A new individual Internet-Draft submitted to IETF's datatracker takes the growing pile of "signed action receipt" formats for AI agents and tries to wire them directly to specific regulatory text, rather than leaving compliance mapping as an exercise for whoever deploys the thing. The draft, draft-marques-asqav-compliance-receipts, defines what it calls a compliance profile of an existing signed-receipt wire format. Rather than inventing new cryptography, it works within the existing signing and canonicalization rules and tightens which fields are mandatory. The document binds receipt fields to two regulatory surfaces: on the EU side, Articles 12 and 26 of the EU AI Act and Article 17 of DORA; on the US side, the NIST AI Risk Management Framework, the Colorado AI Act, the Texas Responsible AI Governance Act, New York's cybersecurity regulation for financial firms, HIPAA's Security Rule, SEC Rule 17a-4, and CIRCIA. Concretely, it takes fields that the base receipt format lists as optional and makes a subset of them required, adds a minimum retention period, and requires every receipt to carry at least one independent timestamp anchor — either RFC 3161 or OpenTimestamps — so a receipt's creation time can't simply be asserted by whoever generated it. It also registers new optional extension fields covering things like risk and incident classification, cross-agent envelope binding, build provenance, and server-side enforcement attestation, each with guards meant to catch false attestation claims. This is one piece of a broader pattern of work this year on making agent actions independently checkable rather than just logged. Related efforts documented in recent arXiv literature include projects like Signet, Pipelock, and the Agent Passport System, each taking different architectural stances on where signing keys live and who counts as an independent witness. A comparison paper on this space frames the core distinction as independent attestation versus self-attestation — whether the entity vouching for an action is the same one that performed it. Two caveats matter here. First, this is an individual Internet-Draft, not a working-group product or a ratified standard — it's a proposal at the earliest stage of IETF's process, and plenty of drafts never advance further. Second, mapping receipt fields to statute doesn't itself establish legal admissibility or regulatory acceptance in any of the eight jurisdictions it references; that's a separate, unresolved question. What the draft does show is a shift in emphasis: the argument for signed receipts is starting to be made in the specific vocabulary of auditors and regulators, not just security engineers.