{
  "component-definition": {
    "uuid": "08442705-7260-55f8-8d02-524f882f3b0a",
    "metadata": {
      "title": "RateLoop Human Review Evidence Compliance Map",
      "published": "2026-07-16T00:00:00Z",
      "last-modified": "2026-10-08T00:00:00Z",
      "version": "rateloop.assurance-compliance-map.v1",
      "oscal-version": "1.2.2",
      "document-ids": [
        {
          "scheme": "https://rateloop.ai/docs/compliance-map",
          "identifier": "rateloop.assurance-compliance-map.v1"
        }
      ],
      "props": [
        {
          "name": "mapping-version",
          "ns": "https://rateloop.ai/ns/oscal",
          "value": "rateloop.assurance-compliance-map.v1"
        },
        {
          "name": "mapping-hash",
          "ns": "https://rateloop.ai/ns/oscal",
          "value": "sha256:e759cb4fd613b8ba3dbd7022c97fcaad1a006db2b0c6d1ac39f26fa8a7c1b2b8"
        },
        {
          "name": "claim-boundary",
          "ns": "https://rateloop.ai/ns/oscal",
          "value": "These mappings identify evidence RateLoop artifacts can support. They do not establish certification, legal compliance, control effectiveness, or discharge a customer's duties."
        }
      ],
      "links": [
        {
          "href": "https://pages.nist.gov/OSCAL-Reference/models/v1.2.2/component-definition/",
          "rel": "described-by",
          "media-type": "text/html",
          "text": "OSCAL 1.2.2 Component Definition Model"
        }
      ],
      "remarks": "This component definition is a machine-readable evidence cross-reference. It does not represent an assessment result, certification, legal opinion, or assertion that a customer's controls are implemented or effective."
    },
    "components": [
      {
        "uuid": "41d44c7c-86a0-55f2-80a6-7663429df5fd",
        "type": "service",
        "title": "RateLoop Human Review Evidence",
        "description": "A service component that produces integrity-bearing records of configured and sampled human review of AI-enabled workflows. Host-reported execution metadata remains explicitly unverified.",
        "purpose": "Provide review-policy, human-judgment, coverage, escalation, gate, and audit evidence that customers can evaluate within their own governance systems.",
        "props": [
          {
            "name": "mapping-version",
            "ns": "https://rateloop.ai/ns/oscal",
            "value": "rateloop.assurance-compliance-map.v1"
          },
          {
            "name": "mapping-hash",
            "ns": "https://rateloop.ai/ns/oscal",
            "value": "sha256:e759cb4fd613b8ba3dbd7022c97fcaad1a006db2b0c6d1ac39f26fa8a7c1b2b8"
          },
          {
            "name": "claim-boundary",
            "ns": "https://rateloop.ai/ns/oscal",
            "value": "supports-evidence-for"
          },
          {
            "name": "execution-provenance",
            "ns": "https://rateloop.ai/ns/oscal",
            "value": "host-reported-unverified"
          }
        ],
        "control-implementations": [
          {
            "uuid": "82173e73-93e1-5216-aa99-064466f35190",
            "source": "#f0c392b6-f948-5185-a657-11130917c6b3",
            "description": "The listed RateLoop artifacts support evidence for selected ISO/IEC 42001:2023 expectations. This is a cross-reference, not an assertion that a control is implemented or effective.",
            "props": [
              {
                "name": "framework-id",
                "ns": "https://www.iso.org/standard/81230.html#",
                "value": "iso-iec-42001"
              },
              {
                "name": "claim",
                "ns": "https://rateloop.ai/ns/oscal",
                "value": "supports-evidence-for"
              }
            ],
            "implemented-requirements": [
              {
                "uuid": "e5aaccba-490d-57c5-9ae6-79b699ba931d",
                "control-id": "iso-iec-42001-a-6-2-6",
                "description": "The listed RateLoop artifacts support evidence for operation-and-monitoring records for a deployed AI system, including the frozen review policy in force, sampling decisions, human results, coverage rollups, and stage transitions for a bounded period. This mapping does not demonstrate that a customer has implemented the A.6.2.6 control or that RateLoop is ISO/IEC 42001 certified.",
                "props": [
                  {
                    "name": "reference",
                    "ns": "https://www.iso.org/standard/81230.html#",
                    "value": "A.6.2.6"
                  },
                  {
                    "name": "claim",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "supports-evidence-for"
                  },
                  {
                    "name": "evidence-artifact",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "signed-assurance-evidence-packet"
                  },
                  {
                    "name": "evidence-artifact",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "adaptive-coverage-export"
                  },
                  {
                    "name": "evidence-artifact",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "host-reported-execution-evidence"
                  }
                ],
                "links": [
                  {
                    "href": "#9ea956b1-7f3e-5c89-89e7-d809f18684c3",
                    "rel": "evidence",
                    "text": "Signed assurance evidence packet"
                  },
                  {
                    "href": "#d5d0b0ec-1ff3-5cf7-8725-1b6229e20e3c",
                    "rel": "evidence",
                    "text": "Adaptive assurance coverage export"
                  },
                  {
                    "href": "#de8163fc-29a5-5adc-a1d7-ab627d5d605d",
                    "rel": "evidence",
                    "text": "Host-reported execution evidence"
                  }
                ]
              },
              {
                "uuid": "01900b51-d6b8-59a6-b61c-300ee4c2619f",
                "control-id": "iso-iec-42001-a-6-2-8",
                "description": "The listed RateLoop artifacts support evidence for event-log evidence about review decisions, policy context, gate state, and integrity-checkable audit history. This mapping does not establish completeness of a customer's wider AI-system event logging or retention programme.",
                "props": [
                  {
                    "name": "reference",
                    "ns": "https://www.iso.org/standard/81230.html#",
                    "value": "A.6.2.8"
                  },
                  {
                    "name": "claim",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "supports-evidence-for"
                  },
                  {
                    "name": "evidence-artifact",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "workspace-audit-export"
                  },
                  {
                    "name": "evidence-artifact",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "signed-assurance-evidence-packet"
                  },
                  {
                    "name": "evidence-artifact",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "human-review-gate-evidence"
                  }
                ],
                "links": [
                  {
                    "href": "#bde8250a-b58f-5596-b715-23da54e2681d",
                    "rel": "evidence",
                    "text": "Workspace audit-chain export"
                  },
                  {
                    "href": "#9ea956b1-7f3e-5c89-89e7-d809f18684c3",
                    "rel": "evidence",
                    "text": "Signed assurance evidence packet"
                  },
                  {
                    "href": "#10c884d0-a2b8-5562-9323-8e0db11729c3",
                    "rel": "evidence",
                    "text": "Human-review gate evidence"
                  }
                ]
              },
              {
                "uuid": "2d129b70-2d4e-5548-be4e-990f3f3bbcfc",
                "control-id": "iso-iec-42001-a-9-2",
                "description": "The listed RateLoop artifacts support evidence for responsible-use records showing configured review rules, human judgments, coverage, escalation, and release-gate evidence. This mapping does not assign customer responsibility, competence, training, authority, or approval obligations to RateLoop.",
                "props": [
                  {
                    "name": "reference",
                    "ns": "https://www.iso.org/standard/81230.html#",
                    "value": "A.9.2"
                  },
                  {
                    "name": "claim",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "supports-evidence-for"
                  },
                  {
                    "name": "evidence-artifact",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "signed-assurance-evidence-packet"
                  },
                  {
                    "name": "evidence-artifact",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "adaptive-coverage-export"
                  },
                  {
                    "name": "evidence-artifact",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "human-review-gate-evidence"
                  }
                ],
                "links": [
                  {
                    "href": "#9ea956b1-7f3e-5c89-89e7-d809f18684c3",
                    "rel": "evidence",
                    "text": "Signed assurance evidence packet"
                  },
                  {
                    "href": "#d5d0b0ec-1ff3-5cf7-8725-1b6229e20e3c",
                    "rel": "evidence",
                    "text": "Adaptive assurance coverage export"
                  },
                  {
                    "href": "#10c884d0-a2b8-5562-9323-8e0db11729c3",
                    "rel": "evidence",
                    "text": "Human-review gate evidence"
                  }
                ]
              }
            ]
          },
          {
            "uuid": "256c2ad9-8ea3-52e0-a554-cd1c37b64cd5",
            "source": "#3a594389-d27d-5e34-ba41-7588cd18e4f2",
            "description": "The listed RateLoop artifacts support evidence for selected NIST AI Risk Management Framework expectations. This is a cross-reference, not an assertion that a control is implemented or effective.",
            "props": [
              {
                "name": "framework-id",
                "ns": "https://airc.nist.gov/airmf-resources/airmf/",
                "value": "nist-ai-rmf"
              },
              {
                "name": "claim",
                "ns": "https://rateloop.ai/ns/oscal",
                "value": "supports-evidence-for"
              }
            ],
            "implemented-requirements": [
              {
                "uuid": "999b9788-ee87-5ba2-8570-9e2b8ea7458b",
                "control-id": "nist-ai-rmf-measure-2-8",
                "description": "The listed RateLoop artifacts support evidence for documented examination of transparency and accountability limits, including privacy-safe aggregation, the stated limitations of each packet, and execution metadata recorded as host-reported and not independently verified. This mapping is an evidence cross-reference and does not represent a NIST assessment, endorsement, or determination of risk acceptability.",
                "props": [
                  {
                    "name": "reference",
                    "ns": "https://airc.nist.gov/airmf-resources/airmf/",
                    "value": "MEASURE 2.8"
                  },
                  {
                    "name": "claim",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "supports-evidence-for"
                  },
                  {
                    "name": "evidence-artifact",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "signed-assurance-evidence-packet"
                  },
                  {
                    "name": "evidence-artifact",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "host-reported-execution-evidence"
                  }
                ],
                "links": [
                  {
                    "href": "#9ea956b1-7f3e-5c89-89e7-d809f18684c3",
                    "rel": "evidence",
                    "text": "Signed assurance evidence packet"
                  },
                  {
                    "href": "#de8163fc-29a5-5adc-a1d7-ab627d5d605d",
                    "rel": "evidence",
                    "text": "Host-reported execution evidence"
                  }
                ]
              },
              {
                "uuid": "4436e3cb-fe4b-54da-9ea4-39da0ae35a1c",
                "control-id": "nist-ai-rmf-measure-4-2",
                "description": "The listed RateLoop artifacts support evidence for documented measurement results informed by invited domain-expert reviewers, covering sampling, human agreement and disagreement, latency, and design-weighted population estimates or typed coverage gaps. This mapping is an evidence cross-reference and does not represent a NIST assessment or endorsement, and an invitation to review is not proof of a reviewer's expertise or independence.",
                "props": [
                  {
                    "name": "reference",
                    "ns": "https://airc.nist.gov/airmf-resources/airmf/",
                    "value": "MEASURE 4.2"
                  },
                  {
                    "name": "claim",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "supports-evidence-for"
                  },
                  {
                    "name": "evidence-artifact",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "adaptive-coverage-export"
                  },
                  {
                    "name": "evidence-artifact",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "signed-assurance-evidence-packet"
                  }
                ],
                "links": [
                  {
                    "href": "#d5d0b0ec-1ff3-5cf7-8725-1b6229e20e3c",
                    "rel": "evidence",
                    "text": "Adaptive assurance coverage export"
                  },
                  {
                    "href": "#9ea956b1-7f3e-5c89-89e7-d809f18684c3",
                    "rel": "evidence",
                    "text": "Signed assurance evidence packet"
                  }
                ]
              },
              {
                "uuid": "811af0da-647c-5bf0-ba36-a371249988d8",
                "control-id": "nist-ai-rmf-manage-2-4",
                "description": "The listed RateLoop artifacts support evidence for records binding a configured review requirement to the stop-gate state and the exact release decision for a single reviewed output. RateLoop records a hold-or-release decision for a single reviewed output and does not supersede, disengage, or deactivate the customer's AI system. External agent integrations are advisory; RateLoop Chat checks the current review policy and required human result before sending email.",
                "props": [
                  {
                    "name": "reference",
                    "ns": "https://airc.nist.gov/airmf-resources/airmf/",
                    "value": "MANAGE 2.4"
                  },
                  {
                    "name": "claim",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "supports-evidence-for"
                  },
                  {
                    "name": "evidence-artifact",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "human-review-gate-evidence"
                  },
                  {
                    "name": "evidence-artifact",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "workspace-audit-export"
                  }
                ],
                "links": [
                  {
                    "href": "#10c884d0-a2b8-5562-9323-8e0db11729c3",
                    "rel": "evidence",
                    "text": "Human-review gate evidence"
                  },
                  {
                    "href": "#bde8250a-b58f-5596-b715-23da54e2681d",
                    "rel": "evidence",
                    "text": "Workspace audit-chain export"
                  }
                ]
              },
              {
                "uuid": "1e98ffb3-7a63-5a51-801f-54838e8eb7a3",
                "control-id": "nist-ai-rmf-manage-4-1",
                "description": "The listed RateLoop artifacts support evidence for post-deployment monitoring records covering human override of an AI result, returning a changed scope to its saved starting coverage, and integrity-checkable follow-up history. This mapping does not make or replace the customer's risk treatment, acceptance, response, or governance decisions.",
                "props": [
                  {
                    "name": "reference",
                    "ns": "https://airc.nist.gov/airmf-resources/airmf/",
                    "value": "MANAGE 4.1"
                  },
                  {
                    "name": "claim",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "supports-evidence-for"
                  },
                  {
                    "name": "evidence-artifact",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "human-review-gate-evidence"
                  },
                  {
                    "name": "evidence-artifact",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "workspace-audit-export"
                  },
                  {
                    "name": "evidence-artifact",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "signed-assurance-evidence-packet"
                  }
                ],
                "links": [
                  {
                    "href": "#10c884d0-a2b8-5562-9323-8e0db11729c3",
                    "rel": "evidence",
                    "text": "Human-review gate evidence"
                  },
                  {
                    "href": "#bde8250a-b58f-5596-b715-23da54e2681d",
                    "rel": "evidence",
                    "text": "Workspace audit-chain export"
                  },
                  {
                    "href": "#9ea956b1-7f3e-5c89-89e7-d809f18684c3",
                    "rel": "evidence",
                    "text": "Signed assurance evidence packet"
                  }
                ]
              }
            ]
          },
          {
            "uuid": "ce07bce3-2b97-5c95-a587-46e21d6a6f77",
            "source": "#7567e401-9089-55d4-95ee-e61aefaf5da2",
            "description": "The listed RateLoop artifacts support evidence for selected Regulation (EU) 2024/1689 (EU AI Act) expectations. This is a cross-reference, not an assertion that a control is implemented or effective.",
            "props": [
              {
                "name": "framework-id",
                "ns": "http://data.europa.eu/eli/reg/2024/1689/oj#",
                "value": "eu-ai-act"
              },
              {
                "name": "claim",
                "ns": "https://rateloop.ai/ns/oscal",
                "value": "supports-evidence-for"
              }
            ],
            "implemented-requirements": [
              {
                "uuid": "c6272c60-9996-56e3-87ce-0da60b047aaa",
                "control-id": "eu-ai-act-article-26-5-6",
                "description": "The listed RateLoop artifacts support evidence for monitoring records, review-policy operation, and export history that may support a deployer's monitoring evidence and retention process for logs generated by its high-risk AI system. RateLoop is not the deployer's assigned human oversight. Its six-month floor applies to RateLoop review records, not the logs generated by the customer's high-risk AI system, and does not satisfy Article 26(6) or any monitoring, authority, competence, or reporting duty.",
                "props": [
                  {
                    "name": "reference",
                    "ns": "http://data.europa.eu/eli/reg/2024/1689/oj#",
                    "value": "Article 26(5)-(6)"
                  },
                  {
                    "name": "claim",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "supports-evidence-for"
                  },
                  {
                    "name": "evidence-artifact",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "adaptive-coverage-export"
                  },
                  {
                    "name": "evidence-artifact",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "signed-assurance-evidence-packet"
                  },
                  {
                    "name": "evidence-artifact",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "workspace-audit-export"
                  }
                ],
                "links": [
                  {
                    "href": "#d5d0b0ec-1ff3-5cf7-8725-1b6229e20e3c",
                    "rel": "evidence",
                    "text": "Adaptive assurance coverage export"
                  },
                  {
                    "href": "#9ea956b1-7f3e-5c89-89e7-d809f18684c3",
                    "rel": "evidence",
                    "text": "Signed assurance evidence packet"
                  },
                  {
                    "href": "#bde8250a-b58f-5596-b715-23da54e2681d",
                    "rel": "evidence",
                    "text": "Workspace audit-chain export"
                  }
                ]
              },
              {
                "uuid": "3c2d38d5-457c-56d8-9816-23096c40e277",
                "control-id": "eu-ai-act-article-73",
                "description": "The listed RateLoop artifacts support evidence for preserving review decisions, gate outcomes, and audit history that may support a customer's serious-incident investigation and report preparation. RateLoop does not determine whether an event is a serious incident and does not perform the customer's regulatory notification.",
                "props": [
                  {
                    "name": "reference",
                    "ns": "http://data.europa.eu/eli/reg/2024/1689/oj#",
                    "value": "Article 73"
                  },
                  {
                    "name": "claim",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "supports-evidence-for"
                  },
                  {
                    "name": "evidence-artifact",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "signed-assurance-evidence-packet"
                  },
                  {
                    "name": "evidence-artifact",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "human-review-gate-evidence"
                  },
                  {
                    "name": "evidence-artifact",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "workspace-audit-export"
                  }
                ],
                "links": [
                  {
                    "href": "#9ea956b1-7f3e-5c89-89e7-d809f18684c3",
                    "rel": "evidence",
                    "text": "Signed assurance evidence packet"
                  },
                  {
                    "href": "#10c884d0-a2b8-5562-9323-8e0db11729c3",
                    "rel": "evidence",
                    "text": "Human-review gate evidence"
                  },
                  {
                    "href": "#bde8250a-b58f-5596-b715-23da54e2681d",
                    "rel": "evidence",
                    "text": "Workspace audit-chain export"
                  }
                ]
              }
            ]
          },
          {
            "uuid": "15766a3c-9642-5530-97ca-a07f65bc960c",
            "source": "#81a5892e-b90c-5dd7-824d-9f7f23e545e1",
            "description": "The listed RateLoop artifacts support evidence for selected FINRA supervision rules and generative-AI guidance expectations. This is a cross-reference, not an assertion that a control is implemented or effective.",
            "props": [
              {
                "name": "framework-id",
                "ns": "https://www.finra.org/rules-guidance/",
                "value": "finra"
              },
              {
                "name": "claim",
                "ns": "https://rateloop.ai/ns/oscal",
                "value": "supports-evidence-for"
              }
            ],
            "implemented-requirements": [
              {
                "uuid": "1aecbb30-9b2e-54b2-b8fc-7eae9c9399c8",
                "control-id": "finra-regulatory-notice-24-09",
                "description": "The listed RateLoop artifacts support evidence for technology-governance records for a supervisory system that uses generative AI, including the review policy in force, host-reported model and version metadata, and integrity-checkable review history. Regulatory Notice 24-09 states that it creates no new requirements and sets no human-review obligation; this mapping does not determine which FINRA rules apply, approve a member firm's supervisory system, or constitute legal advice.",
                "props": [
                  {
                    "name": "reference",
                    "ns": "https://www.finra.org/rules-guidance/",
                    "value": "Regulatory Notice 24-09"
                  },
                  {
                    "name": "claim",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "supports-evidence-for"
                  },
                  {
                    "name": "evidence-artifact",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "signed-assurance-evidence-packet"
                  },
                  {
                    "name": "evidence-artifact",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "host-reported-execution-evidence"
                  },
                  {
                    "name": "evidence-artifact",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "workspace-audit-export"
                  }
                ],
                "links": [
                  {
                    "href": "#9ea956b1-7f3e-5c89-89e7-d809f18684c3",
                    "rel": "evidence",
                    "text": "Signed assurance evidence packet"
                  },
                  {
                    "href": "#de8163fc-29a5-5adc-a1d7-ab627d5d605d",
                    "rel": "evidence",
                    "text": "Host-reported execution evidence"
                  },
                  {
                    "href": "#bde8250a-b58f-5596-b715-23da54e2681d",
                    "rel": "evidence",
                    "text": "Workspace audit-chain export"
                  }
                ]
              },
              {
                "uuid": "70648452-d6b1-5a86-9386-2a01c54fa977",
                "control-id": "finra-rule-3110",
                "description": "The listed RateLoop artifacts support evidence for documented review policies, exceptions, escalations, release decisions, and audit history that may be incorporated into a member firm's supervisory records. RateLoop does not establish, maintain, or certify the member firm's supervisory system or written supervisory procedures.",
                "props": [
                  {
                    "name": "reference",
                    "ns": "https://www.finra.org/rules-guidance/",
                    "value": "Rule 3110"
                  },
                  {
                    "name": "claim",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "supports-evidence-for"
                  },
                  {
                    "name": "evidence-artifact",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "adaptive-coverage-export"
                  },
                  {
                    "name": "evidence-artifact",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "human-review-gate-evidence"
                  },
                  {
                    "name": "evidence-artifact",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "workspace-audit-export"
                  }
                ],
                "links": [
                  {
                    "href": "#d5d0b0ec-1ff3-5cf7-8725-1b6229e20e3c",
                    "rel": "evidence",
                    "text": "Adaptive assurance coverage export"
                  },
                  {
                    "href": "#10c884d0-a2b8-5562-9323-8e0db11729c3",
                    "rel": "evidence",
                    "text": "Human-review gate evidence"
                  },
                  {
                    "href": "#bde8250a-b58f-5596-b715-23da54e2681d",
                    "rel": "evidence",
                    "text": "Workspace audit-chain export"
                  }
                ]
              },
              {
                "uuid": "c578786e-62f7-5999-a3e8-ed0965712e85",
                "control-id": "finra-rule-3110-07",
                "description": "The listed RateLoop artifacts support evidence for review records that chronicle the reviewing account, the item reviewed, the date of review, and the action taken, in a form a member firm can retain alongside its supervisory records. Rule 3110.07 governs evidence of review of internal communications and correspondence rather than AI output, and this mapping does not establish, maintain, or certify the member firm's supervisory system or written supervisory procedures.",
                "props": [
                  {
                    "name": "reference",
                    "ns": "https://www.finra.org/rules-guidance/",
                    "value": "Rule 3110.07"
                  },
                  {
                    "name": "claim",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "supports-evidence-for"
                  },
                  {
                    "name": "evidence-artifact",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "workspace-audit-export"
                  },
                  {
                    "name": "evidence-artifact",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "human-review-gate-evidence"
                  },
                  {
                    "name": "evidence-artifact",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "signed-assurance-evidence-packet"
                  }
                ],
                "links": [
                  {
                    "href": "#bde8250a-b58f-5596-b715-23da54e2681d",
                    "rel": "evidence",
                    "text": "Workspace audit-chain export"
                  },
                  {
                    "href": "#10c884d0-a2b8-5562-9323-8e0db11729c3",
                    "rel": "evidence",
                    "text": "Human-review gate evidence"
                  },
                  {
                    "href": "#9ea956b1-7f3e-5c89-89e7-d809f18684c3",
                    "rel": "evidence",
                    "text": "Signed assurance evidence packet"
                  }
                ]
              },
              {
                "uuid": "f9c1770f-e8ae-506d-8a79-785821a753ad",
                "control-id": "finra-oversight-report-2026-genai",
                "description": "The listed RateLoop artifacts support evidence for records of human-in-the-loop review of model output, the formal review and approval process in force, and tracking of which model version was used and when. The report presents these as practices a firm may want to consider rather than as FINRA requirements, and this mapping does not establish that a member firm has adopted them or that its supervisory system is adequate.",
                "props": [
                  {
                    "name": "reference",
                    "ns": "https://www.finra.org/rules-guidance/",
                    "value": "2026 Annual Regulatory Oversight Report, GenAI: Continuing and Emerging Trends"
                  },
                  {
                    "name": "claim",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "supports-evidence-for"
                  },
                  {
                    "name": "evidence-artifact",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "signed-assurance-evidence-packet"
                  },
                  {
                    "name": "evidence-artifact",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "adaptive-coverage-export"
                  },
                  {
                    "name": "evidence-artifact",
                    "ns": "https://rateloop.ai/ns/oscal",
                    "value": "host-reported-execution-evidence"
                  }
                ],
                "links": [
                  {
                    "href": "#9ea956b1-7f3e-5c89-89e7-d809f18684c3",
                    "rel": "evidence",
                    "text": "Signed assurance evidence packet"
                  },
                  {
                    "href": "#d5d0b0ec-1ff3-5cf7-8725-1b6229e20e3c",
                    "rel": "evidence",
                    "text": "Adaptive assurance coverage export"
                  },
                  {
                    "href": "#de8163fc-29a5-5adc-a1d7-ab627d5d605d",
                    "rel": "evidence",
                    "text": "Host-reported execution evidence"
                  }
                ]
              }
            ]
          }
        ]
      }
    ],
    "back-matter": {
      "resources": [
        {
          "uuid": "f0c392b6-f948-5185-a657-11130917c6b3",
          "title": "ISO/IEC 42001:2023",
          "description": "Authoritative framework or regulatory source used only as a cross-reference for this mapping.",
          "props": [
            {
              "name": "framework-id",
              "ns": "https://www.iso.org/standard/81230.html#",
              "value": "iso-iec-42001"
            }
          ],
          "citation": {
            "text": "ISO/IEC 42001:2023 official standard record. Access to the complete standard may require a licence from ISO or a national standards body."
          },
          "rlinks": [
            {
              "href": "https://www.iso.org/standard/81230.html",
              "media-type": "text/html"
            }
          ]
        },
        {
          "uuid": "3a594389-d27d-5e34-ba41-7588cd18e4f2",
          "title": "NIST AI Risk Management Framework",
          "description": "Authoritative framework or regulatory source used only as a cross-reference for this mapping.",
          "props": [
            {
              "name": "framework-id",
              "ns": "https://airc.nist.gov/airmf-resources/airmf/",
              "value": "nist-ai-rmf"
            }
          ],
          "citation": {
            "text": "NIST AI RMF Core and Playbook resources maintained by the U.S. National Institute of Standards and Technology."
          },
          "rlinks": [
            {
              "href": "https://airc.nist.gov/airmf-resources/airmf/5-sec-core/",
              "media-type": "text/html"
            },
            {
              "href": "https://airc.nist.gov/airmf-resources/playbook/",
              "media-type": "text/html"
            }
          ]
        },
        {
          "uuid": "7567e401-9089-55d4-95ee-e61aefaf5da2",
          "title": "Regulation (EU) 2024/1689 (EU AI Act)",
          "description": "Authoritative framework or regulatory source used only as a cross-reference for this mapping.",
          "props": [
            {
              "name": "framework-id",
              "ns": "http://data.europa.eu/eli/reg/2024/1689/oj#",
              "value": "eu-ai-act"
            }
          ],
          "citation": {
            "text": "Official Journal text of Regulation (EU) 2024/1689 on harmonised rules on artificial intelligence, as amended by Regulation (EU) 2026/1744 (Digital Omnibus on AI, OJ L, 2026/1744, 24 July 2026, in force 27 July 2026). The amendment leaves the text of the mapped provisions unchanged and postpones Chapter III, Section 3 to 2 December 2027 for Annex III high-risk systems and to 2 August 2028 for Annex I high-risk systems."
          },
          "rlinks": [
            {
              "href": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng",
              "media-type": "text/html"
            }
          ]
        },
        {
          "uuid": "81a5892e-b90c-5dd7-824d-9f7f23e545e1",
          "title": "FINRA supervision rules and generative-AI guidance",
          "description": "Authoritative framework or regulatory source used only as a cross-reference for this mapping.",
          "props": [
            {
              "name": "framework-id",
              "ns": "https://www.finra.org/rules-guidance/",
              "value": "finra"
            }
          ],
          "citation": {
            "text": "FINRA Rule 3110 with Supplementary Material .07, Regulatory Notice 24-09 (27 June 2024), and the GenAI section of the 2026 FINRA Annual Regulatory Oversight Report (9 December 2025). Notice 24-09 states that it creates no new requirements, and the report presents practices a firm may want to consider. The mapping does not constitute FINRA approval or legal advice."
          },
          "rlinks": [
            {
              "href": "https://www.finra.org/rules-guidance/rulebooks/finra-rules/3110",
              "media-type": "text/html"
            },
            {
              "href": "https://www.finra.org/rules-guidance/notices/24-09",
              "media-type": "text/html"
            },
            {
              "href": "https://www.finra.org/rules-guidance/guidance/reports/2026-finra-annual-regulatory-oversight-report/gen-ai",
              "media-type": "text/html"
            }
          ]
        },
        {
          "uuid": "9ea956b1-7f3e-5c89-89e7-d809f18684c3",
          "title": "Signed assurance evidence packet",
          "description": "A signed, hash-bound packet containing frozen invited-review inputs, privacy-safe aggregation, review authority, and limitations.",
          "props": [
            {
              "name": "artifact-id",
              "ns": "https://rateloop.ai/ns/oscal",
              "value": "signed-assurance-evidence-packet"
            },
            {
              "name": "schema-version",
              "ns": "https://rateloop.ai/ns/oscal",
              "value": "rateloop.human-assurance.evidence.v10"
            }
          ]
        },
        {
          "uuid": "d5d0b0ec-1ff3-5cf7-8725-1b6229e20e3c",
          "title": "Adaptive assurance coverage export",
          "description": "A hash-bound workspace export of policy snapshots, sampling decisions, forced-review rules, human-result observations, design-weighted population estimates or typed coverage gaps, coverage rollups, and stage transitions for a bounded period.",
          "props": [
            {
              "name": "artifact-id",
              "ns": "https://rateloop.ai/ns/oscal",
              "value": "adaptive-coverage-export"
            },
            {
              "name": "schema-version",
              "ns": "https://rateloop.ai/ns/oscal",
              "value": "rateloop.assurance-coverage-export.v3"
            }
          ]
        },
        {
          "uuid": "bde8250a-b58f-5596-b715-23da54e2681d",
          "title": "Workspace audit-chain export",
          "description": "A workspace-scoped, hash-chained audit export whose sequence and head digest can be checked with the offline verifier.",
          "props": [
            {
              "name": "artifact-id",
              "ns": "https://rateloop.ai/ns/oscal",
              "value": "workspace-audit-export"
            },
            {
              "name": "schema-version",
              "ns": "https://rateloop.ai/ns/oscal",
              "value": "rateloop-audit-v1"
            }
          ]
        },
        {
          "uuid": "10c884d0-a2b8-5562-9323-8e0db11729c3",
          "title": "Human-review gate evidence",
          "description": "Signed evidence binding a review requirement to the stop-gate state and the exact release decision without exposing private review material.",
          "props": [
            {
              "name": "artifact-id",
              "ns": "https://rateloop.ai/ns/oscal",
              "value": "human-review-gate-evidence"
            },
            {
              "name": "schema-version",
              "ns": "https://rateloop.ai/ns/oscal",
              "value": "rateloop.human-review-gate-evidence.v1"
            }
          ]
        },
        {
          "uuid": "de8163fc-29a5-5adc-a1d7-ab627d5d605d",
          "title": "Host-reported execution evidence",
          "description": "A canonical commitment to model identity and execution metadata reported by the connected host. It is explicitly marked independentlyVerified:false and does not independently verify that the reported model produced the output.",
          "props": [
            {
              "name": "artifact-id",
              "ns": "https://rateloop.ai/ns/oscal",
              "value": "host-reported-execution-evidence"
            },
            {
              "name": "schema-version",
              "ns": "https://rateloop.ai/ns/oscal",
              "value": "rateloop.execution-evidence.v1"
            }
          ]
        }
      ]
    }
  }
}