Limitations and Non-Claims

Conformance to ARCS does not by itself establish privilege, confidentiality, immunity from discovery, immunity from preservation, immunity from liability, legal sufficiency under any specific jurisdiction, insurance coverage, or zero-record operation.

ARCS governs record architecture and disclosure. It does not govern legal outcomes. Legal advice regarding discovery, privilege, and compliance obligations should be obtained from qualified counsel.

ARCS does not define model quality requirements, privacy law compliance in general, information security certification in general, privilege doctrine, substantive discovery law, insurance coverage terms, product performance requirements, AI safety evaluation methodology, red-teaming or adversarial testing methodology, content moderation policy, data protection impact assessment methodology, or model documentation requirements. Where ARCS governs records created by such activities (safety review logs, evaluation datasets, moderation artifacts), the governance applies to the records, not to the activities that generated them.

ARCS does not require non-retention. It requires that retention decisions are explicit, documented, auditable, and architecture-aware. An implementation that retains all interaction records may conform to ARCS if the retention is documented, the custody surface is mapped, and the governance controls are operational.

ARCS does not require any specific retention duration, any specific architecture, any specific vendor, any specific security model, or any specific legal theory. ARCS requires disclosure, mapping, and documentation.

Conformance to ARCS does not establish compliance with any external regulatory framework, including GDPR, CCPA, HIPAA, the EU AI Act, NIST SP 800-53, ISO 27001, or SOC 2. ARCS may be used alongside those frameworks, and an implementation may satisfy overlapping requirements, but ARCS conformance and external regulatory compliance are independently evaluated.