> For the complete documentation index, see [llms.txt](https://docs.layerlens.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.layerlens.ai/more-in-this-section-2/compliance-7.md). # Manufacturing and industrial compliance Manufacturing compliance is a layered stack of **quality system standards + process-safety regulation + export control + product/material law**. AI systems used in production environments inherit all of them. ## Regulatory frame | Regime | Applies when | Evaluation-evidence shape | | ---------------------------------------------------- | ------------------------------------------------- | ----------------------------------------------------------------- | | **ISO 9001** | Most manufacturers (general QMS) | Documented procedure; corrective action evidence | | **IATF 16949** | Automotive supply chain | Customer-specific QMS evidence | | **AS9100** | Aerospace | Risk management; configuration control | | **ISO 13485** | Medical-device manufacturing | Design controls; CAPA | | **OSHA Process Safety Management (29 CFR 1910.119)** | Highly hazardous chemicals (HHC) above thresholds | PHA, MOC, audit, mechanical-integrity records | | **EPA Risk Management Program (40 CFR 68)** | Regulated-substance handling above thresholds | Risk-management plan; audit | | **ITAR (22 CFR 120-130)** | Defense articles | License evidence; deemed-export controls | | **EAR (15 CFR 730-774)** | Dual-use export | License determination; ECCN classification | | **OFAC sanctions** | All transactions | Screening at each transaction | | **RoHS (EU)** | Electronics in EU | Substance-restriction proof | | **REACH (EU)** | Chemicals in EU | Registration; SVHC notification | | **Conflict Minerals (Dodd-Frank § 1502)** | SEC-registered issuers | Country-of-origin; due diligence | | **Recall regulators** | Per industry | NHTSA (auto), FDA (food/device), CPSC (consumer), FAA (aerospace) | | **NIST AI RMF + sectoral** | Voluntary; appears in some customer contracts | GOVERN/MAP/MEASURE/MANAGE evidence | ## ISO 9001 / IATF 16949 / AS9100 / ISO 13485 For manufacturers maintaining a certified quality management system: * **Documented procedure** required for any AI system affecting product quality * **Corrective and Preventive Action (CAPA)** evidence for AI-flagged issues * **Internal audit** scope must include AI components * **Customer-specific requirements** in IATF 16949 and AS9100 may require deeper supplier-AI evidence **Stratix evaluation evidence:** * Audit-trail per evaluation (model, prompt, scoring, decision) * Evaluation-history retained per QMS records-retention schedule * Drift dashboards as monitoring evidence ## OSHA PSM and EPA RMP For sites handling Highly Hazardous Chemicals above thresholds: * **PHA (Process Hazard Analysis)** — must consider AI control loops * **MOC (Management of Change)** — model updates are MOC events * **Mechanical Integrity** — sensors feeding AI must be tested and maintained * **Operating Procedures** — AI advisories cannot replace approved procedures * **Training** — operators must understand AI's role and limits * **Compliance Audits** — every 3 years minimum; PSM violations carry willful-violation penalties **Stratix evaluation evidence:** * Hard rule: AI advisory-only on process-safety-critical decisions * SOP-citation rule on every operator copilot output * MOC log per model update tied to evaluation evidence ## ITAR / EAR For defense articles and dual-use technology: * **ITAR**: classified by USML; license required for export; deemed-export rules for foreign nationals on US soil * **EAR**: ECCN classification; license determined by item + destination + end-use + end-user * **Penalties**: per-incident fines; criminal exposure; debarment **Stratix evaluation evidence:** * BYOK custom models for ITAR / EAR-controlled technical data * Tenant boundary documented; foreign-national access controls aligned with site procedures * Audit log of every AI interaction with controlled data ## OFAC sanctions For all transactions: * **SDN List, Sectoral Sanctions, country programs** — all in scope * **Knowledge standard** — strict liability for primary violations; "reason to know" applies * **50% rule** — entities owned 50%+ by sanctioned parties are themselves sanctioned **Stratix evaluation evidence:** * Hard sanctions-screening rule on every supplier and counterparty surfaced by AI * Daily refresh of sanctions data feeding the rule * Audit log retained for 5 years (OFAC standard) ## RoHS / REACH / Conflict Minerals For materials and component decisions: * **RoHS** — restricts six (now ten) substances in electronics in the EU * **REACH** — registration, evaluation, authorization, restriction of chemicals in the EU * **Conflict Minerals (3TG: tin, tantalum, tungsten, gold)** — SEC issuer due-diligence reporting **Stratix evaluation evidence:** * Spec-match rule on substitution recommendations * Country-of-origin code assertion against verified database * Audit log of supplier-info AI surfaced ## Recall regulators By industry: * **NHTSA** (automotive) — TREAD Act early-warning reporting * **FDA** (food, drugs, medical devices) — recall classification I/II/III * **CPSC** (consumer products) — Section 15(b) reporting * **FAA** (aerospace) — service bulletins, ADs AI involved in any quality decision must produce evidence that supports root-cause investigation if a recall ensues. ## NIST AI RMF and sectoral overlays Some customers (particularly DoD prime contractors) require NIST AI RMF or CMMC-aligned AI evidence as a flow-down requirement. ## Recommended setup 1. Pro tier minimum; Enterprise for ITAR/EAR-controlled environments 2. SSO + RBAC scoped to plant / shift / role 3. BYOK custom models for ITAR/EAR/HIPAA-grade workloads 4. Hard rules: sanctions screening, spec match, manual-version match, advisory-only for safety-critical 5. Per-defect-class P/R tracking; drift vs. golden image set 6. Audit retention matching the longest applicable QMS, recall, or OFAC requirement (default 7+ years) 7. MOC integration: model updates logged and reviewed per PSM MOC procedure 8. Tenant isolation; export-control flag at the project level ## See also * [Manufacturing scenarios](/more-in-this-section-2/scenarios-7.md) * [Manufacturing eval patterns](/more-in-this-section-2/eval-patterns-7.md) * [Concept: Multi-tenancy](/7.-observe-see-whats-happening/multi-tenancy.md) * [Enterprise](/4.2-industry-use-cases/manufacturing.md) * [BYOK custom models](/5.-select-pick-the-model/byok-custom-models.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.layerlens.ai/more-in-this-section-2/compliance-7.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.