The Documentary Accountability Gap in AI Governance: Why Sandbox Supervision Fails Across Jurisdictions and What Comes Before Compliance Tooling

AI governance frameworks have been developing across jurisdictions for longer than the current generation of AI systems has existed. Canada's Directive on Automated Decision-Making (2019), the United Kingdom's ICO AI auditing framework (2020), the European Union AI Act (2024), and Singapore's Model AI Governance Framework for Agentic AI (2026) differ substantially in regulatory philosophy, binding force, and operational specificity. They share a structural feature: each specifies what governance outputs must exist — documentation, logs, accountability records, impact assessments — without specifying the documentary mechanism by which authoritative text becomes a stable operational obligation, or by which subsequent action against those obligations is preserved in a defensible, reviewable chain. This paper does not treat the omission as an oversight. Governments cannot specify documentary mechanisms across every industry that uses AI. The omission is a structural result of how regulation works, not a flaw in any particular framework. The gap is therefore filled elsewhere. Courts are filling it on a case-by-case basis. The Amsterdam Court of Appeal in the Uber and Ola robo-firing cases (April 2023) rejected nominal human review as sufficient evidence of meaningful oversight. The Court of Justice of the European Union in SCHUFA Holding (Scoring) (December 2023) rejected the upstream-downstream separation between algorithmic outputs and human sign-off. The CJEU in Dun & Bradstreet (February 2025) rejected categorical opacity as a defense against the right to meaningful explanation. The legal question this trajectory makes inescapable is direct: how do you know the defendant was not fired by AI, and how do you know that you know it? This paper introduces the term Documentary Accountability Substrate (DAS) to describe the under-specified layer that appears across jurisdictions, and presents two open protocols — the Deterministic Document Review Protocol (DDRP) and the Controlled Attribution and Accountability Protocol (CAAP) — as working examples of infrastructure that operates within that layer. Neither protocol claims technical novelty. The argument is that the gap exists, has consequences, and can be addressed.