The principles
One section per principle. Each names the obligation it was written against. An anchor here states alignment and nothing more: it is the article the principle was designed to answer to, never a statement that this project is subject to it.
P-1 · Deterministic first, probabilistic quarantined
Published in fullEverything that reaches a person, a document or another system is deterministic by default: parseable, reproducible, and reconstructable from its inputs. Machine learning components are held to bounded tasks. The boundary is explicit in the code rather than in a diagram: a probabilistic component returns a value, a confidence and the method the value was extracted by, never a bare value. A bare value is the failure this principle exists to prevent, because a bare value cannot be gated, disclosed or reviewed.
Alignment: Regulation (EU) 2024/1689, Article 9 on the risk management system and Article 15 on accuracy and robustness.
Source: Regulation (EU) 2024/1689, Article 9 (risk management system) and Article 15 (accuracy, robustness and cybersecurity) (primary source) · checked on 7 September 2026
P-2 · Confidence-gated output
Published as a principleConfidence attaches to a single attribute, not to a document. A document is not right or wrong as a whole; each fact it carries is separately well or poorly evidenced, and one score for the file hides exactly that. Three levels exist. The lowest never reaches a published output; it goes to a person instead. Where there is no evidence at all there is no value: the output says the value is not available, and never estimates it.
Not published
The rules that map an extraction method to a level, and the arithmetic that combines several sources into one, are not published here. They belong to a filed application. A framework loses nothing by describing what it stops and staying silent on the arithmetic that stops it.
Alignment: Regulation (EU) 2024/1689, Article 14 on human oversight and Article 15 on accuracy.
Source: Regulation (EU) 2024/1689, Article 14 (human oversight) and Article 15 (accuracy, robustness and cybersecurity) (primary source) · checked on 7 September 2026
P-3 · Human review by architecture
Published as a principleReview is triggered by confidence, not by a schedule and not by somebody noticing. It happens at attribute level: the reviewer sees one fact and the passage of the source it came from, side by side, and decides about that fact. A rejected value leaves the attribute empty. The system never fills it with a second guess, because the reason for the review was that the evidence was insufficient, and a guess does not repair that.
Not published
How the review queue is built and ordered, and what is demanded of a reviewer at the moment a decision is written, are not published here.
Alignment: Regulation (EU) 2024/1689, Article 14 on human oversight.
Source: Regulation (EU) 2024/1689, Article 14 (human oversight) (primary source) · checked on 7 September 2026
P-4 · One trace, end to end
Published in fullA single identifier is created when a document is taken in, and it travels with everything that happens afterwards: every processing step, every confidence assessment, every human decision, and the published output. The trail is append-only, so a later entry corrects an earlier one and nothing is rewritten. One query reconstructs the chain from a published output back to the documents it rests on, and the chain exports as JSON for somebody who did not build the system.
Alignment: Regulation (EU) 2024/1689, Article 12 on record-keeping and Article 13 on transparency towards deployers. For product passports, Regulation (EU) 2024/1781, Article 13 requires the Commission to set up a registry storing at least the unique identifiers.
Source: Regulation (EU) 2024/1689, Article 12 (record-keeping) and Article 13 (transparency and provision of information to deployers) (primary source) · checked on 7 September 2026
Source: Regulation (EU) 2024/1781, Article 13(1) (primary source) · checked on 7 September 2026
P-5 · Disclosure of machine extraction
Published in fullEvery attribute carries the method it was extracted by. Where any attribute in a published output was read by optical character recognition or by a language model, the output carries a visible line saying so and naming which attributes it applies to. The line sits on the document a reader is looking at, not in metadata a reader would have to go and find.
Alignment: Regulation (EU) 2024/1689, Article 50 on transparency obligations for providers and deployers of certain AI systems.
Source: Regulation (EU) 2024/1689, Article 50 (transparency obligations for providers and deployers of certain AI systems) (primary source) · checked on 7 September 2026
P-6 · The fence system
Published as a principleA guardrail that lives in a document is advice. A guardrail that runs in the pipeline and blocks a release is a fence. Fences fall in four categories: data, architecture, copy and process. Each has an identifier, a rule, and an enforcement method. A fence earns its place only by a proof of teeth: the real defect is planted, the fence fires, and the plant is removed byte for byte. A fence nobody has watched fail is a comment with a test runner attached.
Not published
The vocabulary the publication fence matches on is not itself published. A list of what is being watched is a map of what is being protected, and printing the map defeats the fence.
Alignment: Regulation (EU) 2024/1689, Article 9 on the risk management system and Article 17 on the quality management system.
Source: Regulation (EU) 2024/1689, Article 9 (risk management system) and Article 17 (quality management system) (primary source) · checked on 7 September 2026
P-7 · Standards dependency isolation
Published in fullClassification systems, terminology databases and external validation services live in adapter modules, marked as such, outside the core data model. An external service can raise the confidence of an attribute. None of them can gate an output: when a service is unavailable the system produces less confident evidence rather than nothing at all, and when a licence changes the core is untouched. Licensed content is marked in its metadata and kept apart from the open core.
Alignment: Regulation (EU) 2024/1689, Article 9 on the risk management system.
Source: Regulation (EU) 2024/1689, Article 9 (risk management system) (primary source) · checked on 7 September 2026
P-8 · Policy as data, with graduated autonomy
Published as a principleThe rules a decision is measured against are data. The engine that evaluates them does not change when a rule changes. A decision record is bound to the version of the rule set that produced it, which extends the trace of P-4 into rule provenance. Autonomy is a property of the rules rather than of the code: how much the system may do without a person is set per jurisdiction and per risk class, and it never exceeds the ceiling the law sets there. Raising it where the law allows is a rule change with a recorded legal basis, never a fork of the code.
Prior art
Signed, reloadable rule sets with version-linked decision records already exist, and Open Policy Agent is the obvious example. Nothing here presents that idea as new. The contribution here is the practice of binding it into the rest of this architecture.
Not published
How a rule set is sealed, how the seal is checked, how the ceiling is enforced, and how any of that meets the confidence gate, are not published here.
Alignment: Regulation (EU) 2024/1689, Article 12 on record-keeping and Article 17 on the quality management system. Where Article 14 applies, effective human intervention stays wired in whatever the rules say.
Source: Regulation (EU) 2024/1689, Article 12 (record-keeping), Article 17 (quality management system) and Article 14 (human oversight) (primary source) · checked on 7 September 2026
Honest absence
Inside P-2, and stated separately because it is the rule most often broken: no evidence produces no value. Not a default, not a median, not a plausible figure. An empty attribute is a true statement about what is known, and a filled one that nobody can trace is not.
Candidate principles
Four practices that behave like principles and are not yet numbered as such. They are published because they are in use, and a practice in use that nobody wrote down is a practice that decays.
Claim discipline
Every regulatory sentence resolves to a primary source and the date somebody read it. Every sentence about our own behaviour resolves to deployed behaviour or to a named test. When a sentence turns out to have neither, there are two honest moves: build the thing, or soften the sentence. Citing a source nobody opened is not among them. This has no value to an application and a great deal of value to a reader.
Non-override
An authenticated adverse fact from an official source cannot be attested away. A finding the system derived itself can be resolved by a named person, and the resolution is recorded with who made it and what they saw. The distinction is the entire point: a person may overrule an inference of ours and may not overrule a register.
Evidence semantics
One fact carries several readings at once and they never collapse into a single number. Is the source genuine. What does it actually cover. What did it return. How recent is it. Where did it come from. Was a person involved. Which duty does it speak to. A high reading on one and a low reading on another is not a contradiction to be averaged away; it is the information.
Not published
The states each reading moves through, the rules that move them, and the way a narrow coverage limits the rest, are not published here.
Disclosure control
A fence keeps inventive matter that has not been filed off every public surface, including built frontend bundles, and a register records what is being held and the condition under which it stops being held. That the discipline exists is worth stating. What it guards is not.
Communication red lines
Binding on every framework and product text. Each row is a sentence that is easy to write and impossible to support.
Say: Audit-ready evidence that management met its oversight duty.
Never: Protection from personal liability.
Why: Oversight duties are statutory and are not waived by a tool.
Say: Human oversight by design, human on the loop.
Never: Human out of the loop.
Why: Where Article 14 of Regulation (EU) 2024/1689 applies, effective human intervention is the requirement.
Source: Regulation (EU) 2024/1689, Article 14 (primary source) · checked on 7 September 2026
Say: Verifiably reduces the risk of a fabricated value.
Never: Eliminates hallucination.
Why: An architecture lowers a risk. It does not remove a property of the model class.
Say: A regulation-wired framework with a runtime enforcement path.
Never: The first AI-native enterprise architecture framework.
Why: There is prior art, and a first-of-its-kind claim invites the one argument nobody needs.