Built to Protect What You Bring Into the Room.

Every decision rehearsal involves sensitive context — market intelligence, financial projections, strategic options that haven't been announced. MAIA's compliance architecture ensures that what you share stays protected, what MAIA outputs stays defensible, and your organization stays on the right side of the regulations that govern your industry.

The Four-Layer Compliance Architecture

Most AI compliance strategies are a policy document and a terms-of-service clause. MAIA's compliance is running code — four independent layers, each operating at a different point in the pipeline, each enforceable without relying on the others.

16 Industries. Every one governed.

MAIA launched with 14 industry profiles. The compliance architecture adds two more — Nonprofit/NGO and a Generic/Cross-industry fallback mode — bringing total coverage to 16. Each industry has its own dedicated compliance rule set: detection patterns for DIAA, prohibited language rules for LAA, scope boundaries, governing bodies, and ZDR requirements.

The two new additions matter for different reasons. Nonprofit/NGO was added because nonprofit boards carry genuine fiduciary duties — documenting that major decisions were stress-tested is a governance asset, not a compliance burden, and MAIA's Visual Intelligence Package serves that purpose directly. Generic/Cross-industry is the compliance fallback mode: when MAIA cannot confirm a specific industry from the session context, it activates maximum-caution mode — all universal detection patterns active — and notifies the Navigator that industry-specific rules could not be confirmed.

Data Ingestion Audit Agent — How It Works

DIAA operates at the input boundary of the pipeline. Before any Navigator-supplied data enters agent processing, DIAA scans it against two pattern sets: universal patterns that fire regardless of industry, and the industry-specific patterns loaded from the active industry's compliance rule set.

Universal detection patterns (all industries)

These fire on every session regardless of which industry is selected:

• SSN patterns — numeric sequences matching ###-##-#### format
• Credit card patterns — 16-digit sequences matching Luhn algorithm
• Classified document markings — TOP SECRET, SECRET, CONFIDENTIAL, CUI, NOFORN, FOUO
• ITAR/EAR indicators — USML category references, ECCN codes, export license numbers
• API keys and credentials — bearer tokens, OAuth secrets, private key headers
• MNPI language patterns — unannounced earnings, pending acquisition language
• PHI combination patterns — personal identifiers combined with medical or clinical terms
• Attorney-client markers — privilege language combined with matter identifiers

Industry-specific pattern types

Each of the 49 industry-specific patterns is structured as a typed, executable object — not prose guidance. Each pattern carries an ID, description, type, keyword list or regex, context requirements, proximity window, flag category, and severity level. DIAA executes these directly against input text.

What happens on a flag

When DIAA identifies a prohibited data pattern, it executes a four-step sequence:

1. Hold — The flagged data is withheld from the pipeline. Processing does not continue with flagged content.
2. Notify — The Navigator receives a plain-language notice identifying the flag category and the action required. No rule citations. No agent names.
3. Log — The flag event is written to the session compliance audit log: timestamp, session ID, flag category, industry, stage, action taken. The flagged content itself is never logged.
4. Offer — The Navigator is offered three options: remove or redact and resubmit; proceed without the flagged source; abort the session.

Language Audit Agent — How It Works

LAA operates at the output boundary of every pipeline stage. Before any agent output reaches the Navigator, LAA reviews it across three independent dimensions. Normal operation is silent — the Navigator never sees LAA working. When a flag fires, the Navigator receives a brief notice. In severe cases where output cannot be rewritten compliantly, it is held and the stage regenerates.

Three audit dimensions

Dimension 1 — MAIA Language Standard. Enforced universally, every output, every stage, regardless of industry. MAIA surfaces, reveals, supports, and enables. MAIA never decides, mandates, forces, directs, or recommends. Minor violations are rewritten automatically without Navigator notification.

Dimension 2 — Industry Prohibited Language. Each industry's compliance rule set defines specific prohibited phrases and their compliant rewrites. Investment advice language in Financial Services. Clinical recommendation language in Healthcare. Legal opinion language in Legal Services. ITAR classification determinations in Defense. When LAA detects these patterns, it rewrites to the pre-defined compliant version and surfaces a brief inline notice.

Dimension 3 — Scope Boundary Enforcement. MAIA must not claim capabilities it does not have, assert certainty beyond what evidence supports, or frame rehearsal outputs as binding organizational commitments. Overreach language is flagged and softened.

The MAIA Language Standard

MAIA's language standard is the simplest and most powerful compliance protection in the system. It keeps MAIA clearly in the decision support category — never the decision making category, which is where AI regulation is concentrating across financial services, healthcare, insurance, and legal. The LAA enforces this automatically on every output before the Navigator sees it.

The language standard is a regulatory buffer. It keeps MAIA clearly positioned as a decision support tool across every industry where AI regulation is most active. No output from MAIA constitutes investment advice, medical advice, legal opinion, actuarial determination, or regulatory compliance guidance.

The Compliance Audit Log

Every flag event from both DIAA and LAA writes a structured record to the session compliance audit log. The log travels with the session — it is embedded in the Visual Intelligence Package that exports when the rehearsal completes. Enterprise compliance officers and legal reviewers can access it from the package metadata. No separate compliance dashboard is required. The record ships with the decision brief.

Each log entry records: session ID, timestamp (UTC), agent (DIAA or LAA), active industry, pipeline stage, flag category, action taken, whether the Navigator was notified, and resolution status. content_logged is always false. No log entry ever contains the text that triggered the flag.

How MAIA Compares on Compliance

What This Means for Your Role