FL-Compliance-Guard: Machine-Checkable Compliance Evidence for Federated Learning Pipelines

Abstract Federated learning (FL) is considered for healthcare, finance, and other settings in which training data cannot be pooled. Distributed training, however, does not by itself show that an operator’s regulatory and governance controls remained in force. We present FL-Compliance-Guard, a proof-of-concept framework that encodes a deployment-specific set of technical controls as machine-checkable predicates. Each predicate is linked to provisions of the GDPR, the EU AI Act, or the HIPAA Security Rule that it is intended to support; this linkage provides traceability, not an automated legal verdict. A static checker evaluates the declared configuration before deployment, and a runtime monitor checks per-round events against the admitted configuration. The resulting evidence is stored in a hash-chained ledger, and a conservative privacy accountant tracks the recorded differential-privacy parameters. The monitor reads bookkeeping state, consumes no random draws, and does not alter model updates. We evaluate the design with 20 simulated clients on the digits classification task using FedAvg and DP-FedAvg. The static checker detects all 18 seeded misconfigurations in the stated catalog, with a mean check time of 0.011 ms and no alerts on 500 benign perturbations. The runtime monitor detects all six injected operational faults at the next applicable check and raises no alerts in the clean runs. Monitored and unmonitored runs have bit-identical accuracy trajectories. Full checking takes monitoring time equal to 4.4–15.2% of measured training time; ledger-only recording takes 1.0%. Component ablations show which checks account for each detection. These results establish coverage for the evaluated fault model, rather than legal compliance in general.