Manufacturing and industrial compliance

Manufacturing compliance — ISO 9001, IATF 16949, AS9100, ISO 13485, OSHA PSM, EPA RMP, ITAR/EAR/OFAC, RoHS/REACH/Conflict Minerals.

Manufacturing compliance is a layered stack of quality system standards + process-safety regulation + export control + product/material law. AI systems used in production environments inherit all of them.

Regulatory frame

Regime	Applies when	Evaluation-evidence shape
ISO 9001	Most manufacturers (general QMS)	Documented procedure; corrective action evidence
IATF 16949	Automotive supply chain	Customer-specific QMS evidence
AS9100	Aerospace	Risk management; configuration control
ISO 13485	Medical-device manufacturing	Design controls; CAPA
OSHA Process Safety Management (29 CFR 1910.119)	Highly hazardous chemicals (HHC) above thresholds	PHA, MOC, audit, mechanical-integrity records
EPA Risk Management Program (40 CFR 68)	Regulated-substance handling above thresholds	Risk-management plan; audit
ITAR (22 CFR 120-130)	Defense articles	License evidence; deemed-export controls
EAR (15 CFR 730-774)	Dual-use export	License determination; ECCN classification
OFAC sanctions	All transactions	Screening at each transaction
RoHS (EU)	Electronics in EU	Substance-restriction proof
REACH (EU)	Chemicals in EU	Registration; SVHC notification
Conflict Minerals (Dodd-Frank § 1502)	SEC-registered issuers	Country-of-origin; due diligence
Recall regulators	Per industry	NHTSA (auto), FDA (food/device), CPSC (consumer), FAA (aerospace)
NIST AI RMF + sectoral	Voluntary; appears in some customer contracts	GOVERN/MAP/MEASURE/MANAGE evidence

ISO 9001 / IATF 16949 / AS9100 / ISO 13485

For manufacturers maintaining a certified quality management system:

• Documented procedure required for any AI system affecting product quality
• Corrective and Preventive Action (CAPA) evidence for AI-flagged issues
• Internal audit scope must include AI components
• Customer-specific requirements in IATF 16949 and AS9100 may require deeper supplier-AI evidence

Stratix evaluation evidence:

• Audit-trail per evaluation (model, prompt, scoring, decision)
• Evaluation-history retained per QMS records-retention schedule
• Drift dashboards as monitoring evidence

OSHA PSM and EPA RMP

For sites handling Highly Hazardous Chemicals above thresholds:

• PHA (Process Hazard Analysis) — must consider AI control loops
• MOC (Management of Change) — model updates are MOC events
• Mechanical Integrity — sensors feeding AI must be tested and maintained
• Operating Procedures — AI advisories cannot replace approved procedures
• Training — operators must understand AI's role and limits
• Compliance Audits — every 3 years minimum; PSM violations carry willful-violation penalties

Stratix evaluation evidence:

• Hard rule: AI advisory-only on process-safety-critical decisions
• SOP-citation rule on every operator copilot output
• MOC log per model update tied to evaluation evidence

ITAR / EAR

For defense articles and dual-use technology:

• ITAR: classified by USML; license required for export; deemed-export rules for foreign nationals on US soil
• EAR: ECCN classification; license determined by item + destination + end-use + end-user
• Penalties: per-incident fines; criminal exposure; debarment

Stratix evaluation evidence:

• BYOK custom models for ITAR / EAR-controlled technical data
• Tenant boundary documented; foreign-national access controls aligned with site procedures
• Audit log of every AI interaction with controlled data

OFAC sanctions

For all transactions:

• SDN List, Sectoral Sanctions, country programs — all in scope
• Knowledge standard — strict liability for primary violations; "reason to know" applies
• 50% rule — entities owned 50%+ by sanctioned parties are themselves sanctioned

Stratix evaluation evidence:

• Hard sanctions-screening rule on every supplier and counterparty surfaced by AI
• Daily refresh of sanctions data feeding the rule
• Audit log retained for 5 years (OFAC standard)

RoHS / REACH / Conflict Minerals

For materials and component decisions:

• RoHS — restricts six (now ten) substances in electronics in the EU
• REACH — registration, evaluation, authorization, restriction of chemicals in the EU
• Conflict Minerals (3TG: tin, tantalum, tungsten, gold) — SEC issuer due-diligence reporting

Stratix evaluation evidence:

• Spec-match rule on substitution recommendations
• Country-of-origin code assertion against verified database
• Audit log of supplier-info AI surfaced

Recall regulators

By industry:

• NHTSA (automotive) — TREAD Act early-warning reporting
• FDA (food, drugs, medical devices) — recall classification I/II/III
• CPSC (consumer products) — Section 15(b) reporting
• FAA (aerospace) — service bulletins, ADs

AI involved in any quality decision must produce evidence that supports root-cause investigation if a recall ensues.

NIST AI RMF and sectoral overlays

Some customers (particularly DoD prime contractors) require NIST AI RMF or CMMC-aligned AI evidence as a flow-down requirement.

Recommended setup

1. Pro tier minimum; Enterprise for ITAR/EAR-controlled environments
2. SSO + RBAC scoped to plant / shift / role
3. BYOK custom models for ITAR/EAR/HIPAA-grade workloads
4. Hard rules: sanctions screening, spec match, manual-version match, advisory-only for safety-critical
5. Per-defect-class P/R tracking; drift vs. golden image set
6. Audit retention matching the longest applicable QMS, recall, or OFAC requirement (default 7+ years)
7. MOC integration: model updates logged and reviewed per PSM MOC procedure
8. Tenant isolation; export-control flag at the project level

See also

• Manufacturing scenarios
• Manufacturing eval patterns
• Concept: Multi-tenancy
• Enterprise
• BYOK custom models