AI Regulatory Horizon / Obligation Intelligence Architecture 解读

配对阅读：本篇的操作手册版（模板/RACI/门禁/runbook）是 docs/AI_REGULATORY_HORIZON_OBLIGATION_INTELLIGENCE_PLAYBOOK.md。第一遍读本篇建立原理与架构判断；第二遍做案例时再用 playbook 查表落地，两者不需要重复精读。

Source Anchors

核心导读

AI regulatory horizon 不应停留在法规新闻转发、法律备忘录归档或季度培训。金融零售 AI 的外部约束会持续来自 laws、guidance、regulatory speeches、supervisory priorities、standards、vendor notices 和 peer incidents。真正有价值的是把外部信号转成内部可查询、可分派、可测试、可上线门禁、可审计和可汇报的 obligation-to-control graph。

Obligation intelligence architecture 关注“外部变化如何变成内部设计变化”。它要回答：新信号是否适用，影响哪些 AI asset、产品、地区、客户、流程、模型、供应商和证据；应抽取成 obligation、expectation、control implication 还是 watch item；谁负责解释、落地、测试、发布和证明。

可以把它理解为：

obligation intelligence =
  source monitoring
  + applicability triage
  + obligation extraction
  + impact graph
  + owner assignment
  + control/eval/change linkage
  + evidence and reporting

1. 问题定义

Regulatory response 关注已经发生的 exam、incident、audit finding、regulator request。Regulatory horizon / obligation intelligence 关注更早、更系统的问题：

• 哪些 laws、guidance、speeches、priorities、standards、vendor notices 和 peer incidents 正在变化。
• 哪些变化可能适用于哪些实体、产品、地区、客户群、AI capability、数据边界和供应商关系。
• 哪些文本应被抽取为 hard obligation、supervisory expectation、control implication 或 watch item。
• 哪些 owner 需要更新 control、eval、release gate、evidence、management reporting 或 risk acceptance。

金融零售 AI 的义务不是单一法规，而是叠加系统：

关键区分：

• Law is not control.
• Guidance is not product requirement.
• Obligation is not evidence.
• Evidence is not control operation unless it proves the control ran.

2. 架构模型

Obligation intelligence 的核心是把外部 source、内部 AI inventory、control library、eval registry、change ticket、incident、evidence 和 management reporting 连成图。

External sources
  EU AI Act | NIST | ISO | SR letters | CFPB | speeches | standards | incidents
        |
        v
Source registry and version store
        |
        v
Signal classifier
  law | supervisory expectation | standard update | enforcement pattern | vendor notice
        |
        v
Applicability triage
  jurisdiction | entity | role | product | AI capability | customer impact | data | vendor
        |
        v
Obligation extraction and ontology
  obligation | expectation | control implication | watch item
        |
        v
Obligation-to-control/eval/change graph
  AI inventory <-> controls <-> evals <-> releases <-> incidents <-> evidence
        |
        v
Workflow and reporting
  owner tasks | governance review | dashboard | board memo | audit evidence

Design principle:

Every material signal becomes one of:
  no-impact rationale
  watch item
  obligation object
  control update
  eval update
  change request
  management risk acceptance

关键架构对象：

3. 关键机制/生命周期

Obligation intelligence 生命周期从来源监控开始，到义务退役或控制持续运行结束。

monitor source
  -> create signal record
  -> classify source and signal
  -> triage applicability
  -> extract obligation / expectation / control implication
  -> map impact to AI assets and controls
  -> assign owners and due dates
  -> update eval / release gate / evidence
  -> review implementation
  -> report status and risk
  -> monitor changes and retire when obsolete

Obligation ontology 是这套系统的骨架：

SR 26-2 与 GenAI 的边界需要单独建模。更好的 framing 不是“所有 GenAI 都按旧模型风险模板处理”，而是：

• Predictive models、scorecards 和 AML models 仍需要模型风险治理。
• GenAI、RAG 和 agentic AI 包含模型行为，也包含 prompt、corpus、tool permission、workflow、human oversight、vendor 和 monitoring risk。
• 某些 GenAI 组件可能进入模型风险语境，但系统还需要 broader AI governance：inventory、source governance、tool authority、eval、transparency、incident、change 和 evidence。
• Obligation intelligence 应把义务路由到正确治理域，避免盲目套用 legacy validation checklist。

4. 证据与控制

Obligation control 的目标不是证明“我们看过法规”，而是证明外部变化已被版本化、适用性已被判断、义务已被抽取、影响已被映射、owner 已经行动、控制已运行、证据可被审计。

一个轻量结构化记录可以帮助验证系统是否跑通：

source:
  id: SRC-FED-SR26-2
  url: https://www.federalreserve.gov/supervisionreg/srletters/SR2602.htm
  type: supervisory_guidance
  access_date: 2026-06-30
signal:
  text: revised model risk management guidance supersedes SR 11-7 and SR 21-8
  jurisdiction: US federal banking
triage:
  product: credit_card_ai_assistant
  ai_capability: predictive_score + rag + llm_draft
  customer_impact: medium
  decision_role: recommend_and_draft
obligation_object:
  type: model_risk_and_ai_governance_alignment
  action: map components to model risk, AI governance, vendor risk, eval and change controls
  owner: ai_governance_owner
  due: 2026-07-31

对应图查询应回答：

SELECT ai_asset_id, control_id, eval_id, owner_role
FROM obligation_graph
WHERE source_id = 'SRC-FED-SR26-2'
  AND status IN ('new', 'triaged', 'mapped')
  AND risk_tier IN ('Tier1', 'Tier2');

通过标准不是字段填满，而是每个 material signal 都产生 owner、decision 和 traceable graph edge。

5. 金融零售/AI产品场景

Scenario: A retail bank runs an AI customer service assistant for credit card disputes and fee questions across US and EU channels.

New signals:

• EU AI Act transparency and high-risk screening are reviewed for EU users.
• CFPB guidance index shows changes in consumer finance circulars that may affect misleading statements, credit reporting or dispute handling.
• SR 26-2 updates model risk management expectations for supervised banking organizations.
• NIST AI RMF and ISO/IEC 42001 are used as governance and management-system anchors.

Impact mapping:

产品和架构上的真实变化应包括：

• AI inventory 增加 jurisdiction、role、customer-facing、decision impact 和 provider/deployer 属性。
• RAG source governance 增加 policy freshness、source approval、citation and retrieval eval。
• Customer harm eval 增加 dispute deadline、fee explanation、credit reporting 和 complaint escalation 场景。
• Release gate 增加 obligation-linked regression tests。
• Evidence layer 增加 obligation ID 到 control result、eval result、release decision 和 management action 的链接。

6. 反模式

7. 最终心智模型

Obligation intelligence 的成熟度不在于追踪了多少法规链接，而在于外部变化能否变成内部系统变化。高级金融零售 AI 架构必须让每个重要 regulatory signal 走完从 source、triage、obligation、impact、owner、control、eval、change 到 evidence 的路径。

最终要形成一条稳定链路：

external signal
  -> applicability triage
  -> obligation object
  -> impact graph
  -> control/eval/change update
  -> evidence
  -> management reporting

如果一个组织只能说明“我们关注了 EU AI Act、NIST、ISO、SR letters 和 CFPB guidance”，却不能查询这些来源分别影响哪些 AI assets、哪些 release gates、哪些控制、哪些证据和哪些未关闭 owner action，它还没有建立真正的 obligation intelligence architecture。

---

SOTA 状态标注 (2026-07-01)

本篇属于第二、三遍深读池（参考架构/深读笔记），未列入 12 周主线必读。时效基线为写作时点；引用前请按 CLAUDE.md 全局时效性硬规则复查最新进展。模块级 SOTA 对照见 docs/AI_SYSTEMATIC_LEARNING_ROADMAP_2026.md 各周「2026 SOTA 对照」行与文末「SOTA 检查」。