DETAILED ACTION
This communication is in response to the amendment/remarks filed 05 May 2026.
Claims 1, 7, 12, 13, 17, and 18 have been amended. Claim 3 has been canceled.
Claims 1, 2, and 4-20 are currently pending.
Claims 1, 2, and 4-20 are rejected.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Amendment/Remarks
The objections to the drawings have been remedied by amendment of the drawings and are withdrawn.
Regarding 35 USC § 101, Applicant’s remarks have been fully considered but are not persuasive. Applicant argues that “certain aspects of the rejection evaluate claim features in isolation, rather than assessing the claims as an ordered combination as a whole.” Remarks at 7. While the rejection may be laid out this way for completeness and to show that each limitation was addressed, Examiner did analyze the claims as a whole and as an ordered combination. Applicant’s argument is not persuasive.
Applicant argues that the “claims recite training a base large language model using rule-containing documents – this is inherently a process which can only be performed with computer hardware and cannot be performed in the human mind under any reasonable interpretation.” Remarks at 7. As indicated in the rejection below (and the previous rejection in the Non-Final Office Action), the training step falls into the Mathematical Concepts grouping of abstract ideas and there is no determination of whether a human could or could not perform this step. As indicated, this step is similar to Example 47, Claim 2, step (c) which involves the training of an artificial neural network and was found to fall into the Mathematical Concepts grouping of abstract ideas. Applicant’s argument is not persuasive.
Applicant argues that the “specification describes a specific technical problem, namely that existing compliance monitoring systems are rule-based systems in which compliance requirements are set at the time of initial startup and are unable to adapt when documentation or controls change. The claimed subject matter solves this problem by training an LLM to convert unstructured rule-containing documents into tree structures, generate controls, and produce weighted mappings, which results in a processing pipeline which overcomes the problems associated with legacy systems.” Remarks at 7. Examiner finds a description of the problem at ¶ 0070 of the specification. However, that description does not indicate that the problem is technical in nature. Rather, it is one of using old rules where new rules may apply. This would have been a problem when paper systems were utilized as well. Compliance based on applicable rules, wherein those rules can change over time, is not inherently technical. Applicant’s argument is not persuasive.
Applicant argues that “the claims recite training a specific type of AI model …. this is not a generic computer implementation described at a high level of generality.” Remarks at 7. Regarding any hardware, that hardware is described at a high level of generality. For example, the processor is described in the specification at ¶ 0033 as any number of off-the-shelf processors. Regarding the training of the AI model, the claims recite “training a base large language model (LLM) based on one or more rule-containing documents, said one or more rule-containing documents comprising a set of compliance requirements, wherein said rule-containing documents comprise unstructured text.” There is no description of the training beyond this. There is no description of the AI model beyond what is input and what is output. Thus, the AI model is a “black box.” Without more, there can be no finding that the AI model provides a practical application or significantly more than the abstract idea. Applicant’s argument is not persuasive.
Regarding 35 USC § 103, Applicant’s remarks have been fully considered. An additional search has been performed for the added limitations. Examiner finds that the claims are not found in either a single reference nor an obvious combination of references. The rejections are withdrawn. The closest prior art remains Kurian, Singh, and Adebayo, all previously cited.
Claim Objections
Claims 4-6 are objected to because of the following informalities: these claims depend on a canceled claim, claim 3. Appropriate correction is required.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1, 2, and 4-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to a judicial exception (i.e., a law of nature, a natural phenomenon, or an abstract idea) without significantly more.
Step 1
Claims 1, 2, and 4-11 recite a method which is considered a process. Claims 12-16 recite a system which is considered a machine or manufacture. Claims 17-20 recite a non-transitory computer-readable storage medium which is considered a machine or manufacture. Thus, all claims fall into at least one statutory category of invention.
Step 2A-Prong One
(Claims 1, 12, and 17) The “training a base large language model (LLM) based on one or more rule-containing documents, said one or more rule-containing documents comprising a set of compliance requirements, wherein said rule-containing documents comprise unstructured text” step encompasses mathematical concepts. This step is similar to Example 47, Claim 2, step (c) which involves the training of an artificial neural network. These claims fall into the mathematical concepts grouping of abstract ideas. Thus, these claims recite an abstract idea.
(Claims 1, 12, and 17) The “generating, by the base LLM, one or more tree objects representing one or more of said rule-containing documents” step, as drafted, is a process that under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components. For example, but for the “by the base LLM” language in claim 1 or the “cause the one or more processors to perform … by the base LLM” language in claims 12 and 17, the claims encompass a user manually generating a tree object. This step is not recited at such a high level of complexity that a human could not perform it. These claims fall into the mental processes grouping of abstract ideas. Thus, these claims recite an abstract idea.
(Claims 1, 12, and 17) The “generating a set of controls based on said one or more tree objects representing said one or more rule-containing documents and a set of control prompts” step, as drafted, is a process that under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components. For example, but for the “cause the one or more processors to perform” language in claims 12 and 17, the claims encompass a user manually generating a set of controls based on known information. Claim 1 does not recite any computer components for performing this step, thus its broadest reasonable interpretation also encompasses a user manually performing the step. These claims fall into the mental processes grouping of abstract ideas. Thus, these claims recite an abstract idea.
(Claims 1, 12, and 17) The “generating a mapping between said compliance evidence object and said set of tree objects, wherein said mapping comprises a plurality of weights linking a control with a node in one of said tree objects, said weights representing how much a respective node in said one of said tree objects affects observed compliance” step, as drafted, is a process that under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components. For example, but for the “cause the one or more processors to perform” language in claims 12 and 17, the claims encompass a user manually generating a mapping comprising weights using known information. Claim 1 does not recite any computer components for performing this step, thus its broadest reasonable interpretation also encompasses a user manually performing the step. These claims fall into the mental processes grouping of abstract ideas. Thus, these claims recite an abstract idea.
(Claims 1, 12, and 17) The “determining a compliance score for said application based on said compliance evidence object and said mapping” step, as drafted, is a process that under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components. For example, but for the “cause the one or more processors to perform” language in claims 12 and 17, the claims encompass a user manually determining a score using known information. Claim 1 does not recite any computer components for performing this step, thus its broadest reasonable interpretation also encompasses a user manually performing the step. These claims fall into the mental processes grouping of abstract ideas. Thus, these claims recite an abstract idea.
(Claim 2) This claim further limits the types of documents utilized in the process of claim 1 (see “said rule-containing documents include one or more of regulatory documents, policy documents, public cloud architecture documents, and industry architecture documents). This step does not take the claim out of the above identified abstract idea groupings. For example, a human can still generate a tree object using the documents specified in this claim. Thus, this claim recites an abstract idea.
(Claim 4) This claim further limits that the controls are specific to a cloud environment (see “said set of controls is specific to said cloud operating environment”). This limitation does not take the claim out of the above identified abstract idea groupings. For example, a human can still generate a set of controls wherein the controls are specific to a cloud environment. Thus, this claim recites an abstract idea.
(Claims 5 and 6) These claims further define the environment in which the application operates (see “said cloud operating environment is a public cloud operating environment” in claim 5, and “said cloud operating environment is a private cloud operating environment” in claim 6). These limitations do not take the claims out of the above identified abstract idea groupings. For example, a human can still determine a compliance score for an application in any of the environments specified in these claims. Thus, these claims recite an abstract idea.
(Claim 9) This claim further specifies the sum of the weights (see “wherein the sum of said plurality of weights is equal to 1”). This limitation does not take the claim out of the above identified abstract idea groupings. For example, a human can still generate a mapping and weights wherein the sum of the weights is equal to 1. Thus, this claim recites an abstract idea.
(Claims 10, 15, and 20) These claims recite “adjusting one or more of said weights based on one or more of said rule-containing documents being modified” which is a process that under its broadest reasonable interpretation, covers performance of the limitation in the mind. For example, the claims encompass a user manually adjusting the weights based on given information. Thus, these claims fall into the mental processes grouping of abstract ideas. Thus, these claims recite an abstract idea.
(Claims 11 and 16) These claims recite “determining said compliance score comprises changing said compliance scored based on the weight associated with a specific control” which is a process that under its broadest reasonable interpretation, covers performance of the limitation in the mind. For example, the claims encompass a user manually changing the score based on weights. Thus, these claims fall into the mental processes grouping of abstract ideas. Thus, these claims recite an abstract idea.
Step 2A-Prong Two
This judicial exception is not integrated into a practical application. The claims recite the additional element of a base LLM (found in claims 1, 2, and 4-11), a system comprising one or more processors, a non-transitory computer-readable storage medium, and a base LLM (found in claims 12-16) or a non-transitory computer-readable storage medium and one or more processors and a base LLM (found in claims 17-20) and includes no more than mere instructions to apply the exception using a generic computer component. The system or medium and processors does not integrate the abstract idea into a practical application because it does not impose any meaningful limits on practicing the abstract idea.
Additionally, the steps of “automatically collecting compliance evidence from a software application executing in a cloud computing environment external to said organization,” “receiving, from said software application, a compliance evidence object corresponding to one or more of said controls, said compliance evidence object comprising data relating to said application’s compliance with said one or more of said controls” (found in claims 1, 12, and 17), “automatic collection of compliance evidence is on a continuous basis” (found in claims 7, 13, and 18), and “receiving a stream of events comprising compliance evidence objects” (found in claims 8, 14, and 19) are mere data gathering. These steps are considered insignificant extra-solution activity and do not integrate the abstract idea into a practical application.
Step 2B
The claims do not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed previously with respect to Step 2A-Prong Two, the additional element in the claim amounts to no more than mere instructions to apply the exception using a generic computer component. The same analysis applies here in Step 2B, i.e., mere instructions to apply an exception using a generic computer component cannot integrate a judicial exception into a practical application at Step 2A or provide an inventive concept in Step 2B. See MPEP 2106.05(f). The claims do not provide an inventive concept (significantly more than the abstract idea). The claims are ineligible.
Regarding the step of “automatically collecting compliance evidence from a software application executing in a cloud computing environment external to said organization,” “receiving, from said software application, a compliance evidence object corresponding to one or more of said controls, said compliance evidence object comprising data relating to said application’s compliance with said one or more of said controls” (found in claims 1, 12, and 17), “automatic collection of compliance evidence is on a continuous basis” (found in claims 7, 13, and 18), and “receiving a stream of events comprising compliance evidence objects” (found in claims 8, 14, and 19) the courts have found that “Receiving or transmitting data over a network, e.g., using the Internet to gather data” in considered well-understood, routine, and conventional when claimed in a merely generic manner, as is the case in these claims. Thus, these data gathering steps are considered well-understood, routine, and conventional activity. See MPEP 2106.05(d)(II).
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MEREDITH A LONG whose telephone number is (571)272-3196. The examiner can normally be reached Mon - Fri 9:30 - 6.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Ilana Spar can be reached on 571-270-7537. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/MEREDITH A LONG/Primary Examiner, Art Unit 3622
Prosecution Insights