The Regulatory Framework Converging on Training-Data Provenance
Five regulatory streams now converge on the same architectural requirement. EU AI Act Article 10 obligates providers of high-risk AI systems to implement data-governance practices that cover relevant design choices, data collection processes, examination for biases, identification of data gaps, and demonstration that training, validation, and testing datasets are relevant, sufficiently representative, free of errors, and complete in light of the intended purpose. Article 15 layers on accuracy, robustness, and cybersecurity obligations that cannot be evaluated without knowing what the system was trained on. Article 26, addressed in the parallel inference-control article, then requires deployers to operate under those training-time guarantees.
GDPR Article 22, on automated decision-making, and the broader lawful-basis framework under Article 6 require that personal data used for training carry a lawful basis through the entire training and inference lifecycle. Revocation of consent or exercise of erasure rights under Article 17 must propagate to every model whose parameters were shaped by the revoked data, an obligation whose enforcement depends on per-example lineage.
NIST AI RMF organizes the same obligations under its Govern, Map, Measure, and Manage functions. Map requires that the context of use, including data provenance, be documented. Measure requires that training-data characteristics be quantified against the intended use. Manage requires that adverse training-time decisions be remediable. ISO/IEC 23894 provides the AI-specific risk-management vocabulary that translates these functions into operational controls, and ISO/IEC 42001 places those controls inside an auditable AI Management System (AIMS) certifiable by accredited bodies.
Sector-specific regimes specialize the same shape. The FDA AI/ML PCCP framework, finalized for Software as a Medical Device, requires a Predetermined Change Control Plan that bounds permissible modifications and a Modification Protocol that specifies the methods used to validate any change, including changes to training data. NHTSA's AV TEST initiative and the broader UNECE WP.29 cybersecurity framework (R155) and software update regulation (R156) require traceability from fielded behavior back to the training and software process that produced it. EASA's Concept Papers on machine-learning assurance carry the same logic into airworthiness. The OECD AI Principles, which now inform domestic legislation in more than forty jurisdictions, codify the underlying expectation: traceability and accountability across the AI lifecycle.
Architectural Requirement: Per-Example Provenance, Not Per-Pipeline Documentation
Each of these regimes asks a question of the same structural form: given an observed behavior of a deployed model, which training-time inputs caused it, under what rights and what governance, and can that causal chain be reproduced under audit? The disclosed architecture answers it from the training record itself. Pipeline-level documentation operates at a different level of resolution: it describes the process the engineering team followed, while the architectural approach binds a specific gradient update to a specific training example and makes the sequence replayable.
In the described architecture, therefore, training data enters the model through admission events that carry credentialed provenance, gradient updates are routed at a depth selectivity that is itself recorded, and the resulting model state is reconstructible from the ordered sequence of credentialed updates. That structure is what supports the kind of forensic question regulators are now empowered to ask after a vehicle incident, a medical adverse event, an algorithmic-discrimination complaint under GDPR, or a recall under FDA Section 518.
Procedural Compliance at Fleet Scale
The procedural pattern, collect data, document collection, train a model, document training, audit the documentation, was developed for low-volume traditional ML where a single team controlled the dataset and a single training run produced a single artifact. Regulated autonomy operates under different conditions from the ones that pattern assumes. Fleet learning aggregates contributions from thousands of vehicles, hundreds of clinical sites, or millions of devices; each contribution arrives under different consent posture, different jurisdictional rights, and different quality controls. Continuous training under the FDA PCCP framework or under the EU AI Act's post-market monitoring obligations means there is no single artifact to audit: there is a continuously evolving model whose state at any given time is the integral of an ongoing stream of updates.
Keeping documentation aligned with a continuous stream is a structural problem rather than a matter of engineering diligence. When an audit asks which training contributors influenced a specific behavior, a documentation-based approach answers by reconstruction from logs, commit histories, dataset snapshots, and institutional knowledge, artifacts authored for other purposes. Reconstruction of that kind is effortful and its resolution is bounded by what those artifacts happen to record, which is typically discovered when a serious incident or a regulatory inspection puts the question under adversarial conditions.
A second dimension is revocation. GDPR Article 17 erasure, withdrawal of consent under research-ethics frameworks, or removal of a contributor under contractual termination must propagate into the model. Per-example lineage is what makes the affected parameter updates identifiable, so that remediation can be targeted at those updates rather than scoped to a full retraining run, which at fleet scale is a substantial operational undertaking.
What the Training-Governance Primitive Provides
The Training Governance primitive of United States Patent Application 19/647,395 treats every training contribution as a governed observation. As Chapter 11 discloses, each example admitted into the training stream carries a governance record identifying the policy object that authorized its admission and the policy object that set its depth profile, a content provenance record identifying source, acquisition pathway, and chain of custody, and an admissibility determination recording whether it was admitted, rejected, or admitted with a modified depth profile. In a regulated deployment those policy objects are the credentials issued by a fleet operator, a clinical site, or a data-rights authority, and the cryptographic policy framework cross-referenced by the application lets them be signed and sealed so that alteration after the fact is detectable. Depth-selective gradient routing, implemented through one or more of the three disclosed techniques (gated residual connections, attention-based depth selection, or architecture-agnostic layer-specific scaling factors), then confines the contribution's gradient signal to specific layer blocks under that depth profile. Every admission, depth profile, and per-block contribution weight is written to the append-only, sequentially numbered, timestamped training-provenance log, which can be periodically sealed into tamper-evident checkpoints for third-party verification.
The model state at any time is therefore the ordered composition of logged, governed update events. A reverse provenance query begins with an observed model behavior and traces backward through the log to the bounded set of training content whose depth profiles encompassed the active layer blocks; a forward query begins with a training example and reports which layer blocks it was permitted to influence and at what magnitude. When a contributor's data must be withdrawn under an erasure or revocation right, the log makes the dependent update events identifiable, and because privacy-sensitive or revocation-prone content can be confined by policy to shallow layers or to a parameter-efficient adaptation layer, its influence is structurally bounded rather than diffused through the whole network. The compliance pathway shifts from procedural reconstruction to architectural query.
Compliance Mapping
EU AI Act Article 10 data-governance obligations map onto credentialed admission: each training example arrives with a signed rights and quality envelope, and the admission policy enforces representativeness and bias-examination requirements at the moment of admission rather than retrospectively. Article 15 accuracy and robustness obligations map onto the depth-selective routing record, which makes the relationship between training inputs and model behavior reproducible for evaluation. GDPR Article 17 erasure and Article 22 automated-decision obligations map onto the revocation propagation that per-example lineage enables.
NIST AI RMF Map and Measure functions map directly onto the governance and content-provenance records; Manage maps onto the reverse-query audit path and the structural confinement of revocation-prone content. ISO/IEC 23894 risk controls and ISO/IEC 42001 AIMS clauses on data management, lifecycle traceability, and corrective action are addressed architecturally rather than through a separate documentation layer. The FDA PCCP Modification Protocol becomes executable: the bounded modifications are bounded by routing policy, and the validation methods are reproducible against the credentialed update record. UNECE R155 cybersecurity-management traceability and R156 software-update integrity obligations map onto the same primitive. EASA learning-assurance objectives, particularly the Data Management and Learning Process Management objectives in the EASA Concept Paper, gain a structural implementation.
Adoption Pathway
Adoption proceeds in three stages. First, operators wrap existing training pipelines with credentialed admission at the dataset boundary, producing a per-example provenance record without modifying the training algorithm. This step alone closes the most acute audit gap. Second, operators introduce depth-selective routing for incremental updates, fleet-learning increments, post-market updates under FDA PCCP, or fine-tuning under continuous learning, so that updates carry the routing record that makes revocation tractable. Third, operators integrate the audit-replay path into their AIMS under ISO/IEC 42001, so that regulator queries are answered by query against the lineage rather than by manual reconstruction.
Cross-jurisdictional operation, a vehicle platform fielded under UNECE in Europe, NHTSA in the United States, and equivalent frameworks in Japan and Korea; a medical-device platform under FDA, EU MDR with AI Act overlay, and PMDA, gains the same architectural foundation in every jurisdiction. The primitive is positioned at the layer where regulated autonomy is converging, and it gives operators a compliance posture grounded in the training record itself rather than in documentation assembled around it.
Concretely, a vehicle program adopting the primitive begins by treating each fleet-collected scenario contribution, a corner-case event, a sensor-anomaly capture, a driver-disengagement sequence, as a credentialed observation signed by the contributing vehicle and counter-signed by the fleet operator's data-rights authority. The training pipeline then admits the contribution into specific perception, prediction, or planning subsystems through depth-selective routing, recording the routing decision and the policy that authorized it. When NHTSA later issues a Standing General Order request, when a UNECE R155 audit asks how a software update was validated, or when an EU AI Act post-market incident report must be filed under Article 73, the operator answers by query against the lineage rather than by reconstruction from scattered engineering artifacts.
A medical-device program follows an analogous path. Each clinical-site contribution carries the IRB approval, consent posture, and dataset characterization as part of the credential. PCCP-bounded modifications are admitted only when the proposed update is consistent with the routing policy declared in the Modification Protocol; modifications that fall outside the bound are refused at the architectural boundary rather than at a later review stage. When an FDA inspection asks why a particular device behavior emerged after a particular update, the audit-replay path produces an answer at per-example resolution. The primitive does not replace the regulatory dialogue with FDA, UNECE, EASA, or national authorities; it supplies a structural foundation that lets that dialogue proceed by query against the lineage rather than by reconstruction.
Embodiments and Variations
The disclosed training governance admits several embodiments that map onto distinct regulatory needs. The depth-selective mechanism can be realized through gated residual connections for residual networks, attention-based depth selection for transformer architectures, or layer-specific scaling factors that are architecture-agnostic and therefore applicable to convolutional, recurrent, mixture-of-experts, or hybrid networks used across perception, prediction, and planning subsystems. Depth control may operate at block-level granularity rather than per individual layer, balancing expressiveness against the computational overhead of profile evaluation at fleet scale.
Three further embodiments give regulators concrete answers. First, training-level memorization detection: when a fielded behavior is flagged as similar to a known artifact, a reverse provenance query retrieves the depth profile under which the similar content was admitted and classifies the result as shallow, deep, or absent memorization, evidencing whether time-limited or rights-restricted content was properly confined. Second, per-content differential privacy by architectural confinement: privacy-sensitive contributions are routed primarily to shallow, generic layers with zero or low gating coefficients at deep layers, so that in the described embodiments content assigned a zero weight at the deeper blocks contributes no gradient to the layers most associated with memorization, without the corpus-wide noise calibration that uniform noise injection applies. Third, governed fine-tuning provenance: fine-tuning corpora are recorded in a provenance record structurally distinct from pre-training provenance, so that a challenged output can be attributed to the pre-training entity or the fine-tuning entity for liability allocation. Real-time interactive training applies the same routing and logging to individual accepted or corrected interactions, extending the audit chain to continuous, post-market learning. Deployment options range from wrapping only the dataset boundary with governed admission, to routing incremental fleet-learning and PCCP updates, to integrating the full reverse-query path into an ISO/IEC 42001 AI Management System.
Disclosure Scope
The training-governance technology described in this article, including governed admission, depth-selective gradient routing through gated residual connections, attention-based depth selection, and layer-specific scaling factors, the append-only and cryptographically sealable training-provenance log, forward and reverse provenance queries, training-level memorization detection, differential privacy by depth-selective confinement, and governed fine-tuning provenance, is disclosed in United States Patent Application 19/647,395. The regulatory, market, and deployment framing (UNECE WP.29 R155/R156, the FDA AI/ML PCCP framework, EASA learning-assurance concept papers, the EU AI Act, GDPR, NIST AI RMF, ISO/IEC 23894 and 42001, and the vehicle and medical-device adoption scenarios) is provided as an enabling application of that disclosed technology. This article is a dated description of how the disclosed technology applies to regulated autonomy.
