IBM Files Patent for AI That Designs Computer Systems to Meet Security Rules
Every new IT system has to prove it follows a long list of security rules. IBM filed a patent application for software that reads those rules and drafts the system design itself.
What IBM's security-design software actually does
Every time a company builds a new computer system that handles customer data, a team of experts has to check it against a pile of security rules, then redo the work when the rules change. It is slow, expensive, and easy to get wrong.
IBM's patent application describes software that writes the first draft for you. You feed it what the customer wants plus the standards that apply, such as health privacy or payment-card rules. A machine learning model sorts out which security requirements overlap and produces a shortlist of controls the system needs.
Next, the software checks a library of past designs. If an old design covers enough of the list (the filing gives 75% as an example), it reuses that one. If not, it fills the gaps from a reference guide and writes a new design, which goes back into the library.
… identifying, by the one or more processors, relevant categorical variables in the input data by applying a machine learning algorithm, wherein the machine learning algorithm utilizes the relevant categorical variables to determine common controls in the input data …
Translation: An algorithm scans the rules to find the patterns that matter for security.
How the system matches rules to past designs
The claims cover a method for generating a compliant system design. It starts by ingesting requirements and standards for the system. A machine learning algorithm picks out categorical variables (simple labeled answers, such as "GDPR compliance required" or "single sign-on needed") and uses them to find common controls, meaning security measures that satisfy several requirements at once.
From there, the steps run like this:
- Recommend a base control set, an initial list of security measures, and write solution requirement specifications.
- Compare those against a reference solution pattern repository, a library of previously finished designs.
- If a design matches, build on it. The filing's main example is Zero Trust, a security approach where no user or device is trusted by default.
- If nothing matches, parse a reference blueprint for missing controls, add them, and produce a tailored control set.
Dependent claims name a random forest (a model that combines many decision trees to rank which inputs matter most) to rank features, and statistical tests such as chi-square to trim the list. Another claim fills in missing requirements automatically and checks the result against a threshold.
The final output lists components and specific products, and the new design is saved back into the library for reuse.
Why automated compliance design matters for IBM
If it works as described, a company building a new system could get a draft design that already lines up with rules like HIPAA health privacy or PCI payment-card standards, instead of waiting on a team of analysts and architects. The filing says that manual work is slow and costly, and that different people read the same rules differently. A shared library of past designs also means each finished project makes the next one quicker.
You would likely never see this directly. It matters through how businesses that handle your data get their systems built and checked. The examiner's first review rejected the claims as filed, which is routine at this stage and usually followed by amendments.
IBM's 67th filing we've tracked since May in the AI guardrails race builds on earlier work like one stopping innocent flags and one finding confusing examples.
The problem is large. Security standards are long, they change often, and a gap in a design can sit unnoticed until something goes wrong. The filing itself says that doing the mapping by hand is slow and that people interpret the same requirements differently.
The approach fits that problem well. Reuse what already passed, fill gaps from a reference guide, and save each new design for next time. A library that grows with every project is a sensible way to cut repeat work.
The open question is trust. A match threshold of 75% still leaves a quarter of the controls to cover another way, and the filing leans on human experts to check designs in some examples. Software that drafts while people sign off is the believable version, and the drafting step is where the time savings would come from.
Get our take in your Top Stories
Liked this breakdown? Add Patentlyze as a preferred source on Google, and our plain-English take shows up more often in your Top Stories the next time IBM patent news breaks.
There are more where this came from
We read every patent application Big Tech publishes and send you the ones worth knowing. Plain English, free, every week.
The drawings
6 drawing sheets from US 2026/0330021 A1 · click any drawing to enlarge
Want this weekly breakdown for a company we don't cover? Patentlyze Pro →
Be the first to weigh in