One Record, Every Regulator

A regulated firm rarely answers to one regulator. A bank sits under the Fed, the OCC, and the CFPB at once. An insurer answers to every state that adopted the NAIC model. A device maker answers to the FDA. Any firm operating in the EU answers to the AI Act on top of all of it.

The agent action underneath those regimes is one event. It happens once. The regulators are several readers of the same event, and most firms hand each of them a separately assembled record.

One act, several authorities.

Count the regimes a single deployment already lives under. A credit agent at a US bank touches model risk expectations, fair-lending law, and, if the firm operates abroad, the EU AI Act. An underwriting agent at a multistate carrier answers to a dozen insurance departments working from the same model bulletin. The action each agent takes is a single decision at a single moment.

The number of authorities that can pull that decision is not one. It is however many regimes claim jurisdiction over the firm. The record has to serve all of them, and they do not read the same way.

The per-framework record ages out.

The common practice is to capture evidence shaped to the framework in force when the system shipped. The record is built to answer that framework. It answers that framework and nothing else.

Regimes do not hold still. SR 26-2 took effect on April 17, 2026 and placed agentic AI outside its scope, which points each institution back at its own risk practices to define what it keeps. EU AI Act Article 9 obligations were deferred to December 2, 2027 for standalone systems and August 2, 2028 for embedded ones, and the simplification package cleared the Council on June 29, 2026. The NAIC is running an examination tool in pilot and weighing a model law above the bulletin. The list of frameworks a given action must answer to grows after the action has already run. A record captured for one framework cannot be retrofitted to a framework that did not exist when the action was sealed.

Capture neutral, project per regime.

The record has to be captured without a framework baked into it. Seal one canonical account of the action at the moment it happens. What the agent proposed. What authority governed it. What was reduced, held, or refused. The identity that stood behind it. Fixed on a tamper-evident chain, in a schema that names the facts of the decision rather than the clauses of any one rulebook.

The mapping to a given regime is then a read-time operation. SR 26-2 materiality, EU AI Act Article 9 risk management, NAIC governance-program expectations, FDA change control. Each is a lens laid over the same sealed facts. The mapping to any one framework is a projection applied when the record is read, not a separate artifact captured when the action ran.

Why one canonical record, not many.

Producing a record per framework looks safer and is not. N records of one act cannot all be authoritative, and records maintained independently drift. When two of them disagree, the firm is holding evidence that impeaches itself.

One canonical record has one source of truth. One act produces one sealed record, and every regulator reads that same record through its own lens. This is also the only structure that survives divergence. Analysis of EU and US rules already finds multinationals facing obligations that do not reconcile with each other. A record shaped to one side cannot answer the other. A neutral record is the common substrate each side projects from, and the projections can differ without the underlying fact changing.

Where the line is now.

The regimes are moving on separate clocks and pointing at the same events. SR 26-2 handed institutions the job of defining their own record. The EU set its dates and deferred them. The NAIC is turning a bulletin into an examination practice and, perhaps, a law. None of these coordinates with the others, and each will pull the same agent action when the examination cycle arrives.

The firm that captured a framework-specific record answers one of them and reconstructs for the rest. The firm that sealed a neutral record answers each one by projection. The record does not become several records because the regulators are several. It stays one, and the readers change.

What we are building.

Wayfinder Systems Group sits in the decision path and seals one canonical record of each agent action at the moment it runs, in a schema that names the facts of the decision rather than the clauses of any single framework. The mapping to SR 26-2, the EU AI Act, the NAIC bulletin, or an FDA change-control plan is a projection over that record, applied when a given examiner reads it. One act, one sealed record, many readers. Patents held in The Wayfinder Trust. We call her Velma.