Abstract

The EU AI Act, South Korea's AI Basic Act, Japan's AI Act, China's algorithm and AI-content rules, and state laws in Texas and Colorado all rely mainly on written governance: risk-management files, conformity assessments, human-oversight instructions, transparency notices and logs. These are necessary, but once an AI system can act at machine speed — rejecting a job applicant, opening a valve, exporting customer data, publishing content or commanding a satellite — a document cannot make the operation technically incapable of breaking the rule, and an audit log shows only that a rule existed after the harm and its cost have occurred. Authentication proves who is asking, not whether this act is permitted; a UI "approve" button helps only if execution actually depends on it; model guardrails are probabilistic. This paper describes an execution-finality architecture for high-risk AI. Each consequential AI-generated operation becomes a candidate act held in a non-effective state. A protected enforcement domain checks it against a signed, machine-readable governance profile — permitted operation, target, recipient, destination, approved model version, human approval bound to the exact act, required AI-content marker, risk-control state, policy epoch and revocation — and issues single-use, act-bound authority. A finality sink at the first usable effect re-verifies that authority and the current state before anything happens; unknown or unverifiable state means no effect. The paper maps Articles 5, 9, 10, 12, 13, 14, 15, 26 and 50 to runtime checks without making legal determinations, supports jurisdiction-specific profiles combined by intersection with conflicts failing closed, and covers sidecar deployment for legacy systems, latency, delegation between agents, insider threats, offline operation and residual limits. A runnable reference implementation with 727 passing tests is publicly available. This disclosure is based on the author's international patent application PCT/IB2026/055615 (the "Mothership" application), filed on 4 June 2026 and publicly disclosed on 16 July 2026. The author is open to acquihire or strategic collaboration. IETF draft: https://datatracker.ietf.org/doc/draft-das-eu-ai-act-execution-enforcement/ KEYWORDS EU AI Act, AI governance, AI compliance, high-risk AI systems, human oversight, Article 14, Article 50, AI-generated content labelling, prohibited AI practices, risk management, South Korea AI Basic Act, Japan AI Act, agentic AI, prompt injection, policy enforcement point, runtime enforcement, fail-closed, replay protection, policy versioning, revocation, critical infrastructure, defence AI, digital sovereignty

Creative Commons License

Creative Commons License
This work is licensed under a Creative Commons Attribution-Noncommercial 4.0 License

Download

Share

COinS