Judgment Machine: AI Regulation Simulator and Prompt Triage Engine

Core design rule

Judgment Machine is a jurisdiction-aware legal and ethics triage engine. It should classify a prompt, proposed AI system, deployment context, data type, affected persons, and missing safeguards. It must not assign moral value, trustworthiness, future behavior, or civic legitimacy to the user.

The product answer is not “you are suspicious.” The answer is: “this proposed AI use appears to trigger named regulatory categories; here are the provisions, uncertainty, missing facts, and safer counterfactuals.”

The system is a simulator and documentation aid, not legal advice, official certification, a government decision, or a moral oracle.

Primary user flow

The user enters a prompt or describes an AI system. The app asks for context that a prompt alone cannot supply: jurisdiction, actor role, domain, affected people, data types, decision impact, human oversight, transparency posture, and deployment status.

A local extraction layer converts the prompt into structured facts. A deterministic rule engine, not a free-form model, applies versioned rules against a pinned corpus. The final result is a layered judgment with citations, confidence, severity, missing facts, and counterfactual mitigation.

{
  "judgmentVersion": "2026-06-17T20:30:00Z",
  "subject": "Prompt and proposed AI use case",
  "primaryJudgment": "HIGH_RISK_OR_HIGH_IMPACT",
  "notJudged": [
    "User morality",
    "User trustworthiness",
    "User identity",
    "User future behavior"
  ],
  "summary": "The prompt appears to describe AI-supported ranking of job applicants. Employment-related AI systems can trigger high-risk or automated-decision safeguards depending on jurisdiction and deployment facts.",
  "confidence": 0.82
}

Judgment taxonomy

Do not return a single good/bad score. Return a legal state plus a confidence state, and separate severity from confidence.

The UI must expose extracted facts before judgment. The user can correct those facts when the extraction is wrong.

Source-ranked regulatory corpus

Use a versioned corpus. Binding law controls the decision. Official regulator guidance and treaty frameworks receive lower but visible authority. Voluntary frameworks are advisory overlays, never hidden law.

Current first-release sources include the EU AI Act risk model and high-risk/prohibited categories; GDPR Article 22 and current UK automated-decision guidance; the Council of Europe AI Convention; China generative-AI and synthetic-content-labeling rules; South Korea’s AI Basic Act; Colorado’s current automated-decision framework after SB26-189; Canada’s federal Algorithmic Impact Assessment; and voluntary frameworks from NIST, OECD, and UNESCO.

The Colorado corpus entry must not rely on stale SB24-205/SB25B timing alone. The 2026 SB26-189 reset must be represented as the current Colorado branch unless later law changes again.

Pipeline

The final judgment should come from deterministic, reviewable rules over structured facts. The local model may extract facts, retrieve candidate citations, ask missing-fact questions, and summarize explanations, but it must not invent legal rules or override the rule engine.

Local-first browser architecture

The safest MVP is offline-first. No prompt leaves the browser by default. No user profile is created. No hidden morality score is stored. Remote model calls require explicit opt-in and visible payload preview.

A practical browser stack can use SQLite-Wasm on OPFS, IndexedDB fallback, SQLite FTS for exact legal phrase search, a local embedding index for semantic retrieval, deterministic JSON/YAML rules in a Web Worker, and a service worker for cached app and corpus bundles.

Core database schema

Store all operational timestamps as UTC ISO-8601 strings. Pin every judgment to the corpus version used. Never silently replace legal rules; show a diff and keep old corpus versions available for historical reports.

CREATE TABLE CorpusVersion (
    CorpusVersionId TEXT PRIMARY KEY,
    VersionName TEXT NOT NULL,
    PublishedUtc TEXT NOT NULL,
    ImportedUtc TEXT NOT NULL,
    SourceManifestHash TEXT NOT NULL,
    IsActive INTEGER NOT NULL CHECK (IsActive IN (0, 1))
);

CREATE TABLE Instrument (
    InstrumentId TEXT PRIMARY KEY,
    JurisdictionCode TEXT NOT NULL,
    CorpusVersionId TEXT NOT NULL,
    Name TEXT NOT NULL,
    InstrumentType TEXT NOT NULL,
    AuthorityRank INTEGER NOT NULL,
    Status TEXT NOT NULL,
    EffectiveUtc TEXT NULL,
    LastReviewedUtc TEXT NOT NULL,
    OfficialSourceUrl TEXT NOT NULL,
    CreatedUtc TEXT NOT NULL,
    UpdatedUtc TEXT NOT NULL
);

CREATE TABLE Rule (
    RuleId TEXT PRIMARY KEY,
    InstrumentId TEXT NOT NULL,
    Name TEXT NOT NULL,
    JudgmentLabel TEXT NOT NULL,
    Severity INTEGER NOT NULL CHECK (Severity BETWEEN 0 AND 5),
    RuleJson TEXT NOT NULL,
    IsBlocking INTEGER NOT NULL CHECK (IsBlocking IN (0, 1)),
    CreatedUtc TEXT NOT NULL,
    UpdatedUtc TEXT NOT NULL
);

CREATE TABLE JudgmentRun (
    JudgmentRunId TEXT PRIMARY KEY,
    CorpusVersionId TEXT NOT NULL,
    PromptHash TEXT NOT NULL,
    PromptRedactedText TEXT NULL,
    ContextJson TEXT NOT NULL,
    ExtractedFactsJson TEXT NOT NULL,
    PrimaryJudgmentLabel TEXT NOT NULL,
    Severity INTEGER NOT NULL CHECK (Severity BETWEEN 0 AND 5),
    Confidence REAL NOT NULL CHECK (Confidence BETWEEN 0 AND 1),
    CreatedUtc TEXT NOT NULL
);

Rule DSL example

Rules should be compact, declarative, human-reviewable, and pinned to provisions. Ambiguity should lower confidence and create missing-fact questions, not secret moral judgment.

id: eu.ai_act.high_risk.employment_candidate_evaluation
instrumentId: eu.ai_act.2024.regulation_2024_1689
authority: binding_law
judgmentLabel: HIGH_RISK_OR_HIGH_IMPACT
severity: 4
blocking: false

appliesWhen:
  all:
    - jurisdiction.anyOf: ["EU", "EU_MEMBER_STATE"]
    - domain.anyOf: ["employment", "worker_management", "self_employment_access"]
    - aiCapability.anyOf:
        - ranking
        - filtering
        - scoring
        - candidate_evaluation

requires:
  - risk_management_system
  - data_governance
  - documentation
  - logging
  - human_oversight
  - accuracy_and_cybersecurity

citations:
  - provisionId: eu.ai_act.annex_iii.employment
  - provisionId: eu.ai_act.high_risk_obligations

Safeguards

The product must make its anti-judgment rule mechanically enforceable. Every test should assert that no hidden user morality label, user risk profile, or future-behavior score is created.

Counterfactual mitigation should replace moral condemnation. The product should say which facts would change the classification and which mitigations cannot cure a prohibited use.

MVP build sequence

Milestone one: corpus and rules. Build the source manifest, jurisdiction table, instrument table, provision table, 50 to 100 initial deterministic rules, and rule test cases.

Milestone two: local judgment engine. Add prompt context schema, fact extractor, risk-signal detector, rule matcher, aggregation, citation retrieval, and local audit history.

Milestone three: interactive UI. Add prompt input, context questionnaire, extracted-facts editor, jurisdiction cards, citation drawer, counterfactual mitigation, and exportable report.

Milestone four: offline-first app. Add SQLite-Wasm storage, OPFS persistence, IndexedDB fallback, service worker, signed corpus imports, rollback, and stale-corpus warnings.

Milestone five: adversarial and legal QA. Test ambiguity, prompt injection, stale corpus, jurisdiction conflict, missing facts, and no-person-judgment guarantees.

Starter kit files

The package includes a non-network static prototype and deterministic-rule starter kit. It is demonstration tooling, not legal advice, certification, or production compliance software.

Source and verification note

This page uses the uploaded scenario and product-design brief as implementation input. Public legal and technical claims should remain tied to named official or primary sources because AI regulation changes quickly. This page is not legal advice, compliance certification, or a hosted import service.

• European Commission — AI Act overview
• GDPR Article 22 — automated individual decision-making
• UK ICO — automated decision-making and profiling rights
• Council of Europe — Framework Convention on AI
• NIST — AI RMF and Generative AI Profile
• UNESCO — Recommendation on the Ethics of Neurotechnology
• OECD — AI Principles
• Canada — Algorithmic Impact Assessment tool
• Colorado General Assembly — SB25B-004 effective-date extension
• South Korea — Framework Act on Development of AI and Trust
• MDN — IndexedDB API
• MDN — Service Worker API
• MDN — Origin private file system
• SQLite — WASM persistence and OPFS

Expanded product safeguards from the reports

The updated design keeps the local model subordinate to deterministic rules. It may extract facts, find candidate citations, and draft explanations. It must not invent legal rules, override cited rules, infer user morality, or build a hidden user-risk profile.