DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-20 are rejected under 35 U.S.C. 101. Claim(s) 1-20 is/are directed to statutory methods, mediums and systems under Step 1 of the eligibility analysis. However, the claims are further directed toward a judicial exception under Step 2A Prong One of the eligibility analysis, namely an abstract idea. Under Step 2A Prong Two of the eligibility analysis, the claim(s) does/do not include additional elements to integrate the exception into a practical application of that exception. Under Step 2B of the eligibility analysis, the claims are not sufficient to amount to significantly more than the judicial exception because nothing in the asserted claims purports to improve the functioning of the computer itself or effect an improvement in any other technology or technical field. The claim(s) is/are directed to the abstract idea of suggesting Sarbanes-Oxley (SOX) compliance controls and outputting one or more results. Creating source code and/or runtime code that complies with regulations such a SOX can be considered to be a mental process. The courts consider a mental process (thinking) that "can be performed in the human mind, or by a human using a pen and paper" to be an abstract idea. CyberSource Corp. v. Retail Decisions, Inc., 654 F.3d 1366, 1372, 99 USPQ2d 1690, 1695 (Fed. Cir. 2011), (see MPEP 2106.04(a)(2) III. MENTAL PROCESSES). In this case a human can write software code using a pen and paper. This is similar to collecting and comparing known information (claim 1), which are steps that can be practically performed in the human mind, Classen Immunotherapies, Inc. v. Biogen IDEC, 659 F.3d 1057, 1067, 100 USPQ2d 1492, 1500 (Fed. Cir. 2011). Claims to "comparing BRCA sequences and determining the existence of alterations," where the claims cover any way of comparing BRCA sequences such that the comparison steps can practically be performed in the human mind, University of Utah Research Foundation v. Ambry Genetics, 774 F.3d 755, 763, 113 USPQ2d 1241, 1246 (Fed. Cir. 2014) (see MPEP 2106.04(a)(2).
MPEP 2106.05(h) Field of Use and Technological Environment
A consideration when determining whether a claim integrates the judicial exception into a practical application in Step 2A Prong Two or recites significantly more than a judicial exception in Step 2B is whether the additional elements amount to more than generally linking the use of a judicial exception to a particular technological environment or field of use. In this case, Using AI to write software for SOX compliance is considered to be generally linking the use of a judicial exception to a particular technological environment (i.e. machine learning algorithms) or field of use (i.e. regulatory compliance).
Similar examples in the MPEP of limitations that the courts have described as merely indicating a field of use or technological environment in which to apply a judicial exception include:
ii. Identifying the participants in a process for hedging risk as commodity providers and commodity consumers, because limiting the use of the process to these participants did no more than describe how the abstract idea of hedging risk could be used in the commodities and energy markets, Bilski, 561 U.S. at 595, 95 USPQ2d at 1010.
viii. Language specifying that the abstract idea of budgeting was to be implemented using a "communication medium" that broadly included the Internet and telephone networks, because this limitation merely limited the use of the exception to a particular technological environment, Intellectual Ventures I v. Capital One Bank, 792 F.3d 1363, 1367, 115 USPQ2d 1636, 1640 (Fed. Cir. 2015).
MPEP 2106.05(f) Mere Instructions To Apply An Exception
Another consideration when determining whether a claim integrates a judicial exception into a practical application in Step 2A Prong Two or recites significantly more than a judicial exception in Step 2B is whether the additional elements amount to more than a recitation of the words "apply it" (or an equivalent) or are more than mere instructions to implement an abstract idea or other exception on a computer. In this case the generative AI is used as a tool to generate regulatory compliance suggestions. This is similar to TLI Communications LLC v. AV Auto, LLC, 823 F.3d 607, 613, 118 USPQ2d 1744, 1748 (Fed. Cir. 2016) (computer server and telephone unit) “the claims invoked the telephone unit and server merely as tools to execute the abstract idea… Thus, the court found that the additional elements did not add significantly more to the abstract idea because they were simply applying the abstract idea on a telephone network without any recitation of details of how to carry out the abstract idea”.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
Claim(s) 1-20 is/are rejected under 35 U.S.C. 102(a)(2) as being anticipated by Prasad Tanniru et al., US 20250037141 A1.
19. A method comprising:
obtaining, by a processing system including a processor, first information that characterizes development of at least one software program, (see Prasad, ¶ 1 “The most prevalent challenges that organizations face are delayed validations of regulations, compliance, and security checks towards the end of a software development life cycle (SDLC).”);
obtaining, by the processing system, second information that identifies one or more Sarbanes-Oxley (SOX) controls that have been applied to the software program, (see Prasad, ¶ 71 “compliance type may refer to different legislative acts that measure the existing security and compliance practices followed against the requirements that may need to be met. For example, compliance type may include, but not limited to, health insurance portability and accountability act (HIPAA), Sarbanes-Oxley Act (SOX), etc.”);
obtaining, by the processing system, third information that characterizes development of a software program under test; inputting the first, second, and third information to a first generative artificial intelligence (AI) process, wherein the first generative AI process outputs one or more suggested SOX controls to be applied to the software program under test;
inputting the one or more suggested SOX controls to a second generative AI process, wherein the second generative AI process outputs a recommended test plan for the software program under test, and wherein the recommended test plan indicates how each of the one or more suggested SOX controls is to be tested for the software program under test, (see Prasad, ¶ 91 “for every control selection, the real-time recommendations may be suggested which may help projects to stay fully compliant and give ready to use controls, which may also be customized. For every new control added to define the various checks/validations, generative AI may be leveraged. This may help in quickly generating the test cases in real-time.”);
applying the recommended test plan to the software program under test, (see Prasad, ¶ 91 “Every customization (i.e., addition of compliance type or control) may be appended in the database 416, as discussed above, which may be added to the training data for subsequent training and model building, thereby improving the self-learning system and results for better recommendations.”); and
outputting one or more results of the applying of the test plan, (see Prasad, ¶ 99-100 “The data from the artifacts may be extracted and reported in analytics 524, which may be a unified view of metrics from all the orchestrators and all the environments.”).
20. The method of claim 19, wherein:
the first information comprises one or more user stories, one or more test plans, one or more test plan results, source code of the software program, runtime code of the software program, or any combination thereof, (see Prasad, ¶ 71 “Dynamic Application Security Testing (DAST), Static Application Security Testing (SAST)”), ¶ 91 “generative AI may be leveraged…generating the test cases in real-time”;
each of the one or more SOX controls of the second information provides for monitoring, detection, remediation, prevention, or any combination thereof, (see Prasad, ¶ 89 “the ML-based compliance advisor 406 may be trained using industry/domain specific compliance requirements like… SOX for finance”);
the third information comprises one or more user stories, one or more test plans, one or more test plan results, source code of the software program under test, runtime code of the software program under test, or any combination thereof, (see Prasad, ¶ 71); and
each of the one or more suggested SOX controls provides for monitoring, detection, remediation, prevention, or any combination thereof, (see Prasad, ¶ 89, 91 “the real-time recommendations may be suggested which may help projects to stay fully compliant and give ready to use controls, which may also be customized”).
5. The device of claim 4, wherein the outputting comprises: outputting one or more real-time alerts, (see Prasad, ¶ 112 “an alert mechanism may be incorporated for immediate action by a developer or user”).
10. The device of claim 1, wherein: each of the corporate governance controls relates to access control, change, control, release control, distribution control, deployment, or any combination thereof; and each of the one or more proposed corporate governance controls relates to access control, change, control, release control, distribution control, deployment, or any combination thereof, (see Prasad, ¶ 137, “the disclosed solution may make compliance types and controls available for every project within an enterprise, thereby bridging compliance gaps and staying updated with new global or enterprise-level regulatory, compliance, and policy amendments”).
12. The device of claim 1, wherein each of the plurality of software applications and the software application under test comprises a respective communications network software application, (see Prasad, FIG. 1 “illustrates an example operating environment or a network architecture in which a system such as a compliance system may be implemented to democratize compliance with customizable and extendable controls”).
13. The device of claim 12, wherein each communications network software application comprises a respective wireless communications network software application, (see Prasad, ¶ 53 “The network may also include, by way of example, but not limited to, one or more of a wireless network”).
14. The device of claim 13, wherein the operating features facilitate operation of a wireless communications network, (see Prasad, ¶ 53).
15. The device of claim 1, wherein: the first generative AI process comprises a machine leaning (ML) process, (see Prasad, ¶ 5 “dynamically generate, via a machine learning engine, a set of remedies for fixing each of the non-complaint controls”).
Claims 1-4, 6-9, 11, 16-18 are substantially similar to the claims rejected above, and therefore these claims are rejected on the same basis and rationale as those above herein by reference.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure: US 20250068743 A1.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to RUSSELL S GLASS whose telephone number is (571)272-7285. The examiner can normally be reached M-F, 9-5.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, FLORIAN ZEENDER can be reached at 571-272-6790. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/RUSSELL S GLASS/Primary Examiner, Art Unit 3627
Prosecution Insights