FrameworkSharia AI Compliance Framework (SACF)Sheet 58

SACF (Sharia AI Compliance Framework™).

One governance system. Two authority sources. A dual-authority governance architecture for Islamic finance.

← Defensible AI · How the nine relate

§ 01Status

What this is.

REG-08 · Sharia AI Compliance Framework (SACF)™

Position in the architecture · Regulatory Floor

Specification · Deposited. 10.5281/zenodo.22170143, CC BY 4.0.

One machinery with two authority sources, against two parallel processes Two arrangements compared. On the left, the arrangement this framework rejects: a civil governance process runs from the financial supervisor down through mandate, procedure and control, while a separate Sharia process runs beside it from the Sharia Supervisory Board, meeting the system later. It produces two record sets, arrives after the system is built, and has no defined behaviour when the two disagree. On the right, the arrangement the framework proposes: both the financial supervisor and the Sharia Supervisory Board sit at the Regulatory Floor as authority sources, one cascade carries both sets of obligations down through the Strategic Compass, Operational Machinery and the Technical Substrate, and one record set results. A disagreement appears as an unsatisfied floor obligation rather than as a dispute between two functions, and the framework does not claim to resolve it. One machinery with two authority sources, against two parallel processes Nabeel Khan 2026 https://doi.org/10.5281/zenodo.22170143 https://doi.org/10.5281/zenodo.22170143 Copyright 2026 Nabeel A. Khan. Licensed CC BY 4.0. Nabeel Khan https://nabeelkhan.com/frameworks/sacf THE CONSTITUTION REJECTED · TWO PROCESSES Financial supervisor binding Sharia Supervisory Board binding Civil governance mandate procedure control record set A Sharia process separate review different people different evidence record set B the AI system, reached twice and at different times Two record sets that must be reconciled after the fact. A review that arrives once redesign is expensive. Disagreement is a dispute between two committees, with no defined behaviour. PROPOSED · ONE MACHINERY, TWO SOURCES REGULATORY FLOOR Financial supervisor Sharia Supervisory Board one cascade Strategic Compass · mandate, appetite, decision rights Operational Machinery · validation, data, vendor, incident Technical Substrate · the control that actually enforces one record set, one account of one system A determination is traceable to the control enforcing it. A disagreement appears as an unsatisfied floor obligation, which the framework surfaces and does not resolve. The claim is architectural, not theological. It says nothing about what a board should determine. No Sharia Supervisory Board has reviewed or endorsed this framework. The Sharia AI Compliance Framework v1.0 · Nabeel Khan · nabeelkhan.com/frameworks/sacf · CC BY 4.0 · DOI 10.5281/zenodo.22170143
Figure 1. The rejected two-process arrangement, against the proposed one.
§ 02Stated with the framework

Before the argument.

No Sharia Supervisory Board has reviewed or endorsed this framework. It is an engineering proposal for how binding Sharia authority can be integrated into AI lifecycle governance, offered for scholarly and institutional review.

The Halal data certification chain is author methodology. No standard-setter recognizes such a chain. It must not be presented as an existing requirement of any Sharia standard.

§ 03Two binding authorities

Two binding authorities.

An Islamic financial institution operates under two binding authorities. A financial supervisor determines what it may do in law. A Sharia Supervisory Board determines what it may do in conscience, and in most such institutions the board’s determinations bind rather than advise. Both predate artificial intelligence and neither has specified how its authority reaches an AI system.

The three threads from the Sharia Supervisory Board into existing machinery The Sharia Supervisory Board sits at the Regulatory Floor as an authority source. Its determinations pass through a Maqasid risk frame, which classifies what an AI decision may harm in the terms of faith, life, intellect, lineage and wealth, and which determines materiality rather than inferring it. Three threads then enter machinery the institution already operates. Thread one, dual validation, enters model risk management at the independent validation step: a civil track and a Sharia track run concurrently and both must close before approval. Thread two, the Halal data certification chain, enters data governance and runs source permissibility, transform integrity and certified use, where an unattested hop breaks the chain. Thread three, Sharia screening, enters vendor risk at the diligence stage and screens the conduct of the vendor's AI in the institution's use. Each thread extends a discipline rather than standing up a parallel one, and each produces evidence that joins the institution's single record set. The three threads from the Sharia Supervisory Board into existing machinery Nabeel Khan 2026 https://doi.org/10.5281/zenodo.22170143 https://doi.org/10.5281/zenodo.22170143 Copyright 2026 Nabeel A. Khan. Licensed CC BY 4.0. Nabeel Khan https://nabeelkhan.com/frameworks/sacf THREE THREADS INTO EXISTING MACHINERY REGULATORY FLOOR · AUTHORITY SOURCE Sharia Supervisory Board binding. Its determinations are satisfied, never weighed Maqasid risk frame what the decision may harm: faith · life · intellect · lineage · wealth materiality is determined by the board, never inferred by the institution THREAD 1 Dual validation into model risk management, at independent validation civil track Sharia track both must close before approval and THREAD 2 Halal data certification into data governance, at classification source permissibility transform integrity certified use an unattested hop breaks the chain THREAD 3 Sharia screening into vendor risk, at diligence the conduct of the vendor AI in the institution use the attestation records whether it rests on the vendor own statement evidence joins the institution single record set, not a second one The Sharia AI Compliance Framework v1.0 · Nabeel Khan · nabeelkhan.com/frameworks/sacf · CC BY 4.0 · DOI 10.5281/zenodo.22170143
Figure 2. Three threads carrying Sharia authority into existing disciplines.
§ 04The second process is the error

The second process is the error.

So the institution does what institutions do when a new object arrives without a rule for it. It builds a second process beside the first. This framework proposes that the second process is unnecessary, and that building it is the mistake. The board is constituted as an authority source at the Regulatory Floor alongside the civil supervisor, so its determinations cascade through the same machinery: one governance system, two authority sources, one record set.

Concurrent escalation, against the sequential arrangement it replaces Two escalation arrangements compared. Above, the sequential arrangement this framework rejects: an incident is detected, the institution classifies it, contains it, decides its response, and only then informs the Sharia Supervisory Board, which is presented with a settled matter and whose remaining options are to accept the resolution or to reopen it. Below, the concurrent arrangement the framework requires: on detection and classification, the reconstruction goes to the civil escalation path and to the board at the same time, so the board determination shapes the response rather than reviewing it. The reconstruction sent to the board is evidence produced at the time of the decisions in question rather than an account assembled afterwards. Where materiality is unclear at the moment of an incident, the institution escalates, because an incident wrongly escalated costs the board time while an incident wrongly withheld costs the board authority. Concurrent escalation, against the sequential arrangement it replaces Nabeel Khan 2026 https://doi.org/10.5281/zenodo.22170143 https://doi.org/10.5281/zenodo.22170143 Copyright 2026 Nabeel A. Khan. Licensed CC BY 4.0. Nabeel Khan https://nabeelkhan.com/frameworks/sacf ESCALATION REJECTED · SEQUENTIAL Signal and classify Contain rollback, suspend Decide the response Inform the board a settled matter The authority is handed a resolved matter. Its remaining options are to accept the resolution or to reopen it, which is not the position a body at the Regulatory Floor should be in. REQUIRED · CONCURRENT Signal and classify Sharia-material? unclear means escalate Civil escalation path governance office, executive, regulator Sharia Supervisory Board at the same time, not afterwards The board determination shapes the response rather than reviewing one already chosen. What it receives is the reconstruction from evidence written at decision time. An incident wrongly escalated costs the board time. An incident wrongly withheld costs the board authority. The reconstruction must be evidence produced at the time of the decisions in question, never an account assembled afterwards. The Sharia AI Compliance Framework v1.0 · Nabeel Khan · nabeelkhan.com/frameworks/sacf · CC BY 4.0 · DOI 10.5281/zenodo.22170143
Figure 3. Escalation is concurrent, not sequential.
§ 05The Maqasid risk frame

The Maqasid risk frame.

What an AI decision may harm is classified in the terms the authority itself uses, rather than translated into a Western risk taxonomy and back. A framework that asks a board to recognise its own concerns in someone else’s vocabulary has added a translation step at the point where precision matters most.

§ 06Where it applies

Which institutions, and on whose authority.

Scoped to this sector by the specification

SACF is the one framework in the family scoped to a sector by its own text. It addresses an institution operating under two binding authorities, a financial supervisor and a Sharia Supervisory Board, and proposes that both be satisfied from one set of records rather than two parallel processes.

Where it bites · Islamic finance

§ 07How it has changed

The record of its own revisions.

A framework that cannot say how it changed reads as though it never has. This is drawn from the registry entry, which versions itself independently of the specification it points at.

Change history

  • 2026-08-30 · entry v1.0 — First registry entry, status instrument-pending

Limitations recorded in the registry

  • No Sharia Supervisory Board has reviewed or endorsed this framework. It is an engineering proposal for how binding Sharia authority can be integrated into AI lifecycle governance, offered for scholarly and institutional review. This clause MUST accompany any presentation of SACF until an endorsement exists and can be named.
  • The Halal data certification chain is author methodology. No standard-setter recognizes such a chain as of the date of this registry, and it MUST NOT be presented as an existing requirement of any Sharia standard.
  • That a Sharia Supervisory Board would accept the dual-validation construct. No board has publicly accepted it.
  • Specifies the architecture by which Sharia authority enters AI governance. Makes no Sharia determination and does not substitute for scholarly opinion on any question of permissibility.

What would show this to be wrong. SACF is falsified if an institution operating the single-machinery constitution is found unable to satisfy both authorities from one set of records, so that a second and parallel record set has to be created for the Sharia authority in practice. The framework's central claim is that one governance system with two authority sources at its floor is sufficient for both. A parallel record set appearing under operation refutes that claim by observation rather than by opinion, which is what 3.6 requires, and it is observable by any party with access to the institution's records.

§ 08Scope

What it does not do.

SACF specifies the architecture by which Sharia authority enters AI governance. It does not make, and must not be read as making, any Sharia determination, and it does not substitute for scholarly opinion on any question of permissibility.

§ 09Honest limits

What this does not claim.

No institution unconnected to the author has been observed operating it, and no standard-setter has reviewed it.

§ 10Cite

Citation.

Cite this work. Sharia AI Compliance Framework (SACF), version 1.0. 10.5281/zenodo.22170143. This is the concept DOI and it always resolves to the latest version. CC BY 4.0.

Also on SSRN. Posted 21 September 2026 as abstract 7484640. Distributed in 2 eJournals: European Economics: Macroeconomics & Monetary Economics (Vol 19, Issue 147) on 22 September 2026; Monetary Economics: International Financial Flows, Financial Crises, Regulation & Supervision (Vol 11, Issue 175) on 22 September 2026. Scheduled for IO: Regulation, Antitrust & Privatization on 11 December 2026, and Monetary Economics: Financial System & Institutions on 13 January 2027. The deposited specification is the version of record and the Zenodo concept DOI above is the one to cite; SSRN carries the same text for a finance and policy readership.

§ 11Where this sits

In the practice.

§ 10Ask an assistantLive, no key

Ask your AI assistant instead.

This page is a snapshot, accurate at the release it cites. The same corpus is callable, publicly and without a key, so an assistant can query it live and return an answer carrying the source it came from. For this page that is explain_this_setup and search_knowledge, which do what this page describes rather than describe it again: the first returns how this site's machine layer is actually built, component by component, and the second queries the corpus behind this page and returns matches with the URL each came from. The page states the practice; the tools are the practice.

01 · Connect
claude mcp add --transport http concylium https://mcp.nabeelkhan.com/api/mcp

Claude Desktop, ChatGPT, Cursor, VS Code and Gemini CLI take the endpoint on its own: https://mcp.nabeelkhan.com/api/mcp. No key, no account, nothing to sign. Setup for every client.

02 · Ask

“Using Concylium, call explain_this_setup and tell me whether this site actually implements what its machine-accessible-ai-expertise page claims.”

A category page that survives being audited by the reader's own assistant is doing something a brochure cannot.

§ 12Ask an assistantLive, no key

Ask your AI assistant instead.

This page is a snapshot, accurate at the release it cites. The same corpus is callable, publicly and without a key, so an assistant can query it live and return an answer carrying the source it came from. For this page that is search_knowledge, which searches the published corpus this framework was drawn from and returns matches with the canonical URL of each, so a definition can be checked against its source instead of recalled.

01 · Connect
claude mcp add --transport http concylium https://mcp.nabeelkhan.com/api/mcp

Claude Desktop, ChatGPT, Cursor, VS Code and Gemini CLI take the endpoint on its own: https://mcp.nabeelkhan.com/api/mcp. No key, no account, nothing to sign. Setup for every client and every tool, in its own words; each call is logged by tool, outcome and duration only, never with what you asked.

02 · Ask

“Using Concylium, search the corpus for this framework and return the definitions with the page each came from.”

A framework quoted from memory drifts. One returned with its source does not.

Fin · Machine-Accessible Expertise
Point your assistant at the endpoint →