Separate the law from the guidance

The defensible posture names the force behind each requirement it cites. Binding law — the EU AI Act, GDPR Art. 22 — is a statute, enforced by a court, non-negotiable. Supervisory guidance — SR 11-7, BCRA expectations — is enforced by the examiner and the supervisor, not by statute. Voluntary frameworks — NIST AI RMF, ISO/IEC 42001 — are adopted by choice; no examiner compels them. The defensible posture separates them, line by line. The indefensible one lumps them into a single word, "compliance," and the examiner who reads that word has already discounted the submission, because the word tells the examiner that the firm does not know which force is behind which line.

We are pre-revenue and building the POC. This post is the discipline of separation in practice — the line-by-line version, because the three-tier discipline is the discipline every other audit post in this series depends on.

The line-by-line version

Separation is not a paragraph in the introduction; it is a label on each line. A requirement cited as "EU AI Act, Annex III, transparency obligation (binding)" is a line an examiner reads as someone who knows. The same requirement cited as "we comply with transparency obligations" is a line an examiner reads as someone who does not. The label is the signal: binding, supervisory, voluntary. Three labels, one per line, and the submission reads as if someone read each document before citing it. The submission that omits the labels reads as if no one did.

Why the label changes the submission

The label changes what the examiner expects to follow. A binding label is followed by evidence of compliance — a record an examiner or court can read. A supervisory label is followed by evidence of meeting expectations — a record an examiner reads in the examination room. A voluntary label is followed by evidence of posture — a record that shows a system beyond the floor. The manifest (BR-842) is the same artifact in all three cases, but the framing differs: deliverable for binding, evidence for supervisory, substrate for voluntary. The label tells the examiner which framing to apply, and the examiner applies it without having to ask, which is what a competent submission does.

The label tells the examiner which framing to apply, and the examiner applies it without having to ask. That is what a competent submission does — it saves the examiner the question.

• Binding law (EU AI Act, GDPR Art. 22) — statute, court-enforced, non-negotiable. The manifest is the deliverable.
• Supervisory guidance (SR 11-7, BCRA) — examiner-enforced, not statute. The manifest is the evidence.
• Voluntary frameworks (NIST AI RMF, ISO/IEC 42001) — adopted by choice. The manifest is the substrate the posture operates on.
• The label on each line is the signal; the absence of the label is the discount.

The mistake that repeats

The mistake that repeats across submissions is the single sentence: "we comply with SR 11-7, the EU AI Act, NIST AI RMF, and ISO/IEC 42001." That sentence lumps a statute, a supervisory letter, and two voluntary frameworks into one verb, and the examiner who reads it has already marked the submission down — not because the firm has not done the work, but because the firm has shown it does not know which work is which. The sentence that wins is the sentence that separates them, line by line, with the force labeled on each. The work is the same; the label is the difference between a submission that reads as competence and one that reads as its absence.

What the manifest does and does not claim

The manifest attests provenance and reproducibility — never truth. It is built for the binding tier first, because the binding tier is the floor; it maps onto the supervisory tier, because the examiner enforces it; it supports the voluntary tier, because posture beyond the floor is a credit. The manifest does not make a firm compliant with any tier by itself; it provides the record that makes compliance evidentiary instead of narrative. Calibration is a separate, gated loop (Gate 1b). We are building the POC, and the manifest fields exist; the calibration loop is inert until it is filled. The honesty is in keeping the tiers, the record, and the loop separate — because that is where the competence is.

The work is the same; the label is the difference. A submission that separates the tiers reads as competence; a submission that lumps them reads as someone who has not read the documents they are citing.

— separation discipline note