Regulatory Coverage
Framework Coverage Index
RCAN protocol provisions mapped to applicable regulatory frameworks for physical robot AI systems. The labels refer to protocol-layer technical controls only. Organizational, procedural, and regulatory obligations remain the responsibility of the provider and deployer.
Conformance is not certification.
Conformance to RCAN tracks (L1–L4 protocol, Gateway Authority, HIL Runtime Safety) is self-asserted via signed bundles and independently replayable from those bundles. Conformance is not certification. Certification requires audit by a qualified third-party body, which is intentionally out-of-scope for the foundation in 2026.
None of these labels means that a system meets the requirement. Most of each obligation is organizational and stays with the provider or deployer, and whether a system meets it is decided through their own conformity assessment, which RCAN does not perform.
EU AI Act (2024/1689)
Applies to high-risk AI systems. A robot can be high-risk under Art. 6(1), as or within a safety component of a product covered by Annex I law such as the Machinery Regulation, or under Art. 6(2) if its use is listed in Annex III. The two routes carry different obligations and application dates; registration under Art. 49, for example, applies to Annex III systems.
| Article | Requirement | RCAN Provisions | Coverage |
|---|---|---|---|
| Art. 9 | Risk management system — identify and mitigate known and foreseeable risks across the system lifecycle | §16.3 confidence gates (per-scope thresholds); ConfidenceGate; castor fria generate FRIA artifact (OpenCastor#858) | Supports |
| Art. 12 | Record keeping — automatic logging of operational events enabling post-deployment reconstruction | §6 AuditChain (HMAC-SHA256 append-only, chained); §16.2 AI block (model identity, confidence, latency, thought_id); QuantumLink-Sim commitment chain | Provides records for |
| Art. 13 | Transparency — deployers must be able to interpret outputs and understand system limitations | §16.5 thought log (GET /api/thoughts/<id>, OWNER-gated); robot-memory.md structured operational history (rcan-spec#191) | Supports |
| Art. 14 | Human oversight — effective oversight during operation; ability to intervene, override, or halt | §16.4 HiTL gates (PENDING_AUTH → AUTHORIZE flow, which the spec requires the runtime rather than the AI agent to enforce); §2 RBAC OWNER role enforcement; ESTOP protocol | Supports |
| Art. 17 | Quality management — documented methodology, testing, performance monitoring, change management | §16.3 confidence gate thresholds (performance floor); §16.2 inference_latency_ms in every audit record; robot-memory.md confidence decay (systematic degradation monitoring) | Supports |
| Art. 26 | Deployer obligations — use system as instructed, maintain human oversight, report incidents | §2 RBAC LEASEE role (deployer authority boundary; the runtime rejects out-of-scope commands) | Supports |
| Art. 50 | Marking of AI-generated content — providers of systems that generate synthetic audio, image, video or text must mark that output as AI-generated (Art. 50(2)). Whether this covers robot commands is not established. | §16.6 AI output watermarking — HMAC watermark token on every AI-generated COMMAND message; verification endpoint (rcan-spec#194, in progress) | In progress |
Detailed article-level mapping: docs/compliance/eu-ai-act-mapping.md — includes conformity assessment citation guidance.
NIST AI Risk Management Framework 1.0
Voluntary framework for US federal agencies and government procurement. Relevant for DoD and GSA-schedule robotics contracts.
| Function | Core Requirement | RCAN Provisions | Coverage |
|---|---|---|---|
| GOVERN | Organizational accountability, policies, and workforce capability for AI risk | §2 RBAC (role-scoped authority); §16 AI accountability provisions; L1–L4 conformance as measurable governance target | Supports |
| MAP | Identify and characterize AI risks in deployment context | FRIA protocol §22 (risk entries from conformance gaps + robot-memory hardware observations); rcan-spec#195 | Supports |
| MEASURE | Analyze and assess AI risks using quantitative and qualitative methods | L1–L4 conformance test suite (quantitative pass/fail per requirement); confidence gate rejection rates; audit chain integrity verification; safety benchmarks (OpenCastor#859) | Supports |
| MANAGE | Prioritize and address risks; communicate residual risks to stakeholders | §16.3–16.4 gating (risk prevention); §16.5 thought log (decision transparency); AuditChain (residual risk evidence); FRIA artifact (stakeholder communication) | Supports |
Detailed alignment: docs/compliance/nist-ai-rmf-alignment.md
Additional Frameworks
ISO 10218-1:2025
SupportsSafety requirements for industrial robots. RCAN provisions: Protocol 66 safety rules (15 rules across motion, force, workspace, human, thermal, electrical, software, emergency, property, privacy domains); geofencing with dead-reckoning odometry; emergency stop with callback chain.
Full alignment doc →IEC 62443
SupportsIndustrial automation and control system cybersecurity. RCAN provisions: ML-DSA-65 + Ed25519 message signing; RBAC with rate limiting and session timeouts; JWT authentication; mDNS discovery with peer verification.
Full alignment doc →GDPR Article 22
SupportsAutomated individual decision-making. RCAN provisions: §16.4 HiTL gates (human in the decision loop); §16.5 thought log (decision explainability); privacy-by-default sensor policy in OpenCastor (camera, microphone scope controls).
HIPAA
SupportsApplicable to medical robotics (surgical, clinical support, care pathway automation). RCAN provisions: role-gated audit record access (OWNER required for reasoning field); tamper-evident chain for PHI-adjacent action logs; air-gap capable (no external network required).
ISO 42001
SupportsAI management systems — organizational requirements. RCAN provisions: L1–L4 conformance levels provide measurable quality benchmarks for an AI management system's technical controls; audit chain supports post-market monitoring data infrastructure.
SIL/PLe (IEC 62061 / ISO 13849)
SupportsFunctional safety for machinery. RCAN provisions: safety stop integration (agent.safety_stop flag); latency budget constraint (latency_budget_ms); Protocol 66 safety invariants provide evidence for safety function documentation.
What RCAN does not address
RCAN is a protocol specification. The following compliance requirements are organizational, procedural, or regulatory in nature and are outside the scope of any protocol: EU AI Act Art. 43 conformity assessment and CE marking; Art. 49 registration in the EU AI public database; Art. 72 post-market monitoring organizational process; Art. 9(2)(b) estimation of risks under reasonably foreseeable misuse; Art. 73 reporting of serious incidents to the authorities.
RCAN provides the technical controls and audit infrastructure that support these obligations — it does not constitute the organizational process itself. For conformity assessment template guidance, see docs/compliance/conformity-assessment-template.md.