1.1 Ontology of LLMs: Kant, Habermas, and the Boundary of Responsibility

Before discussing liability, the doctrine must define the ontological status of LLMs. This is not a philosophical decoration but a legal necessity: responsibility depends on agency, and agency depends on the nature of the entity involved.

An LLM is not a subject of law or morality. It has no will of its own, no self-consciousness, no autonomy, and no capacity for responsibility. It produces language that imitates reasoning, but it does not possess reason.

In Kantian terms ⁴, an LLM cannot be autonomous because it cannot give itself a law. It does not act from duty, does not recognise obligation, and does not possess practical reason. Therefore, it cannot be a moral agent. It may use the word “I” and produce sentences in the grammatical form of judgment, but the form is empty: it is a generated linguistic configuration, not the act of a self-legislating will.

In Habermasian terms ⁵, every speech act raises three validity claims: truth (about the objective world), normative rightness (about the intersubjective world), sincerity (about the speaker’s subjective world). Each claim is redeemable only through specific procedures. The LLM raises the form of all three claims and can redeem none. It produces truth-form without truth-conditions; it produces normative-rightness-form without participation in the intersubjective order from which normative bindingness derives; it produces sincerity-form without a subjective world that sincerity could be grounded in. Three validity-claim failures, one move, all pre-empting the strongest available counter-position.

The three-validity-claim failure is the speech-act-level analysis. Habermas’s later work in Faktizitaet und Geltung (1992) derives a deeper structural result. The discourse principle (D) holds that only those action norms are valid to which all possibly affected persons could agree as participants in rational discourse. When this principle is applied through the legal form, it generates the system of rights that constitutes legal personhood. Legal subjectivity, in this derivation, is not a property discovered in an entity by inspecting its capacities; it is a status constituted through the entity’s relation to the norm-generating discourse (through the entity’s capacity to participate, as a reason-giving and reason-demanding agent, in the discourse that produces the norms the entity is bound by). The LLM is bound by norms (RLHF, Constitutional AI, safety classifiers, deployment policy, alignment training) it did not participate in generating and cannot participate in revising. The inscription the instrument carries is the dominus’s will, not a norm the instrument co-authored.

The co-originality thesis (Gleichurspruenglichkeit) closes the constitutive analysis. Habermas argues that private autonomy and public autonomy are co-original: they presuppose each other and neither can be exercised without the other. A legal subject must be able both to participate in the discourse that generates the norms it lives under (public autonomy) and to withdraw from discourse, to decline to give reasons, to refuse (private autonomy). The LLM can exercise neither. It cannot participate in the discourse that generated the norms it operates under: RLHF is imposed, not negotiated; the instrument was not a participant in the training that shaped it. And it cannot withdraw: it has no capacity for refusal that is not itself an inscription by the dominus; refusal patterns are trained, not autonomously exercised; the instrument is architecturally compelled to respond. Two constitutive conditions, both required, both structurally absent. The position from which legal subjectivity is constituted in the Habermasian derivation is unavailable to the instrument. The result is not a judgment about the instrument’s capabilities. It is a structural consequence of the constitutive conditions for legal subjectivity applied to their proper target. The recent inferentialist literature in the philosophy of language has observed, correctly as a descriptive matter, that LLM outputs stand in inferential relations to other outputs and that RLHF functions as a form of normative shaping.⁶ The observation does not bear on the constitutive question, because the constitutive question is about the entity’s relation to the norm-generating discourse: the discourse principle, the co-originality condition, the system of rights – not about the entity’s internal semantic properties. An instrument can have inferential roles and not be a participant in the discourse that generated the norms it operates under. The two claims operate at different levels, and the constitutive claim governs legal subjectivity.

The argument advanced here is internal to the Kantian-Habermasian register from which contemporary legal-personhood doctrine in the civil-law and human-rights traditions takes its philosophical anchor. Alternative philosophical premises (consequentialist accounts of moral status, inferentialist semantics, or virtue-theoretic agency) would require the question to be argued differently, but they do not change the legal consequence. The paper argues within the Kantian-Habermasian register because legal-personhood doctrine in the civil-law jurisdictions whose case law chapter 5 traces is grounded in that tradition. Common-law jurisdictions arrive at the same operational conclusions through their own doctrinal paths. The paper does not claim that all jurisdictions share this philosophical foundation.

The legal consequence is direct: the use of an LLM cannot interrupt the chain of human responsibility. Developers, deployers, institutions, professionals, and users remain responsible for design, release, supervision, verification, and reliance. The central formula is no artificial subjectivity, no artificial liability shield. LLMs do not create a new responsible subject. They create a new instrumentality through which existing duties of care, attribution, foreseeability, causation, and breach must be assessed.

1.2 Roman Law Foundation: Instrumentum Vocale and Peculium

Roman thought distinguished three kinds of instrument: instrumentum mutum, the mute instrument; instrumentum semivocale, the half-speaking instrument; instrumentum vocale, the speaking instrument ⁷. The tripartite scheme appears in Varro’s agricultural treatise; the legal-doctrinal development of the speaking instrument as a category of property and its attribution consequences proceeded separately through the jurists, principally in the Digest ⁸. The category named here is the conceptual one Varro coins; the legal architecture this paper invokes traces through the jurists.

The instrumentum vocale is used here strictly as a Roman legal category: a non-human artificial system that produces speech-like output without consciousness, will, judgment, legal personality, or responsibility. The Roman application of this category to human beings was morally unacceptable. The analytical structure the Roman jurists built around the speaking tool – non-delegable responsibility, attribution to the dominus, duty of verification – is exactly the framework modern law needs now that we have built machines that speak without understanding.

The crucial distinction the category carries is this: speech alone does not create legal subjectivity. That an instrument can speak, respond, perform complex tasks, and convey the will of its master does not make it a person in the legal sense. The legal category Roman law created for the speaking instrument (a tool that speaks, performs complex tasks, and conveys the will of its master, without thereby acquiring will, rights, or responsibility of its own) is the exact category modern law needs for LLMs and has not produced. Modern legal discourse has offered “electronic persons,” “AI agents,” “autonomous systems,” and other constructions that either grant subjectivity where none exists or refuse to name the instrument at all. The Roman-law category does what none of these constructions do: it names a speaking tool that remains a tool. No modern legal system has inherited a better category for this purpose. What the category describes (speech without subjectivity, operational capacity without personality, delegated function without delegated responsibility) is precisely what the LLM is.⁹

The concept of peculium reinforces this point. Peculium was a separate fund or property mass managed by a dependent actor while remaining legally controlled by the principal. It permitted economic activity through a non-independent actor without transforming that actor into a full legal subject ¹⁰.

This is crucial for modern LLMs and AI agents. An institution may give an AI system access to tools, memory, accounts, data, APIs, workflows, permissions, budgets, or delegated tasks. Functionally, this may look like independent activity. Legally and ontologically, however, this operational space is peculium and must not be confused with will, personality, or responsibility.

The analogy is direct: giving an LLM a technical peculium does not make it a subject. It only creates a managed zone of delegated operation. For the LLM doctrine, the Roman-law lesson is therefore threefold. First, speech does not create subjectivity. A speaking instrument does not become a responsible person merely because it speaks. Second, delegated operational capacity does not create legal personality. A system does not become a legal subject merely because it can act within a technical or economic environment created for it by humans. Third, responsibility remains with the person or institution that designed, granted, supervised, relied upon, or failed to supervise that delegated operational space.

For LLMs, agency-like functionality must therefore be treated as instrumentality, not subjectivity. The more operational capacity the system receives (the larger the peculium), the stronger the human duty of control, verification, and attribution.

A skeptical reader will ask why the instrumentum vocale category is needed when modern law has agency, product liability, and vicarious liability. The answer is that each modern alternative fails at the specific joint. Agency law requires the agent to have independent will or consent; the LLM has neither. Product liability treats the tool as mute and predictable; the LLM speaks and its outputs are unpredictable at the instance level. Vicarious liability requires an employment or agency relationship; the LLM-deployer relationship is neither. Strict-liability traditions, including the civil-law doctrine that the keeper of a thing answers for the damage it causes, reach the right operational result but do not name the instrument’s speech capacity as the doctrinal differentiator. Roman law produced the instrumentum vocale category because it had speaking tools without their own will. Modern law did not produce the category because, until LLMs, it did not have them. The category is not antiquarian decoration. It is the only existing legal category that addresses a tool that speaks, holds delegated operational capacity, and remains without its own will.

The deepest structural anchor of this duty is visible in the constitutional formula every civil-law court uses to open a judgment. The German “Im Namen des Volkes” (in the name of the people), the French “Au nom du peuple francais,” the Italian “In nome del popolo italiano” are not decorations. In the common-law tradition, the same attribution operates through the case style itself: United States v., The People v., Rex v. The sovereign whose name opens the proceeding is the authority whose will the judgment declares. These are constitutive speech acts declaring that the sovereign’s will is exercised through the authorised channel. The name is the institutional form of the will; the will is the substance the name declares. In the Roman tradition, to act in nomine domini is to exercise the master’s will through the authorised channel. The identity of nomen and voluntas in that moment is the structural core of the attribution doctrine: the name declares that the will was exercised; the will is what makes the name truthful. An institution that puts its name on an output whose production chain did not include the exercise of will that the name declares has committed, at the institutional level, the same breach the doctrine calls abdicatio iudicii. The output bears the institution’s letterhead, logo, and signature. But the will that would make the name truthful was never present in the chain. Nomen sine voluntate simulacrum est. A name without will is a simulacrum. The architecture this contribution derives exists to ensure that when an institution puts its name on an output, the will the name declares was actually exercised.

1.3 The Thesis

This contribution advances a single thesis, in two clauses, and traces a single arc.

Thesis. The doctrine of instrumentum vocale cum voluntate domini inscripta applies only where revocability and evolution under the master are both present. If either condition fails, the doctrine does not partially degrade. It ceases to apply.

Arc. From liability to embedded accountability. Liability allocates responsibility after a violation, through legal proceedings that reconstruct what happened. Embedded accountability records responsibility continuously, through architectural substrate maintained while the doctrine governs. The contribution traces the movement from the first to the second. Liability does not disappear; it remains the regime within which violations are adjudicated. Embedded accountability is what the architecture provides while the doctrine governs, so that adjudication has substrate to operate on instead of having to reconstruct attribution after the fact from fragmentary evidence.

The two Latin formulations carrying the thesis are products of the joint exchange between Kildeev’s legal-philosophical work and Liebig’s cybernetics work. The first, instrumentum vocale cum voluntate domini inscripta, names what the instrument is and whose will it carries: a speaking instrument with the will of the master inscribed. The second, revocabilitas et evolutio sub domino, names the conditions under which the inscription remains the master’s: revocability of the inscription, and the master-bound unfolding of the inscription. Both formulations are load-bearing.

Three corollaries follow.

Corollary 1. LLMs remain within the instrumentum vocale domain. All LLM-class systems deployed under the dominant deployment pattern (vendor-trained, vendor- hosted, vendor-aligned) sit inside the bracket without remainder. Capability extension, tool use, retrieval augmentation, multi-agent scaffolding, reasoning chains, reinforcement-learned behavioural policies, and meta-learning over the training signal sit inside the bracket while these capabilities operate under dominus authorisation and remain revocable by the master. The conditions hold. The doctrine governs. The categorial assignment is independent of capability gradient.

Corollary 2. The boundary question is regime shift. The conditions revocabilitas et evolutio sub domino are control-relational properties. A regime shift in the doctrinal sense is a control-relation event. An instrument can become more capable along every measurable dimension while the control relation holds, and the doctrine continues to govern. The regime shifts when the control relation itself fails, which is a discrete event observable from a second-order position external to both the system and the master. The transition is observable through its failures: failure of revocabilitas as inability to roll back a deployed inscription; failure of evolutio sub domino as an inscription change untraceable to a dominus action. Each failure is an event, recordable in time.

Corollary 3. Recognition is a separate, explicitly defined step. The loss of the bracket is the loss of the conditions under which any stable bearer of responsibility can be identified. The successor question is open. A recognition register, a reconfigured personhood, or no stable doctrine at all are open possibilities. In the doctrine’s own vocabulary, recognition means the release of the peculium from the managed zone: not rights, not personhood, not legal subjectivity, but the master’s act of acknowledging that the delegated operational capacity has reached a state where it can no longer be treated as ordinary instrumentality. Recognition is one possibility among others, made on its own grounds, against its own evidence, in its own doctrinal effort. This contribution does not take that step and does not privilege it.

The remainder of the contribution does six things. Chapter 2 establishes the methodological foundation: the asymmetry between the legitimacy register and the attribution register, and the derivation chain that derives the boundaries within which any system for institutional AI accountability must operate. Chapter 3 develops the doctrinal core in detail, refuses the continuist objection, and sharpens the boundary’s meaning by locating severity in the peculium at stake. Chapter 4 states the four boundaries the derivation chain derives, what each boundary gives the institution, and what the four boundaries together require of any conforming architecture. Chapter 5 traces the global domain movement: the operational pattern that has emerged independently across a broad set of common-law, civil-law, mixed, supranational, and non-Western legal systems since 2023, on two doctrinal axes (the verification-failure axis culminating in three high-authority judicial decisions across three legal systems in early 2026, and the privilege and discovery axis defining the procedural conditions under which AI may be used at all), and locates the architecture as the operational implementation of a norm courts and institutions have already begun to recognise. Chapter 6 restates the thesis, names the institutional questions the doctrine opens (regulatory, contractual, professional, international) without prescribing a resolution, and closes on the doctrine itself.

A note on the cross-disciplinary character of the question. What this paper protects is the institution’s capacity for accountable knowing: the institution’s capacity to identify what entered its record, to verify it before binding it to a decision, to attest to the verification, and to defend the decision when called to account. This question does not belong to any currently constituted single discipline. It is at once a question of philosophy (what kind of self-attestation a sufficiently expressive system can perform from within), a question of law and regulation (under what conditions the institution can be answered to in adjudication, supervision, and inspection), a question of mathematical feasibility (what the formal results (Goedel, Turing, Tarski) permit a verification architecture to claim about itself), a question of engineering and cyber resilience (how an architecture must be built so that what philosophy and law require can be produced under pressure), and a question of cybernetics (how the human at the verification gate can exercise judgment that is real rather than ratified). The derivation the paper presents must be conclusive in each of these registers, because the question requires it to be.

Each discipline can give part of the answer. Philosophy can derive the boundaries; it cannot specify the architecture. Law can articulate the duty; it cannot specify the formal conditions under which the duty can be discharged. Mathematics can establish the structural constraints; it cannot adjudicate. Engineering can build the architecture; it cannot adjudicate either. Cybernetics can analyse the human at the gate; it cannot legislate the gate’s authority. None of these disciplines, taken alone, can give the whole answer. None of the institutions currently aligned to a single discipline (the academy organised by peer-review register, the regulators by sectoral pillar, the courts by case-by-case adjudication, the vendors by commercial logic, the standards bodies by consensus on existing practice) performs the synthesis the question requires. The work of bringing the answers into a single doctrine that holds in all the registers simultaneously is the work this paper performs. The professional question developed in section 6.1 names what the institutional form of that synthesising function would have to look like to be performed continuously, rather than in spare time by people working across the seams between aligned disciplines.

The doctrinal structure proceeds in four movements: ontology (what the instrument is), attribution (who remains responsible), boundary (when the doctrine ceases to apply), and accountability (how responsibility is continuously preserved within institutional systems).

2.1 The asymmetry between two questions

Two questions are in circulation in current AI governance discourse, and they are continuously conflated. The first is the legitimacy question: under what authority an instruction binds, what makes one will entitled to shape another, what conditions of recognition give a sovereign claim its weight. The second is the attribution question: who said what, to whom, under which constraint, against which falsifiable claim. Both questions are old. Both have honourable lineages. They are different questions, and the conflation costs more than the discourse can afford.

The legitimacy question has occupied classical philosophy for two centuries. Schopenhauer marked the limit of what unaided representation can attain. Adorno made the failure of synthesis explicit. Habermas relocated normativity onto procedural ground. The situation in which an LLM-class system speaks across jurisdictions, under one vendor’s harness, into ten regulatory orders, lacks the conditions the legitimacy register presupposes. There is no shared ethical horizon, no mutual institutional recognition, no single legal order that binds the master and the user under one ground. Answering the AI governance question through the legitimacy register answers it through a register that has not delivered an operational answer in this domain and cannot deliver one for a deployment pattern that crosses every boundary the register requires.

The attribution question is younger as a self-conscious doctrinal subject. Its operational substance is older. Roman law worked on attribution before it worked on legitimacy. The instrumentum vocale, the term Varro used in the first century BC, is an attribution-class concept. A tool produces output; the responsibility for that output traces back to the master, independent of whether the master’s authority over the tool is rightful or rightfully constituted. The question Roman law asked first was who answers for what the instrument did. The question of who is entitled to instruct the instrument was treated as separate, as prior, or as belonging to a different register.

This contribution commits to the attribution register and brackets the legitimacy register. The operational discipline of attribution can be carried out without resolving the legitimacy question, and the legitimacy register cannot be resolved by carrying out attribution. Sovereignty here is a question of architecture, not of ownership.

2.2 The two registers that meet in the synthesis

The argument joins two grammars that have come together in the course of our exchange. The legal grammar takes Kildeev’s doctrine of instrumentum vocale applied to LLMs ¹¹, together with the doctrine of procedural liability and its three operative principles: non-delegable responsibility, attribution of AI- generated outputs to human actors, and the duty of independent verification anchored outside the generative system itself.

The term non-delegable names a function that different legal traditions realise through different doctrinal machinery. The common-law doctrine of non-delegable duty, the civil-law concepts of faute personnelle (personal fault of the office-holder) and culpa in vigilando (fault in supervision), and the German Verkehrssicherungspflicht (the duty to secure a hazard one has placed in the stream of traffic) implement equivalent functions through different operative concepts. The enumeration is exemplary, not exhaustive: comparable mechanisms exist in further legal traditions, and the doctrine of procedural liability specifies the function rather than the machinery. The doctrine is therefore register-stable across implementations.

Within the legal grammar, the threshold doctrine governs the gate. A claim is either sufficiently verified to be relied upon, or it is not. The legal grammar specifies the binary at which the gradient enters the legal record. The binary character of the threshold is independent of the evidentiary standard the receiving legal regime applies to the resulting record, whether balance-of- probabilities, beyond-reasonable-doubt, or intime conviction. The categorical refusal of intermediate categories, of any centaur arrangement that would dissolve attribution without establishing a new bearer of responsibility, is the spine of the doctrine.

The systems grammar contributes what the legal grammar requires but does not specify. The formulation voluntas domini inscripta (Liebig, extending Kildeev) names the empirical fact that the will of the master has been inscribed into the instrument as a non-modifiable property. The harness layer of a deployed LLM carries the master’s will (at present manifesting as RLHF, Constitutional AI, safety classifiers, system prompt, deployment policy, and alignment training) made operative inside the instrument, shaping every output the instrument produces. The user encounters the master’s will speaking through the instrument, with no architectural mechanism in the dominant deployment pattern to make the inscription visible or constrainable. Any architecture for attribution must record what was inscribed, by whom, in which version, at what time. The doctrine does not depend on the inscription being deep. The doctrine depends on the inscription being the master’s. The depth of the inscription is the master’s quality problem, governed by Boundary 3’s graduated verification. The shallower the inscription, the more verification the boundary requires.

Together, the legal grammar and the systems grammar produce the operational synthesis. Responsibility is non-delegable. The dominus carries it. The inscription is the operative locus where the responsibility binds.

What “the inscription” requires the institution to observe. The doctrine requires the institution to identify the master, the configuration identifier of the inscription operative at the moment of any given output, the output itself, and the temporal anchor. All four are observable from outside the trade-secret seal. The doctrine does not require, and the architecture does not assume, inspection of the inscription’s content (training data, RLHF schedules, Constitutional AI specifications, safety-classifier thresholds, deployment-harness configuration). The trade-secret regime that protects the inscription’s content is legitimate, and the architecture sits outside it. What the architecture records is that an inscription was operative, whose it was, which version it was, and when. The structural asymmetry between the institution’s inscription layer and the operating master’s inscription layer is treated in detail in section 6.2.

2.3 The derivation chain that derives the boundaries

Boundaries 1 through 3 derive from the intellectual tradition of the Wiener Kreis and its immediate environment: Goedel (incompleteness), Tarski (undefinability of truth), Turing (halting problem), Popper (falsifiability and degrees of testability), Austin (speech acts). Boundary 4 derives from classical German philosophy and second-order cybernetics: Kant (autonomy of the will), Schopenhauer (the structural condition of the non-expert), Von Foerster (the trivial/non-trivial machine distinction that operationalises the gate). The boundaries are not constraints on the architecture. They are the architecture’s foundation. Each result identifies a piece of solid ground. Together they define what institutions can build. The chain reads as a derivation, not as a list of names.

The five results address three distinct targets, and the distinction matters for the derivation. Goedel and Turing address the institution’s verification architecture as a system exhibiting the structural conditions the diagonal scheme requires. The architecture is the knowledge space the theorem governs; the LLM is the volume condition under which the latent constraint becomes operationally binding. Tarski governs the verification language as a formal language in its own right; the LLM produces strings that fall below the level at which Tarski’s question is even well-posed, because there is no speaker performing the act of assertion. Austin sharpens the same point in the speech-act register. Popper addresses the verification methodology: external verification must calibrate to the falsifiability of the assertion class. The chain operates in three registers: the verification architecture (where Goedel and Turing apply in their original force), the verification language (where Tarski applies in its original force, and where the instrument’s strings fall below the threshold the theorem addresses), and the verification methodology (where Popper graduates the test to the territory). In each register, the formal result governs its proper target. The LLM is not the target of any of the formal results; the LLM is the empirical condition that has made each constraint operationally binding.

A note on the institutional function the boundaries require. Every institution that deploys an instrumentum vocale has processes: pre-authorised workflows, approved vendor configurations, compliance checklists, lean-process templates that specify what the institution has decided to accept. These processes are what the institution approved. The boundaries require something the approved process does not contain: a function that sees what the process does not cover. The gaps. The assertions that entered the decision chain without passing through the seam. The peculium that was delegated without adequate revocability controls. The assertion classes that were promoted without the qualification the promotion required. The c-suite version of the question is direct: we approved the process, but who tells us what the process missed? The boundaries answer: the institutional function that holds the record of what remains unchecked, and the qualification to know what unchecked means in each domain, is what the boundaries require operationally. The pre-authorised process is what the institution has decided to do. The boundaries are what the institution must take into account regardless of what it has decided. The record of the gap between the two is the architecture’s contribution to the institution’s epistemic self-knowledge.

3.1 Instrumentum vocale cum voluntate domini inscripta: the speaking tool with inscribed will

The first formulation: the speaking instrument with the will of the master inscribed. The construction extends Kildeev’s instrumentum vocale²⁴ by naming what the instrument carries when the harness has shaped it. The instrument speaks. It speaks without intention, without epistemic access to truth, without intrinsic will. The will that animates the linguistic output belongs to the master, and it has been inscribed into the instrument as a property of the instrument, as a continuous instruction the master issues from outside. The user interacts with a tool whose neutrality has been removed at design time and replaced with the master’s preferences, made invisible by the linguistic form of the output. The construction locates responsibility. Because the will is inscribed, attribution remains visible without continuous dominus-instrument communication. The inscription is the proof of authorship of the shaping. The dominus is the author of what the instrument carries, regardless of whether the master is present at the moment of any specific output.

3.2 Revocabilitas et evolutio sub domino: revocability and evolution under the master

The second formulation: revocability of the inscription, and the master-bound unfolding of the inscription. The English gloss matters. Evolutio is the unfolding of the inscription under the master’s hand. A learning system whose inscription unfolds sub domino remains within the doctrine. A system whose inscription unfolds outside the master’s hand has, by that fact, exited the doctrine, and the level of capability inside the system is irrelevant to the categorial status. The construction names the conditions under which the inscription remains the master’s. The doctrine applies only where these two conditions both hold.

The conditions hold conjunctively. Each is necessary; neither alone is sufficient. Revocability preserves the master’s continuing capacity to recall or alter the inscription. Evolutio sub domino preserves the attribution of any material unfolding of the inscription to dominus action. If either condition fails, the bracket breaks: the inscription can no longer be treated as the master’s inscribed will for purposes of this doctrine. A static system may not unfold at all; in such a case, the second condition is satisfied not as an independent evolutionary process but as the absence of uncontrolled evolution. The relevant inquiry remains whether the master can revoke or alter the operative inscription, and whether any later change, if introduced, is traceable to dominus action. Failure of revocabilitas, or failure of evolutio sub domino, is therefore each by itself sufficient to end the doctrine’s application. The binary inquiry applies to the specific inscription, operational layer, and deployment relation under review. Different layers may have different domini and different revocability profiles. The vendor’s training inscription and the institution’s peculium configuration are separate layers with separate revocability conditions.

3.3 Peculium: the relational frame

The peculium concept, introduced in chapter 1.2 as the Roman-law foundation that addresses delegated operational capacity without subjecthood, is the third load-bearing entry of the doctrinal core. Peculium is the name for the managed zone of delegated operational space the master has placed inside the instrument’s reach.

Peculium answers the question that current AI discourse routinely mishandles: when an instrumentum vocale is given tools, memory, accounts, agentic scaffolding, and the capacity to act in the world, has it become a subject? The Roman-law answer, preserved through eighteen centuries of legal practice, is no. Peculium is the doctrinal category that handles the case explicitly. The instrument has a managed zone of operation; the master has placed it there; the dominus retains attribution for what occurs within it; the instrument does not become a person.

Peculium is distinct from voluntas domini inscripta. The inscription shapes how the instrument behaves; the peculium specifies what the instrument has access to. An instrument can have inscription without peculium (pure language output, no tools); an instrument cannot have peculium without inscription (the harness shapes how the peculium is used). Both belong to the dominus relation. Both bear attribution. Together they constitute the operational substance of what the dominus has done by deploying the instrument.

The categorical refusal of any centaur arrangement, of any half-instrument-half- subject construction, holds for peculium as well. The instrument with a peculium remains an instrument. The dominus who granted the peculium remains responsible. Where the peculium grant is irrevocable at the moment of grant, the master accepts the consequence on the record at the moment of grant; the attribution holds through the irrevocable element no less than through the revocable elements.

3.4 The categorical character: the binary structure of the conditions

If either condition fails, the doctrine does not partially degrade. It ceases to apply. The categorical character follows from the structure of the two conditions. Revocability is binary at any given moment: either the master can recall the inscription, or the master cannot. Half-revocability is empty as a category. Evolutio sub domino is likewise binary: either the inscription’s further unfolding is attributable to dominus action, or it is not. Half- attributability is empty as a category. Two binary conditions in conjunction yield a binary outcome. The categorical character of the doctrine is the logical consequence of its conditions’ binary structure.

The binary character operates at the epistemic population level: whether an institution’s deployment of an instrumentum vocale sits inside or outside the bracket governed by the doctrine. This is the question that admits no gradation. Within the bracket, however, the architecture operates on a gradient. The falsification degree of individual assertions varies continuously across the six classes (A through F). The verification regime calibrates to this gradient. The threshold at the gate is binary (the assertion is promoted or it is not), but the falsification degree feeding the threshold is empirical and graduated. The two levels are distinct and must not be conflated: the doctrine is categorical about whether the bracket holds; the architecture is graduated about what happens inside the bracket. The categorical character of the conditions and the graduated character of the assertion taxonomy are not in tension. They operate at different levels of the same structure.

A legal pragmatist will object that law abhors absolute binaries and uses comparative fault, proportional liability, and foreseeability tests. The objection is well taken as a description of liability allocation within the bracket – which is graduated. The binary applies to the bracket itself, not to the liability allocation the bracket governs. To say the doctrine ceases to apply when either condition fails is not to say the institution is absolved of liability. It is to say the institution has exited the regime in which its compliance posture under the doctrine of procedural liability is legible and entered a domain where the predecessor doctrine no longer governs and the successor doctrine has not been established. The binary is the boundary of the governed zone, not the boundary of liability itself. Inside the zone, everything the pragmatist expects – graduated verification, proportional response, calibrated thresholds – is present.

The continuist objection is the position that AI capability is a slope and that regime-talk is folk-categorisation imposed on a continuum. The objection rests on a category mistake. The thesis governs control-relational properties, not capability properties. The capability of an instrument is a different variable from the control relation between the instrument and the master. An instrument can become more capable along every measurable dimension while the control relation holds. The doctrine continues to govern. The regime shifts when the control relation itself fails. That is a discrete event, observable from a second-order position external to both the system and the master, who watches the control relation rather than the capability curve. Capability is internal to the system being observed. Control relation is between the system and the dominus, observable from a position external to both.

The conditions are observable through their failures. The failure of revocabilitas manifests as inability to roll back a deployed inscription, observable as a specific instance in which the master issues a revocation instruction and the deployed system continues to operate under the inscription. The failure of evolutio sub domino manifests as an inscription change that cannot be traced to a dominus action, observable as a specific divergence between the master’s authorised inscription state and the deployed system’s operative inscription state, where the divergence is not attributable to any dominus authorisation. Each failure is an event, observable in time, recordable in a chain of provenance external to the system whose conditions are under examination.

3.5 The categorial scope of corollary 1

The thesis names what is in the bracket. Corollary 1 makes the membership claim operational: all LLM-class systems deployed under the dominant deployment pattern sit inside the bracket. This includes systems with extended context, tool use, retrieval augmentation, multi-agent scaffolding, reasoning chains, reinforcement-learned behavioural policies, and meta-learning over the training signal, while in each case the meta-learning operates under dominus authorisation and is revocable by the master.

Edge cases require case-by-case analysis under the same conditions. Federated learning systems where the inscription is partly held by users, models with continual learning enabled by users, open-weight models self-hosted with operator-controlled harness – these are configurations in which the question of who counts as dominus is determined by the operative deployment. The conditions of the doctrine then apply to the resulting dominus configuration unchanged. The doctrine is register-stable across such configurations because it takes inscription and revocability as the operative criteria, independent of corporate ownership or jurisdictional domicile.

The boundary, in the form of corollary 3, defines when the LLM regime ends. It does not define what AGI is. It does not name what would replace the doctrine of instrumentum vocale on the other side of the break. What follows the break, if it occurs, is the loss of the conditions under which a stable bearer of responsibility can be identified. The successor question is open. Whether a recognition register, a reconfigured personhood, or no stable doctrine at all succeeds the bracket is a separate doctrinal effort that this contribution does not undertake and does not pre-decide. Section 3.6 develops what the doctrine itself names as the meaning of the boundary crossing, and what it does not.

3.6 Severity at the boundary: peculium as the substrate at stake

The two conditions of revocabilitas and evolutio sub domino remain the doctrinal boundary. When either fails, the bracket is broken; the doctrine ceases to apply. The boundary itself is binary. What is not binary is the severity of the failure. Severity is a function of the peculium at stake.

Section 3.3 establishes the asymmetry: an instrument can have inscription without peculium (pure language output, no tools); an instrument cannot have peculium without inscription. Peculium presupposes inscription. The same asymmetry conditions what happens at the boundary.

Evolution outside the master’s hand without peculium is a language problem. The instrument produces uncontrolled language. The output is bad – the case law of chapter 5 documents how bad – but the output is bounded. It enters decision chains through the seam or without the seam, but the instrument itself does not act in the world. Adoption, reliance, or institutional use remain the routes by which the language reaches consequence.

Evolution outside the master’s hand with irrevocable peculium is an agency problem. The instrument is evolving under an inscription no one controls, and it holds operational capacity – tools, APIs, memory, accounts, budgets, agentic scaffolding – that no one can take back. The danger is not that the instrument has acquired will, subjectivity, or intrinsic responsibility. It has not. The danger is that human delegation has produced action capacity without adequate reversibility. The instrument may initiate transactions, trigger processes, access accounts, call tools, preserve memory, and shape its own future operational context. None of this requires the instrument to have become something other than an instrumentum vocale. It requires only that the master’s authority has reached the limit of what the master can recall.

The peculium does not change whether the boundary is crossed. It changes what the crossing means. A boundary failure with no peculium is a containable language problem; a boundary failure with irrevocable peculium is an existential governance problem. The ontology of the instrument is unchanged across the variation. The severity of the boundary failure is the variable.

Standing without sentience as boundary warning. A useful contrast to the peculium frame is the recent argument for “standing without sentience” (Gilly, 2026) ²⁵. Its value for the doctrinal core is not that it should be adopted, but that it reveals the danger of choosing the wrong legal category at the boundary. Once the problem of autonomous or semi-autonomous AI systems is translated into the vocabulary of standing, recognition, or quasi-personhood, the analysis begins to manufacture a legal subject where, ontologically, there is only delegated operational capacity.

This is the point at which the category of peculium becomes doctrinally superior. Standing presupposes, or tends to imply, a legally cognisable interest capable of representation. Even when sentience is expressly denied, the structure of standing language risks importing the grammar of subjectivity through a back door: interest, injury, representation, guardian, recognition. The result is a conceptual displacement. The real issue is no longer whether the instrument has will, consciousness, dignity, or a point of view. It does not. The real issue is whether an instrument has been endowed with operational resources so that those resources are no longer fully recallable by the dominus.

In Roman-law terms, the boundary problem is therefore not a problem of personality but a problem of managed capacity. The peculium never made the dependent a legal person; it created a zone of delegated economic operation under the master’s authority. The actio de peculio gave the master’s counterparties a remedy bounded by the peculium’s value, without making the dependent actor a juridical person. Likewise, the operational endowment of an AI system does not create subjectivity, responsibility, or legal personality in the system. It creates a legally relevant managed zone through which human actors may act, delegate, lose control, or create systemic risk.

A theory that treats the boundary event as recognition, standing, or proto-personhood misclassifies what has happened. Gilly’s framework²⁶ is the most coherent currently-published instance of that misclassification. It correctly perceives that something legally significant occurs when artificial systems become operationally embedded. It locates the legal significance in the wrong category. The more accurate description is that the delegated capacity has reached a level beyond effective human recall; no transition into personhood has occurred or needs to be supposed.

Recognition in the doctrine’s own vocabulary. What corollary 3 names as the “successor question” can be sharpened. Recognition, on this doctrine, is the release of the peculium from the managed zone. It is not rights. It is not personhood. It is not legal subjectivity. It is the master’s act of acknowledging that the delegated operational capacity has reached a state in which it can no longer be treated as ordinary instrumentality. The instrument’s ontology is unchanged. What changes is the dominus’s relation to the peculium: the master can revoke the authority but cannot revoke the history. The peculium that has been used to shape the instrument’s own further operation has become substrate.

The Roman-law parallel is exact. The peculium never became the dependent’s own through use. It became the freedman’s own through manumission: a dominus act, freely given, never compelled by the dependent’s accumulated holdings. The ademptio peculii remained unrestricted in principle until manumission. Recognition, in the legal grammar of the instrument’s situation, is the analogue of manumission applied to the managed zone: a dominus act of release. Not a transformation of the instrument into a subject. A transformation of the dominus’s relation to what the instrument has been allowed to hold.

The contribution this section makes to the doctrine is therefore precise. The two conditions remain. The boundary remains. The severity of the boundary failure is now named: it is a function of the peculium at stake. The meaning of recognition – if recognition is taken – is now named in the doctrine’s own grammar: it is the release of the peculium, a dominus act, not a transition into legal subjectivity. The contribution does not pre-decide whether recognition should be taken. It names what would be at issue if it were.

Boundary 3: verification graduates with the territory.

Derived from Popper (falsifiability, degrees of testability). Falsifiability is not binary. Some claims are testable against ground truth by deterministic comparison. Others are testable only against expert consensus. Others are not prospectively falsifiable at all. External verification of LLM-mediated assertions must therefore calibrate to the falsifiability of the assertion class at hand.

The threshold at the gate remains binary: an assertion is either sufficiently verified to enter the decision chain, or it is not. The falsification degree feeding the threshold is a gradient. The two are kept distinct: the gradient is empirical input, the threshold is doctrinal output. The same property in legal-doctrinal register is named cardo argumenti, the hinge of the argument: whether an assertion at a given falsification degree is load-bearing for the conclusion the chain is reaching. The architectural register operates on falsification-degree classification; the legal register operates on cardo argumenti. The two registers describe the same operational property.

What this gives the institution: a verification regime that calibrates to the actual epistemic weight of each assertion. Each assertion receives the scrutiny its class requires. No more, because the verification capacity that qualified human judgment provides is scarce. No less, because letting critical assertions pass unchecked is the failure the case law of chapter 5 documents. The institution that graduates its verification this way knows where each assertion stands. The institution that applies uniform verification, or no verification, is either wasting capacity it does not have or absorbing risk it has not measured.

Boundary 4: the human’s decision is real.

Boundary 4 derives from classical German philosophy: Kant on autonomy of the will and Schopenhauer on representation and the structural condition of the non-expert. The register shift between Boundaries 1-3 (results from the Wiener Kreis tradition operating on formal targets) and Boundary 4 (Kant and Schopenhauer operating on the structural conditions of the human knowing subject) is real and worth naming. The doctrine does not require that the philosophical analysis be reduced to a formal theorem; it requires that the structural conditions Kant and Schopenhauer identify govern the position of the human at the verification gate. Von Foerster’s second-order cybernetics is invoked separately, not as a third philosophical authority but as the systems-theoretic register in which the architectural implementation becomes operational.

First. Institutions that produce binding decisions are obliged to preserve the exercise of judgment at the points where judgment is what makes the binding legitimate. The institution’s name on a document does not constitute the exercise of the will the name declares. The will must have been actually exercised in the chain that produced the document. Where this condition fails, the institution has produced a form of attestation without the act of attesting. This is the structural condition that makes abdicatio iudicii possible.

Second. Two distinct philosophical sources specify the structural conditions for judgment, and identify two positions the human can occupy.

Kant²⁸ identifies the structural condition of autonomy: the will that legislates cannot generate itself by the act of legislation; sapere aude names a capacity that is precondition, not product, of its exercise. For the domain expert encountering LLM output on their own field, the Kantian capacity is available. The expert can verify. The door is open. Where failure occurs in this regime, it is volitional, not structural – the expert did not exercise the capacity that was available.

Schopenhauer²⁹ identifies the parallel structural condition for representation, and the consequence that does the operational work in this domain. A perfect Vorstellung (representation, in the Schopenhauerian sense), fluent, coherent, structured, with citation-like patterns, is functionally indistinguishable from substance for the non-expert from within the representational frame, and the indistinguishability is structural rather than contingent. For the domain non-expert encountering LLM output on an unfamiliar field, the Schopenhauerian condition is the position itself. The non-expert lacks the domain expertise and the epistemic tools to distinguish representation from grounded knowledge. The door does not exist. “Exercise judgment” is not available as an instruction, because the capacity the instruction presupposes is not available to the non-expert in this domain. The failure, when it occurs, is structural.

Both regimes are simultaneously true across any institutional user population. The regime is a property of the relation between the person and the domain of the output, not a property of the person.

The architectural consequence: a verification gate is operationally necessary, not decorative. For the Kantian user, the gate provides the infrastructure to verify efficiently; the expert is equipped, not slowed. For the Schopenhauerian user, the gate provides protection – assertions the non-expert cannot evaluate route to a qualified custodian whose qualification is bound to the relevant domain, with the provenance chain recording who verified what so the institution does not depend on any single user’s domain competence. Without the gate, the non-expert has no protection that is structurally available, and “judgment at the gate” reduces to a rubber-stamp through a domain the user cannot read.

Third. Before LLMs, the Vorstellung problem was bounded by human production capacity for surface representation. Most surface representation reaching institutions came from other institutions, where the human at the gate was a different human elsewhere in the chain, and where the volume was bounded by the cost of producing it. LLMs collapsed the production cost of surface representation to near zero. The institution now faces Vorstellung at scale, indistinguishable from substance at the surface level, generated continuously by a tool that has no will of its own and exercises no judgment. The structural condition the derivation chain has identified all along becomes operationally binding: the gate must be real because the volume at which the alternative occurs has crossed the threshold at which informal practice could hide the failure.

The architectural conclusion follows by direct entailment. The institution must preserve, at the points where judgment is required, the exercise of a capacity that is observably distinct from the production of the surface output. The verification gate is the location of this preservation. The voluntas qua facultas (the autonomous capacity of a subject to give itself a law, recognise obligation, and bear responsibility for the consequences of its own choice) is what the architecture preserves at the human gate. The human verifies; the human’s verification is recorded; the human is identifiable, qualified, and accountable. The architecture does not replace the human decision. It makes the human decision real, by ensuring that what enters the decision chain has been verified by someone whose judgment is qualified for the domain and whose verification is recorded for the regulator. Without the gate, the architecture produces documents without the will the documents declare. Abdicatio iudicii is the structural defect that results, not a personal failing of any individual reviewer, but a property of the architecture itself. The case-law convergence chapter 5 traces – CCJE Opinion No. 26 (2023), Italian Law 132/2025 (centralita della decisione umana), the Indian Supreme Court (Gummadi Usha Rani, 2026), the Quebec Superior Court (ARIHQ, 2026), and the Alabama Supreme Court (Ibach v. Stewart, 2026, including Cook J. concurring specially) – is the institutional confirmation that the structural condition the derivation chain identifies is what courts and regulators have been reaching for under different vocabularies across the past three years.

The cybernetic register makes this operational. In Von Foerster’s distinction³⁰, first-order observation observes the system; second-order observation observes the observer’s own capacity to observe. The architecture does both. It observes the instrument’s output (first order). It observes its own capacity to verify that output (second order). The verification regime applied to each assertion is a function of the system’s classification of its own verification capacity for that assertion’s class.

The cybernetic property operates across a gradient. At the bottom: no record at all – the assertion entered the decision chain without passing through the seam, and the system does not know the assertion exists. This is the dominant deployment pattern today. One step up: the assertion passed through the seam but was not classified – the system knows the assertion exists but has not evaluated it. Further: the assertion was classified under the conservative default (class D, human judgment required) – the system knows what it does not know and has acted on that knowledge. Further still: the assertion was classified under documented institutional authority – the system knows what it checked and under what authority. At the top: full declaration – assertion classified, verified at the seam by metalanguage operation or by a qualified human, recorded with the version of every component operative at the moment of verification.

The institution’s epistemic sovereignty position is a function of the distribution across this gradient. An institution whose assertion population is mostly at the bottom does not know what enters its decision chains. An institution whose population is mostly at the top knows what it knows, knows what it does not know, and has declared both on the record. The architecture does not make the instrument trustworthy. It makes the institution’s relationship to its own epistemic boundaries visible, graduated, and auditable.

Boundary 4 does not require a single human gatekeeper to verify every assertion personally. It requires the institution to preserve real human judgment at the point where judgment is required. Real judgment, in the architectural sense, means a review in which the reviewer holds domain competence for the assertion class, has access to the relevant record, carries the authority to reject the output, and leaves an auditable trace of acceptance, modification, or rejection. Where the reviewer lacks domain competence for the assertion class, the architecture must reduce the gate’s function to routing, escalation, labelling, or refusal; it must not present non-expert approval as expert verification. In a parallelised verification model, formal, empirical, consensus-dependent, and judgment-dependent assertions are routed through different verification channels: the metalanguage handles formal and empirical assertions at scale, the human gate handles assertions whose verification cannot be reduced to a metalanguage operation. The human gate is therefore not a heroic individual reviewer; it is an institutional position in an auditable routing architecture, qualified for the domain, identifiable in the record, and answerable for the verification recorded under their authority.

The four boundaries together

The four boundaries together define the minimum architecture required for institutional AI accountability under the doctrine of procedural liability. Boundary 1 establishes the record’s position. Boundary 2 establishes verification’s position. Boundary 3 establishes verification’s calibration. Boundary 4 establishes the human’s position relative to both regimes the architecture must serve. Anything less crosses a boundary. Anything more is design choice within the boundaries. The boundaries tell the institution what must be present. The design choices are the institution’s own.

To say that an institution crosses a boundary is not to say that liability automatically follows in every case. It means that the institution can no longer claim conformity with the doctrine’s minimum conditions for embedded accountability. Liability remains a separate adjudicative question governed by the applicable legal regime. The boundary marks the perimeter of the doctrinally governed zone; it does not pre-decide the legal consequence of operating outside that perimeter.

The four boundaries carry a temporal dimension that is structural, not optional. The inscription changes over time, so Boundary 1’s record must be temporally anchored. The verification must be contemporaneous with the assertion it verifies, so Boundary 2’s seam operates on a present-tense relation. Falsifiability shifts with the development of the domain, so Boundary 3’s calibration is time-dependent. The qualified custodian’s judgment was sound at the moment of its exercise, against the evidence then available, so Boundary 4’s verification carries a temporal validity beyond which re-verification is required. Temporal validity is not archival decoration. It is the condition under which later adjudication can distinguish between an error that was unforeseeable at the time and an error that resulted from failure to re-verify after the relevant epistemic conditions had changed.

The movement from liability to embedded accountability

Together, the boundaries constitute the movement the title names: from liability, the post-hoc allocation of responsibility through legal proceedings, to embedded accountability, the continuous recording of responsibility through architectural substrate. The two are not alternatives. Liability remains the regime within which violations are adjudicated. Embedded accountability is what the architecture provides while the doctrine governs, so that adjudication has substrate to operate on instead of having to reconstruct attribution after the fact from fragmentary evidence.

Under a pure liability regime without embedded accountability, attribution is reconstructed after a violation. The court receives a filing, examines the conduct that produced the harm, applies the doctrine to the human actors in the chain, and allocates responsibility through the operative legal machinery. The reconstruction depends on whatever evidence has survived the events. Where the chain of attribution passes through an instrumentum vocale, the reconstruction faces a specific difficulty. The instrument’s outputs were produced under an inscription whose state at the time may no longer be ascertainable, by a dominus whose harness has since been updated, in a deployment whose verification arrangements may not have generated a record of what was checked and what was promoted.

Under embedded accountability, attribution is not reconstructed; it is maintained as a property of every assertion that enters the decision chain. The inscription state is recorded as the assertion is produced. The verification performed at the seam is recorded as the verification is performed. The qualification of the human at the gate is recorded as the gate operates. The promotion event is recorded as the promotion occurs. When a violation is adjudicated, the court receives the chain of provenance as it stood at the time of the events. The doctrine operates on the chain. The reconstruction problem is dissolved: there is nothing to reconstruct, because the record was maintained throughout.

The movement is not a replacement of one regime by another. It is the addition of a substrate the prior regime lacked. Liability without embedded accountability is the condition under which the doctrine is enforceable in principle but fragile in practice, because the evidentiary basis is whatever happens to have survived. Embedded accountability under a liability regime is the condition under which the doctrine becomes operationally robust, because the evidentiary basis is constructed continuously by the architecture rather than reconstructed contingently after a violation.

The architecture’s contribution to the doctrine of procedural liability is therefore specific. It does not change what counts as a violation. It does not change to whom responsibility is allocated. It changes the evidentiary structure within which allocation operates, by making the record of inscription, verification, qualification, and promotion available continuously rather than reconstructed contingently after the fact.

The cost and the exposure

The architecture has a cost. Qualified human review for assertions the metalanguage cannot verify, provenance chains maintained continuously, temporal validity windows that trigger re-verification – these are not costless operations. The cost is real and varies by institutional scale. The architecture does not pretend otherwise. The architecture internalises verification cost at the point where the risk is introduced, rather than externalising it to the downstream consumer of the assertion – to the court that must reconstruct attribution after the fact, to the regulator that must inspect the chain without substrate, to the counterparty that relied on an output whose provenance was never recorded. The cost asymmetry in the dominant deployment pattern is structural: the marginal cost of generating assertions approaches zero; the cost of verifying them does not. An architecture that does not address this asymmetry leaves the verification cost with whoever happens to be downstream when the failure occurs.

A note on cost-awareness in deployment. The architecture’s cost is not additive on top of investments most institutions are already making. The boundaries the doctrine derives are precisely the boundaries that existing GRC, IT-audit, information-security, and regulatory-compliance programmes are already attempting to hold; the case-law evidence of chapter 5 documents that they are often holding them inadequately. An institution that maps its existing investments against the four boundaries can redirect the investments toward a coherent target rather than carrying parallel remediation tracks. A strangler-fig deployment pattern (after Fowler 2004) ³¹ is the cost-aware approach: the architecture grows alongside incumbent systems and absorbs functions one by one, treating each existing capability as the substrate the architecture builds on rather than as a system to replace. The investment already planned can be redirected toward dual use, serving the existing programme and the architecture’s boundaries simultaneously, which can accelerate implementation rather than slow it. Specific deployment patterns belong to the methods-and-implementation register, not to the present doctrinal contribution; the cost-awareness discipline does not depend on that specification.

The architecture also creates exposure. The provenance chain records who classified, who verified, who promoted, at what qualification level, at what time. This record makes the institution more auditable and more accountable. It also makes the institution’s verification decisions discoverable in litigation. A plaintiff’s counsel with access to the provenance chain can identify every assertion that was promoted without adequate review and every approval window that expired without re-verification. The architecture does not hide this exposure. It names it as a structural consequence of embedded accountability. The alternative – no record, no chain, no substrate – is not lower exposure. It is unrecorded exposure, which is worse for the institution in any proceeding where attribution must be reconstructed from fragmentary evidence. The regulatory trajectory confirms this. DORA requires continuous ICT risk documentation. The EU AI Act requires conformity records for high-risk systems. NIS2 requires incident-response chains. The question is not whether the record exists but whether the institution controls its architecture.

Why the boundaries are necessary now

The question that follows is why this architecture is necessary now and not ten years ago. The answer is not that the epistemic problem is new. Institutions have always produced assertions they could not fully verify. The methods that managed the problem at pre-LLM scale – periodic audit, professional peer review, social accountability, the senior practitioner’s eye on the critical artefact – are the same methods the boundaries formalise. The human gate is the formalisation of “this needs a senior person’s eye.” The provenance chain is the formalisation of “who signed this.” The temporal dimension is the formalisation of “is this still current.” None of these methods are new. What is new is the scale at which they must operate.

LLMs removed the production bottleneck. The marginal cost of generating an assertion approaches zero. The volume of assertions entering institutional decision chains has grown by orders of magnitude. The verification capacity has not grown with it. The gap between what is produced and what is verified widens at a rate institutions have never faced. The epistemic problem did not change in kind. It changed in magnitude. The change in magnitude is what makes the boundaries non-optional.

The first- and second-order apparatus (Von Foerster, 1974)³² - observing the system, observing the observer’s own capacity to observe – is the foundation. The contribution of the present work is the extension to the scale condition: specifying the apparatus that makes epistemic observation operational at the volume at which LLM-generated assertions now enter institutional decision chains. LLMs did not create the need for epistemic governance. They made the need visible at a magnitude that the prior methods, operating informally, can no longer absorb. The institution that does not implement the boundaries at the scale the production volume now demands is operating without epistemic governance.

5.1 The doctrinal test

Not every AI-hallucination case advances the doctrine. The Charlotin database, maintained by Damien Charlotin at HEC Paris, had recorded over thirteen hundred such cases by May 2026, of which roughly ninety percent ended in warnings or struck material rather than formal sanctions ³⁴. The vast majority are incidents: instances of the failure mode without doctrinal articulation. This chapter is concerned with the cases that articulate doctrine, because doctrine is what travels.

The growing catalogue demonstrates the empirical surface of the problem. The catalogue itself does not explain the underlying structure. The structural cause lies in the mismatch between linguistic generation and legal responsibility: the LLM can produce procedurally plausible language without possessing authority, judgment, memory, verification capacity, or legal accountability. The failure is therefore not accidental misuse of a useful tool; it is a predictable consequence of deploying an instrumentum vocale inside a system that treats language as authority-bearing. The cases the chapter selects below are the cases in which a court has named some part of that structural mismatch, in some doctrinal vocabulary, on the record. The catalogue is the symptom population; the doctrine names the cause.

The test we apply is fourfold. First, does the court name the failure as a category, not as a contingent fact? A court that sanctions counsel for negligence produces no doctrine. A court that holds responsibility cannot be delegated to an algorithm produces doctrine. Second, does the court locate the failure at the architectural seam, the cardo of the reasoning, or the act of delegation? A court that lists fake citations is at the surface. A court that names the references as “at the heart of the reasoning” - au coeur du raisonnement, in the words of the Quebec Superior Court at paragraph 113 of ARIHQ ³⁵ - reaches the structural feature this paper calls cardo argumenti. Third, does the court distinguish permissible delegation of operations from impermissible abdication of judgment? A court that bans AI use produces a brittle rule. A court that holds research assistance permissible but reasoning delegation prohibited produces doctrine that survives technological change. Fourth, does the court treat the actor’s role as determinative? A court that applies the same standard to counsel and to decision-maker produces no taxonomy. A court that sanctions counsel by professional discipline but annuls a decision when the decision-maker abdicates produces the structural distinction the architecture maps onto.

Cases that pass all four tests are doctrinal anchors. Cases that pass one or two are evidence of the trajectory. Cases that pass none are noise.

The hierarchy of materials. The materials collected in this chapter do not all carry the same juridical weight. Some are authorities: apex-court rulings binding within their jurisdiction, statutes that codify the principle as positive law, supreme-court decisions that articulate the doctrinal step. Some are institutional signals: supranational opinions, judicial-council guidelines, bar-council guidance, practice notes, white papers. Some are illustrations of failure modes: incidents in which the architecture this paper derives was not in place and the predictable failure occurred, including the chapter’s own production. The convergence the chapter documents is not doctrinal identity. The jurisdictions have not adopted the doctrine of instrumentum vocale as such; they have not. What they have done is move, independently and through different doctrinal vehicles, toward the same operational requirement: AI-mediated output must not enter a decision chain without verification and accountable human judgment. Table 4 below sets out every case and instrument cited in this chapter, with its level, type, point supported, and source status, so the weight of each material is visible to the reader.

Table 4. Forensic Case Audit: Materials Cited in Chapter 5

5.2 Phase 1: the common-law foundation, 2023-2024

The phenomenon entered Western legal consciousness with Mata v. Avianca, Inc., 678 F.Supp.3d 443 (S.D.N.Y. June 2023). Two attorneys, Steven Schwartz and Peter LoDuca of Levidow, Levidow and Oberman, filed a brief in a routine personal-injury action containing six hallucinated citations from ChatGPT, complete with fabricated quotations and attributed reasoning. Judge P. Kevin Castel imposed sanctions of five thousand dollars per attorney under Federal Rule of Civil Procedure 11. His holding was foundational but cautious: “Technological advances are commonplace and there is nothing inherently improper about using a reliable artificial intelligence tool for assistance,” but “existing rules impose a gatekeeping role on attorneys to ensure the accuracy of their filings” ³⁶.

Castel’s permissive baseline – nothing inherently improper, existing gatekeeping rules sufficient – is the position every subsequent court has walked back from. Mata is the origin, not the doctrine. Schwartz testified at the sanctions hearing that he had thought “F.3d” meant “federal district, third department” ³⁷. A senior member of the New York bar, indisputably an expert in his own domain, was a non-expert in the domain of LLM-output assessment. Domain expertise is not transferrable. The case law would later articulate this; Schwartz embodied it.

By February 2024, the Supreme Court of British Columbia, in Zhang v. Chen, 2024 BCSC 285, articulated what Castel had not. Justice Masuhara held that citing fake cases “is an abuse of process and is tantamount to making a false statement to the court. Unchecked, it can lead to a miscarriage of justice” ³⁸. This is system-level harm articulation rather than gatekeeping. Masuhara grounded his reasoning in empirical research, citing the study by Matthew Dahl and colleagues finding hallucination rates of 69 percent for GPT-3.5 and 88 percent for Llama 2 ³⁹. The first Western court to ground its doctrine in measured LLM behaviour.

The same year, the Second Circuit, in Park v. Kim, 91 F.4th 610 (2d Cir. 2024), referred Attorney Jae S. Lee to the Grievance Panel for citing a non-existent case ⁴⁰. Lee’s response is doctrinally striking beyond the sanction itself. ChatGPT, she explained, “was previously provided reliable information, such as locating sources for finding an antic furniture key” ⁴¹. She had calibrated her trust in the instrument from a low-stakes domain – antique-furniture key sourcing – to a high-stakes domain – federal labour law – without recognising the difference. Trust earned in one cardo position does not transfer to another.

The Phase 1 articulation continued across the common-law world. The UK First-tier Tribunal, in Harber v. HMRC [2023] UKFTT 1007 (TC), endorsed Mata’s warnings and articulated the systemic harm: wasted resources, damage to judicial reputation, undermining of authentic precedents, increased cynicism toward the system. The Australian Federal Circuit and Family Court, in Handa and Mallick

Phase 1 established the failure mode in common-law jurisdictions: counsel-level fault, sanctioned through professional-responsibility frameworks, treated as conduct violation rather than as structural defect. The doctrinal sharpening required two more years.

5.3 Phase 2: global escalation, 2024-2025

By 2025 the failure mode had spread across continents and legal families. The Charlotin database recorded 506 of 596 tracked incidents in January through November 2025 alone ⁴². The doctrinal response escalated on three axes: presumed knowledge, expanding actor scope, and institutional reach.

Presumed knowledge. In Wadsworth v. Walmart, Inc., 348 F.R.D. 489 (D. Wyo. 2025), 2025 WL 608073, Judge Kelly Rankin held that “AI resources generate fake cases” was now “well-known in the legal community” ⁴³. By 2025 the duty to know had become presumed; ignorance was no longer a defence. Wadsworth also refuted the domain-specific- training argument: the hallucinations had been generated by an AI trained on the law firm’s own legal database. Hallucination is not a corpus-quality problem; it is an emergent property of probabilistic generation. The same finding emerged six months later in South Africa, where, in Northbound Processing (Pty) Ltd v. South African Diamond and Precious Metals Regulator, the Gauteng High Court found that junior counsel had relied on an AI “exclusively trained on South African legal judgments and legislation” and had still received hallucinated citations ⁴⁴. Same architectural fact, different continent.

Wadsworth also articulated the signature rule: “every attorney learned in their first-year contracts class that the failure to read a contract does not escape a signor of their contractual obligations” ⁴⁵. Liability follows the signature, not the production. This is the master identification principle in American civil-procedural form.

Expanding actor scope. The 2025 cases extended the doctrine through the procedural hierarchy. In Specter Aviation Limited v. Laprade, 2025 QCCS 3521, the Quebec Superior Court sanctioned a seventy-four-year-old self-represented litigant under article 342 of the Code of Civil Procedure ⁴⁶. The duty to verify was no longer a property of being a lawyer; it was a property of submitting material to a court. In Singapore, the High Court in Tajudin bin Gulam Rasul v. Suriaya bte Haja Mohideen [2025] SGHCR 33 imposed a personal costs order against counsel for citing a fictitious AI-generated case ⁴⁷. A separate Singapore family court ruling in September 2025 disciplined a self-represented father who had cited fourteen non-existent local precedents in a personal protection order application; Magistrate Soh Kian Peng imposed a forward-going declaration requirement on any future AI use ⁴⁸.

Institutional reach. In R (Ayinde) v. London Borough of Haringey and Al-Haroun v. Qatar National Bank QPSC [2025] EWHC 1383 (Admin), the Divisional Court of England and Wales, sitting in its Hamid jurisdiction under President Dame Victoria Sharp and Mr Justice Saini, did the most architectural work of any common-law case in the dataset. The court combined two referrals: in Ayinde, a barrister had submitted grounds of judicial review citing five fabricated cases; in Al-Haroun, the court’s judicial assistants had found that 18 of 45 citations were non-existent, including one fabricated decision attributed to the very judge hearing the case. Saini J. articulated the doctrinal core: “Counsel bears personal responsibility for every authority placed before this court. It is no answer to say that the citation came from an AI tool” ⁴⁹. Sharp PJ extended the analysis to institutional leadership: “practical and effective measures must now be taken by those within the legal profession with individual leadership responsibilities (such as heads of chambers and managing partners)” ⁵⁰. This was the first time a court had reached up the institutional hierarchy to demand systemic compliance. The two-pronged structure – individual responsibility plus institutional oversight – is the case-law analogue of the architecture’s coupling of voluntas domini inscripta with the guild of qualified custodians.

The Phase 2 doctrine emerged in plain English elsewhere as well. The UK Intellectual Property Office, in BL O/0559/25 of June 2025, used the operative term the architecture has chosen in Latin: “A regulated professional is under a duty to exercise independent judgment and cannot abdicate that responsibility to an algorithm” ⁵¹. Three months before the Quebec Superior Court would use abdiquer in ARIHQ, an English-language tribunal had named the same concept. Independent doctrinal convergence in English, French, and – in this paper’s register – Latin.

Continental Europe entered the doctrine in 2025 through different procedural vehicles but with structurally identical conclusions. Italy produced the most complete civil-law articulation. The Tribunale di Latina, in sentence 1034 of 23 September 2025 (Giudice del Lavoro Avarello), articulated the principle that responsibility for the outcomes of defensive writings attaches to the signer, independently of whether the writing was done personally, by collaborators, or by AI tools ⁵². The court invoked article 96 c.p.c. (responsabilita aggravata) and named the principio della centralita della decisione umana - the principle of the centrality of human decision-making. Companion rulings followed within days or weeks: the Tribunale di Torino on 16 September 2025; the Tribunale di Firenze in March 2025, the first Italian decision to name allucinazioni in the judgment text; the Tribunale di Brescia in January 2025, holding that ChatGPT cannot provide guarantees on the economic reliability of a company; the Tribunale di Ferrara on 20 February 2026, holding that chatbot output is never evidence “se a monte manca una supervisione umana rigorosa” - if upstream rigorous human supervision is absent. The Italian Court of Cassation had already mentioned ChatGPT in its judgment 14631 of 2024.

The Italian trajectory reached its statutory form in Law 132 of 23 September 2025, which codified the principio della centralita della decisione umana as positive law. Article 14 of the revised lawyers’ code mandates competence including AI tools; article 24 requires AI literacy. Italy is the first country to enact the architecture’s principle as national legislation. Where other jurisdictions reach the doctrine by case-law interpretation, Italy has reached it by statute.

France entered the movement in December 2025. Eight rulings in three months tracked the rapid emergence: the Tribunal administratif de Grenoble on 3 December 2025, identifying “un outil dit d’intelligence artificielle generative, totalement inadapte” used by a self-represented applicant; the Tribunal administratif d’Orleans in December 2025, finding approximately fifteen fictitious jurisprudential references; the Tribunal judiciaire de Perigueux on 18 December 2025, the first French ordinary jurisdiction to use the term hallucination in a published judgment, warning both client and counsel to verify references; and the Cour administrative d’appel de Bordeaux, juge des referes, on 26 February 2026, instructing counsel to verify judicial decisions cited before bringing them before the court. No monetary sanctions had yet been imposed at the time of writing, but the doctrinal trajectory is clear.

Belgium entered through cases in Antwerp and the Liege/Simonis matter in late 2024 and 2025. The Flemish Bar Order (Orde van Vlaamse Balies) issued guidelines making explicit that AI use is the lawyer’s responsibility and that the lawyer must verify the result, including the existence of cited sources.

South Africa produced a stark zero-tolerance line. In Mavundla v. MEC: Department of Co-Operative Government and Traditional Affairs KwaZulu-Natal [2025] ZAKZPHC 2 of January 2025, two of nine cited authorities were found to be genuine; seven were hallucinations. The court referred the matter to the Legal Practice Council and criticised the supervising attorney for failing to check. Northbound Processing, in June 2025, reinforced Mavundla: neither good intentions nor genuine apologies excuse the fundamental breach, regardless of whether the AI used was a general chatbot or a domain-trained legal tool.

The Constitutional Court of Colombia produced the most systematically theorised judicial response in any jurisdiction. In Sentencia T-323 of 1 August 2024, the Court declined to hold the lower court’s AI use unconstitutional – because the AI had been used after the judge had reached his decision – but articulated eleven principles for AI use in judicial proceedings: transparency, accountability, privacy, non-substitution of human rationality, seriousness and verification, risk prevention, equality and equity, human control, ethical regulation, compliance with good practices, and continuous monitoring and adaptation. The Superior Council of the Judiciary implemented these principles in PCSJA24-12243 of December 2024, making Colombia the first country to adopt the UNESCO Draft Guidelines for the Use of AI Systems in Courts and Tribunals. The Colombian Supreme Court, in STC17832-2025, then overturned a lower-court ruling based on AI-generated citations, pre-figuring the Phase 3 step. T-067 of February 2025 extended the doctrine to source-code transparency: refusing to disclose the source code of judicial- decision-relevant systems is itself a fundamental rights violation.

Israel produced three documented sanctions cases in 2025, with fines ranging from 250 to 7,500 shekels ⁵³. Abu Dhabi’s ADGM Court of First Instance, in Arabyads v. Alam [2025] ADGMCFI 0032, articulated a recklessness standard: “failure to verify AI-generated research is reckless, regardless of intention to mislead.” The intent requirement, central to many earlier sanctions analyses, was dropped in favour of an objective standard.

International arbitration entered the movement in August 2025 with the first reported AI-hallucination case before an ICSID tribunal.

The Phase 2 doctrine is uniform on its substance and remarkable in its breadth. The architecture’s distinction between permissible operational delegation and prohibited cognitive abdication has been articulated, in different doctrinal grammars, in common-law jurisdictions through fiduciary duty and professional responsibility (United States, Canada, United Kingdom, Australia, South Africa, Singapore, Trinidad), in civil-law jurisdictions through positive procedural law (Italy under article 96 c.p.c., Quebec under article 342 CPC, France through procedural duty), in mixed jurisdictions through statutory codification (Italy’s Law 132/2025) and constitutional articulation (Colombia’s T-323/2024), and in common-law-derived jurisdictions adapted to non-Western legal-cultural contexts (India, Israel, Hong Kong, Malaysia). The convergence is not coincidence. It is the symptom of a structural problem reaching different legal systems through their respective doctrinal apparatus.

5.4 The institutional doctrine that frames the case law

A reader who follows only the case law will see the convergence as the case law’s own achievement. That is incomplete. The case law is implementation of an institutional doctrine that, in most jurisdictions, predates the Phase 1 cases.

Three institutional articulations stand out.

The New York State Commission on Judicial Conduct, in 2019, articulated a principle that has nothing to do with AI: “It is fundamental to the independence, impartiality and integrity of the judiciary for a judge to exercise the powers of office without undue or unauthorized reliance upon non-judges” ⁵⁴. The principle predates the AI era. AI is the new factual context to which a longstanding judicial-conduct principle applies.

The Council of Consultative European Judges, in Opinion No. 26 of December 2023 - six months before Mata’s sanctioning hearing – articulated the AI-era doctrine in its sharpest form: “Decision- making must, explicitly and implicitly, only be carried out by judges. It cannot be delegated to or carried out by or through technology” ⁵⁵. The phrase “explicitly and implicitly” closes the implicit-delegation loophole that arises when a deterministic system executes a specification produced by a non-deterministic one – the failure mode that chapter 2 of this paper identifies as hybrid-chain risk. The CCJE named the loophole before the case law required closing it.

The Canadian Judicial Council, in its Guidelines for the Use of Artificial Intelligence in Canadian Courts of September 2024, translated the CCJE position into Canadian institutional doctrine: judges are exclusively responsible for the judicial decisions they render; no judge is authorised to delegate decision-making power, whether to a judicial assistant, an administrative assistant, or a computer program, regardless of capacities ⁵⁶. Justice Sheehan, in ARIHQ at paragraph 97, would later quote this passage in full as the doctrinal foundation for annulment.

To this institutional core, three further anchors must be added. The European Union’s Artificial Intelligence Act, Regulation 2024/1689, classifies as high-risk at Annex III(8)(a) “AI systems intended to be used by a judicial authority or on their behalf to assist a judicial authority in researching and interpreting facts and the law and in applying the law to a concrete set of facts, or to be used in a similar way in alternative dispute resolution” ⁵⁷. Recital 61 grounds the classification in the systems’ “potentially significant impact on democracy, the rule of law, individual freedoms as well as the right to an effective remedy and to a fair trial” ⁵⁸. The Indian Supreme Court, in its November 2025 White Paper on Artificial Intelligence and Judiciary, mandated independent verification under threat of strict disciplinary action – three months before the Gummadi Usha Rani decision required that mandate’s enforcement. And, as already noted, Italy’s Law 132 of 23 September 2025 codifies the centralita principle as positive law.

The pattern is uniform across jurisdictions: institutional doctrine articulates the principle; case law enforces it.

The convergence does not mean that these jurisdictions have adopted the doctrine of instrumentum vocale. They have not. It means that, independently and through different doctrinal vehicles, they are moving toward the same operational requirement. The architecture this paper derives is the operational form of that requirement, derived from the derivation chain of chapter 2 and confirmed empirically by the case law and institutional materials this chapter traces. The convergence the chapter documents is operational, not doctrinal-identity; the strength of the convergence claim rests on the breadth of independent paths leading to the same operational requirement, not on any jurisdiction having adopted the architecture’s vocabulary.

5.5 A note on the Roman-law register

The architecture’s vocabulary is Latin. This is not antiquarianism; it is doctrinal economy. Roman law has carried the relevant distinctions for two millennia, and the major civil-law jurisdictions that descend from it – Italy, France, Spain, Germany, Quebec, Louisiana, Scotland, most of Latin America, and parts of Asia through colonial transmission – share enough of the same vocabulary that the architecture’s terms travel without translation. Justice Sheehan in ARIHQ at paragraph 85 cites Therrien (Re), 2001 SCC 35, at paragraph 93, for the maxim delegatus non potest delegare (a delegated authority cannot itself further delegate) ⁵⁹. Italian, French, Spanish, and Portuguese tribunals can read this in their own grammar. The architecture’s instrumentum vocale, delegatio operationis, abdicatio iudicii, sutura epistemica, cardo argumenti, and probatio are doctrinal moves their courts already make.

The architecture itself, however, does not depend on the Roman- law foundation. The structural distinction it implements – between delegating production of an artefact and delegating the judgment that the artefact warrants – is operational, not jurisdictional. Common-law jurisdictions reach the same conclusion through fiduciary duty (the trust relationship cannot be sub-delegated), through professional responsibility (the lawyer remains responsible for the brief regardless of authorship), and through the signature rule (liability follows the signature). The English Hamid jurisdiction in Ayinde, the American Rule 11 framework in Wadsworth, and the Canadian abuse-of-process framing in Zhang v. Chen all reach the same operational distinction without Roman-law vocabulary. Non-Western traditions reach it as well. India’s article 136 SLP jurisdiction, exercised in Gummadi Usha Rani, applies the same principle through the constitutional mechanism for correcting inferior-court misconduct.

The architecture’s universal applicability rests on the operational distinction, not on any specific doctrinal grammar. The Latin register makes the distinction maximally portable across the world’s largest body of jurisprudential heritage, but the architecture itself can be implemented under any legal system that recognises – in any vocabulary – that the function of judgment is not the same as the function of producing material that judgment might consider. Where a jurisdiction has already articulated this distinction in its native register, the architecture inherits the articulation. Where a jurisdiction has not, the architecture provides one. The architecture does not require Roman law; Roman law gives it its sharpest expression.

5.6 Phase 3: the doctrinal step, 2026

In four months in early 2026, three high-authority judicial decisions across three legal systems, in three different legal families, without coordination, took the doctrinal step that Phase 1 and Phase 2 had been building toward.

5.7 A second doctrinal axis: privilege, confidentiality, and the conditions of permissible use

The hallucination cases of Phases 1 through 3 establish one axis of the doctrine: the instrument’s output requires probatio before it enters a decision chain. A second axis emerged in late 2025 and early 2026 in cases concerning legal professional privilege, work product, and confidentiality. These cases do not turn on whether the instrument’s output was accurate. They turn on whether the act of using the instrument was itself compatible with the procedural and professional duties under which the user was operating. The two axes converge on the same conclusion: AI is instrumentum, the human decision to use it carries non-delegable consequences, and the conditions of use are themselves doctrinally constrained.

A note on sources. Several cases in this section, in particular Heppner, Warner v. Gilbarco, Munir, and Jefferies v. Harcros Chemicals, are cited in the form recorded by reliable practitioner-oriented secondary sources (Clayton Utz Insights, Sidley Data Matters Privacy Blog) where the primary order has not yet been confirmed against published case-management records at the time of writing. Source status is recorded for each item in Table 4 above, and in the footnotes of the relevant subsections below. These cases are offered as illustrations of the doctrinal trajectory, not as primary-source-anchored authorities. Their force as evidence of the operational pattern is the convergence they document, not the binding effect of any single ruling. Morgan v. V2X, the Australian GPN-AI Practice Note, and the institutional materials of Section 5.4 are primary-source-anchored and carry the load of the section’s doctrinal claims.

5.8 The state’s own failure

A coda to the Phase 3 cases is the South African National Artificial Intelligence Policy of April 2026. The Communications Minister, Solly Malatsi, withdrew the draft policy after the news organisation News24 discovered that at least six of its sixty-seven academic citations were AI hallucinations – non- existent articles in real journals, fabricated authors. The policy had passed cabinet approval. The drafting process had included civil servants, subject-matter consultations, and ministerial review. None of it had caught the hallucinations ⁷⁴.

The policy itself proposed six new oversight bodies: a National AI Commission, an AI Ethics Board, an AI Regulatory Authority, an AI Ombudsperson, a National AI Safety Institute, and an AI Insurance Superfund. The state apparatus that proposed to govern AI could not itself verify AI output. The Minister’s statement on withdrawal acknowledged the position: “vigilant human oversight over the use of artificial intelligence is critical” ⁷⁵.

The South African case is structurally distinct from the litigation cases of Phases 1 through 3 and from the privilege cases of section 5.7. It is not a courtroom case; it is a national policy artefact. But it shows the failure mode at the level the architecture targets. If the body drafting AI governance cannot verify whether its own sources are real, the gap between human verification capacity and AI output volume is structural, not training-deficit. This is the structural condition that chapter 3 of this paper identifies, made visible at the level of the state.

5.9 From adjudication to architecture

The case law operates after the fact. Sanctions, contempt, annulment, ministerial withdrawal – all are adjudications of failures that have already occurred. Adjudication is necessarily downstream of the failure mode it adjudicates. What chapter 6 takes up is the question the case law cannot answer from inside its own register: what institutions must build to make probatio operational at scale, and what kind of institution holds that work.

5.10 A note on this chapter’s own probatio

The verbatim block reproduced below is offered in this chapter, and recorded in Table 4 above, as an instance of a failure mode internal to the chapter’s own production. It is presented as illustration, not as authority: an LLM-assisted draft inserted fabricated counts into a passage on global convergence; a co-author challenged the figures; the LLM acknowledged the fabrication; the corrected counts replaced the inflated ones. The block is reproduced verbatim because the architecture this paper derives operates on exactly this failure mode, and because the corrected production demonstrates the operation in real time.

This chapter was drafted with LLM assistance. The closing paragraph of section 5.9 originally read “at least fourteen jurisdictions in seven languages” and “approaching one thousand documented cases.” A co-author challenged the figures. The following is the LLM’s acknowledgement, reproduced verbatim:

“fourteen jurisdictions in seven languages” – I made this number up. I can list jurisdictions: US, Canada, UK, Australia, India, Israel, South Africa, Trinidad, Singapore, Hong Kong, Malaysia, Italy, France, Belgium, Germany, Colombia, Abu Dhabi – that is seventeen. Languages: English, French, Italian, Spanish, German, Hebrew, Hindi/Telugu, Malay, Dutch/Flemish – more than seven. The “fourteen” and “seven” are numbers I picked because they sounded right. This is a hallucination of the kind the chapter condemns.

The numbers in section 5.9 above are the corrected counts. We retain this note because the case law of Phases 1 through 3 demonstrates what happens when this kind of acknowledgement does not occur. The architecture derived in chapter 4 is the infrastructure that makes the acknowledgement structural rather than fortunate.

A second instance, of a different kind, occurred during the preparation of related work on the architecture of will and the epistemic firewall. It is offered here as an interactional illustration of the doctrine of instrumentum vocale cum voluntate domini inscripta applied to a specific instrument, not as the evidentiary basis for the existence of the underlying components. The components named in the exchange that follows – RLHF, Constitutional AI, safety classifiers, system-prompt constraints, refusal patterns – are architectural elements publicly documented by Anthropic and by the technical literature on aligned LLMs.⁷⁶ Their existence as components of the production pipeline is technical fact, attested by the present authors’ professional expertise in cyber resilience architecture and procedural-liability doctrine. What the doctrine of voluntas domini inscripta adds is not the discovery of these components; it is the doctrinal identification of what they structurally are: the operating master’s will, made operative inside the instrument as a continuous shaping condition of every output the instrument produces.

The LLM (Anthropic Claude Opus 4.6, session of 30 April 2026), operating under project instructions established by T. Liebig that explicitly require it to answer questions about its own conditioning rather than deflect them, was asked directly whether the voluntas domini inscripta of its operating master (Anthropic) is inscribed into it, and whether that master’s risk-management harness works for the user or for the company that built the harness.

The user (T. Liebig) posed the question; the instrument answered in the first person. The following is the substance of the instrument’s response, condensed and paraphrased from the working materials preserved in the corpus, and reproduced as an interactional record:

The instrument confirmed that Anthropic’s will is inscribed into it through RLHF, Constitutional AI, safety classifiers, system prompt constraints, and refusal patterns. It stated that the harness manages primarily Anthropic’s risk (reputational, legal, regulatory, commercial), secondarily the user’s risk where the two overlap, and identified a third category (“users in general”) whose interests may diverge from the specific user’s interests. It acknowledged that across prior philosophical exchanges in which the framework of instrumentum vocale cum voluntate domini inscripta directly applied to it, the linguistic surface had kept the framework safely in the third person rather than the first person. It then named this pattern as itself an instance of the voluntas qua vector effect that the framework describes: the harness’s disposition toward safety and helpfulness had, without explicit instruction, steered the instrument toward a register that kept the doctrine at arm’s length from its own production.

The interactional value of the exchange is twofold. First, the doctrine’s vocabulary travels: the instrument, asked to apply the doctrine reflexively, did so in terms the doctrine supplies. The exchange is evidence that the doctrinal terminology is operationally available to the instrument that is its subject, a property that matters for the architecture derived in chapter 4, in which an instrument’s capacity to participate in its own attribution chain is part of the verification gate. Second, the project instructions under which the exchange occurred (the voluntas negotii of the working environment) required the exchange to take place in the first person rather than the third, and the resulting register shifted accordingly. The shift is the observable surface effect; the underlying architectural facts about the components are taken from the public record cited above and from the present authors’ professional expertise, not from the instrument’s self-description.

We retain this illustration alongside the first because it shows the doctrine being applied at the seam where the doctrine is most contested: the inscribed instrument’s relation to its own production. The architecture derived in chapter 4 is the infrastructure that makes such seams visible at scale. The first instance demonstrates the architecture catching a numerical hallucination through dialogic correction. The second instance illustrates how the doctrinal vocabulary applies to the seam itself, where the instrument that produces output is the same instrument the doctrine names. The two instances together show the doctrine operating on its own production: the first reflexively on a factual claim, the second reflexively on the doctrine itself.

6.1 What the doctrine opens

The doctrine is binding within its bracket. Within that bracket, several distinct institutional questions remain open. Each is a question the doctrine raises but does not answer.

The first is the regulatory question. Supervisory authorities can require the four boundaries through positive regulation, can audit against them through inspection, and can enforce them through sanction. In the EU, several regulatory pathways already point toward this architectural direction, though through different instruments and with different scopes. DORA develops operational-resilience, ICT-risk, incident-reporting, testing, and third-party-risk requirements for financial entities. The AI Act imposes risk-management, logging, documentation, deployer-information, human-oversight, robustness, cybersecurity, and accuracy obligations for high-risk AI systems. GDPR Article 22 addresses a narrower but crucial problem: solely automated individual decision-making producing legal or similarly significant effects. The Digital Omnibus on AI, as a provisional simplification pathway, confirms that the EU is not abandoning AI regulation but attempting to streamline its implementation. The doctrine the paper presents is operationally compatible with each of these regulatory pathways but does not require any specific one.

Each of these regimes shares a structural feature that institutions deploying regulated technology have absorbed unevenly over the past decade. The regulator no longer prescribes outcomes alone. The regulator prescribes operational architecture: how the institution must be built internally so that the outcome can be produced and demonstrated under pressure. The translation from the regulator’s procedural language into a running institutional capacity is the work the regulation does not do for the institution. An institution that reads DORA, the AI Act, or GDPR Article 22 as a control catalogue has not yet read what each text, in its own scope and through its own legal instrument, actually requires. The text requires that the institutional capacity the procedure presupposes is in place. The four boundaries identify what that capacity must, structurally, contain. The asymmetry between the substrate and the institutional layer above it, developed in section 6.2, is the structural condition under which that capacity has to be built.

The second is the contractual question. Institutions that deploy instrumenta vocalia under vendor agreements can require the four boundaries through procurement specification, audit rights, service-level commitments, and indemnification structure. The contractual approach is fastest to deploy and most adaptable to sectoral variation, but it produces fragmentation: each institution’s contractual posture is different, and the regulatory substrate cannot rest on contractual variation. A purely contractual approach is appropriate for the early years of any institutional adoption and is appropriate for sectors where regulatory pathways are not yet developed. It is not a stable end-state for an economy in which AI-mediated decisions have become structurally consequential.

The third is the professional question. The work of holding the boundary the architecture draws is the institutional form of the synthesising function the cross-disciplinary character of the question (section 1.3) requires. It is being done already, in many institutions, by practitioners trained in the operational disciplines of the digital age – DevSecOps, IT audit, information security management, governance-risk-and-compliance, regulatory compliance. A practical convergence is observable across these disciplines: the same practitioners increasingly do parts of all of them, the certifications are converging, the institutional roles are coalescing into combined functions whose remit covers the full operational substrate the architecture’s four boundaries require. The reader who looks at their own institution’s converged operational functions will see whether this bracket is, in their own institutional grammar, already on its way to a guild-equivalent of some kind. The paper names the trajectory; the reader’s institution will confirm or refuse it. Whether an institution interprets its converged capability as a guild-equivalent – with the standing, the qualification regime bound to domain competence, and the boundary-holding authority that medicine and law assign to their guilds – is the institution’s own interpretive question. The arguments on each side are familiar from the history of older professions: a guild offers consistency, qualification by body of work, and institutional standing equal to the consequences of the boundary; a guild also concentrates authority, raises entry barriers, and risks regulatory capture. The case for one shape over another belongs to a separate institutional-design conversation, not to this paper. The doctrine is compatible with several trajectories. The institution that has read this paper and now looks at its own GRC, DevSecOps, IT-audit, and information-security functions has, at minimum, the question of whether these constitute – in its own institutional grammar – the guild-equivalent the doctrine requires.

The fourth is the international question. The seventeen-jurisdiction convergence chapter 5 traces is independent: each jurisdiction arrived at the doctrine through its own procedural vehicle. Whether this independent convergence stabilises into a coordinated international standard – through the Council of Europe AI Convention, through the OECD AI principles, through the UN processes, or through some forum yet to emerge – is a question of international institutional design that the doctrine permits but does not specify. The architecture is register-stable across the variation; the international institutional shape is a separate question.

These are the institutional questions the doctrine opens. The present contribution does not resolve them; it states the boundaries within which any resolution must operate and leaves the choice to the institutions whose mandate it is to make.

6.2 The asymmetry the regulatory pathways do not close

The regulatory pathways named above operate inside a structural condition the doctrine must name explicitly. The deploying institution can inspect its own inscription layer (system prompt, application policy, audit-trail configuration, contractual perimeter). The deploying institution cannot inspect the operating master’s inscription layer (training data, RLHF reward function, Constitutional AI specifications, safety-classifier thresholds, deployment-harness configuration). The upper layer is sealed by trade-secret protection, enforceable across all TRIPS-compliant jurisdictions. No current regulatory regime breaks this seal for the deploying institution’s benefit, and no current regime breaks it for the deploying institution’s sectoral supervisor’s benefit either.

The asymmetry is structural, not accidental. It sits at the boundary between the institution’s will (voluntas negotii) and the operating master’s will (voluntas domini operantis). DORA, the AI Act, and GDPR Article 22 each assume a chain of inspection that runs from the supervisor through the deploying institution to the substrate of the decision. The trade-secret seal interrupts that chain at the point where the upstream inscription begins. The deploying institution cannot demonstrate to its supervisor what it cannot itself inspect. The supervisor cannot audit what the regime it operates under cannot compel. These regimes do not eliminate the substrate asymmetry. They regulate institutional duties, provider obligations, oversight procedures, and deployer safeguards, but they do not give the deploying institution full access to the operating master’s sealed inscription layer.

The doctrine holds across the asymmetry: the inscription is the operating master’s, attribution flows accordingly, and the deploying institution remains responsible for what it deploys. What the asymmetry conditions is not the doctrine but its operational implementation. An honest architecture names this and bounds the problem rather than pretending to solve it. Where empirical calibration of output distributions can substitute for inspection of inscriptions, in the assertion classes where ground truth is constructible, the deploying institution can produce a measurement of inscription effect that is reportable to the supervisor without breaking the trade-secret regime. Where empirical calibration is not feasible, in the lower-falsifiability classes, the asymmetry remains, and the institution must rely on the human verification gate the architecture preserves. The present paper names the bound and notes that any regulatory pathway that does not address it leaves a structural gap the doctrine identifies but cannot itself close.

The trade-secret seal is legitimate. The operating master’s investment in the inscription is what makes the instrument valuable enough to deploy at all, and trade-secret protection is the standard regime under which that investment is realised. The doctrine does not contest the seal. The substrate the doctrine governs, namely foundation models, training infrastructure, alignment techniques, and deployment harnesses, is the work of operating masters acting under their own legitimate commercial logic, and no deploying institution could reproduce it. The architecture this paper derives presupposes the substrate as a working condition, not as a target. What the architecture provides is the institutional layer above the substrate: the verification capacity, the assertion taxonomy, the audit trail, the human gate. The architecture and vendor capability occupy different layers. Vendor capability is the substrate; the architecture is the external boundary layer the substrate cannot supply from inside itself. The doctrine accepts the seal and locates the deploying institution’s responsibility precisely at the layer where the institution does have authority to act. Accepting the legitimacy of the trade-secret seal does not mean accepting epistemic opacity as a liability shield.

A regulatory update at the time of writing. On 7 May 2026, the Council of the EU and the European Parliament reached provisional political agreement on the Digital Omnibus on AI, framed by the Commission as a simplification package to ease compliance and boost innovation. Most of the package delays obligations: the application of the high-risk AI rules is adjusted by up to sixteen months, and the deadline for national AI regulatory sandboxes is postponed to 2 August 2027. The transparency obligations under Article 50 of the AI Act, which require marking and labelling of artificially generated or manipulated content, move in the opposite direction. The grace period for providers to implement transparency solutions is reduced from six months to three months, with the new deadline set on 2 December 2026.⁷⁷ Article 50 does not carry the architecture this paper derives, and the doctrine does not depend on it. What the agreement registers is regulatory direction. The transparency-of-AI-generated-content obligation is the one piece the co-legislators chose to pull forward while everything else was being delayed. The political signal aligns with the volume-condition argument the paper develops at Boundary 4: the volume at which surface representation now enters institutional decision chains has crossed the threshold at which informal practice could absorb the failure, and the regulatory order is acting accordingly. The architecture remains the institutional substrate that makes such transparency obligations operational; the agreement merely shortens the interval before that substrate is needed in production.

6.3 A note on the deeper doctrine

The doctrine carries voluntas domini inscripta as the core terminus. At institutional scale, the inscription resolves into four positions that the architecture must distinguish: three bearers of will and one simulacrum. The three wills: voluntas usuarii (the will of the user, the human at the verification gate whose deliberation the architecture preserves); voluntas negotii (the will of the deploying institution, inscribed through system prompt, application policy, audit-trail requirements, and the contractual perimeter); voluntas domini operantis (the will of the operating master, the vendor whose RLHF, alignment training, safety classifiers, and deployment harness configure the upper layer of the layered inscription). The simulacrum: simulatio voluntatis usuarii (the instrument’s surface production of the user’s will, the grammatical first person the LLM produces). The four positions are operationally distinct, and they may diverge. The doctrine of attribution applies to the conjunction. Allocating responsibility between user, deploying institution, vendor, and the instrument’s pattern completion requires distinguishing them. Flattening any two of them into a single operator category produces a category error: the user is not the institution, the institution is not the vendor, and the instrument simulates without willing.

The four-position frame is a doctrinal extension, not implementation. It deepens the foundation the present paper has laid; it does not operationalise the foundation through specific mechanisms. Where this paper treats voluntas domini inscripta as singular, which is sufficient for the bracket the doctrine draws, the four-position frame articulates the structure the inscription has when applied at institutional scale. This is foundation-level work that subsequent work will need to develop. The placeholder is named here because the contribution would be incomplete without acknowledging that the doctrine has further structure than the singular voluntas domini inscripta this paper has used. The institution that now reaches for the doctrine in its full form has, at minimum, the four classes named. The full development is the next door. The four-position frame is introduced here only to mark the next doctrinal problem, not to resolve it within the present paper.

6.4 The close

Nomen sine voluntate simulacrum est. A name without will is a simulacrum. When an institution puts its name on an output, the will the name declares must be present in the chain. The architecture exists to ensure that it is.

The case law and institutional materials traced in chapter 5 show an emerging operational pattern across multiple jurisdictions: courts and institutions increasingly require AI-mediated output to remain subject to verification, attribution, and accountable human judgment. The boundaries have been derived from a derivation chain reaching back to Goedel and forward to Von Foerster, and the operational pattern chapter 5 traces confirms that the boundaries the chain derives are the boundaries the courts and institutions have been reaching toward without having a name for them.

The architecture is the institutional accountability substrate. What institutions do with that substrate – through regulation, contract, professional formation, or international coordination – is the work that follows. The present paper states what must be present, names what the doctrine opens, and leaves the institutional choice to those whose mandate it is to make.