📈 Compliance Progress by Layer
🎯 Maturity Posture Radar (CCM v4.1.0)
Average maturity per domain — scores updated live from Controls tab
⏰ Upcoming Obligations
| Obligation | Framework | Effective Date | Status |
|---|---|---|---|
| Disclose AI interaction | EU AI Act | 2026-08-02 | Due in 59 days |
| Human oversight for high-risk | EU AI Act | 2027-12-02 | Upcoming |
| Logging & traceability | EU AI Act | 2027-12-02 | Upcoming |
| Control documented information | ISO 42001 | Ongoing | Active |
| Obligation | Framework | Topic | Type | Effective | Severity |
|---|
| Code | Control | Family | Type | Automation | Status | Maturity (1–5) |
|---|
📅 EU AI Act Application Timeline
🔥 Governance Risk Heatmap — Likelihood × Impact
🩺 NHID‑Clinical v1.3 — Voice Agent Conformance
Voluntary framework for AI voice agents in B2B healthcare payer‑provider workflows. Disclosure before data exchange, no human mimicry, human handoff, minimal audit log.
| Control | Requirement | Status |
|---|---|---|
| DISC‑01 | Disclose AI identity before any data exchange | ✅ Conformant |
| MIME‑01 | No human voice mimicry or impersonation | ✅ Conformant |
| HAND‑01 | Offer human handoff on request | ✅ Conformant |
| LOG‑01 | Minimal audit log of call and disclosures | ✅ Conformant |
| AUTH‑01 | Verify caller authorization / NPI delegation | ⚠️ Gap — Not in v1.3 |
⚠️ v1.3 does not verify caller authorization (AUTH‑01). A spoofed NPI + voice AI can pass all four behavioral controls while completely bypassing identity verification.
Interactively demonstrate why disclosure alone is not enough to prevent spoofed-identity attacks in B2B healthcare voice channels.
🔗 NHID‑Clinical in the 5‑Layer Trust Stack for B2B Healthcare Voice
| Layer | Scope |
|---|---|
| Layer 0 | NPI Registry — no delegation proof, no call-time authorization |
| Layer 1 | STIR/SHAKEN — carrier attestation (A/B/C levels), verifies phone number origin only |
| Layer 2 ★ | NHID‑Clinical v1.3 — Behavioral Baseline (disclosure, no mimicry, handoff, audit log) |
| Layer 3 | NHID‑Auth v1.4 — Ed25519 delegation chain + DPoP call‑nonce binding (closes AUTH‑01) |
| Layer 4 | FHIR AuditEvent R4 / IHE BALP — healthcare‑native structured logging |
| Layer 5 | OpenTelemetry spans → SIEM / enterprise observability pipeline |
★ NHID‑Clinical is the governance spec that connects these layers for cross‑organizational, real‑time voice‑channel authorization. AUTH‑01 is closed only at Layer 3+.
📋 NHID‑Clinical Compliant Event Trace Example
"call_id": "nhid-call-2026-06-04-001",
"agent_id": "brianna-voice-agent-v3",
"start_time": "2026-06-04T09:12:00Z",
"disclosure_time": "2026-06-04T09:12:02Z",
"disclosure_text": "I'm an automated assistant from Dr. Smith's office.",
"operational_data_exchanged": "09:12:08Z",
"human_handoff_requested": true,
"handoff_time": "2026-06-04T09:12:22Z",
"audit_log_complete": true,
"deceptive_artifacts_detected": false,
"auth_01_verified": false, // ← AUTH-01 gap: NPI not cryptographically verified
"nhid_clinical_score": "4/5"
}
This trace passes all four behavioral controls (DISC‑01, MIME‑01, HAND‑01, LOG‑01) but AUTH‑01 remains unverified — a spoofed caller would produce an identical trace.