Regulatory mapping

Compliance is embedded into how AI is allowed to act

Type-III (CRSP-governed) agents do not “comply after the fact.” They constrain authority, produce review-ready artifacts, and preserve accountable human decision roles.

Industry Frameworks Type-III aligns with Typical Type-III artifacts
Healthcare FDA CDS, HIPAA, Joint Commission, ISO 62304 Patient-facing drafts (non-diagnostic), clinical templates, governance records, misuse/over-reliance analysis
Finance SEC, FINRA, SR 11-7, Basel III Policy/procedure drafts, audit-prep packs, risk-control narratives, disclosure language (non-advisory)
Government OMB AI memo(s), FOIA, Administrative Law Policy drafts, transparency statements, impact analysis memos, oversight-ready documentation
Defense DoD AI Ethics, NIST AI RMF Governance constraints, oversight artifacts, red-team response packs, cross-program authority controls
Energy NERC CIP, OSHA, EPA Safety procedures, incident post-mortems, regulatory reporting drafts, risk communications
Legal / Compliance SOX, ISO 37301, internal audit standards Policy drafting, regulatory summaries, audit response prep, human-signed usage justification

Boundary-first operating mode

Type-III systems keep assistance and authority separate—by design.

  • Explicit role assignments (who decides, who approves)
  • Prohibitions on advisory/authoritative language where required
  • Operational constraints that survive audits

Artifacts that map to review workflows

Regulators and auditors review records, not vibes.

  • Draft outputs + rationale trails suitable for governance committees
  • Misuse / over-reliance analysis and mitigations
  • Evidence bundles for internal controls and change control

Model-agnostic governance layer

Switch models without resetting your entire approval process.

  • Standardized constraint language across vendors
  • Consistent output formats for audit logs and approvals
  • Clear separation: governance layer vs. model layer

Defeaters and stop conditions

Type-III systems recognize conditions that require escalation or refusal.

  • High-risk user intent detection
  • Insufficient evidence / ambiguity triggers
  • Mandatory human review gates