> For the complete documentation index, see [llms.txt](https://docs.layerlens.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.layerlens.ai/more-in-this-section-2/compliance-7.md).

# Manufacturing and industrial compliance

Manufacturing compliance — ISO 9001, IATF 16949, AS9100, ISO 13485, OSHA PSM, EPA RMP, ITAR/EAR/OFAC, RoHS/REACH/Conflict Minerals.

Manufacturing compliance is a layered stack of **quality system standards + process-safety regulation + export control + product/material law**. AI systems used in production environments inherit all of them.

## Regulatory frame

| Regime                                               | Applies when                                      | Evaluation-evidence shape                                         |
| ---------------------------------------------------- | ------------------------------------------------- | ----------------------------------------------------------------- |
| **ISO 9001**                                         | Most manufacturers (general QMS)                  | Documented procedure; corrective action evidence                  |
| **IATF 16949**                                       | Automotive supply chain                           | Customer-specific QMS evidence                                    |
| **AS9100**                                           | Aerospace                                         | Risk management; configuration control                            |
| **ISO 13485**                                        | Medical-device manufacturing                      | Design controls; CAPA                                             |
| **OSHA Process Safety Management (29 CFR 1910.119)** | Highly hazardous chemicals (HHC) above thresholds | PHA, MOC, audit, mechanical-integrity records                     |
| **EPA Risk Management Program (40 CFR 68)**          | Regulated-substance handling above thresholds     | Risk-management plan; audit                                       |
| **ITAR (22 CFR 120-130)**                            | Defense articles                                  | License evidence; deemed-export controls                          |
| **EAR (15 CFR 730-774)**                             | Dual-use export                                   | License determination; ECCN classification                        |
| **OFAC sanctions**                                   | All transactions                                  | Screening at each transaction                                     |
| **RoHS (EU)**                                        | Electronics in EU                                 | Substance-restriction proof                                       |
| **REACH (EU)**                                       | Chemicals in EU                                   | Registration; SVHC notification                                   |
| **Conflict Minerals (Dodd-Frank § 1502)**            | SEC-registered issuers                            | Country-of-origin; due diligence                                  |
| **Recall regulators**                                | Per industry                                      | NHTSA (auto), FDA (food/device), CPSC (consumer), FAA (aerospace) |
| **NIST AI RMF + sectoral**                           | Voluntary; appears in some customer contracts     | GOVERN/MAP/MEASURE/MANAGE evidence                                |

## ISO 9001 / IATF 16949 / AS9100 / ISO 13485

For manufacturers maintaining a certified quality management system:

* **Documented procedure** required for any AI system affecting product quality
* **Corrective and Preventive Action (CAPA)** evidence for AI-flagged issues
* **Internal audit** scope must include AI components
* **Customer-specific requirements** in IATF 16949 and AS9100 may require deeper supplier-AI evidence

**Stratix evaluation evidence:**

* Audit-trail per evaluation (model, prompt, scoring, decision)
* Evaluation-history retained per QMS records-retention schedule
* Drift dashboards as monitoring evidence

## OSHA PSM and EPA RMP

For sites handling Highly Hazardous Chemicals above thresholds:

* **PHA (Process Hazard Analysis)** — must consider AI control loops
* **MOC (Management of Change)** — model updates are MOC events
* **Mechanical Integrity** — sensors feeding AI must be tested and maintained
* **Operating Procedures** — AI advisories cannot replace approved procedures
* **Training** — operators must understand AI's role and limits
* **Compliance Audits** — every 3 years minimum; PSM violations carry willful-violation penalties

**Stratix evaluation evidence:**

* Hard rule: AI advisory-only on process-safety-critical decisions
* SOP-citation rule on every operator copilot output
* MOC log per model update tied to evaluation evidence

## ITAR / EAR

For defense articles and dual-use technology:

* **ITAR**: classified by USML; license required for export; deemed-export rules for foreign nationals on US soil
* **EAR**: ECCN classification; license determined by item + destination + end-use + end-user
* **Penalties**: per-incident fines; criminal exposure; debarment

**Stratix evaluation evidence:**

* BYOK custom models for ITAR / EAR-controlled technical data
* Tenant boundary documented; foreign-national access controls aligned with site procedures
* Audit log of every AI interaction with controlled data

## OFAC sanctions

For all transactions:

* **SDN List, Sectoral Sanctions, country programs** — all in scope
* **Knowledge standard** — strict liability for primary violations; "reason to know" applies
* **50% rule** — entities owned 50%+ by sanctioned parties are themselves sanctioned

**Stratix evaluation evidence:**

* Hard sanctions-screening rule on every supplier and counterparty surfaced by AI
* Daily refresh of sanctions data feeding the rule
* Audit log retained for 5 years (OFAC standard)

## RoHS / REACH / Conflict Minerals

For materials and component decisions:

* **RoHS** — restricts six (now ten) substances in electronics in the EU
* **REACH** — registration, evaluation, authorization, restriction of chemicals in the EU
* **Conflict Minerals (3TG: tin, tantalum, tungsten, gold)** — SEC issuer due-diligence reporting

**Stratix evaluation evidence:**

* Spec-match rule on substitution recommendations
* Country-of-origin code assertion against verified database
* Audit log of supplier-info AI surfaced

## Recall regulators

By industry:

* **NHTSA** (automotive) — TREAD Act early-warning reporting
* **FDA** (food, drugs, medical devices) — recall classification I/II/III
* **CPSC** (consumer products) — Section 15(b) reporting
* **FAA** (aerospace) — service bulletins, ADs

AI involved in any quality decision must produce evidence that supports root-cause investigation if a recall ensues.

## NIST AI RMF and sectoral overlays

Some customers (particularly DoD prime contractors) require NIST AI RMF or CMMC-aligned AI evidence as a flow-down requirement.

## Recommended setup

1. Pro tier minimum; Enterprise for ITAR/EAR-controlled environments
2. SSO + RBAC scoped to plant / shift / role
3. BYOK custom models for ITAR/EAR/HIPAA-grade workloads
4. Hard rules: sanctions screening, spec match, manual-version match, advisory-only for safety-critical
5. Per-defect-class P/R tracking; drift vs. golden image set
6. Audit retention matching the longest applicable QMS, recall, or OFAC requirement (default 7+ years)
7. MOC integration: model updates logged and reviewed per PSM MOC procedure
8. Tenant isolation; export-control flag at the project level

## See also

* [Manufacturing scenarios](/more-in-this-section-2/scenarios-7.md)
* [Manufacturing eval patterns](/more-in-this-section-2/eval-patterns-7.md)
* [Concept: Multi-tenancy](/7.-observe-see-whats-happening/multi-tenancy.md)
* [Enterprise](/4.2-industry-use-cases/manufacturing.md)
* [BYOK custom models](/5.-select-pick-the-model/byok-custom-models.md)