{
  "version": "v0.2.0",
  "updated": "2026-08-06",
  "facts": [
    {
      "id": "role",
      "section": "Your position",
      "label": "What is your relationship to the solution?",
      "multi": true,
      "help": "More than one can be true, and different instruments bind different roles.",
      "options": [
        {
          "id": "provider",
          "label": "We build it, or place it on the market under our name"
        },
        {
          "id": "deployer",
          "label": "We use it under our own authority"
        },
        {
          "id": "manufacturer",
          "label": "We manufacture a product with digital elements"
        },
        {
          "id": "importer",
          "label": "We bring it into the Union from outside"
        },
        {
          "id": "distributor",
          "label": "We make it available without being provider or importer"
        },
        {
          "id": "controller",
          "label": "We decide why and how personal data is processed"
        },
        {
          "id": "processor",
          "label": "We process personal data on someone else's instructions"
        }
      ]
    },
    {
      "id": "euMarket",
      "section": "Your position",
      "label": "Is it placed on the Union market, or used by people in the Union?",
      "boolean": true
    },
    {
      "id": "size",
      "section": "Your position",
      "label": "How large is the organisation?",
      "options": [
        {
          "id": "micro",
          "label": "Fewer than 10 people"
        },
        {
          "id": "small",
          "label": "Fewer than 50 people"
        },
        {
          "id": "medium",
          "label": "Fewer than 250 people"
        },
        {
          "id": "large",
          "label": "250 or more"
        }
      ]
    },
    {
      "id": "nature",
      "section": "What it is",
      "label": "What kind of solution is it?",
      "multi": true,
      "options": [
        {
          "id": "software-service",
          "label": "Software delivered as a service"
        },
        {
          "id": "product-digital-elements",
          "label": "A product with digital elements placed on the market"
        },
        {
          "id": "connected-product",
          "label": "A connected product that generates data in use"
        },
        {
          "id": "ai-system",
          "label": "An AI system"
        },
        {
          "id": "gpai-model",
          "label": "A general-purpose AI model"
        },
        {
          "id": "intermediary",
          "label": "An intermediary or hosting service for third-party content"
        }
      ]
    },
    {
      "id": "lifecycle",
      "section": "What it is",
      "label": "When was it, or when will it be, placed on the market?",
      "options": [
        {
          "id": "already",
          "label": "Already on the market before 2 August 2026"
        },
        {
          "id": "new",
          "label": "From 2 August 2026 onwards"
        }
      ]
    },
    {
      "id": "openSource",
      "section": "What it is",
      "label": "Is it free and open-source software outside a commercial activity?",
      "boolean": true
    },
    {
      "id": "personalData",
      "section": "Data",
      "label": "Does it process personal data?",
      "boolean": true
    },
    {
      "id": "specialCategories",
      "section": "Data",
      "label": "Does it process special categories, such as health, biometrics or beliefs?",
      "boolean": true
    },
    {
      "id": "profiling",
      "section": "Data",
      "label": "Does it profile people, or decide about them automatically?",
      "boolean": true
    },
    {
      "id": "largeScaleMonitoring",
      "section": "Data",
      "label": "Does it monitor people systematically at large scale?",
      "boolean": true
    },
    {
      "id": "transfersOutsideEu",
      "section": "Data",
      "label": "Is personal data transferred outside the Union?",
      "boolean": true
    },
    {
      "id": "aiPurpose",
      "section": "If it uses AI",
      "label": "Does the AI do any of these?",
      "options": [
        {
          "id": "none",
          "label": "None of these"
        },
        {
          "id": "social-scoring",
          "label": "Scores people socially, leading to detrimental treatment"
        },
        {
          "id": "crime-prediction",
          "label": "Predicts offending from profiling or traits alone"
        },
        {
          "id": "face-scraping",
          "label": "Builds facial recognition databases by untargeted scraping"
        },
        {
          "id": "emotion-inference",
          "label": "Infers emotions of people"
        },
        {
          "id": "biometric-categorisation-sensitive",
          "label": "Infers sensitive attributes biometrically"
        },
        {
          "id": "realtime-remote-biometric-id",
          "label": "Identifies people biometrically in real time in public spaces"
        },
        {
          "id": "ncii",
          "label": "Generates intimate imagery of identifiable people without consent"
        },
        {
          "id": "csam",
          "label": "Can generate child sexual abuse material"
        }
      ]
    },
    {
      "id": "aiTechniques",
      "section": "If it uses AI",
      "label": "Does it use manipulative techniques?",
      "multi": true,
      "options": [
        {
          "id": "subliminal",
          "label": "Subliminal, manipulative or deceptive techniques"
        },
        {
          "id": "vulnerability",
          "label": "Exploits vulnerabilities of age, disability or circumstance"
        }
      ]
    },
    {
      "id": "aiUseCase",
      "section": "If it uses AI",
      "label": "What does it decide or support?",
      "options": [
        {
          "id": "none",
          "label": "None of these"
        },
        {
          "id": "biometrics",
          "label": "Biometric identification, categorisation or emotion recognition"
        },
        {
          "id": "critical-infrastructure",
          "label": "Safety of critical infrastructure"
        },
        {
          "id": "education",
          "label": "Access to education, assessment or proctoring"
        },
        {
          "id": "employment",
          "label": "Recruitment, evaluation, allocation, monitoring or termination"
        },
        {
          "id": "essential-services",
          "label": "Essential services, creditworthiness, insurance pricing or triage"
        },
        {
          "id": "law-enforcement",
          "label": "Law enforcement"
        },
        {
          "id": "migration",
          "label": "Migration, asylum or border control"
        },
        {
          "id": "justice-democracy",
          "label": "Justice or democratic processes"
        }
      ]
    },
    {
      "id": "aiDerogation",
      "section": "If it uses AI",
      "label": "If it falls in one of those areas, which is true?",
      "multi": true,
      "help": "Article 6(3) of the AI Act. It never applies where the system profiles people.",
      "options": [
        {
          "id": "narrow-procedural",
          "label": "A narrow procedural task only"
        },
        {
          "id": "improves-prior-human",
          "label": "Improves a completed human activity"
        },
        {
          "id": "detects-patterns-no-replace",
          "label": "Detects patterns without replacing human assessment"
        },
        {
          "id": "preparatory",
          "label": "A preparatory task"
        }
      ]
    },
    {
      "id": "annexOneProduct",
      "section": "If it uses AI",
      "label": "Is it a safety component of a regulated product needing third-party assessment?",
      "boolean": true
    },
    {
      "id": "gpaiSystemicRisk",
      "section": "If it uses AI",
      "label": "Does the model exceed the systemic-risk compute threshold?",
      "boolean": true
    },
    {
      "id": "interactsWithPeople",
      "section": "Behaviour",
      "label": "Does it interact directly with people?",
      "boolean": true
    },
    {
      "id": "generatesSyntheticContent",
      "section": "Behaviour",
      "label": "Does it generate synthetic audio, image, video or text?",
      "boolean": true
    },
    {
      "id": "emotionOrBiometricCategorisation",
      "section": "Behaviour",
      "label": "Does it recognise emotions or categorise people biometrically?",
      "boolean": true
    },
    {
      "id": "publishesDeepFakesOrPublicInterestText",
      "section": "Behaviour",
      "label": "Do you publish deep fakes, or AI text informing the public on matters of public interest?",
      "boolean": true
    },
    {
      "id": "sector",
      "section": "Sector",
      "label": "Which sector does it serve?",
      "options": [
        {
          "id": "general",
          "label": "General commercial"
        },
        {
          "id": "finance",
          "label": "Financial services"
        },
        {
          "id": "health",
          "label": "Health"
        },
        {
          "id": "energy",
          "label": "Energy or utilities"
        },
        {
          "id": "transport",
          "label": "Transport"
        },
        {
          "id": "digital-infrastructure",
          "label": "Digital infrastructure, cloud or managed services"
        },
        {
          "id": "public",
          "label": "Public body"
        },
        {
          "id": "education",
          "label": "Education"
        }
      ]
    },
    {
      "id": "essentialEntity",
      "section": "Sector",
      "label": "Is the organisation an essential or important entity under national cybersecurity law?",
      "boolean": true
    }
  ],
  "packs": [
    {
      "id": "ai-act",
      "title": "Artificial Intelligence Act",
      "instrument": "Regulation (EU) 2024/1689",
      "amendedBy": [
        {
          "id": "omnibus-ai",
          "title": "Regulation (EU) 2026/1744 (Digital Omnibus on AI)",
          "inForce": "2026-07-27"
        }
      ],
      "source": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj",
      "version": "v0.2.0",
      "reads": [
        "role",
        "euMarket",
        "nature",
        "lifecycle",
        "aiPurpose",
        "aiTechniques",
        "aiUseCase",
        "aiDerogation",
        "profiling",
        "annexOneProduct",
        "gpaiSystemicRisk",
        "interactsWithPeople",
        "generatesSyntheticContent",
        "emotionOrBiometricCategorisation",
        "publishesDeepFakesOrPublicInterestText"
      ],
      "gate": "(f) => f.euMarket === true && (f.nature || []).some((n) => [\"ai-system\", \"gpai-model\"].includes(n))",
      "rules": [
        {
          "id": "aia-p-social-scoring",
          "check": {
            "level": "none",
            "on": "2026-08-06",
            "source": "Encoded from working knowledge. Not yet checked against the official text."
          },
          "severity": "prohibited",
          "title": "Social scoring leading to detrimental treatment",
          "provision": "Article 5(1)(c)",
          "since": "2025-02-02",
          "when": "(f) => f.aiPurpose === \"social-scoring\""
        },
        {
          "id": "aia-p-crime-prediction",
          "check": {
            "level": "none",
            "on": "2026-08-06",
            "source": "Encoded from working knowledge. Not yet checked against the official text."
          },
          "severity": "prohibited",
          "title": "Predicting offending from profiling or traits alone",
          "provision": "Article 5(1)(d)",
          "since": "2025-02-02",
          "when": "(f) => f.aiPurpose === \"crime-prediction\""
        },
        {
          "id": "aia-p-face-scraping",
          "check": {
            "level": "none",
            "on": "2026-08-06",
            "source": "Encoded from working knowledge. Not yet checked against the official text."
          },
          "severity": "prohibited",
          "title": "Untargeted scraping of facial images",
          "provision": "Article 5(1)(e)",
          "since": "2025-02-02",
          "when": "(f) => f.aiPurpose === \"face-scraping\""
        },
        {
          "id": "aia-p-emotion",
          "check": {
            "level": "none",
            "on": "2026-08-06",
            "source": "Encoded from working knowledge. Not yet checked against the official text."
          },
          "severity": "prohibited",
          "title": "Emotion inference in the workplace or education",
          "provision": "Article 5(1)(f)",
          "since": "2025-02-02",
          "when": "(f) => f.aiPurpose === \"emotion-inference\" && [\"employment\", \"education\"].includes(f.aiUseCase)"
        },
        {
          "id": "aia-p-biocat",
          "check": {
            "level": "none",
            "on": "2026-08-06",
            "source": "Encoded from working knowledge. Not yet checked against the official text."
          },
          "severity": "prohibited",
          "title": "Biometric categorisation inferring sensitive attributes",
          "provision": "Article 5(1)(g)",
          "since": "2025-02-02",
          "when": "(f) => f.aiPurpose === \"biometric-categorisation-sensitive\""
        },
        {
          "id": "aia-p-rbi",
          "check": {
            "level": "none",
            "on": "2026-08-06",
            "source": "Encoded from working knowledge. Not yet checked against the official text."
          },
          "severity": "prohibited",
          "title": "Real-time remote biometric identification in public spaces for law enforcement",
          "provision": "Article 5(1)(h)",
          "since": "2025-02-02",
          "when": "(f) => f.aiPurpose === \"realtime-remote-biometric-id\" && f.aiUseCase === \"law-enforcement\""
        },
        {
          "id": "aia-p-subliminal",
          "check": {
            "level": "none",
            "on": "2026-08-06",
            "source": "Encoded from working knowledge. Not yet checked against the official text."
          },
          "severity": "prohibited",
          "title": "Subliminal or manipulative techniques distorting behaviour",
          "provision": "Article 5(1)(a)",
          "since": "2025-02-02",
          "when": "(f) => (f.aiTechniques || []).includes(\"subliminal\")"
        },
        {
          "id": "aia-p-vulnerability",
          "check": {
            "level": "none",
            "on": "2026-08-06",
            "source": "Encoded from working knowledge. Not yet checked against the official text."
          },
          "severity": "prohibited",
          "title": "Exploiting vulnerabilities of age, disability or circumstance",
          "provision": "Article 5(1)(b)",
          "since": "2025-02-02",
          "when": "(f) => (f.aiTechniques || []).includes(\"vulnerability\")"
        },
        {
          "id": "aia-p-ncii",
          "check": {
            "level": "secondary",
            "on": "2026-08-06",
            "source": "Regulation (EU) 2026/1744 as reported by multiple firms; awaiting an EUR-Lex read"
          },
          "severity": "prohibited",
          "title": "Generating non-consensual intimate imagery of identifiable people",
          "provision": "Article 5, as amended",
          "since": "2026-12-02",
          "addedBy": "omnibus-ai",
          "when": "(f) => f.aiPurpose === \"ncii\""
        },
        {
          "id": "aia-p-csam",
          "check": {
            "level": "secondary",
            "on": "2026-08-06",
            "source": "Regulation (EU) 2026/1744 as reported by multiple firms; awaiting an EUR-Lex read"
          },
          "severity": "prohibited",
          "title": "Generating child sexual abuse material, or lacking safeguards against it",
          "provision": "Article 5, as amended",
          "since": "2026-12-02",
          "addedBy": "omnibus-ai",
          "when": "(f) => f.aiPurpose === \"csam\""
        },
        {
          "id": "aia-hr-annexiii",
          "check": {
            "level": "secondary",
            "on": "2026-08-06",
            "source": "Deferral to 2027-12-02 confirmed across Commission reporting and four law firms"
          },
          "severity": "high-risk",
          "title": "High-risk: falls within an Annex III area",
          "provision": "Article 6(2) and Annex III",
          "since": "2027-12-02",
          "deferredBy": "omnibus-ai",
          "when": "(f) => f.aiUseCase && f.aiUseCase !== \"none\" && !((f.aiDerogation || []).length && f.profiling !== true)",
          "note": "Deferred from 2 August 2026 by Regulation (EU) 2026/1744. Preparation is expected to be under way rather than starting then."
        },
        {
          "id": "aia-hr-derogation",
          "check": {
            "level": "none",
            "on": "2026-08-06",
            "source": "Encoded from working knowledge. Not yet checked against the official text."
          },
          "severity": "note",
          "title": "Annex III area, with the Article 6(3) derogation claimed",
          "provision": "Article 6(3)",
          "since": "2027-12-02",
          "when": "(f) => f.aiUseCase && f.aiUseCase !== \"none\" && (f.aiDerogation || []).length > 0 && f.profiling !== true",
          "note": "Relying on the derogation requires a documented assessment before placing on the market, and registration in the EU database. It never applies where the system profiles people."
        },
        {
          "id": "aia-hr-profiling",
          "check": {
            "level": "none",
            "on": "2026-08-06",
            "source": "Encoded from working knowledge. Not yet checked against the official text."
          },
          "severity": "high-risk",
          "title": "The derogation is unavailable because the system profiles people",
          "provision": "Article 6(3), final subparagraph",
          "since": "2027-12-02",
          "when": "(f) => f.aiUseCase && f.aiUseCase !== \"none\" && (f.aiDerogation || []).length > 0 && f.profiling === true"
        },
        {
          "id": "aia-hr-annexi",
          "check": {
            "level": "secondary",
            "on": "2026-08-06",
            "source": "Deferral to 2028-08-02 confirmed across the same sources"
          },
          "severity": "high-risk",
          "title": "High-risk as a regulated product or its safety component",
          "provision": "Article 6(1) and Annex I",
          "since": "2028-08-02",
          "deferredBy": "omnibus-ai",
          "when": "(f) => f.annexOneProduct === true",
          "note": "Sits alongside the existing product legislation rather than replacing it."
        },
        {
          "id": "aia-t-interaction",
          "check": {
            "level": "none",
            "on": "2026-08-06",
            "source": "Encoded from working knowledge. Not yet checked against the official text."
          },
          "severity": "obligation",
          "title": "Tell people they are interacting with an AI system",
          "provision": "Article 50(1)",
          "since": "2026-08-02",
          "when": "(f) => f.interactsWithPeople === true && (f.role || []).some((r) => [\"provider\", \"importer\"].includes(r))"
        },
        {
          "id": "aia-t-marking",
          "check": {
            "level": "secondary",
            "on": "2026-08-06",
            "source": "Deferral to 2026-12-02 for systems already on the market, confirmed across the same sources"
          },
          "severity": "obligation",
          "title": "Mark synthetic content in a machine-readable way",
          "provision": "Article 50(2)",
          "since": "2026-08-02",
          "sinceIfAlreadyOnMarket": "2026-12-02",
          "deferredBy": "omnibus-ai",
          "when": "(f) => f.generatesSyntheticContent === true && (f.role || []).includes(\"provider\")"
        },
        {
          "id": "aia-t-emotion-notice",
          "check": {
            "level": "none",
            "on": "2026-08-06",
            "source": "Encoded from working knowledge. Not yet checked against the official text."
          },
          "severity": "obligation",
          "title": "Inform people exposed to emotion recognition or biometric categorisation",
          "provision": "Article 50(3)",
          "since": "2026-08-02",
          "when": "(f) => f.emotionOrBiometricCategorisation === true && (f.role || []).includes(\"deployer\")"
        },
        {
          "id": "aia-t-deepfake",
          "check": {
            "level": "none",
            "on": "2026-08-06",
            "source": "Encoded from working knowledge. Not yet checked against the official text."
          },
          "severity": "obligation",
          "title": "Disclose deep fakes and AI-generated text on matters of public interest",
          "provision": "Article 50(4)",
          "since": "2026-08-02",
          "when": "(f) => f.publishesDeepFakesOrPublicInterestText === true && (f.role || []).includes(\"deployer\")"
        },
        {
          "id": "aia-g-docs",
          "check": {
            "level": "none",
            "on": "2026-08-06",
            "source": "Encoded from working knowledge. Not yet checked against the official text."
          },
          "severity": "obligation",
          "title": "General-purpose model documentation, downstream information, copyright policy and training-content summary",
          "provision": "Article 53",
          "since": "2025-08-02",
          "when": "(f) => (f.nature || []).includes(\"gpai-model\") && (f.role || []).includes(\"provider\")"
        },
        {
          "id": "aia-g-systemic",
          "check": {
            "level": "none",
            "on": "2026-08-06",
            "source": "Encoded from working knowledge. Not yet checked against the official text."
          },
          "severity": "obligation",
          "title": "Systemic-risk evaluation, adversarial testing, incident reporting and cybersecurity",
          "provision": "Articles 51 and 55",
          "since": "2025-08-02",
          "when": "(f) => (f.nature || []).includes(\"gpai-model\") && (f.role || []).includes(\"provider\") && f.gpaiSystemicRisk === true"
        },
        {
          "id": "aia-literacy",
          "check": {
            "level": "none",
            "on": "2026-08-06",
            "source": "Encoded from working knowledge. Not yet checked against the official text."
          },
          "severity": "obligation",
          "title": "AI literacy: ensure staff dealing with the system are sufficiently competent",
          "provision": "Article 4",
          "since": "2025-02-02",
          "when": "(f) => (f.nature || []).includes(\"ai-system\")"
        }
      ],
      "obligationsIfHighRisk": {
        "provider": [
          {
            "id": "aia-o-rms",
            "title": "Risk management system across the lifecycle",
            "provision": "Article 9"
          },
          {
            "id": "aia-o-data",
            "title": "Data and data governance",
            "provision": "Article 10"
          },
          {
            "id": "aia-o-techdoc",
            "title": "Technical documentation",
            "provision": "Article 11 and Annex IV"
          },
          {
            "id": "aia-o-logging",
            "title": "Automatic event logging",
            "provision": "Article 12"
          },
          {
            "id": "aia-o-instructions",
            "title": "Instructions enabling deployers to comply",
            "provision": "Article 13"
          },
          {
            "id": "aia-o-oversight",
            "title": "Design for human oversight",
            "provision": "Article 14"
          },
          {
            "id": "aia-o-accuracy",
            "title": "Accuracy, robustness and cybersecurity",
            "provision": "Article 15"
          },
          {
            "id": "aia-o-qms",
            "title": "Quality management system",
            "provision": "Article 17"
          },
          {
            "id": "aia-o-conformity",
            "title": "Conformity assessment, declaration and CE marking",
            "provision": "Articles 43, 47 and 48"
          },
          {
            "id": "aia-o-registration",
            "title": "Registration in the EU database",
            "provision": "Article 49"
          },
          {
            "id": "aia-o-postmarket",
            "title": "Post-market monitoring and serious incident reporting",
            "provision": "Articles 72 and 73"
          }
        ],
        "deployer": [
          {
            "id": "aia-d-instructions",
            "title": "Use in accordance with the instructions",
            "provision": "Article 26(1)"
          },
          {
            "id": "aia-d-oversight",
            "title": "Competent, trained human oversight",
            "provision": "Article 26(2)"
          },
          {
            "id": "aia-d-input",
            "title": "Relevant and representative input data",
            "provision": "Article 26(4)"
          },
          {
            "id": "aia-d-monitor",
            "title": "Monitoring and serious incident reporting",
            "provision": "Article 26(5)"
          },
          {
            "id": "aia-d-logs",
            "title": "Keep the logs the system generates",
            "provision": "Article 26(6)"
          },
          {
            "id": "aia-d-workers",
            "title": "Inform workers and their representatives",
            "provision": "Article 26(7)"
          },
          {
            "id": "aia-d-fria",
            "title": "Fundamental rights impact assessment where applicable",
            "provision": "Article 27"
          },
          {
            "id": "aia-d-subjects",
            "title": "Inform people subject to decisions",
            "provision": "Article 26(11)"
          }
        ]
      },
      "timeline": [
        {
          "date": "2024-08-01",
          "label": "Enters into force",
          "provision": "Article 113"
        },
        {
          "date": "2025-02-02",
          "label": "Prohibitions and AI literacy apply",
          "provision": "Articles 4 and 5"
        },
        {
          "date": "2025-08-02",
          "label": "General-purpose model obligations, governance and penalties apply",
          "provision": "Chapter V"
        },
        {
          "date": "2026-08-02",
          "label": "Transparency obligations apply and enforcement begins",
          "provision": "Article 50"
        },
        {
          "date": "2026-12-02",
          "label": "Marking applies to systems already on the market; new prohibitions apply",
          "provision": "Articles 50(2) and 5",
          "changedBy": "omnibus-ai"
        },
        {
          "date": "2027-12-02",
          "label": "High-risk obligations apply to Annex III systems",
          "provision": "Chapter III",
          "changedBy": "omnibus-ai"
        },
        {
          "date": "2028-08-02",
          "label": "High-risk obligations apply to Annex I systems",
          "provision": "Chapter III",
          "changedBy": "omnibus-ai"
        }
      ],
      "watch": []
    },
    {
      "id": "cra",
      "title": "Cyber Resilience Act",
      "instrument": "Regulation (EU) 2024/2847",
      "source": "https://eur-lex.europa.eu/eli/reg/2024/2847/oj",
      "version": "v0.2.0",
      "reads": [
        "role",
        "euMarket",
        "nature",
        "openSource"
      ],
      "gate": "(f) => f.euMarket === true && (f.nature || []).includes(\"product-digital-elements\")",
      "rules": [
        {
          "id": "cra-reporting",
          "check": {
            "level": "official-summary",
            "on": "2026-08-06",
            "source": "https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act"
          },
          "severity": "obligation",
          "title": "Report actively exploited vulnerabilities and severe incidents to ENISA and the CSIRT",
          "provision": "Article 14",
          "since": "2026-09-11",
          "when": "(f) => (f.role || []).includes(\"manufacturer\")",
          "note": "The first CRA duty to bind, ahead of the main requirements."
        },
        {
          "id": "cra-essential",
          "check": {
            "level": "official-summary",
            "on": "2026-08-06",
            "source": "https://digital-strategy.ec.europa.eu/en/policies/cra-summary"
          },
          "severity": "obligation",
          "title": "Essential cybersecurity requirements in design, development and production",
          "provision": "Article 13 and Annex I",
          "since": "2027-12-11",
          "when": "(f) => (f.role || []).includes(\"manufacturer\")"
        },
        {
          "id": "cra-vuln-handling",
          "check": {
            "level": "official-summary",
            "on": "2026-08-06",
            "source": "https://digital-strategy.ec.europa.eu/en/policies/cra-summary"
          },
          "severity": "obligation",
          "title": "Vulnerability handling, including a coordinated disclosure policy and security updates",
          "provision": "Annex I Part II",
          "since": "2027-12-11",
          "when": "(f) => (f.role || []).includes(\"manufacturer\")"
        },
        {
          "id": "cra-sbom",
          "check": {
            "level": "official-summary",
            "on": "2026-08-06",
            "source": "https://digital-strategy.ec.europa.eu/en/policies/cra-summary"
          },
          "severity": "obligation",
          "title": "Software bill of materials covering top-level dependencies",
          "provision": "Annex I Part II(1)",
          "since": "2027-12-11",
          "when": "(f) => (f.role || []).includes(\"manufacturer\")"
        },
        {
          "id": "cra-conformity",
          "check": {
            "level": "official-summary",
            "on": "2026-08-06",
            "source": "https://digital-strategy.ec.europa.eu/en/policies/cra-summary"
          },
          "severity": "obligation",
          "title": "Conformity assessment, EU declaration of conformity and CE marking",
          "provision": "Articles 32, 28 and 30",
          "since": "2027-12-11",
          "when": "(f) => (f.role || []).includes(\"manufacturer\")"
        },
        {
          "id": "cra-support",
          "check": {
            "level": "secondary",
            "on": "2026-08-06",
            "source": "Commission summary describes the support period; the five-year default needs an Article 13(8) read"
          },
          "severity": "obligation",
          "title": "Define and publish the support period, at least five years unless the expected use is shorter",
          "provision": "Article 13(8)",
          "since": "2027-12-11",
          "when": "(f) => (f.role || []).includes(\"manufacturer\")"
        },
        {
          "id": "cra-importer",
          "check": {
            "level": "secondary",
            "on": "2026-08-06",
            "source": "Article number encoded from working knowledge; awaiting an official read"
          },
          "severity": "obligation",
          "title": "Verify the manufacturer's conformity assessment and marking before placing on the market",
          "provision": "Article 19",
          "since": "2027-12-11",
          "when": "(f) => (f.role || []).includes(\"importer\")"
        },
        {
          "id": "cra-distributor",
          "check": {
            "level": "secondary",
            "on": "2026-08-06",
            "source": "Article number encoded from working knowledge; awaiting an official read"
          },
          "severity": "obligation",
          "title": "Act with due care in relation to the requirements when making a product available",
          "provision": "Article 20",
          "since": "2027-12-11",
          "when": "(f) => (f.role || []).includes(\"distributor\")"
        },
        {
          "id": "cra-oss",
          "check": {
            "level": "official-summary",
            "on": "2026-08-06",
            "source": "https://digital-strategy.ec.europa.eu/en/policies/cra-summary"
          },
          "severity": "note",
          "title": "Open-source software outside a commercial activity is treated differently",
          "provision": "Article 2 and Recitals",
          "since": "2027-12-11",
          "when": "(f) => f.openSource === true",
          "note": "Stewards of open-source software carry lighter duties than manufacturers. The boundary turns on commercial activity, and it is the fact most often assumed rather than checked."
        }
      ],
      "timeline": [
        {
          "date": "2024-12-10",
          "label": "Enters into force",
          "provision": "Article 71"
        },
        {
          "date": "2026-09-11",
          "label": "Reporting obligations for actively exploited vulnerabilities apply",
          "provision": "Article 14"
        },
        {
          "date": "2027-12-11",
          "label": "The remaining obligations apply",
          "provision": "Article 71(2)"
        }
      ],
      "watch": []
    },
    {
      "id": "gdpr",
      "title": "General Data Protection Regulation",
      "instrument": "Regulation (EU) 2016/679",
      "source": "https://eur-lex.europa.eu/eli/reg/2016/679/oj",
      "version": "v0.2.0",
      "reads": [
        "role",
        "euMarket",
        "personalData",
        "specialCategories",
        "profiling",
        "largeScaleMonitoring",
        "transfersOutsideEu",
        "size",
        "sector"
      ],
      "gate": "(f) => f.personalData === true",
      "rules": [
        {
          "id": "gdpr-lawful-basis",
          "check": {
            "level": "none",
            "on": "2026-08-06",
            "source": "Encoded from working knowledge. Not yet checked against the official text."
          },
          "severity": "obligation",
          "title": "Identify and record a lawful basis for each purpose",
          "provision": "Article 6",
          "since": "2018-05-25",
          "when": "() => true"
        },
        {
          "id": "gdpr-special",
          "check": {
            "level": "none",
            "on": "2026-08-06",
            "source": "Encoded from working knowledge. Not yet checked against the official text."
          },
          "severity": "obligation",
          "title": "Establish an Article 9 condition before processing special categories",
          "provision": "Article 9",
          "since": "2018-05-25",
          "when": "(f) => f.specialCategories === true"
        },
        {
          "id": "gdpr-transparency",
          "check": {
            "level": "none",
            "on": "2026-08-06",
            "source": "Encoded from working knowledge. Not yet checked against the official text."
          },
          "severity": "obligation",
          "title": "Inform people at collection, in clear and accessible terms",
          "provision": "Articles 13 and 14",
          "since": "2018-05-25",
          "when": "() => true"
        },
        {
          "id": "gdpr-ropa",
          "check": {
            "level": "none",
            "on": "2026-08-06",
            "source": "Encoded from working knowledge. Not yet checked against the official text."
          },
          "severity": "obligation",
          "title": "Maintain a record of processing activities",
          "provision": "Article 30",
          "since": "2018-05-25",
          "when": "(f) => f.size === \"large\" || f.specialCategories === true || f.largeScaleMonitoring === true",
          "note": "The exemption for organisations under 250 people falls away where processing is not occasional, is likely to result in risk, or involves special categories."
        },
        {
          "id": "gdpr-dpia",
          "check": {
            "level": "none",
            "on": "2026-08-06",
            "source": "Encoded from working knowledge. Not yet checked against the official text."
          },
          "severity": "obligation",
          "title": "Carry out a data protection impact assessment before starting",
          "provision": "Article 35",
          "since": "2018-05-25",
          "when": "(f) => f.largeScaleMonitoring === true || (f.profiling === true && f.specialCategories === true) || (f.profiling === true && f.sector === \"finance\")"
        },
        {
          "id": "gdpr-automated",
          "check": {
            "level": "none",
            "on": "2026-08-06",
            "source": "Encoded from working knowledge. Not yet checked against the official text."
          },
          "severity": "obligation",
          "title": "Automated decisions with legal or similarly significant effects need a basis, safeguards and human intervention",
          "provision": "Article 22",
          "since": "2018-05-25",
          "when": "(f) => f.profiling === true"
        },
        {
          "id": "gdpr-processor",
          "check": {
            "level": "none",
            "on": "2026-08-06",
            "source": "Encoded from working knowledge. Not yet checked against the official text."
          },
          "severity": "obligation",
          "title": "A written processing agreement with every processor",
          "provision": "Article 28",
          "since": "2018-05-25",
          "when": "(f) => (f.role || []).includes(\"controller\")"
        },
        {
          "id": "gdpr-security",
          "check": {
            "level": "none",
            "on": "2026-08-06",
            "source": "Encoded from working knowledge. Not yet checked against the official text."
          },
          "severity": "obligation",
          "title": "Security appropriate to the risk, and the ability to demonstrate it",
          "provision": "Article 32",
          "since": "2018-05-25",
          "when": "() => true"
        },
        {
          "id": "gdpr-breach",
          "check": {
            "level": "none",
            "on": "2026-08-06",
            "source": "Encoded from working knowledge. Not yet checked against the official text."
          },
          "severity": "obligation",
          "title": "Notify a personal data breach to the authority within 72 hours where it is likely to result in risk",
          "provision": "Articles 33 and 34",
          "since": "2018-05-25",
          "when": "() => true"
        },
        {
          "id": "gdpr-transfers",
          "check": {
            "level": "none",
            "on": "2026-08-06",
            "source": "Encoded from working knowledge. Not yet checked against the official text."
          },
          "severity": "obligation",
          "title": "A transfer mechanism, and a transfer impact assessment where required",
          "provision": "Chapter V",
          "since": "2018-05-25",
          "when": "(f) => f.transfersOutsideEu === true"
        },
        {
          "id": "gdpr-dpo",
          "check": {
            "level": "none",
            "on": "2026-08-06",
            "source": "Encoded from working knowledge. Not yet checked against the official text."
          },
          "severity": "obligation",
          "title": "Designate a data protection officer",
          "provision": "Article 37",
          "since": "2018-05-25",
          "when": "(f) => f.sector === \"public\" || f.largeScaleMonitoring === true || (f.specialCategories === true && f.size === \"large\")"
        }
      ],
      "timeline": [
        {
          "date": "2018-05-25",
          "label": "Applies",
          "provision": "Article 99"
        }
      ],
      "watch": [
        {
          "id": "gdpr-omnibus",
          "title": "The Data Omnibus would amend the GDPR, ePrivacy, NIS2, DORA and the Data Act",
          "status": "proposed",
          "proposedOn": "2025-11-19",
          "note": "Still in negotiation as of August 2026 and not law. Reported changes include single-click consent, a moratorium on re-prompting, a longer breach notification window and a single incident reporting point. Plan against the obligations that are in force today."
        }
      ]
    },
    {
      "id": "nis2",
      "title": "NIS2 Directive",
      "instrument": "Directive (EU) 2022/2555",
      "source": "https://eur-lex.europa.eu/eli/dir/2022/2555/oj",
      "version": "v0.2.0",
      "isDirective": true,
      "reads": [
        "euMarket",
        "sector",
        "size",
        "essentialEntity"
      ],
      "gate": "(f) => f.euMarket === true && (f.essentialEntity === true || [\"energy\", \"transport\", \"health\", \"digital-infrastructure\", \"public\", \"finance\"].includes(f.sector))",
      "rules": [
        {
          "id": "nis2-transposition",
          "check": {
            "level": "none",
            "on": "2026-08-06",
            "source": "Encoded from working knowledge. Not yet checked against the official text."
          },
          "severity": "caution",
          "title": "Your obligations are those of the transposing national law, not the directive itself",
          "provision": "Article 41",
          "since": "2024-10-18",
          "when": "() => true",
          "note": "Transposition dates and scope differ by Member State. Name the countries you operate in and check each transposing instrument; this instrument will not assert a national obligation it cannot verify."
        },
        {
          "id": "nis2-registration",
          "check": {
            "level": "none",
            "on": "2026-08-06",
            "source": "Encoded from working knowledge. Not yet checked against the official text."
          },
          "severity": "obligation",
          "title": "Register with the competent national authority",
          "provision": "Article 3(4)",
          "since": "2024-10-18",
          "when": "(f) => f.essentialEntity === true"
        },
        {
          "id": "nis2-measures",
          "check": {
            "level": "none",
            "on": "2026-08-06",
            "source": "Encoded from working knowledge. Not yet checked against the official text."
          },
          "severity": "obligation",
          "title": "Risk management measures: policies, incident handling, continuity, supply chain, cryptography and access control",
          "provision": "Article 21",
          "since": "2024-10-18",
          "when": "(f) => f.essentialEntity === true"
        },
        {
          "id": "nis2-reporting",
          "check": {
            "level": "none",
            "on": "2026-08-06",
            "source": "Encoded from working knowledge. Not yet checked against the official text."
          },
          "severity": "obligation",
          "title": "Early warning within 24 hours, notification within 72 hours, final report within one month",
          "provision": "Article 23",
          "since": "2024-10-18",
          "when": "(f) => f.essentialEntity === true"
        },
        {
          "id": "nis2-management",
          "check": {
            "level": "none",
            "on": "2026-08-06",
            "source": "Encoded from working knowledge. Not yet checked against the official text."
          },
          "severity": "obligation",
          "title": "Management bodies approve the measures and can be held personally liable",
          "provision": "Article 20",
          "since": "2024-10-18",
          "when": "(f) => f.essentialEntity === true"
        }
      ],
      "timeline": [
        {
          "date": "2023-01-16",
          "label": "Enters into force",
          "provision": "Article 45"
        },
        {
          "date": "2024-10-17",
          "label": "Member States were required to transpose it",
          "provision": "Article 41"
        }
      ],
      "watch": [
        {
          "id": "nis2-omnibus",
          "title": "The Data Omnibus proposes streamlined incident reporting through a single entry point",
          "status": "proposed",
          "proposedOn": "2025-11-19",
          "note": "Would let one report satisfy notifications under NIS2, the GDPR and DORA. Not adopted; report separately until it is."
        }
      ]
    }
  ],
  "overlaps": [
    {
      "id": "ov-ce-double",
      "title": "Two conformity assessments under one CE marking",
      "packs": [
        "ai-act",
        "cra"
      ],
      "when": "(f, fired) => fired.has(\"aia-hr-annexi\") || (fired.has(\"cra-conformity\") && (f.nature || []).includes(\"ai-system\"))",
      "provisions": [
        "AI Act Articles 43 and 48",
        "CRA Articles 32 and 30"
      ],
      "detail": "A product carrying digital elements and an AI safety component must satisfy both regimes and affix a single CE marking. Plan one technical file and one assessment route rather than two projects that meet at the end."
    },
    {
      "id": "ov-incident-three-clocks",
      "title": "One incident, three reporting duties on different clocks",
      "packs": [
        "gdpr",
        "nis2",
        "ai-act"
      ],
      "when": "(f, fired) => [fired.has(\"gdpr-breach\"), fired.has(\"nis2-reporting\"), fired.has(\"aia-o-postmarket\")].filter(Boolean).length >= 2",
      "provisions": [
        "GDPR Articles 33 and 34",
        "NIS2 Article 23",
        "AI Act Article 73"
      ],
      "detail": "The same event can require an early warning within 24 hours, a personal data notification within 72, and a serious incident report under the AI Act, to different authorities. One runbook, one decision tree, one owner; the Data Omnibus proposes a single entry point but has not been adopted."
    },
    {
      "id": "ov-dpia-fria",
      "title": "A data protection impact assessment and a fundamental rights impact assessment",
      "packs": [
        "gdpr",
        "ai-act"
      ],
      "when": "(f, fired) => fired.has(\"gdpr-dpia\") && fired.has(\"aia-d-fria\")",
      "provisions": [
        "GDPR Article 35",
        "AI Act Article 27"
      ],
      "detail": "Two assessments with overlapping evidence and different questions. The AI Act permits building on an existing data protection assessment rather than repeating it; the fundamental rights questions are additional, not a subset."
    },
    {
      "id": "ov-article22-transparency",
      "title": "Automated decisions meet AI Act transparency",
      "packs": [
        "gdpr",
        "ai-act"
      ],
      "when": "(f, fired) => fired.has(\"gdpr-automated\") && (fired.has(\"aia-hr-annexiii\") || fired.has(\"aia-d-subjects\"))",
      "provisions": [
        "GDPR Article 22",
        "AI Act Articles 26(11) and 86"
      ],
      "detail": "A person subject to an automated decision has rights under both: meaningful information about the logic, and an explanation of the role the system played. The two duties are satisfied together or not at all."
    },
    {
      "id": "ov-cra-security-gdpr",
      "title": "Product security requirements and processing security",
      "packs": [
        "cra",
        "gdpr"
      ],
      "when": "(f, fired) => fired.has(\"cra-essential\") && fired.has(\"gdpr-security\")",
      "provisions": [
        "CRA Annex I",
        "GDPR Article 32"
      ],
      "detail": "The CRA sets requirements for the product; Article 32 sets them for the processing. Evidence for one is usually evidence for the other, and a single control set mapped to both saves the second audit."
    },
    {
      "id": "ov-nis2-national",
      "title": "A directive and a regulation in the same programme",
      "packs": [
        "nis2",
        "ai-act"
      ],
      "when": "(f, fired) => fired.has(\"nis2-transposition\") && fired.size > 3",
      "provisions": [
        "NIS2 Article 41"
      ],
      "detail": "The regulations bind identically across the Union; NIS2 binds as each Member State transposed it. A single compliance programme therefore has one part that travels and one part that does not, and the second must be checked per country."
    },
    {
      "id": "ov-ai-in-product",
      "title": "An AI system inside a regulated product",
      "packs": [
        "ai-act",
        "cra"
      ],
      "when": "(f) => (f.nature || []).includes(\"ai-system\") && (f.nature || []).includes(\"product-digital-elements\")",
      "provisions": [
        "AI Act Article 6(1)",
        "CRA Article 12"
      ],
      "detail": "Being a product with digital elements does not by itself make the AI high-risk, and being high-risk does not by itself trigger the CRA. Check both routes separately; they share a technical file but not a test."
    }
  ]
}