Law · SCITT
SCITT for legal AI workflows
SCITT in legal AI workflows: what compliance requires, who asks for evidence, and the records to keep.
01 / The rule
What SCITT requires
Issuers of supply chain statements (e.g. software producers, auditors), operators of transparency services, and relying parties that verify them.
- 01Issuers sign statements as COSE_Sign1 messages about a specific artifact.
- 02Transparency services keep an append-only, non-equivocating log that cannot modify, delete or reorder entries.
- 03Transparency services publish and apply a registration policy, itself recorded on the log.
- 04Transparency services register a statement before releasing its COSE receipt (RFC 9942).
- 05Relying parties and auditors verify receipts and log consistency rather than trusting the operator.
02 / In this sector
In a legal AI workflow
Any statement about an AI artifact, such as a model card, evaluation result or dataset hash, can be registered and receipted. The RFC targets software supply chains and does not address AI specifically.
General counsel and litigation support.
FRE 702 · ABA Model Rules.
03 / Records
Records to keep
- 01Signed statements with their COSE receipts
- 02Transparency service registration policy
- 03Auditor log consistency checks
Optional evidence · where Planisphere fits
Keep a record anyone can check
When your team meets a duty, Planisphere can seal the event it reports as a receipt.
A disclosure shown, a review signed, a model change approved: the event your system reports.
The event becomes a sealed receipt, dated and attributed to whoever is signed in.
Paste the receipt into Verify. No account or key.
A record supports your compliance evidence process. It is not a legal finding or a certification. Systems that call Planisphere's gate API can also hold or refuse an action before it runs.
SOURCES
Go back to the source
RFC Editor
IETF Datatracker
RELATED
Related: SCITT: the full guide · SCITT for defense · SCITT for medicine · SCITT for education