docs: regulatory alignment — EU AI Act, FINRA, FCA, MAS

docs/regulatory-alignment.md

@@ -0,0 +1,156 @@
+# Regulatory Alignment
+
+TrustPlane provides the technical governance layer that enterprise AI deployments need to satisfy regulatory requirements. This document maps TrustPlane capabilities against four frameworks active in 2026.
+
+This is a capability mapping, not a compliance certification. Formal compliance requires conformity assessment, legal review, and organizational controls beyond what any software framework provides.
+
+---
+
+## EU AI Act (Enforcement: August 2, 2026)
+
+For each article below, we state what it requires, how TrustPlane maps to it, and the honest gap.
+
+### Article 9. Risk Management System
+
+Requires: continuous lifecycle risk assessment, testing, and mitigation documentation.
+
+TrustPlane: D1 through D4 scoring per session. Failure memory with TTL and recurrence tracking. 5-dimension Task Risk Profile.
+
+Gap: no formal risk management system document. No testing protocol against regulatory criteria.
+
+### Article 11. Technical Documentation (Annex IV)
+
+Requires: documented architecture, testing results, and risk assessment before market placement.
+
+TrustPlane: design docs DESIGN-01 through DESIGN-06 exist.
+
+Gap: no Annex IV formatted compliance document. Not independently audited.
+
+### Article 12. Automatic Event Logging
+
+Requires: automatic, tamper-evident logs traceable to a human operator.
+
+TrustPlane: hash-chained audit trail. user_id on every audit event. Append-only by database trigger. Cannot be modified after the fact.
+
+Coverage: strong.
+
+### Article 13. Transparency
+
+Requires: deployers must be able to interpret system output.
+
+TrustPlane: D1 through D4 scores are interpretable dimensions. Trust tiers documented. Authorization decisions include reason, required controls, and recommended runtime.
+
+Coverage: good.
+
+### Article 14. Human Oversight
+
+Requires: systems must enable humans to monitor, intervene, and deactivate.
+
+TrustPlane: HITL approval gates on high and critical risk tasks. HUMAN_APPROVAL_RECORDED on every governed session. PROBATION demotion. Hook-level blocking (exit 2 is a hard block). Fail-closed by default.
+
+Coverage: strong.
+
+### Article 15. Accuracy and Robustness
+
+Requires: consistent performance, error handling, and resistance to adversarial inputs.
+
+TrustPlane: fail-closed hooks, D1 correctness scoring.
+
+Gap: D1 and D2 scoring not formally calibrated. No adversarial testing suite. Calibration planned for Sprint 5.
+
+### Article 19. Automatically Generated Logs
+
+Requires: logs must be automatic, not manually produced.
+
+TrustPlane: audit chain written automatically on every event. No manual steps required.
+
+Coverage: strong.
+
+### Honest gaps for EU AI Act
+
+- No Annex IV technical documentation
+- No formal conformity assessment
+- No Quality Management System (Article 17)
+- D1/D2 calibration deferred to Sprint 5
+- No CE marking
+
+---
+
+## US: FINRA Agentic AI Supervision (2026)
+
+FINRA's 2026 report identified agentic AI supervision as the emerging focal point for financial services. There is no single statute. Requirements flow through existing broker-dealer supervision rules.
+
+Key requirements: agent inventory, audit trail, human supervision of agent decisions, and the ability to reconstruct what agents did and why.
+
+TrustPlane maps to:
+
+- Agent inventory: trust_subjects table tracks every agent identity across runtimes
+- Audit trail: hash-chained events with user_id
+- Human supervision: HITL gates, approval records
+- Reconstruction: awf audit verify, correlation_id threading across sessions
+
+Gap: no FINRA-specific reporting format. No integration with broker-dealer compliance systems.
+
+---
+
+## UK: FCA Model Risk Management
+
+FCA applies AI governance under existing model risk management frameworks. No new AI-specific law is expected before late 2026.
+
+Key requirements: model identification, validation, ongoing monitoring, bias testing, and board reporting.
+
+TrustPlane maps to:
+
+- Model identification: trust_subjects per runtime
+- Ongoing monitoring: D1 through D4 scoring per session, trust capability profile updated after every session
+- Audit assurance: tamper-evident audit chain
+
+Gap: no bias testing. No board reporting format. D1/D2 not independently validated.
+
+---
+
+## Singapore: MAS AI Risk Management Guidelines (2026)
+
+MAS released consultation guidelines in November 2025. A 12-month transition is expected after finalization. Five pillars: data governance, model accountability, transparency, human oversight, and risk management.
+
+TrustPlane maps to:
+
+- Model accountability: D1 through D4 trust scoring per agent per task class
+- Transparency: interpretable authorization decisions with reasons
+- Human oversight: HITL gates, approval records
+- Risk management: 5-dimension Task Risk Profile, failure memory
+
+Gap: the data governance pillar requires data lineage tracking. TrustPlane does not govern training data or model selection.
+
+---
+
+## Summary Table
+
+| Requirement | EU AI Act | FINRA | FCA | MAS |
+|---|---|---|---|---|
+| Audit trail | Strong | Strong | Strong | Strong |
+| Human oversight | Strong | Strong | Partial | Strong |
+| Risk classification | Partial | Partial | Partial | Partial |
+| Transparency | Good | Good | Good | Good |
+| Formal documentation | Gap | Gap | Gap | Gap |
+| Calibrated scoring | Gap | Gap | Gap | Gap |
+
+---
+
+## What TrustPlane provides today
+
+The four capabilities every AI governance framework requires:
+
+1. Automatic tamper-evident audit trail with a human actor on every event
+2. Pre-execution human approval gates for high-risk work
+3. Risk classification before agent execution
+4. Interpretable trust scores and authorization decisions
+
+## What requires additional work
+
+- Annex IV and other formal compliance documentation
+- Conformity assessment (EU AI Act)
+- D1/D2 calibration (Sprint 5)
+- Adversarial testing suite
+- Reporting formats for specific regulators
+- Legal review and counsel