DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on February 2, 2026 has been entered.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to a
judicial exception without significantly more.
Per step 1 of the eligibility analysis set forth in MPEP § 2106, subsection III, the claims are directed toward a process, machine, or manufacture.
Per step 2A Prong I, independent claim 1 recites specific limitations which fall within at least one of the groupings of abstract ideas enumerated in MPEP 2106.04(a)(2) as follows:
monitoring, at least one network data feed, for new regulatory data that pertains to the regulated computer network;
segmenting, into a first plurality of new regulatory data segments, a first set of new regulatory data that has been obtained from the at least one network data feed;
comparing, with a repository of keywords and keyphrases that pertain to the plurality of computer network controls that govern the regulated computer network, each respective new regulatory data segment from among the first plurality of new regulatory data segments;
based on the comparing, identify, for each respective new regulatory data segment, at least one corresponding relevancy that the respective new regulatory data segment has with respect to at least one corresponding keyword from among the repository of keywords and keyphrases;
categorizing, based on a computer network control categorization similarity threshold and the at least one corresponding relevancy, the first set of new regulatory data;
determining, based on the categorizing, whether the first set of new regulatory data requires a first set of changes to a first set of existing computer network controls from among the plurality of computer network controls;
after determining that the first set of new regulatory data requires the first set of changes, implementing the first set of changes to the first set of existing computer network controls;
determining whether the first set of new regulatory data requires modifying the plurality of computer network controls to include a first set of new computer network controls that pertain to the network, wherein each respective computer network control from among the plurality of computer network controls comprises a respective set of relevant keywords and keyphrases that is associated with the respective computer network control; and
after determining that the first set of new regulatory data requires the modifying, adding the first set of new computer network controls to the plurality of computer network controls and adding the first set of new computer network controls to a network control database that stores the plurality of computer network controls.
As noted above, these limitations fall within at least one of the groupings of abstract ideas enumerated in MPEP 2106.04(a)(2). Specifically, these limitations fall within the group Mental Process, i.e. steps that can be done in the human mind or using pen and paper. Additionally, these limitations fall within the group Certain Methods of Organizing Human Activity (i.e., fundamental economic principles or practices (including hedging, insurance, mitigating risk); commercial or legal interactions (including agreements in the form of contracts; legal obligations; advertising, marketing or sales activities or behaviors; business relations); managing personal behavior or relationships or interactions between people (including social activities, teaching, and following rules or instructions). That is, the limitations describe the business practice of staying up to date on regulatory requirements and implementing business practices in compliance with those regulations. Accordingly, claim 1 recites an abstract idea.
Per step 2A Prong II, the judicial exception is not integrated into a practical application. Claim 1 includes the additional element of a computer network. However, this is merely linking the abstract idea to a field of use for the abstract idea, and does not serve to integrate the abstract idea into a practical application (see MPEP 2106.05(h)). Claim 1 further recites utilizing a first artificial intelligence and machine learning (AI/ML) model. This is recited at a high level of generality and merely amounts to using the word “apply it” with generic computing technology. Further, the step of adding the first set of new computer network controls to a network control database can be considered as an additional element when understood to be storing data in a database. This functionality has been recognized by the courts as insignificant extra-solution activity, see MPEP 2106.05(g). Therefore, the additional elements in claim 1 do not amount to a practical application of the abstract idea.
Per step 2B, the additional elements, when considered both individually and in combination, do not amount to significantly more than the abstract idea. The recitation of a computer network is merely linking the abstract idea to a field of use, and therefore the claim does not include elements sufficient to amount to significantly more than the abstract idea (see MPEP 2106.05(h)). The use of a generic AI/ML model merely amounts to using the word “apply it” with generic computing technology. Finally, the storage of computer network control information in a database has been established as well-understood, routine, and conventional activity per MPEP 2106.05(d). Even in combination, the inclusion of basic computing functionality and a network environment is not enough to amount to significantly more than the abstract idea.
Alice Corp. establishes that the same analysis should be used for all categories of claims (i.e. product and process claims). Therefore, independent system claims 11 and 18 are also rejected as ineligible subject matter under 35 U.S.C. 101 for substantially the same reasons as independent method claim 1. The processor and memory of claim 11 and non-transitory computer-readable medium of claim 18 add nothing of substance to the underlying abstract idea. At best, the components in claims 11 and 18 merely provide an environment to implement the abstract idea. They are generic computer components recited at the apply it level.
Dependent claims 2-10, 12-17, and 19-20, when analyzed as a whole, are held to be patent ineligible under 35 U.S.C. 101 because the additional recited limitations further limit the abstract idea. Dependent claims 4, 10, 14, and 20 recite an AI/ML model, which is recited at a high level of generality.
Therefore, the dependent claims are similarly rejected.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-20 are rejected under 35 U.S.C. 103 as being unpatentable over Stickley et al. (WO 2006/099303) in view of Williams et al. (US 2005/0257267), further in view of Neal et al. (US 2022/0358240).
With reference to claims 1, 11, and 18, Stickley et al. teaches a method for managing a regulated computer network of a plurality of computer network controls to maintain compliance with applicable regulations, the method comprising:
monitoring, at least one network data feed, for new regulatory data that pertains to the regulated computer network (see Figure 1, step 80 and paragraphs 30 and 31 - new regulations used to adapt security policy must be received by the system, and paragraph 3 - regulations having to do with computer network security are the focus of the reference);
categorizing, based on a computer network control categorization similarity threshold, a first set of new regulatory data that has been obtained from the at least one network data feed (see Figure 1, step 80 and paragraph 28 - new regulation, and see paragraph 36 – categorizing regulations);
determining, based on the categorizing, whether the first set of new regulatory data requires a first set of changes to a first set of existing computer network controls from among the plurality of computer network controls (see Figure 1, steps 80 and 20, and paragraph 28 - "The cycle is completed by updating or revising (block 80) the policy data in the policy database when new legislation, regulation or standards dictates a change in policy data." See also paragraph 36 – prompting the user to make a category selection, then generating a report summarizing compliance within the category);
after determining that the first set of new regulatory data requires the first set of changes, implementing the first set of changes to the first set of existing computer network controls (see Figure 1 step 80 and paragraph 28 - adapt security policy due to new regulation);
determining whether the first set of new regulatory data requires modifying the plurality of computer network controls to include a first set of new computer network controls that pertain to the network (see Figure 1, steps 20 and 80 and paragraph 28 - based on new regulations, security policies are developed/adapted); and
after determining that the first set of new regulatory data requires the modifying, adding the first set of new computer network controls to the plurality of computer network controls (see Figure 1, steps 80, 20, 30 and paragraph 28 - adjusting and deploying new policy based on new regulations).
Stickley et al. fails to teach wherein each respective computer network control from among the plurality of computer network controls comprises a respective set of relevant keywords and keyphrases that is associated with the respective computer network control.
Williams et al. teaches wherein each respective computer network control from among the plurality of computer network controls comprises a respective set of relevant keywords and keyphrases that is associated with the respective computer network control (see paragraph 146 - keywords are used to determine semantic equivalence).
It would have been obvious to one of ordinary skill in the art before the effective filing date to modify the computer network control system of Stickley et al. with the keyword usage of Williams et al. as a means to determine if the old and new policy documents are the same or different, by comparing the most important words in the documents to see if they have changed. By combining these known prior art methods, the combination would yield predictable results.
Stickley et al. and Williams et al. fail to teach, but Neal et al. teaches:
segmenting, into a first plurality of new regulatory data segments, a first set of new regulatory data that has been obtained from the at least one network data feed (see paragraph 53 – “tags associated with each requirement within the content catalog” where each tag can represent a segment of the regulatory data, i.e. “applies to employees in Belgium”);
comparing, with a repository of keywords and keyphrases that pertain to the plurality of computer network controls that govern the regulated computer network, each respective new regulatory data segment from among the first plurality of new regulatory data segments (see paragraph 53 – tags of the organization are algorithmically compared with tags of the requirements in the content catalog);
based on the comparing, utilizing a first artificial intelligence and machine learning (AI/ML) model to identify, for each respective new regulatory data segment, at least one corresponding relevancy that the respective new regulatory data segment has with respect to at least one corresponding keyword from among the repository of keywords and keyphrases (see paragraph 58 – using AI/ML to automate and process queries including privacy language from third-party contracts);
categorizing, based on a similarity threshold and the at least one corresponding relevancy, the first set of new regulatory data (see paragraph 80 – using tags to determine requirements, for instance based on location);
adding the first set of new computer network controls to a network control database that stores the plurality of computer network controls (see paragraph 139 – storing data policy framework information in database objects).
It would have been obvious to one of ordinary skill in the art before the effective filing date to combine the data filtering and processing steps of Neal with the regulatory management method of Stickley and Williams, as Neal provides the ability to “accelerate their privacy programs while at the same time preserving value from any existing investments in privacy technology that these orgs have made” (see paragraph 13), thus allowing the network control method of Stickley to more efficiently and effectively track changes in regulation and implement necessary updates.
With reference to claim 2, 12, and 19, Stickley et al., Williams et al., and Neal et al. teach the method of claim 1, and Stickley et al. further teaches wherein each respective computer network control from among the plurality of computer network controls further comprises a respective computer network control categorization that is determined according to a computer network control hierarchy (see paragraph 36 - regulations are categorized).
With reference to claim 3, 13, Stickley et al., Williams et al., and Neal et al. teach the method of claim 2, 12, and Neal et al. further teaches wherein the computer network control hierarchy comprises: a set of domains that each comprise a set of objectives that each comprise a set of procedures (see paragraph 48).
It would have been obvious to one of ordinary skill in the art before the effective filing date that the categories as taught by Stickley et al. could be organized in a hierarchy, as taught by Neal et al. for the purposes of prioritizing and arranging the categories in an easy-to-understand manner. This would constitute a simple substitution of one known element for another.
With reference to claim 4, 14, 20, Stickley et al., Williams et al., and Neal et al. teach the method of claim 2, 12, 19, and Neal et al. teaches further comprising: utilizing an artificial intelligence and machine learning (AI/ML) model to perform at least one from among the monitoring, the identifying, the determining whether the first set of changes is required, and the determining whether the modifying is required, wherein the AI/ML model has been trained with the plurality of computer network controls (see paragraph 39 - "The ADPP140 also utilizes various machine learning (ML) techniques that to provide textual combination (merging) and deduplication." and see paragraph 83 - "using suitable AI/ML models trained on other existing privacy program components and/or other ML features.").
It would have been obvious to one of ordinary skill in the art before the effective filing date to use AI/ML to perform semantic analysis of textual documents as taught by Neal in the method of Stickley and Williams to improve the speed and accuracy of the analysis. By combining these known prior art methods, the combination would yield predictable results.
With reference to claim 5, 15, Stickley et al., Williams et al., and Neal et al. teach the method of claim 4, 14, and Williams further teaches wherein the identifying further comprises:
identifying a first set of relevant regulatory data that comprises at least one from among a relevant keyword and a relevant keyphrase (see paragraph 146 - keywords are used to determine semantic equivalence); and
Stickley et al. further teaches identifying when the first set of relevant regulatory data comprises the first set of new regulatory data, wherein the first set of new regulatory data pertains to a first set of network requirements for which the plurality of computer network controls does not account (see Figure 1, steps 80 and 20, and paragraph 28).
Combined under the same rationale as above.
With reference to claim 6, 16, Stickley et al., Williams et al., and Neal et al. teach the method of claim 5, 15, and Neal et al. further teaches determining, based on the at least one from among the relevant keyword and the relevant keyphrase and at least one corresponding relevant network regulation that corresponds to the at least one from among the relevant keyword and the relevant keyphrase, a corresponding computer network control categorization of the first set of relevant regulatory data (see paragraph 48).
Combined under the same rationale as above.
With reference to claim 7, Stickley et al., Williams et al., and Neal et al. teach the method of claim 6, and Williams et al. further teaches wherein the first set of relevant regulatory data comprises the first set of new regulatory data when a first similarity between the corresponding computer network control categorization and a respective existing computer network control categorization of each existing computer network control among the first set of computer network controls falls below an upper threshold, wherein the computer network control categorization similarity threshold comprises the upper threshold (see paragraph 144 - mapping scores below the threshold are not assumed semantically equivalent).
With reference to claim 8, Stickley et al., Williams et al., and Neal et al. teach the method of claim 6, and Stickley et al. further teaches wherein the first set of changes is determined to be required when a second similarity between the corresponding computer network control categorization and at least one existing computer network control categorization is above a lower threshold, wherein the computer network control categorization similarity threshold comprises the lower threshold (see paragraph 36 - "In one particular embodiment, the answer choices may be limited to indicate whether the enterprise is compliant, partially compliant, noncompliant or not applicable..." The lower threshold of the claim is used to determine whether the enterprise is applicable or not, i.e. the enterprise meets some lower threshold of relevance to need consideration.).
With reference to claim 9, Stickley et al., Williams et al., and Neal et al. teach the method of claim 6, and Stickley et al. further teaches wherein the modifying is determined to be required when a second similarity between the corresponding computer network control categorization and a respective existing computer network control categorization of each existing computer network control among the first set of existing computer network controls falls below a lower threshold, wherein the computer network control categorization similarity threshold comprises the lower threshold (see paragraph 35 - "check new vulnerability and patch info" must see if the information is below a similarity threshold, indicating new information).
With reference to claim 10, Stickley et al., Williams et al., and Neal et al. teach the method of claim 9, and Neal et al. further teaches utilizing the AI/IL model to recommend, based on a fourth similarity between the corresponding computer network control categorization and the respective existing computer network control categorization of each existing computer network control, at least one new computer network control that accounts for the first set of new regulatory data (see paragraph 39 - "The ADPP 140 also utilizes various machine learning (ML) techniques to provide textual combination (merging) and deduplication." and see paragraph 49).
Combined under the same rationale as above.
Response to Arguments
Applicant's arguments filed February 2, 2026 have been fully considered but they are not persuasive. Applicant argues, regarding the 101 rejection, that the claims have been amended to include a process for implementing technology for leveraging artificial intelligence. However, as indicated in the rejection above, the recitation of artificial intelligence in the claims is at the apply it level, and is only suggestive of using generic computing technology to perform its intended functions, rather than any sort of innovation in the technology itself or the use of the technology. Applicant’s comparison to the Desjardins case is not persuasive, because Desjardins disclosed specific reasons why the machine learning training method was an improvement over other training methods. The instant application does not claim or disclose any innovation in the use of machine learning, nor is any improvement in the machine learning claimed or disclosed. As to the ‘tangible result’ applicant has claimed, adding data to a database is the same as storing data in a database, which the courts have recognized as insignificant extra-solution activity and well-understood, routine, and conventional activity. Therefore, the addition of this limitation does not demonstrate a tangible result that would serve to integrate the abstract idea into a practical application or amount to significantly more than the abstract idea. Therefore, the 101 rejection is maintained.
Applicant’s arguments regarding the 103 rejection are moot in view of the new grounds of rejection.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to ILANA L SPAR whose telephone number is (571)270-7537. The examiner can normally be reached 8-4 M-F.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Tariq Hafiz can be reached at 571-272-5350. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/ILANA L SPAR/ Supervisory Patent Examiner, Art Unit 3622
Prosecution Insights