REGISTRY · AXIA.COMPLIANCE-MAPPING.V1

Compliance Mapping Registry

Structured, non-authoritative mappings between Axia capabilities and external regulatory and standards frameworks.

Non-authoritative. These mappings are non-authoritative. Compliance is determined by the regulator and the controller, not by Axia.

1. Conventions

Each mapping MUST declare its framework, article, the Axia capability that maps to it, and a mapping_strength. Mappings MUST be marked non_authoritative: true.

EU — eIDAS 2 (Reg. 910/2014, as revised)

ARTICLE TRUST SERVICES — QUALIFIED TIMESTAMPS & ELECTRONIC SIGNATURES

Interoperability with qualified trust service providers

Per-signature optional RFC 3161 timestamp tokens from qualified or non-qualified TSAs, preserved alongside Ed25519 publisher signatures and Merkle-log inclusion proofs.

Axia is not a Qualified Trust Service Provider. It is compatible with QTSP-issued RFC 3161 tokens and does not itself emit qualified signatures or qualified timestamps.

EU — EUDI Wallet (eIDAS 2, Architecture Reference Framework)

ARTICLE VERIFIABLE ATTESTATIONS BOUND TO CONTENT

Identity-bound provenance of published content

Publisher-attested identity (DNS-verified domain, governed signer, delegated signers) bound cryptographically to every signed asset and preserved in the append-only log.

Axia does not issue EUDI credentials and is not a wallet. It preserves identity attestations declared by the publisher in a form that can be cross-referenced with external identity systems.

EU — MiCA (Reg. 2023/1114)

ARTICLE MARKETING COMMUNICATIONS & DISCLOSURES (TITLE II, IV)

Integrity and timestamping of public disclosures by CASPs and issuers

Cryptographic proof of what was published, by which verified domain, and when — including disclosures, whitepapers, marketing communications and AI-assisted outputs. Append-only log + RFC 3161 timestamps provide auditor-verifiable evidence.

Axia does not classify crypto-asset products or services, does not authorise CASPs, and does not assess MiCA applicability. It provides evidentiary primitives that can support record-keeping and disclosure obligations.

EU — Digital Services Act (Reg. 2022/2065)

ARTICLE ARTICLES 15, 24, 39 — TRANSPARENCY & RECORD-KEEPING

Auditable trace of platform-published content

Append-only Merkle log of signed content events with public inclusion proofs; per-organization exportable audit log; immutable lifecycle assertions per asset.

Axia does not perform content moderation, does not assess illegality, and does not produce DSA transparency reports. It provides a tamper-evident substrate that can underpin record-keeping obligations.

Spain — Ley Orgánica de IA (Anteproyecto 2025)

ARTICLE RÉGIMEN SANCIONADOR

Sanciones por incumplimiento (hasta 35 M€ o 7 % facturación anual)

Cryptographic evidence of publisher-attested AI disclosure, identity binding and content integrity — usable as evidence of due diligence for marking, disclosure and record-keeping obligations.

Axia provides the cryptographic primitives required to evidence marking, disclosure and lifecycle logging. It does not classify AI systems, does not replace the Delegado de IA, and does not constitute legal advice.

ARTICLE AESIA / SUPERVISIÓN

Auditoría y trazabilidad de contenido sintético

Public append-only Merkle log + RFC 3161 timestamping + Bitcoin anchoring of signed content events. AESIA and downstream auditors can independently verify the existence, integrity and publisher-attested disclosure of any signed asset.

Independent verifiability without trusting Axia. The competent authority decides whether a given record is admissible as evidence.

ARTICLE DELEGADO DE IA

Inventario y gobernanza de sistemas IA

Per-organization identity governance: signing-policy, delegated signers, automation level (human_supervised / fully_autonomous), agent operator, risk tier and revocation events — all cryptographically bound and auditable.

Provides machine- and auditor-readable governance metadata for each AI system or agent that signs content. The Delegado de IA remains accountable for the organisation's AI inventory.

Spain — Ley Orgánica de IA / EU AI Act

ARTICLE PROHIBICIÓN DE CONTENIDO SINTÉTICO SEXUAL Y PROTECCIÓN DE MENORES

Deepfakes sexuales y contenido que afecte a menores

Signing API refuses to sign content declared as synthetic sexual material, refuses to sign ai_generated content without an explicit human_review attestation, and requires a mandatory content_origin declaration for every signature.

Enforcement is at the signing layer. Axia does not detect synthetic sexual content; it refuses to attest it once declared and blocks AI-generated signatures without human supervision.

EU AI Act

ARTICLE 50

Transparency obligations for AI-generated content

Publisher-attested AI disclosure preserved as append-only assertion bound to signed content.

Axia preserves the disclosure declared by the publisher. It does not detect AI nor enforce labelling.

ARTICLE 12

Record-keeping & logging

Append-only lifecycle ledger with signed Merkle inclusion.

Provides evidentiary logs for content events. Does not cover full AI system logging requirements.

C2PA

ARTICLE 1.4

Provenance manifests

C2PA-compatible JSON manifests and urn:axia: identifiers.

Axia outputs are interoperable with C2PA verifiers.

RFC 6962

ARTICLE ARCHITECTURAL PATTERN

Certificate Transparency

Append-only Merkle log with periodic signed checkpoints.

Adopts the architectural pattern; not a CT log itself.

RFC 3161

ARTICLE TIME-STAMP PROTOCOL

Trusted timestamping

Optional RFC 3161 timestamp tokens preserved with signed entries.

Compatible with eIDAS-qualified timestamping authorities.

GDPR

ARTICLE 5(1)(C)

Data minimisation

Content is hashed locally; raw bytes never leave the publisher. Visitor IPs are HMAC-hashed.

Supports data minimisation by design.

ARTICLE 5(1)(F)

Integrity & confidentiality

Cryptographic integrity, append-only lifecycle, RLS visibility segmentation.

Provides integrity guarantees on signed entries.