Jurisdictions · clause in, evidence out

The regulator does not ask you
to assert compliance.
It asks when
you last proved it.

Read any supervisory guideline closely and one shape recurs: a clock, a coverage window, an independence requirement, or a record that must survive years and an examiner. Each obligation below is set against what is produced to answer it. Every citation is to published text; sources are at the foot of the page.

§ 01

US frameworks. Resolved once, not maintained nine times.

A US institution is rarely under one regime. A broker-dealer carries SEC recordkeeping, SOX control evidence, model-risk expectations under SR 11-7, a Safeguards Rule obligation and a state privacy statute at the same time — and the same log, the same access review, the same change record answers several of them. Maintained separately, that is nine versions of one fact, each drifting on its own schedule.

The obligation

What is produced

Originals of communications received and copies sent, retained — 17 CFR 240.17a-4(b)(4)

→

A retention class bound to each record, with the binding itself signed

Electronic records preserved with a complete audit trail — 17 CFR 240.17a-4(f)

→

Every step witnessed and sealed at the time it ran, not reconstructed afterwards

Records furnished promptly to Commission examination staff — 17 CFR 240.17a-4(j)

→

A sealed packet an examiner verifies on their own machine, with nothing of ours running

Audit records reviewed, analyzed and findings reported — NIST SP 800-53r5 AU-6, AU-11

→

Review recorded as an act with a named principal, not as a state that is asserted

Model documentation and evidence of ongoing monitoring — SR 11-7 / OCC 2011-12 §V

→

Documentation produced as the work happens, and a version change recorded as an input change

Control design and operating effectiveness for financial reporting — SOX §404

→

Change authority and separation of duties evidenced at the moment of change

Continuous monitoring and annual testing — GLBA Safeguards Rule, 16 CFR 314.4

→

Test results bound to the control they tested, with a last-proved date per obligation

Where two authorities conflict, the decision is recorded rather than left to the reader — which one prevails, on what basis, and what was subordinated. A deletion request that meets a retention floor is resolved once, in writing, and the resolution travels with the evidence.

The overlap resolves into one control set emitting one evidence record, which answers every framework above. Voluntary frameworks — NIST AI RMF, CSF 2.0, ISO/IEC 27001 and 42001, SOC 2 — are carried as mappings and are never treated as binding obligations. Alignment with a framework is not compliance with a rule, and this system will not report it as one.

§ 02

EU AI Act. Annex IV is a state to remain in, not a date to survive.

Article 11 requires technical documentation for every high-risk system; Annex IV specifies its contents; the obligation runs for a decade. Below is what Annex IV asks for, and what is produced against it.

1 · System description

Intended purpose, deployment context, architecture, dependencies — emitted from the planning layer.

2 · Detailed design

Methodology, design choices, key parameters, training data and validation procedures — captured at blueprint generation.

3 · Monitoring & control

Human oversight measures, accuracy and robustness specifications — bound into the enforcement contract.

4 · Risk management

Identified risks, mitigations, residual risk — versioned alongside the blueprint and re-evaluated on change.

5 · Lifecycle changes

Change log, validation outcomes, version history — every change is a sealed event.

6 · Standards applied

Harmonised standards and technical specifications — declared and traceable to controls.

7 · Declaration of conformity

Issued against a specific blueprint version with a stable, citable reference.

8 · Post-market monitoring

Continuous observation against specification — produced live, not assembled retroactively.

9 · Performance metrics

Accuracy, robustness and cybersecurity metrics in the form expected by notified bodies.

A deadline is one tick on the axis; the documentation obligation runs ten years past it. — FIG. I — Retention as a standing obligation rather than a deadline.

§ 03

Central Bank of the UAE.

The Master System of Record holding Confidential Data must be maintained inside the UAE — Outsourcing Regulation Art. 6.1. A location requirement, not a preference. Deployed inside the institution, the question does not arise.

Art. 6.1–6.4 · enabling-technologies cl. 2.27, 3.96–3.108 · clause-by-clause mapping on request.

§ 04

Bank of Mauritius.

Every obligation tested within three years and never beyond forty-eight months; critical logs retained seven years. Proportionality adjusts the scale of the framework, not the requirement to evidence it.

Compliance § 2.14, 2.17, 2.18 · Cyber ¶ 43–46, 58 · clause-by-clause mapping on request.

§ 05

Where each claim stops.

The four boundaries on the home page apply here without amendment. Five more are specific to these jurisdictions.

Mapping is not approval

Obligations from published CBUAE and Bank of Mauritius text are represented as controls. Nothing here is endorsed, reviewed or approved by either regulator, and no representation is made that it has been.

Evidence is not compliance

This system produces records of what was examined and what was found. Whether an institution meets its obligations is a supervisory judgment, made by people, on the whole of its conduct.

What coverage means

It does not mean every control is automated. Some obligations are governance acts performed by named officers — a board approval, a semi-annual meeting, a notification. The system records them. It does not perform them.

Not model assurance

Deployment inside the institution answers a data-location requirement. It does not establish that a model is accurate, fair or fit for purpose — that rests on validation the institution performs.

Not advice

Nothing here substitutes for the institution's own reading of the text it is bound by. Clause references are to the text as published at the dates below; where our reading and yours differ, yours governs.

Sources — Central Bank of the UAE Rulebook: Outsourcing Regulation for Banks, Art. 6; Guidelines for Financial Institutions Adopting Enabling Technologies, 15 November 2021. Bank of Mauritius: Guideline on Compliance Risk Management and Governance Framework, 13 November 2024; Guideline on Cyber and Technology Risk Management, 29 May 2023; Guideline on Use of Cloud Services, 7 September 2022; Guidelines on Outsourcing by Financial Institutions, 6 January 2026. Regulation (EU) 2024/1689, Art. 11 and Annex IV.

§ 06 · Begin

Bring the guideline you are worried about.

A diligence call covers the mapping to the specific text that binds you, deployment inside your perimeter, what the evidence does and does not establish, and pilot scope.

Thirty minutes · no SDR layer · no qualification gauntlet

Book a diligence call info@weavesynth.ai