / dpdp / pipl-cn / lgpd-br / appi-jp / pdpa-sg) — the jurisdictions whose transfer restrictions flip the data-residency write gates from advisory to refusing. The set itself is exported as CROSS_BORDER_REGULATED_POSTURES; this helper is the membership test the local (b.db.from) and external (b.externalDb.query) gates share. Non-string and unknown postures return false.

b.compliance.isCrossBorderRegulated("gdpr");      // → true
b.compliance.isCrossBorderRegulated("soc2");      // → false
b.compliance.isCrossBorderRegulated(null);        // → false

b.compliance.normalizeRegionTag(tag) #

Canonicalize an operator-supplied residency region tag so the same region declared as "EU", "eu", or " Eu " compares equal. Lower- cases and trims the tag; folds the no-constraint wildcards ("global" / "unrestricted" / "any" / "*") to "unrestricted". Returns null for non-string / empty input.

This is an ADDITIVE helper composed OVER the residency write gates (b.db.from local, b.externalDb.query backend/replica) — it does not change the gate internals. Callers normalize their tags with it BEFORE handing them to the gate so case / wildcard drift ("EU" vs "eu" vs "global") doesn't read as a region mismatch.

b.compliance.normalizeRegionTag("EU");           // → "eu"
b.compliance.normalizeRegionTag(" eu ");         // → "eu"
b.compliance.normalizeRegionTag("global");       // → "unrestricted"
b.compliance.normalizeRegionTag("unrestricted"); // → "unrestricted"
b.compliance.normalizeRegionTag(null);           // → null

b.compliance.isRegionCompatible(a, b) #

Returns true when two residency region tags are compatible for a same-region write/replication after normalization: identical normalized regions are compatible, and a wildcard ("global" / "unrestricted") on EITHER side is compatible. Different concrete regions ("eu" vs "us") are NOT compatible — a cross-border transfer the operator must opt into explicitly at the gate.

Mirrors the residency gate's compatibility rule (identical-or- wildcard) but over NORMALIZED tags, so it is case- and wildcard-drift insensitive. ADDITIVE helper composed over the gate — it does not change _residencyCompatible in db-query.js / external-db.js. Missing/non-string tags on either side normalize to null, treated as "no constraint" → compatible (matches the gate's !primaryTag || !replicaTag short-circuit).

b.compliance.isRegionCompatible("EU", "eu");            // → true
b.compliance.isRegionCompatible("eu", "global");        // → true
b.compliance.isRegionCompatible("unrestricted", "us");  // → true
b.compliance.isRegionCompatible("eu", "us");            // → false
b.compliance.isRegionCompatible("EU", null);            // → true

Last updated 2026-08-08T16:39:49.652Z by seeder.