Binding, guidance, voluntary: name the force behind each requirement
The three-tier discipline — the defensible posture never lumps them.
Every AI compliance requirement has a force behind it: statute, supervisor, or voluntary adoption. The defensible posture names which one. The indefensible one lumps them into a single word: compliance.
There are three tiers of force behind every AI compliance requirement. Binding law — the EU AI Act, GDPR Art. 22 — is a statute passed by a legislature, enforced by a court, and non-negotiable. Supervisory guidance — SR 11-7, BCRA expectations — is enforced by the examiner and the supervisor, not by a statute, and the consequence is supervisory criticism, not a statutory penalty. Voluntary frameworks — NIST AI RMF, ISO/IEC 42001 — are adopted by choice; no examiner compels them, and their value is in showing posture beyond the floor. These three tiers are not interchangeable. A posture that lumps them into a single word, "compliance," reads as someone who does not know which force is behind which line. A posture that names them reads as someone who does.
We are pre-revenue and building the POC. This post is the three-tier discipline in one place, because every other audit post in this series assumes it. The manifest (BR-842) is built for the binding tier first; the supervisory tier maps onto it; the voluntary tier is documentation on top.
The three tiers, side by side
- Binding law (EU AI Act, GDPR Art. 22) — a statute, enforced by a court, non-negotiable. The manifest is built to satisfy this tier first.
- Supervisory guidance (SR 11-7, BCRA expectations) — enforced by the examiner and supervisor, not by statute. Consequence is supervisory criticism, not a penalty.
- Voluntary frameworks (NIST AI RMF, ISO/IEC 42001) — adopted by choice, no examiner compels them. Value is posture beyond the floor.
Why the tier changes the documentation
The documentation you produce for a binding obligation is different from the documentation you produce for supervisory guidance, and both are different from voluntary adoption. Binding obligations require evidence of compliance — a record an examiner or court can read. Supervisory guidance requires evidence of meeting expectations — a record an examiner reads in the examination room. Voluntary adoption requires evidence of posture — a record that shows you have a system beyond the floor. The manifest is the same artifact in all three cases, but the framing differs: for binding law, the manifest is the deliverable; for supervisory guidance, the manifest is the evidence; for voluntary adoption, the manifest is the substrate the posture operates on. Same record, three framings — and the framing is what tells the examiner you know which tier you are in.
The mistake that loses the room
The mistake is to write "we comply with SR 11-7, the EU AI Act, NIST AI RMF, and ISO/IEC 42001" in a single sentence. An examiner reads that sentence and sees someone who does not know that one of those is a statute, one is supervisory guidance, and two are voluntary. The sentence that wins is the sentence that separates them: "We meet the EU AI Act logging obligation; we meet SR 11-7 expectations as supervisory guidance; we have adopted the NIST AI RMF and ISO/IEC 42001 as our voluntary management posture." That sentence reads as someone who has read each document and knows which force is behind it.
The sentence that wins is the one that separates the tiers. The sentence that loses is the one that lumps them into a single word.
What the manifest does, and does not, claim
The manifest attests provenance and reproducibility — never truth. It is built for the binding tier first because the binding tier is the floor; the supervisory tier maps onto it because examiners enforce it; the voluntary tier is documentation on top because posture beyond the floor is a credit. The manifest does not make a firm compliant with any tier by itself; it provides the record that makes compliance evidentiary instead of narrative. Calibration of the underlying model is a separate, gated loop (Gate 1b) — the manifest is the audit story, not the accuracy story. We are building the POC, and the manifest fields exist; the calibration loop is inert until it is filled.
The defensible posture names the force behind each line. Binding, supervisory, voluntary — three tiers, one record, and the framing is the signal.
— three-tier discipline note