{
  "version": "v0.6.0",
  "updated": "2026-08-09",
  "facts": [
    {
      "id": "role",
      "section": "Your position",
      "label": "What is your relationship to the solution?",
      "multi": true,
      "help": "More than one can be true, and different instruments bind different roles.",
      "options": [
        {
          "id": "provider",
          "label": "We build it, or place it on the market under our name"
        },
        {
          "id": "deployer",
          "label": "We use it under our own authority"
        },
        {
          "id": "manufacturer",
          "label": "We manufacture a product with digital elements"
        },
        {
          "id": "importer",
          "label": "We bring it into the Union from outside"
        },
        {
          "id": "distributor",
          "label": "We make it available without being provider or importer"
        },
        {
          "id": "controller",
          "label": "We decide why and how personal data is processed"
        },
        {
          "id": "processor",
          "label": "We process personal data on someone else's instructions"
        }
      ]
    },
    {
      "id": "euMarket",
      "section": "Your position",
      "label": "Is it placed on the Union market, or used by people in the Union?",
      "boolean": true
    },
    {
      "id": "size",
      "section": "Your position",
      "label": "How large is the organisation?",
      "options": [
        {
          "id": "micro",
          "label": "Fewer than 10 people"
        },
        {
          "id": "small",
          "label": "Fewer than 50 people"
        },
        {
          "id": "medium",
          "label": "Fewer than 250 people"
        },
        {
          "id": "large",
          "label": "250 or more"
        }
      ]
    },
    {
      "id": "nature",
      "section": "What it is",
      "label": "What kind of solution is it?",
      "multi": true,
      "options": [
        {
          "id": "software-service",
          "label": "Software delivered as a service"
        },
        {
          "id": "product-digital-elements",
          "label": "A product with digital elements placed on the market"
        },
        {
          "id": "connected-product",
          "label": "A connected product that generates data in use"
        },
        {
          "id": "ai-system",
          "label": "An AI system"
        },
        {
          "id": "gpai-model",
          "label": "A general-purpose AI model"
        },
        {
          "id": "intermediary",
          "label": "An intermediary service, such as a network or caching service"
        },
        {
          "id": "hosting-service",
          "label": "A hosting service storing information provided by users"
        },
        {
          "id": "online-platform",
          "label": "An online platform that stores and publishes user content"
        },
        {
          "id": "marketplace",
          "label": "An online marketplace where traders sell to consumers"
        },
        {
          "id": "data-processing-service",
          "label": "A data processing service: cloud or edge computing"
        }
      ]
    },
    {
      "id": "lifecycle",
      "section": "What it is",
      "label": "When was it, or when will it be, placed on the market?",
      "options": [
        {
          "id": "already",
          "label": "Already on the market before 2 August 2026"
        },
        {
          "id": "new",
          "label": "From 2 August 2026 onwards"
        }
      ]
    },
    {
      "id": "openSource",
      "section": "What it is",
      "label": "Is it free and open-source software outside a commercial activity?",
      "boolean": true
    },
    {
      "id": "personalData",
      "section": "Data",
      "label": "Does it process personal data?",
      "boolean": true
    },
    {
      "id": "specialCategories",
      "section": "Data",
      "label": "Does it process special categories, such as health, biometrics or beliefs?",
      "boolean": true
    },
    {
      "id": "profiling",
      "section": "Data",
      "label": "Does it profile people, or decide about them automatically?",
      "boolean": true
    },
    {
      "id": "largeScaleMonitoring",
      "section": "Data",
      "label": "Does it monitor people systematically at large scale?",
      "boolean": true
    },
    {
      "id": "transfersOutsideEu",
      "section": "Data",
      "label": "Is personal data transferred outside the Union?",
      "boolean": true
    },
    {
      "id": "aiPurpose",
      "section": "If it uses AI",
      "label": "Does the AI do any of these?",
      "options": [
        {
          "id": "none",
          "label": "None of these"
        },
        {
          "id": "social-scoring",
          "label": "Scores people socially, leading to detrimental treatment"
        },
        {
          "id": "crime-prediction",
          "label": "Predicts offending from profiling or traits alone"
        },
        {
          "id": "face-scraping",
          "label": "Builds facial recognition databases by untargeted scraping"
        },
        {
          "id": "emotion-inference",
          "label": "Infers emotions of people"
        },
        {
          "id": "biometric-categorisation-sensitive",
          "label": "Infers sensitive attributes biometrically"
        },
        {
          "id": "realtime-remote-biometric-id",
          "label": "Identifies people biometrically in real time in public spaces"
        },
        {
          "id": "ncii",
          "label": "Generates intimate imagery of identifiable people without consent"
        },
        {
          "id": "csam",
          "label": "Can generate child sexual abuse material"
        }
      ]
    },
    {
      "id": "aiTechniques",
      "section": "If it uses AI",
      "label": "Does it use manipulative techniques?",
      "multi": true,
      "options": [
        {
          "id": "subliminal",
          "label": "Subliminal, manipulative or deceptive techniques"
        },
        {
          "id": "vulnerability",
          "label": "Exploits vulnerabilities of age, disability or circumstance"
        }
      ]
    },
    {
      "id": "aiUseCase",
      "section": "If it uses AI",
      "label": "What does it decide or support?",
      "options": [
        {
          "id": "none",
          "label": "None of these"
        },
        {
          "id": "biometrics",
          "label": "Biometric identification, categorisation or emotion recognition"
        },
        {
          "id": "critical-infrastructure",
          "label": "Safety of critical infrastructure"
        },
        {
          "id": "education",
          "label": "Access to education, assessment or proctoring"
        },
        {
          "id": "employment",
          "label": "Recruitment, evaluation, allocation, monitoring or termination"
        },
        {
          "id": "essential-services",
          "label": "Essential services, creditworthiness, insurance pricing or triage"
        },
        {
          "id": "law-enforcement",
          "label": "Law enforcement"
        },
        {
          "id": "migration",
          "label": "Migration, asylum or border control"
        },
        {
          "id": "justice-democracy",
          "label": "Justice or democratic processes"
        }
      ]
    },
    {
      "id": "aiDerogation",
      "section": "If it uses AI",
      "label": "If it falls in one of those areas, which is true?",
      "multi": true,
      "help": "Article 6(3) of the AI Act. It never applies where the system profiles people.",
      "options": [
        {
          "id": "narrow-procedural",
          "label": "A narrow procedural task only"
        },
        {
          "id": "improves-prior-human",
          "label": "Improves a completed human activity"
        },
        {
          "id": "detects-patterns-no-replace",
          "label": "Detects patterns without replacing human assessment"
        },
        {
          "id": "preparatory",
          "label": "A preparatory task"
        }
      ]
    },
    {
      "id": "annexOneProduct",
      "section": "If it uses AI",
      "label": "Is it a safety component of a regulated product needing third-party assessment?",
      "boolean": true
    },
    {
      "id": "gpaiSystemicRisk",
      "section": "If it uses AI",
      "label": "Does the model exceed the systemic-risk compute threshold?",
      "boolean": true
    },
    {
      "id": "interactsWithPeople",
      "section": "Behaviour",
      "label": "Does it interact directly with people?",
      "boolean": true
    },
    {
      "id": "generatesSyntheticContent",
      "section": "Behaviour",
      "label": "Does it generate synthetic audio, image, video or text?",
      "boolean": true
    },
    {
      "id": "emotionOrBiometricCategorisation",
      "section": "Behaviour",
      "label": "Does it recognise emotions or categorise people biometrically?",
      "boolean": true
    },
    {
      "id": "publishesDeepFakesOrPublicInterestText",
      "section": "Behaviour",
      "label": "Do you publish deep fakes, or AI text informing the public on matters of public interest?",
      "boolean": true
    },
    {
      "id": "consumerFacing",
      "section": "Behaviour",
      "label": "Is it offered to consumers?",
      "boolean": true
    },
    {
      "id": "platformAds",
      "section": "Behaviour",
      "label": "Does the platform show advertising?",
      "boolean": true
    },
    {
      "id": "minorsDirected",
      "section": "Behaviour",
      "label": "Is it directed at minors, or predominantly used by them?",
      "boolean": true
    },
    {
      "id": "veryLargePlatform",
      "section": "Behaviour",
      "label": "Has it been designated a very large online platform or search engine?",
      "boolean": true
    },
    {
      "id": "eaaService",
      "section": "Sector",
      "label": "Is it one of these consumer products or services?",
      "help": "The categories the European Accessibility Act covers.",
      "options": [
        {
          "id": "none",
          "label": "None of these"
        },
        {
          "id": "ecommerce",
          "label": "E-commerce"
        },
        {
          "id": "banking",
          "label": "Consumer banking"
        },
        {
          "id": "ebooks",
          "label": "E-books or dedicated reading software"
        },
        {
          "id": "telecoms",
          "label": "Electronic communications"
        },
        {
          "id": "av-media",
          "label": "Audiovisual media services"
        },
        {
          "id": "transport",
          "label": "Transport information or e-ticketing"
        },
        {
          "id": "terminals",
          "label": "Self-service terminals, payment terminals or consumer computing hardware"
        }
      ]
    },
    {
      "id": "financialEntity",
      "section": "Sector",
      "label": "Is the organisation a regulated financial entity?",
      "boolean": true
    },
    {
      "id": "ictProviderToFinance",
      "section": "Sector",
      "label": "Do you provide ICT services to financial entities?",
      "boolean": true
    },
    {
      "id": "sector",
      "section": "Sector",
      "label": "Which sector does it serve?",
      "options": [
        {
          "id": "general",
          "label": "General commercial"
        },
        {
          "id": "finance",
          "label": "Financial services"
        },
        {
          "id": "health",
          "label": "Health"
        },
        {
          "id": "energy",
          "label": "Energy or utilities"
        },
        {
          "id": "transport",
          "label": "Transport"
        },
        {
          "id": "digital-infrastructure",
          "label": "Digital infrastructure, cloud or managed services"
        },
        {
          "id": "public",
          "label": "Public body"
        },
        {
          "id": "education",
          "label": "Education"
        }
      ]
    },
    {
      "id": "essentialEntity",
      "section": "Sector",
      "label": "Is the organisation an essential or important entity under national cybersecurity law?",
      "boolean": true
    }
  ],
  "packs": [
    {
      "id": "ai-act",
      "title": "Artificial Intelligence Act",
      "instrument": "Regulation (EU) 2024/1689",
      "amendedBy": [
        {
          "id": "omnibus-ai",
          "title": "Regulation (EU) 2026/1744 (Digital Omnibus on AI)",
          "inForce": "2026-07-27"
        }
      ],
      "source": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj",
      "version": "v0.5.0",
      "reads": [
        "role",
        "euMarket",
        "nature",
        "lifecycle",
        "aiPurpose",
        "aiTechniques",
        "aiUseCase",
        "aiDerogation",
        "profiling",
        "annexOneProduct",
        "gpaiSystemicRisk",
        "interactsWithPeople",
        "generatesSyntheticContent",
        "emotionOrBiometricCategorisation",
        "publishesDeepFakesOrPublicInterestText"
      ],
      "gate": "(f) => f.euMarket === true && (f.nature || []).some((n) => [\"ai-system\", \"gpai-model\"].includes(n))",
      "rules": [
        {
          "id": "aia-p-social-scoring",
          "check": {
            "level": "official-text",
            "on": "2026-08-06",
            "source": "OJ text, recital 31 (social scoring leading to detrimental or disproportionate treatment)"
          },
          "severity": "prohibited",
          "title": "Social scoring leading to detrimental treatment",
          "provision": "Article 5(1)(c)",
          "since": "2025-02-02",
          "when": "(f) => f.aiPurpose === \"social-scoring\""
        },
        {
          "id": "aia-p-crime-prediction",
          "check": {
            "level": "official-text",
            "on": "2026-08-06",
            "source": "OJ text, recital 42 (prediction based solely on profiling or personality traits)"
          },
          "severity": "prohibited",
          "title": "Predicting offending from profiling or traits alone",
          "provision": "Article 5(1)(d)",
          "since": "2025-02-02",
          "when": "(f) => f.aiPurpose === \"crime-prediction\""
        },
        {
          "id": "aia-p-face-scraping",
          "check": {
            "level": "official-text",
            "on": "2026-08-06",
            "source": "OJ text, recital 43 (untargeted scraping of facial images from the internet or CCTV)"
          },
          "severity": "prohibited",
          "title": "Untargeted scraping of facial images",
          "provision": "Article 5(1)(e)",
          "since": "2025-02-02",
          "when": "(f) => f.aiPurpose === \"face-scraping\""
        },
        {
          "id": "aia-p-emotion",
          "check": {
            "level": "official-text",
            "on": "2026-08-06",
            "source": "OJ text, recital 44 (emotion inference in the workplace and education, excluding medical and safety uses)"
          },
          "severity": "prohibited",
          "title": "Emotion inference in the workplace or education",
          "provision": "Article 5(1)(f)",
          "since": "2025-02-02",
          "when": "(f) => f.aiPurpose === \"emotion-inference\" && [\"employment\", \"education\"].includes(f.aiUseCase)"
        },
        {
          "id": "aia-p-biocat",
          "check": {
            "level": "official-text",
            "on": "2026-08-06",
            "source": "OJ text, recital 30, and recital 40 which cites Article 5(1) first subparagraph point (g)"
          },
          "severity": "prohibited",
          "title": "Biometric categorisation inferring sensitive attributes",
          "provision": "Article 5(1)(g)",
          "since": "2025-02-02",
          "when": "(f) => f.aiPurpose === \"biometric-categorisation-sensitive\""
        },
        {
          "id": "aia-p-rbi",
          "check": {
            "level": "official-text",
            "on": "2026-08-06",
            "source": "OJ text, recitals 32 to 38, and recital 40 which cites Article 5(1) first subparagraph point (h)"
          },
          "severity": "prohibited",
          "title": "Real-time remote biometric identification in public spaces for law enforcement",
          "provision": "Article 5(1)(h)",
          "since": "2025-02-02",
          "when": "(f) => f.aiPurpose === \"realtime-remote-biometric-id\" && f.aiUseCase === \"law-enforcement\""
        },
        {
          "id": "aia-p-subliminal",
          "check": {
            "level": "official-text",
            "on": "2026-08-06",
            "source": "OJ text, recital 29 (subliminal and manipulative techniques materially distorting behaviour)"
          },
          "severity": "prohibited",
          "title": "Subliminal or manipulative techniques distorting behaviour",
          "provision": "Article 5(1)(a)",
          "since": "2025-02-02",
          "when": "(f) => (f.aiTechniques || []).includes(\"subliminal\")"
        },
        {
          "id": "aia-p-vulnerability",
          "check": {
            "level": "official-text",
            "on": "2026-08-06",
            "source": "OJ text, recital 29 (exploitation of vulnerabilities of age, disability or social or economic situation)"
          },
          "severity": "prohibited",
          "title": "Exploiting vulnerabilities of age, disability or circumstance",
          "provision": "Article 5(1)(b)",
          "since": "2025-02-02",
          "when": "(f) => (f.aiTechniques || []).includes(\"vulnerability\")"
        },
        {
          "id": "aia-p-ncii",
          "check": {
            "level": "secondary",
            "on": "2026-08-06",
            "source": "Regulation (EU) 2026/1744 as reported by multiple firms; awaiting an EUR-Lex read"
          },
          "severity": "prohibited",
          "title": "Generating non-consensual intimate imagery of identifiable people",
          "provision": "Article 5, as amended",
          "since": "2026-12-02",
          "addedBy": "omnibus-ai",
          "when": "(f) => f.aiPurpose === \"ncii\""
        },
        {
          "id": "aia-p-csam",
          "check": {
            "level": "secondary",
            "on": "2026-08-06",
            "source": "Regulation (EU) 2026/1744 as reported by multiple firms; awaiting an EUR-Lex read"
          },
          "severity": "prohibited",
          "title": "Generating child sexual abuse material, or lacking safeguards against it",
          "provision": "Article 5, as amended",
          "since": "2026-12-02",
          "addedBy": "omnibus-ai",
          "when": "(f) => f.aiPurpose === \"csam\""
        },
        {
          "id": "aia-hr-annexiii",
          "check": {
            "level": "official-text",
            "on": "2026-08-06",
            "source": "OJ text, recitals 54 to 62 (the eight Annex III areas); the deferred date is from Regulation (EU) 2026/1744"
          },
          "severity": "high-risk",
          "title": "High-risk: falls within an Annex III area",
          "provision": "Article 6(2) and Annex III",
          "since": "2027-12-02",
          "deferredBy": "omnibus-ai",
          "when": "(f) => f.aiUseCase && f.aiUseCase !== \"none\" && !((f.aiDerogation || []).length && f.profiling !== true)",
          "note": "Deferred from 2 August 2026 by Regulation (EU) 2026/1744. Preparation is expected to be under way rather than starting then."
        },
        {
          "id": "aia-hr-derogation",
          "check": {
            "level": "official-text",
            "on": "2026-08-06",
            "source": "OJ text, recital 53 (all four Article 6(3) conditions, the documentation duty and EU database registration)"
          },
          "severity": "note",
          "title": "Annex III area, with the Article 6(3) derogation claimed",
          "provision": "Article 6(3)",
          "since": "2027-12-02",
          "when": "(f) => f.aiUseCase && f.aiUseCase !== \"none\" && (f.aiDerogation || []).length > 0 && f.profiling !== true",
          "note": "Relying on the derogation requires a documented assessment before placing on the market, and registration in the EU database. It never applies where the system profiles people."
        },
        {
          "id": "aia-hr-profiling",
          "check": {
            "level": "official-text",
            "on": "2026-08-06",
            "source": "OJ text, recital 53 (profiling within the meaning of Article 4(4) GDPR removes the derogation)"
          },
          "severity": "high-risk",
          "title": "The derogation is unavailable because the system profiles people",
          "provision": "Article 6(3), final subparagraph",
          "since": "2027-12-02",
          "when": "(f) => f.aiUseCase && f.aiUseCase !== \"none\" && (f.aiDerogation || []).length > 0 && f.profiling === true"
        },
        {
          "id": "aia-hr-annexi",
          "check": {
            "level": "official-text",
            "on": "2026-08-06",
            "source": "OJ text, recitals 50 and 51 (products under Union harmonisation legislation with third-party assessment)"
          },
          "severity": "high-risk",
          "title": "High-risk as a regulated product or its safety component",
          "provision": "Article 6(1) and Annex I",
          "since": "2028-08-02",
          "deferredBy": "omnibus-ai",
          "when": "(f) => f.annexOneProduct === true",
          "note": "Sits alongside the existing product legislation rather than replacing it."
        },
        {
          "id": "aia-t-interaction",
          "check": {
            "level": "secondary",
            "on": "2026-08-06",
            "source": "Article 50 transparency obligations confirmed as applying from 2 August 2026 across the Commission's reporting and several law firms; the wording of Article 50(1) is not yet read"
          },
          "severity": "obligation",
          "title": "Tell people they are interacting with an AI system",
          "provision": "Article 50(1)",
          "since": "2026-08-02",
          "when": "(f) => f.interactsWithPeople === true && (f.role || []).some((r) => [\"provider\", \"importer\"].includes(r))"
        },
        {
          "id": "aia-t-marking",
          "check": {
            "level": "secondary",
            "on": "2026-08-06",
            "source": "Deferral to 2026-12-02 for systems already on the market, confirmed across the same sources"
          },
          "severity": "obligation",
          "title": "Mark synthetic content in a machine-readable way",
          "provision": "Article 50(2)",
          "since": "2026-08-02",
          "sinceIfAlreadyOnMarket": "2026-12-02",
          "deferredBy": "omnibus-ai",
          "when": "(f) => f.generatesSyntheticContent === true && (f.role || []).includes(\"provider\")"
        },
        {
          "id": "aia-t-emotion-notice",
          "check": {
            "level": "secondary",
            "on": "2026-08-06",
            "source": "Article 50(3) as reported consistently; wording not yet read"
          },
          "severity": "obligation",
          "title": "Inform people exposed to emotion recognition or biometric categorisation",
          "provision": "Article 50(3)",
          "since": "2026-08-02",
          "when": "(f) => f.emotionOrBiometricCategorisation === true && (f.role || []).includes(\"deployer\")"
        },
        {
          "id": "aia-t-deepfake",
          "check": {
            "level": "secondary",
            "on": "2026-08-06",
            "source": "Article 50(4) as reported consistently; wording not yet read"
          },
          "severity": "obligation",
          "title": "Disclose deep fakes and AI-generated text on matters of public interest",
          "provision": "Article 50(4)",
          "since": "2026-08-02",
          "when": "(f) => f.publishesDeepFakesOrPublicInterestText === true && (f.role || []).includes(\"deployer\")"
        },
        {
          "id": "aia-g-docs",
          "check": {
            "level": "secondary",
            "on": "2026-08-06",
            "source": "Chapter V obligations applying from 2 August 2025, reported consistently; Article 53 wording not yet read"
          },
          "severity": "obligation",
          "title": "General-purpose model documentation, downstream information, copyright policy and training-content summary",
          "provision": "Article 53",
          "since": "2025-08-02",
          "when": "(f) => (f.nature || []).includes(\"gpai-model\") && (f.role || []).includes(\"provider\")"
        },
        {
          "id": "aia-g-systemic",
          "check": {
            "level": "secondary",
            "on": "2026-08-06",
            "source": "Articles 51 and 55 with the 10^25 floating point operation presumption, reported consistently; wording not yet read"
          },
          "severity": "obligation",
          "title": "Systemic-risk evaluation, adversarial testing, incident reporting and cybersecurity",
          "provision": "Articles 51 and 55",
          "since": "2025-08-02",
          "when": "(f) => (f.nature || []).includes(\"gpai-model\") && (f.role || []).includes(\"provider\") && f.gpaiSystemicRisk === true"
        },
        {
          "id": "aia-literacy",
          "check": {
            "level": "official-text",
            "on": "2026-08-06",
            "source": "OJ text, recital 20 (AI literacy for providers, deployers and affected persons)"
          },
          "severity": "obligation",
          "title": "AI literacy: ensure staff dealing with the system are sufficiently competent",
          "provision": "Article 4",
          "since": "2025-02-02",
          "when": "(f) => (f.nature || []).includes(\"ai-system\")"
        }
      ],
      "obligationsIfHighRisk": {
        "provider": [
          {
            "id": "aia-o-rms",
            "title": "Risk management system across the lifecycle",
            "provision": "Article 9"
          },
          {
            "id": "aia-o-data",
            "title": "Data and data governance",
            "provision": "Article 10"
          },
          {
            "id": "aia-o-techdoc",
            "title": "Technical documentation",
            "provision": "Article 11 and Annex IV"
          },
          {
            "id": "aia-o-logging",
            "title": "Automatic event logging",
            "provision": "Article 12"
          },
          {
            "id": "aia-o-instructions",
            "title": "Instructions enabling deployers to comply",
            "provision": "Article 13"
          },
          {
            "id": "aia-o-oversight",
            "title": "Design for human oversight",
            "provision": "Article 14"
          },
          {
            "id": "aia-o-accuracy",
            "title": "Accuracy, robustness and cybersecurity",
            "provision": "Article 15"
          },
          {
            "id": "aia-o-qms",
            "title": "Quality management system",
            "provision": "Article 17"
          },
          {
            "id": "aia-o-conformity",
            "title": "Conformity assessment, declaration and CE marking",
            "provision": "Articles 43, 47 and 48"
          },
          {
            "id": "aia-o-registration",
            "title": "Registration in the EU database",
            "provision": "Article 49"
          },
          {
            "id": "aia-o-postmarket",
            "title": "Post-market monitoring and serious incident reporting",
            "provision": "Articles 72 and 73"
          }
        ],
        "deployer": [
          {
            "id": "aia-d-instructions",
            "title": "Use in accordance with the instructions",
            "provision": "Article 26(1)"
          },
          {
            "id": "aia-d-oversight",
            "title": "Competent, trained human oversight",
            "provision": "Article 26(2)"
          },
          {
            "id": "aia-d-input",
            "title": "Relevant and representative input data",
            "provision": "Article 26(4)"
          },
          {
            "id": "aia-d-monitor",
            "title": "Monitoring and serious incident reporting",
            "provision": "Article 26(5)"
          },
          {
            "id": "aia-d-logs",
            "title": "Keep the logs the system generates",
            "provision": "Article 26(6)"
          },
          {
            "id": "aia-d-workers",
            "title": "Inform workers and their representatives",
            "provision": "Article 26(7)"
          },
          {
            "id": "aia-d-fria",
            "title": "Fundamental rights impact assessment where applicable",
            "provision": "Article 27"
          },
          {
            "id": "aia-d-subjects",
            "title": "Inform people subject to decisions",
            "provision": "Article 26(11)"
          }
        ]
      },
      "timeline": [
        {
          "date": "2024-08-01",
          "label": "Enters into force",
          "provision": "Article 113"
        },
        {
          "date": "2025-02-02",
          "label": "Prohibitions and AI literacy apply",
          "provision": "Articles 4 and 5"
        },
        {
          "date": "2025-08-02",
          "label": "General-purpose model obligations, governance and penalties apply",
          "provision": "Chapter V"
        },
        {
          "date": "2026-08-02",
          "label": "Transparency obligations apply and enforcement begins",
          "provision": "Article 50"
        },
        {
          "date": "2026-12-02",
          "label": "Marking applies to systems already on the market; new prohibitions apply",
          "provision": "Articles 50(2) and 5",
          "changedBy": "omnibus-ai"
        },
        {
          "date": "2027-12-02",
          "label": "High-risk obligations apply to Annex III systems",
          "provision": "Chapter III",
          "changedBy": "omnibus-ai"
        },
        {
          "date": "2028-08-02",
          "label": "High-risk obligations apply to Annex I systems",
          "provision": "Chapter III",
          "changedBy": "omnibus-ai"
        }
      ],
      "watch": []
    },
    {
      "id": "cra",
      "title": "Cyber Resilience Act",
      "instrument": "Regulation (EU) 2024/2847",
      "source": "https://eur-lex.europa.eu/eli/reg/2024/2847/oj",
      "version": "v0.5.0",
      "reads": [
        "role",
        "euMarket",
        "nature",
        "openSource"
      ],
      "gate": "(f) => f.euMarket === true && (f.nature || []).includes(\"product-digital-elements\")",
      "rules": [
        {
          "id": "cra-reporting",
          "check": {
            "level": "official-summary",
            "on": "2026-08-06",
            "source": "https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act"
          },
          "severity": "obligation",
          "title": "Report actively exploited vulnerabilities and severe incidents to ENISA and the CSIRT",
          "provision": "Article 14",
          "since": "2026-09-11",
          "when": "(f) => (f.role || []).includes(\"manufacturer\")",
          "note": "The first CRA duty to bind, ahead of the main requirements."
        },
        {
          "id": "cra-essential",
          "check": {
            "level": "official-summary",
            "on": "2026-08-06",
            "source": "https://digital-strategy.ec.europa.eu/en/policies/cra-summary"
          },
          "severity": "obligation",
          "title": "Essential cybersecurity requirements in design, development and production",
          "provision": "Article 13 and Annex I",
          "since": "2027-12-11",
          "when": "(f) => (f.role || []).includes(\"manufacturer\")"
        },
        {
          "id": "cra-vuln-handling",
          "check": {
            "level": "official-summary",
            "on": "2026-08-06",
            "source": "https://digital-strategy.ec.europa.eu/en/policies/cra-summary"
          },
          "severity": "obligation",
          "title": "Vulnerability handling, including a coordinated disclosure policy and security updates",
          "provision": "Annex I Part II",
          "since": "2027-12-11",
          "when": "(f) => (f.role || []).includes(\"manufacturer\")"
        },
        {
          "id": "cra-sbom",
          "check": {
            "level": "official-summary",
            "on": "2026-08-06",
            "source": "https://digital-strategy.ec.europa.eu/en/policies/cra-summary"
          },
          "severity": "obligation",
          "title": "Software bill of materials covering top-level dependencies",
          "provision": "Annex I Part II(1)",
          "since": "2027-12-11",
          "when": "(f) => (f.role || []).includes(\"manufacturer\")"
        },
        {
          "id": "cra-conformity",
          "check": {
            "level": "official-summary",
            "on": "2026-08-06",
            "source": "https://digital-strategy.ec.europa.eu/en/policies/cra-summary"
          },
          "severity": "obligation",
          "title": "Conformity assessment, EU declaration of conformity and CE marking",
          "provision": "Articles 32, 28 and 30",
          "since": "2027-12-11",
          "when": "(f) => (f.role || []).includes(\"manufacturer\")"
        },
        {
          "id": "cra-support",
          "check": {
            "level": "secondary",
            "on": "2026-08-06",
            "source": "Commission summary describes the support period; the five year default and the Article 13(8) reference are not yet confirmed against the text"
          },
          "severity": "obligation",
          "title": "Define and publish the support period, at least five years unless the expected use is shorter",
          "provision": "Article 13(8)",
          "since": "2027-12-11",
          "when": "(f) => (f.role || []).includes(\"manufacturer\")"
        },
        {
          "id": "cra-importer",
          "check": {
            "level": "secondary",
            "on": "2026-08-06",
            "source": "Commission summary describes importer duties; the Article 19 number is not yet confirmed against the text"
          },
          "severity": "obligation",
          "title": "Verify the manufacturer's conformity assessment and marking before placing on the market",
          "provision": "Article 19",
          "since": "2027-12-11",
          "when": "(f) => (f.role || []).includes(\"importer\")"
        },
        {
          "id": "cra-distributor",
          "check": {
            "level": "secondary",
            "on": "2026-08-06",
            "source": "Commission summary describes distributor duties; the Article 20 number is not yet confirmed against the text"
          },
          "severity": "obligation",
          "title": "Act with due care in relation to the requirements when making a product available",
          "provision": "Article 20",
          "since": "2027-12-11",
          "when": "(f) => (f.role || []).includes(\"distributor\")"
        },
        {
          "id": "cra-oss",
          "check": {
            "level": "official-summary",
            "on": "2026-08-06",
            "source": "https://digital-strategy.ec.europa.eu/en/policies/cra-summary"
          },
          "severity": "note",
          "title": "Open-source software outside a commercial activity is treated differently",
          "provision": "Article 2 and Recitals",
          "since": "2027-12-11",
          "when": "(f) => f.openSource === true",
          "note": "Stewards of open-source software carry lighter duties than manufacturers. The boundary turns on commercial activity, and it is the fact most often assumed rather than checked."
        }
      ],
      "timeline": [
        {
          "date": "2024-12-10",
          "label": "Enters into force",
          "provision": "Article 71"
        },
        {
          "date": "2026-09-11",
          "label": "Reporting obligations for actively exploited vulnerabilities apply",
          "provision": "Article 14"
        },
        {
          "date": "2027-12-11",
          "label": "The remaining obligations apply",
          "provision": "Article 71(2)"
        }
      ],
      "watch": []
    },
    {
      "id": "gdpr",
      "title": "General Data Protection Regulation",
      "instrument": "Regulation (EU) 2016/679",
      "source": "https://eur-lex.europa.eu/eli/reg/2016/679/oj",
      "version": "v0.5.0",
      "reads": [
        "role",
        "euMarket",
        "personalData",
        "specialCategories",
        "profiling",
        "largeScaleMonitoring",
        "transfersOutsideEu",
        "size",
        "sector"
      ],
      "gate": "(f) => f.personalData === true",
      "rules": [
        {
          "id": "gdpr-lawful-basis",
          "check": {
            "level": "secondary",
            "on": "2026-08-06",
            "source": "Article index reproductions of Regulation (EU) 2016/679 (gdpr-info.eu and others), consistent on Article 6"
          },
          "severity": "obligation",
          "title": "Identify and record a lawful basis for each purpose",
          "provision": "Article 6",
          "since": "2018-05-25",
          "when": "() => true"
        },
        {
          "id": "gdpr-special",
          "check": {
            "level": "secondary",
            "on": "2026-08-06",
            "source": "Article index reproductions, consistent on Article 9 for special categories"
          },
          "severity": "obligation",
          "title": "Establish an Article 9 condition before processing special categories",
          "provision": "Article 9",
          "since": "2018-05-25",
          "when": "(f) => f.specialCategories === true"
        },
        {
          "id": "gdpr-transparency",
          "check": {
            "level": "secondary",
            "on": "2026-08-06",
            "source": "Article index reproductions, consistent on Articles 13 and 14"
          },
          "severity": "obligation",
          "title": "Inform people at collection, in clear and accessible terms",
          "provision": "Articles 13 and 14",
          "since": "2018-05-25",
          "when": "() => true"
        },
        {
          "id": "gdpr-ropa",
          "check": {
            "level": "official-text",
            "on": "2026-08-06",
            "source": "EUR-Lex text: Article 30 named as the record of processing activities; the Article 30(5) exemption for organisations under 250 people is conditional as encoded"
          },
          "severity": "obligation",
          "title": "Maintain a record of processing activities",
          "provision": "Article 30",
          "since": "2018-05-25",
          "when": "(f) => f.size === \"large\" || f.specialCategories === true || f.largeScaleMonitoring === true",
          "note": "The exemption for organisations under 250 people falls away where processing is not occasional, is likely to result in risk, or involves special categories."
        },
        {
          "id": "gdpr-dpia",
          "check": {
            "level": "official-text",
            "on": "2026-08-06",
            "source": "EUR-Lex text: Article 36(1) refers to 'a data protection impact assessment under Article 35', confirming both the duty and its numbering"
          },
          "severity": "obligation",
          "title": "Carry out a data protection impact assessment before starting",
          "provision": "Article 35",
          "since": "2018-05-25",
          "when": "(f) => f.largeScaleMonitoring === true || (f.profiling === true && f.specialCategories === true) || (f.profiling === true && f.sector === \"finance\")"
        },
        {
          "id": "gdpr-automated",
          "check": {
            "level": "secondary",
            "on": "2026-08-06",
            "source": "Article index reproductions, consistent on Article 22 for automated individual decision-making"
          },
          "severity": "obligation",
          "title": "Automated decisions with legal or similarly significant effects need a basis, safeguards and human intervention",
          "provision": "Article 22",
          "since": "2018-05-25",
          "when": "(f) => f.profiling === true"
        },
        {
          "id": "gdpr-processor",
          "check": {
            "level": "secondary",
            "on": "2026-08-06",
            "source": "Article index reproductions, consistent on Article 28 for processor contracts"
          },
          "severity": "obligation",
          "title": "A written processing agreement with every processor",
          "provision": "Article 28",
          "since": "2018-05-25",
          "when": "(f) => (f.role || []).includes(\"controller\")"
        },
        {
          "id": "gdpr-security",
          "check": {
            "level": "secondary",
            "on": "2026-08-06",
            "source": "Article index reproductions, consistent on Article 32 for security of processing"
          },
          "severity": "obligation",
          "title": "Security appropriate to the risk, and the ability to demonstrate it",
          "provision": "Article 32",
          "since": "2018-05-25",
          "when": "() => true"
        },
        {
          "id": "gdpr-breach",
          "check": {
            "level": "official-text",
            "on": "2026-08-06",
            "source": "EUR-Lex text of Regulation (EU) 2016/679: Article 33(1) read verbatim, including the 72 hour limit and the risk qualifier"
          },
          "severity": "obligation",
          "title": "Notify a personal data breach to the authority within 72 hours where it is likely to result in risk",
          "provision": "Articles 33 and 34",
          "since": "2018-05-25",
          "when": "() => true"
        },
        {
          "id": "gdpr-transfers",
          "check": {
            "level": "secondary",
            "on": "2026-08-06",
            "source": "Article index reproductions, consistent on Chapter V, Articles 44 to 50"
          },
          "severity": "obligation",
          "title": "A transfer mechanism, and a transfer impact assessment where required",
          "provision": "Chapter V",
          "since": "2018-05-25",
          "when": "(f) => f.transfersOutsideEu === true"
        },
        {
          "id": "gdpr-dpo",
          "check": {
            "level": "secondary",
            "on": "2026-08-06",
            "source": "Article index reproductions, consistent on Article 37 for designation of the data protection officer"
          },
          "severity": "obligation",
          "title": "Designate a data protection officer",
          "provision": "Article 37",
          "since": "2018-05-25",
          "when": "(f) => f.sector === \"public\" || f.largeScaleMonitoring === true || (f.specialCategories === true && f.size === \"large\")"
        }
      ],
      "timeline": [
        {
          "date": "2018-05-25",
          "label": "Applies",
          "provision": "Article 99"
        }
      ],
      "watch": [
        {
          "id": "gdpr-omnibus",
          "title": "The Data Omnibus would amend the GDPR, ePrivacy, NIS2, DORA and the Data Act",
          "status": "proposed",
          "proposedOn": "2025-11-19",
          "note": "Still in negotiation as of August 2026 and not law. Reported changes include single-click consent, a moratorium on re-prompting, a longer breach notification window and a single incident reporting point. Plan against the obligations that are in force today."
        }
      ]
    },
    {
      "id": "nis2",
      "title": "NIS2 Directive",
      "instrument": "Directive (EU) 2022/2555",
      "source": "https://eur-lex.europa.eu/eli/dir/2022/2555/oj",
      "version": "v0.5.0",
      "isDirective": true,
      "reads": [
        "euMarket",
        "sector",
        "size",
        "essentialEntity"
      ],
      "gate": "(f) => f.euMarket === true && (f.essentialEntity === true || [\"energy\", \"transport\", \"health\", \"digital-infrastructure\", \"public\", \"finance\"].includes(f.sector))",
      "rules": [
        {
          "id": "nis2-transposition",
          "check": {
            "level": "secondary",
            "on": "2026-08-06",
            "source": "Transposition deadline of 17 October 2024 corroborated widely; as of mid-2026 transposition remains uneven and the Commission has referred several Member States to the Court of Justice, which is exactly why this pack refuses to assert a national obligation"
          },
          "severity": "caution",
          "title": "Your obligations are those of the transposing national law, not the directive itself",
          "provision": "Article 41",
          "since": "2024-10-18",
          "when": "() => true",
          "note": "Transposition dates and scope differ by Member State. Name the countries you operate in and check each transposing instrument; this instrument will not assert a national obligation it cannot verify."
        },
        {
          "id": "nis2-registration",
          "check": {
            "level": "secondary",
            "on": "2026-08-06",
            "source": "Article 3(4) requires Member States to establish lists of essential and important entities with information submitted by them; note that Article 27 imposes a separate registry duty on certain digital entity types, which this pack does not yet distinguish"
          },
          "severity": "obligation",
          "title": "Register with the competent national authority",
          "provision": "Article 3(4)",
          "since": "2024-10-18",
          "when": "(f) => f.essentialEntity === true"
        },
        {
          "id": "nis2-measures",
          "check": {
            "level": "secondary",
            "on": "2026-08-06",
            "source": "Multiple independent analyses of Directive (EU) 2022/2555, consistent on Article 21 for risk management measures"
          },
          "severity": "obligation",
          "title": "Risk management measures: policies, incident handling, continuity, supply chain, cryptography and access control",
          "provision": "Article 21",
          "since": "2024-10-18",
          "when": "(f) => f.essentialEntity === true"
        },
        {
          "id": "nis2-reporting",
          "check": {
            "level": "secondary",
            "on": "2026-08-06",
            "source": "Multiple independent analyses, consistent on Article 23 and the 24 hour, 72 hour and one month structure"
          },
          "severity": "obligation",
          "title": "Early warning within 24 hours, notification within 72 hours, final report within one month",
          "provision": "Article 23",
          "since": "2024-10-18",
          "when": "(f) => f.essentialEntity === true"
        },
        {
          "id": "nis2-management",
          "check": {
            "level": "secondary",
            "on": "2026-08-06",
            "source": "Multiple independent analyses, consistent on Article 20 for management approval, oversight, training and personal liability"
          },
          "severity": "obligation",
          "title": "Management bodies approve the measures and can be held personally liable",
          "provision": "Article 20",
          "since": "2024-10-18",
          "when": "(f) => f.essentialEntity === true"
        }
      ],
      "timeline": [
        {
          "date": "2023-01-16",
          "label": "Enters into force",
          "provision": "Article 45"
        },
        {
          "date": "2024-10-17",
          "label": "Member States were required to transpose it",
          "provision": "Article 41"
        }
      ],
      "watch": [
        {
          "id": "nis2-omnibus",
          "title": "The Data Omnibus proposes streamlined incident reporting through a single entry point",
          "status": "proposed",
          "proposedOn": "2025-11-19",
          "note": "Would let one report satisfy notifications under NIS2, the GDPR and DORA. Not adopted; report separately until it is."
        }
      ]
    },
    {
      "id": "data-act",
      "title": "Data Act",
      "instrument": "Regulation (EU) 2023/2854",
      "source": "https://eur-lex.europa.eu/eli/reg/2023/2854/oj/eng",
      "version": "v0.6.0",
      "reads": [
        "role",
        "euMarket",
        "nature",
        "size",
        "personalData"
      ],
      "gate": "(f) => f.euMarket === true && (f.nature || []).some((n) => [\"connected-product\", \"data-processing-service\"].includes(n))",
      "rules": [
        {
          "id": "da-access-by-design",
          "check": {
            "level": "secondary",
            "on": "2026-08-09",
            "source": "Corroborated across independent professional sources on 2026-08-09; wording not read: connected products placed on the market after 12 September 2026 must be designed so that data is accessible by default"
          },
          "severity": "obligation",
          "title": "Design connected products so that the data they generate is accessible to the user by default",
          "provision": "Article 3",
          "since": "2026-09-12",
          "when": "(f) => (f.nature || []).includes(\"connected-product\") && (f.role || []).some((r) => [\"provider\", \"manufacturer\"].includes(r))"
        },
        {
          "id": "da-user-access",
          "check": {
            "level": "secondary",
            "on": "2026-08-09",
            "source": "Corroborated across independent professional sources on 2026-08-09; wording not read"
          },
          "severity": "obligation",
          "title": "Make product and related service data available to the user, and to a third party at the user's request",
          "provision": "Articles 4 and 5",
          "since": "2025-09-12",
          "when": "(f) => (f.nature || []).includes(\"connected-product\")"
        },
        {
          "id": "da-switching",
          "check": {
            "level": "official-text",
            "on": "2026-08-09",
            "source": "EUR-Lex text read on 2026-08-09: Article 29 read verbatim. From 12 January 2027 no switching charges; reduced charges permitted from 11 January 2024 until then, capped at costs directly incurred"
          },
          "severity": "obligation",
          "title": "Remove switching charges: reduced until 12 January 2027, prohibited from that date",
          "provision": "Article 29",
          "since": "2025-09-12",
          "when": "(f) => (f.nature || []).includes(\"data-processing-service\") && (f.role || []).includes(\"provider\")",
          "note": "Early termination penalties remain possible; charges for the switching process itself do not."
        },
        {
          "id": "da-switching-contract",
          "check": {
            "level": "secondary",
            "on": "2026-08-09",
            "source": "Corroborated across independent professional sources on 2026-08-09; wording not read: Chapter VI, Articles 23 to 31, requires contractual terms enabling switching to another provider or to on-premises infrastructure"
          },
          "severity": "obligation",
          "title": "Contractual terms enabling a customer to switch provider, run several in parallel, or move on premises",
          "provision": "Chapter VI, Articles 23 to 31",
          "since": "2025-09-12",
          "when": "(f) => (f.nature || []).includes(\"data-processing-service\") && (f.role || []).includes(\"provider\")"
        },
        {
          "id": "da-interop",
          "check": {
            "level": "secondary",
            "on": "2026-08-09",
            "source": "Corroborated across independent professional sources on 2026-08-09; wording not read: functional equivalence for infrastructure services, open interfaces for others"
          },
          "severity": "obligation",
          "title": "Functional equivalence for infrastructure services, and open interfaces for other data processing services",
          "provision": "Chapter VIII",
          "since": "2025-09-12",
          "when": "(f) => (f.nature || []).includes(\"data-processing-service\") && (f.role || []).includes(\"provider\")"
        },
        {
          "id": "da-intl-access",
          "check": {
            "level": "secondary",
            "on": "2026-08-09",
            "source": "Corroborated across independent professional sources on 2026-08-09; wording not read: publish the jurisdiction of the ICT infrastructure and the measures against unlawful governmental access to non-personal data"
          },
          "severity": "obligation",
          "title": "Publish the jurisdiction your infrastructure sits under, and the safeguards against unlawful international governmental access",
          "provision": "Article 32",
          "since": "2025-09-12",
          "when": "(f) => (f.nature || []).includes(\"data-processing-service\") && (f.role || []).includes(\"provider\")"
        },
        {
          "id": "da-unfair-terms",
          "check": {
            "level": "secondary",
            "on": "2026-08-09",
            "source": "Corroborated across independent professional sources on 2026-08-09; wording not read: unfairly imposed data-sharing terms are not binding; extends to pre-existing contracts from 12 September 2027"
          },
          "severity": "caution",
          "title": "Unilaterally imposed unfair data terms do not bind the other party, and this reaches older contracts from 12 September 2027",
          "provision": "Article 13",
          "since": "2025-09-12",
          "when": "(f) => (f.nature || []).some((n) => [\"connected-product\", \"data-processing-service\"].includes(n))"
        },
        {
          "id": "da-personal-data",
          "check": {
            "level": "secondary",
            "on": "2026-08-09",
            "source": "Corroborated across independent professional sources on 2026-08-09; wording not read: the Data Act covers personal and non-personal data and does not displace the GDPR"
          },
          "severity": "note",
          "title": "Where the data is personal, the GDPR continues to apply alongside this Regulation",
          "provision": "Article 1(5)",
          "since": "2025-09-12",
          "when": "(f) => f.personalData === true"
        }
      ],
      "timeline": [
        {
          "date": "2024-01-11",
          "label": "Enters into force",
          "provision": "Article 50"
        },
        {
          "date": "2025-09-12",
          "label": "Applies: data access, switching and interoperability obligations",
          "provision": "Article 50"
        },
        {
          "date": "2026-09-12",
          "label": "Access by design applies to connected products placed on the market from this date",
          "provision": "Article 3"
        },
        {
          "date": "2027-01-12",
          "label": "Switching charges prohibited entirely",
          "provision": "Article 29"
        },
        {
          "date": "2027-09-12",
          "label": "Unfair terms provisions reach contracts concluded before 12 September 2025",
          "provision": "Article 13"
        }
      ],
      "watch": [
        {
          "id": "da-omnibus",
          "title": "The Digital Omnibus proposes exemptions from the switching regime for custom-made services and a lighter regime for smaller providers",
          "status": "proposed",
          "proposedOn": "2025-11-19",
          "note": "Reported as covering custom-made services other than infrastructure services for contracts concluded before 12 September 2025. Not adopted; the obligations above apply as they stand."
        }
      ]
    },
    {
      "id": "dsa",
      "title": "Digital Services Act",
      "instrument": "Regulation (EU) 2022/2065",
      "source": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R2065",
      "version": "v0.6.0",
      "reads": [
        "role",
        "euMarket",
        "nature",
        "size",
        "platformAds",
        "minorsDirected",
        "veryLargePlatform"
      ],
      "gate": "(f) => f.euMarket === true && (f.nature || []).some((n) => [\"intermediary\", \"hosting-service\", \"online-platform\", \"marketplace\"].includes(n))",
      "rules": [
        {
          "id": "dsa-terms",
          "check": {
            "level": "official-text",
            "on": "2026-08-09",
            "source": "EUR-Lex text read on 2026-08-09: Article 14 read. Terms in clear, plain, intelligible, user-friendly and unambiguous language, publicly available and machine readable, with significant changes notified; where a service is directed at or predominantly used by minors, the conditions must be explained so minors can understand"
          },
          "severity": "obligation",
          "title": "Terms and conditions in plain language, machine readable, with changes notified",
          "provision": "Article 14",
          "since": "2024-02-17",
          "when": "() => true"
        },
        {
          "id": "dsa-contact",
          "check": {
            "level": "secondary",
            "on": "2026-08-09",
            "source": "Corroborated across independent professional sources on 2026-08-09; wording not read: single points of contact for authorities and for recipients, and a legal representative where not established in the Union"
          },
          "severity": "obligation",
          "title": "A point of contact for authorities and for users, and a legal representative if you are not established in the Union",
          "provision": "Articles 11 to 13",
          "since": "2024-02-17",
          "when": "() => true"
        },
        {
          "id": "dsa-notice-action",
          "check": {
            "level": "secondary",
            "on": "2026-08-09",
            "source": "Corroborated across independent professional sources on 2026-08-09; wording not read: Article 16 requires easy-to-access, user-friendly electronic notice mechanisms for illegal content"
          },
          "severity": "obligation",
          "title": "Notice and action mechanism for illegal content, easy to access and electronic",
          "provision": "Article 16",
          "since": "2024-02-17",
          "when": "(f) => (f.nature || []).some((n) => [\"hosting-service\", \"online-platform\", \"marketplace\"].includes(n))"
        },
        {
          "id": "dsa-reasons",
          "check": {
            "level": "secondary",
            "on": "2026-08-09",
            "source": "Corroborated across independent professional sources on 2026-08-09; wording not read: a statement of reasons for each restriction, submitted to the Commission database for online platforms"
          },
          "severity": "obligation",
          "title": "A statement of reasons for every restriction, published to the Commission's database by online platforms",
          "provision": "Articles 17 and 24(5)",
          "since": "2024-02-17",
          "when": "(f) => (f.nature || []).some((n) => [\"hosting-service\", \"online-platform\", \"marketplace\"].includes(n))"
        },
        {
          "id": "dsa-complaints",
          "check": {
            "level": "official-text",
            "on": "2026-08-09",
            "source": "EUR-Lex text read on 2026-08-09: Article 20(1) read. Online platforms must give access to an effective internal complaint-handling system, electronically and free of charge, for at least six months after the decision"
          },
          "severity": "obligation",
          "title": "Internal complaint handling, free and electronic, open for at least six months",
          "provision": "Article 20",
          "since": "2024-02-17",
          "when": "(f) => (f.nature || []).some((n) => [\"online-platform\", \"marketplace\"].includes(n))"
        },
        {
          "id": "dsa-odr",
          "check": {
            "level": "secondary",
            "on": "2026-08-09",
            "source": "Corroborated across independent professional sources on 2026-08-09; wording not read"
          },
          "severity": "obligation",
          "title": "Out-of-court dispute settlement available to users, and cooperation with trusted flaggers",
          "provision": "Articles 21 and 22",
          "since": "2024-02-17",
          "when": "(f) => (f.nature || []).some((n) => [\"online-platform\", \"marketplace\"].includes(n))"
        },
        {
          "id": "dsa-dark-patterns",
          "check": {
            "level": "secondary",
            "on": "2026-08-09",
            "source": "Corroborated across independent professional sources on 2026-08-09; wording not read: Article 25 prohibits interface design that deceives, manipulates or distorts users' ability to make free decisions"
          },
          "severity": "prohibited",
          "title": "Interfaces that deceive or manipulate a user's ability to decide freely are prohibited",
          "provision": "Article 25",
          "since": "2024-02-17",
          "when": "(f) => (f.nature || []).some((n) => [\"online-platform\", \"marketplace\"].includes(n))"
        },
        {
          "id": "dsa-ads",
          "check": {
            "level": "secondary",
            "on": "2026-08-09",
            "source": "Corroborated across independent professional sources on 2026-08-09; wording not read: advertising must be identifiable, with the payer and the main targeting parameters disclosed; profiling on special categories is prohibited"
          },
          "severity": "obligation",
          "title": "Advertising identifiable in real time, with the payer and the main targeting parameters shown, and no targeting on special categories",
          "provision": "Article 26",
          "since": "2024-02-17",
          "when": "(f) => f.platformAds === true && (f.nature || []).some((n) => [\"online-platform\", \"marketplace\"].includes(n))"
        },
        {
          "id": "dsa-minors",
          "check": {
            "level": "secondary",
            "on": "2026-08-09",
            "source": "Corroborated across independent professional sources on 2026-08-09; wording not read: no advertising based on profiling where the platform is aware the recipient is a minor"
          },
          "severity": "prohibited",
          "title": "No advertising based on profiling where you know the recipient is a minor",
          "provision": "Article 28(2)",
          "since": "2024-02-17",
          "when": "(f) => f.minorsDirected === true && (f.nature || []).some((n) => [\"online-platform\", \"marketplace\"].includes(n))"
        },
        {
          "id": "dsa-traders",
          "check": {
            "level": "secondary",
            "on": "2026-08-09",
            "source": "Corroborated across independent professional sources on 2026-08-09; wording not read: marketplaces must obtain and check trader identification before allowing use of the service"
          },
          "severity": "obligation",
          "title": "Know your business customer: obtain and verify trader details before allowing them to sell",
          "provision": "Articles 30 to 32",
          "since": "2024-02-17",
          "when": "(f) => (f.nature || []).includes(\"marketplace\")"
        },
        {
          "id": "dsa-sme-exclusion",
          "check": {
            "level": "secondary",
            "on": "2026-08-09",
            "source": "Corroborated across independent professional sources on 2026-08-09; wording not read: Article 19 excludes micro and small enterprises from the platform-specific obligations in Section 3"
          },
          "severity": "note",
          "title": "Micro and small enterprises are excluded from the platform-specific obligations",
          "provision": "Article 19",
          "since": "2024-02-17",
          "when": "(f) => [\"micro\", \"small\"].includes(f.size) && (f.nature || []).some((n) => [\"online-platform\", \"marketplace\"].includes(n))",
          "note": "The hosting and intermediary duties above still apply. The exclusion does not survive designation as a very large platform."
        },
        {
          "id": "dsa-vlop",
          "check": {
            "level": "secondary",
            "on": "2026-08-09",
            "source": "Corroborated across independent professional sources on 2026-08-09; wording not read: systemic risk assessment and mitigation, independent audit, advertisement repository and researcher data access for designated very large platforms"
          },
          "severity": "obligation",
          "title": "Systemic risk assessment and mitigation, independent audit, ad repository and researcher access",
          "provision": "Articles 34 to 40",
          "since": "2023-08-25",
          "when": "(f) => f.veryLargePlatform === true"
        }
      ],
      "timeline": [
        {
          "date": "2022-11-16",
          "label": "Enters into force",
          "provision": "Article 93"
        },
        {
          "date": "2023-08-25",
          "label": "Applies to designated very large platforms and search engines",
          "provision": "Article 92"
        },
        {
          "date": "2024-02-17",
          "label": "Applies to all intermediary services",
          "provision": "Article 93"
        }
      ],
      "watch": []
    },
    {
      "id": "dora",
      "title": "Digital Operational Resilience Act",
      "instrument": "Regulation (EU) 2022/2554",
      "source": "https://eur-lex.europa.eu/eli/reg/2022/2554/oj/eng",
      "version": "v0.6.0",
      "reads": [
        "euMarket",
        "sector",
        "financialEntity",
        "ictProviderToFinance",
        "essentialEntity"
      ],
      "gate": "(f) => f.euMarket === true && (f.financialEntity === true || f.ictProviderToFinance === true)",
      "rules": [
        {
          "id": "dora-governance",
          "check": {
            "level": "secondary",
            "on": "2026-08-09",
            "source": "Corroborated across independent professional sources on 2026-08-09; wording not read: the management body bears final responsibility for ICT risk management"
          },
          "severity": "obligation",
          "title": "The management body carries final responsibility for ICT risk, and must be able to show it",
          "provision": "Article 5",
          "since": "2025-01-17",
          "when": "(f) => f.financialEntity === true"
        },
        {
          "id": "dora-ict-risk",
          "check": {
            "level": "secondary",
            "on": "2026-08-09",
            "source": "Corroborated across independent professional sources on 2026-08-09; wording not read: an ICT risk management framework covering protection, detection, response, recovery and learning"
          },
          "severity": "obligation",
          "title": "An ICT risk management framework: identify, protect, detect, respond, recover and learn",
          "provision": "Articles 6 to 16",
          "since": "2025-01-17",
          "when": "(f) => f.financialEntity === true"
        },
        {
          "id": "dora-incidents",
          "check": {
            "level": "secondary",
            "on": "2026-08-09",
            "source": "Corroborated across independent professional sources on 2026-08-09; wording not read: classification of ICT-related incidents and reporting of major incidents to the competent authority"
          },
          "severity": "obligation",
          "title": "Classify ICT incidents and report major ones to your competent authority",
          "provision": "Articles 17 to 23",
          "since": "2025-01-17",
          "when": "(f) => f.financialEntity === true"
        },
        {
          "id": "dora-testing",
          "check": {
            "level": "secondary",
            "on": "2026-08-09",
            "source": "Corroborated across independent professional sources on 2026-08-09; wording not read: a digital operational resilience testing programme, with threat-led penetration testing for significant entities"
          },
          "severity": "obligation",
          "title": "A resilience testing programme, with threat-led penetration testing where you are significant",
          "provision": "Articles 24 to 27",
          "since": "2025-01-17",
          "when": "(f) => f.financialEntity === true"
        },
        {
          "id": "dora-third-party",
          "check": {
            "level": "secondary",
            "on": "2026-08-09",
            "source": "Corroborated across independent professional sources on 2026-08-09; wording not read: a register of information on contractual arrangements with ICT third-party providers, and mandatory contractual terms including exit strategies"
          },
          "severity": "obligation",
          "title": "A register of ICT third-party arrangements, mandatory contract terms, and a documented exit strategy for each",
          "provision": "Articles 28 to 30",
          "since": "2025-01-17",
          "when": "(f) => f.financialEntity === true"
        },
        {
          "id": "dora-critical-provider",
          "check": {
            "level": "secondary",
            "on": "2026-08-09",
            "source": "Corroborated across independent professional sources on 2026-08-09; wording not read: critical ICT third-party providers are subject to an EU oversight framework"
          },
          "severity": "caution",
          "title": "If designated critical, an ICT provider to the financial sector comes under direct EU oversight",
          "provision": "Articles 31 to 44",
          "since": "2025-01-17",
          "when": "(f) => f.ictProviderToFinance === true",
          "note": "Designation is a decision taken about you rather than something you elect. Contractual duties reach you long before designation does."
        }
      ],
      "timeline": [
        {
          "date": "2023-01-16",
          "label": "Enters into force",
          "provision": "Article 64"
        },
        {
          "date": "2025-01-17",
          "label": "Applies",
          "provision": "Article 64"
        }
      ],
      "watch": [
        {
          "id": "dora-omnibus",
          "title": "The Data Omnibus proposes a single entry point for incident reporting across DORA, NIS2 and the GDPR",
          "status": "proposed",
          "proposedOn": "2025-11-19",
          "note": "Still in negotiation. Report separately until it is adopted."
        }
      ]
    },
    {
      "id": "eaa",
      "title": "European Accessibility Act",
      "instrument": "Directive (EU) 2019/882",
      "source": "https://eur-lex.europa.eu/eli/dir/2019/882/oj",
      "version": "v0.6.0",
      "isDirective": true,
      "reads": [
        "role",
        "euMarket",
        "size",
        "consumerFacing",
        "eaaService",
        "lifecycle"
      ],
      "gate": "(f) => f.euMarket === true && f.consumerFacing === true && f.eaaService && f.eaaService !== \"none\"",
      "rules": [
        {
          "id": "eaa-transposition",
          "check": {
            "level": "secondary",
            "on": "2026-08-09",
            "source": "Corroborated across independent professional sources on 2026-08-09; wording not read: a directive transposed by all Member States, with enforcement from 28 June 2025 and penalties set nationally"
          },
          "severity": "caution",
          "title": "Your obligations are those of the transposing national law, not the directive itself",
          "provision": "Article 30",
          "since": "2025-06-28",
          "when": "() => true",
          "note": "All Member States have transposed it, but penalties and enforcement differ by country. Check the transposing act where you operate."
        },
        {
          "id": "eaa-requirements",
          "check": {
            "level": "secondary",
            "on": "2026-08-09",
            "source": "Corroborated across independent professional sources on 2026-08-09; wording not read: Annex I sets functional accessibility requirements; conformity with the harmonised standard EN 301 549 creates a presumption of conformity"
          },
          "severity": "obligation",
          "title": "Meet the functional accessibility requirements; EN 301 549 gives a presumption of conformity",
          "provision": "Annex I",
          "since": "2025-06-28",
          "when": "(f) => !(f.size === \"micro\" && !(f.role || []).some((r) => [\"manufacturer\", \"importer\", \"distributor\"].includes(r)))"
        },
        {
          "id": "eaa-information",
          "check": {
            "level": "secondary",
            "on": "2026-08-09",
            "source": "Corroborated across independent professional sources on 2026-08-09; wording not read: service providers must publish information on how the service meets the accessibility requirements"
          },
          "severity": "obligation",
          "title": "Publish how the service meets the accessibility requirements, and keep it current",
          "provision": "Article 13 and Annex V",
          "since": "2025-06-28",
          "when": "(f) => (f.role || []).some((r) => [\"provider\", \"deployer\"].includes(r))"
        },
        {
          "id": "eaa-micro",
          "check": {
            "level": "secondary",
            "on": "2026-08-09",
            "source": "Corroborated across independent professional sources on 2026-08-09; wording not read: microenterprises providing services are exempt; microenterprises manufacturing or distributing covered products are not"
          },
          "severity": "note",
          "title": "Microenterprises providing services are exempt, but not microenterprises making or distributing covered products",
          "provision": "Article 4(5)",
          "since": "2025-06-28",
          "when": "(f) => f.size === \"micro\""
        },
        {
          "id": "eaa-burden",
          "check": {
            "level": "secondary",
            "on": "2026-08-09",
            "source": "Corroborated across independent professional sources on 2026-08-09; wording not read: a disproportionate burden defence exists, and must be assessed, documented and re-assessed"
          },
          "severity": "note",
          "title": "The disproportionate burden defence must be assessed, documented and periodically reviewed, not merely asserted",
          "provision": "Article 14",
          "since": "2025-06-28",
          "when": "() => true"
        },
        {
          "id": "eaa-legacy",
          "check": {
            "level": "secondary",
            "on": "2026-08-09",
            "source": "Corroborated across independent professional sources on 2026-08-09; wording not read: service contracts concluded before 28 June 2025 may continue until 28 June 2030 at the latest"
          },
          "severity": "note",
          "title": "Services provided under contracts concluded before 28 June 2025 have until 28 June 2030",
          "provision": "Article 32",
          "since": "2025-06-28",
          "when": "(f) => f.lifecycle === \"already\""
        }
      ],
      "timeline": [
        {
          "date": "2019-06-07",
          "label": "Published in the Official Journal",
          "provision": "Article 33"
        },
        {
          "date": "2022-06-28",
          "label": "Member States were required to transpose it",
          "provision": "Article 31"
        },
        {
          "date": "2025-06-28",
          "label": "Obligations apply to products and services placed on the market from this date",
          "provision": "Article 31"
        },
        {
          "date": "2030-06-28",
          "label": "Transitional period ends for services under earlier contracts",
          "provision": "Article 32"
        }
      ],
      "watch": []
    }
  ],
  "overlaps": [
    {
      "id": "ov-ce-double",
      "title": "Two conformity assessments under one CE marking",
      "packs": [
        "ai-act",
        "cra"
      ],
      "when": "(f, fired) => fired.has(\"aia-hr-annexi\") || (fired.has(\"cra-conformity\") && (f.nature || []).includes(\"ai-system\"))",
      "provisions": [
        "AI Act Articles 43 and 48",
        "CRA Articles 32 and 30"
      ],
      "detail": "A product carrying digital elements and an AI safety component must satisfy both regimes and affix a single CE marking. Plan one technical file and one assessment route rather than two projects that meet at the end."
    },
    {
      "id": "ov-incident-three-clocks",
      "title": "One incident, three reporting duties on different clocks",
      "packs": [
        "gdpr",
        "nis2",
        "ai-act"
      ],
      "when": "(f, fired) => [fired.has(\"gdpr-breach\"), fired.has(\"nis2-reporting\"), fired.has(\"aia-o-postmarket\")].filter(Boolean).length >= 2",
      "provisions": [
        "GDPR Articles 33 and 34",
        "NIS2 Article 23",
        "AI Act Article 73"
      ],
      "detail": "The same event can require an early warning within 24 hours, a personal data notification within 72, and a serious incident report under the AI Act, to different authorities. One runbook, one decision tree, one owner; the Data Omnibus proposes a single entry point but has not been adopted."
    },
    {
      "id": "ov-dpia-fria",
      "title": "A data protection impact assessment and a fundamental rights impact assessment",
      "packs": [
        "gdpr",
        "ai-act"
      ],
      "when": "(f, fired) => fired.has(\"gdpr-dpia\") && fired.has(\"aia-d-fria\")",
      "provisions": [
        "GDPR Article 35",
        "AI Act Article 27"
      ],
      "detail": "Two assessments with overlapping evidence and different questions. The AI Act permits building on an existing data protection assessment rather than repeating it; the fundamental rights questions are additional, not a subset."
    },
    {
      "id": "ov-article22-transparency",
      "title": "Automated decisions meet AI Act transparency",
      "packs": [
        "gdpr",
        "ai-act"
      ],
      "when": "(f, fired) => fired.has(\"gdpr-automated\") && (fired.has(\"aia-hr-annexiii\") || fired.has(\"aia-d-subjects\"))",
      "provisions": [
        "GDPR Article 22",
        "AI Act Articles 26(11) and 86"
      ],
      "detail": "A person subject to an automated decision has rights under both: meaningful information about the logic, and an explanation of the role the system played. The two duties are satisfied together or not at all."
    },
    {
      "id": "ov-cra-security-gdpr",
      "title": "Product security requirements and processing security",
      "packs": [
        "cra",
        "gdpr"
      ],
      "when": "(f, fired) => fired.has(\"cra-essential\") && fired.has(\"gdpr-security\")",
      "provisions": [
        "CRA Annex I",
        "GDPR Article 32"
      ],
      "detail": "The CRA sets requirements for the product; Article 32 sets them for the processing. Evidence for one is usually evidence for the other, and a single control set mapped to both saves the second audit."
    },
    {
      "id": "ov-nis2-national",
      "title": "A directive and a regulation in the same programme",
      "packs": [
        "nis2",
        "ai-act"
      ],
      "when": "(f, fired) => fired.has(\"nis2-transposition\") && fired.size > 3",
      "provisions": [
        "NIS2 Article 41"
      ],
      "detail": "The regulations bind identically across the Union; NIS2 binds as each Member State transposed it. A single compliance programme therefore has one part that travels and one part that does not, and the second must be checked per country."
    },
    {
      "id": "ov-dora-nis2",
      "title": "DORA displaces NIS2 for a financial entity's ICT risk",
      "packs": [
        "dora",
        "nis2"
      ],
      "when": "(f, fired) => fired.has(\"dora-ict-risk\") && fired.has(\"nis2-measures\")",
      "provisions": [
        "DORA Article 1(2)",
        "NIS2 Article 4"
      ],
      "detail": "Where DORA covers the same ground, it applies as the more specific law and NIS2's corresponding duties do not stack on top. That is a reason to map the two rather than run two programmes, and a reason not to assume the NIS2 obligation has simply vanished: the displacement is provision by provision, not wholesale."
    },
    {
      "id": "ov-dsa-gdpr-ads",
      "title": "Advertising transparency meets lawful processing",
      "packs": [
        "dsa",
        "gdpr"
      ],
      "when": "(f, fired) => fired.has(\"dsa-ads\") && fired.has(\"gdpr-lawful-basis\")",
      "provisions": [
        "DSA Articles 26 and 28",
        "GDPR Articles 6, 9 and 22"
      ],
      "detail": "The DSA requires an advertisement to be identifiable and its targeting parameters disclosed; the GDPR governs whether that targeting may happen at all. Special-category profiling is prohibited under both, and disclosing unlawful targeting does not make it lawful."
    },
    {
      "id": "ov-dataact-gdpr",
      "title": "Data sharing under the Data Act meets data protection",
      "packs": [
        "data-act",
        "gdpr"
      ],
      "when": "(f, fired) => fired.has(\"da-user-access\") && fired.has(\"gdpr-lawful-basis\")",
      "provisions": [
        "Data Act Articles 4, 5 and 1(5)",
        "GDPR Articles 6 and 20"
      ],
      "detail": "A user's right to have product data sent to a third party is not itself a lawful basis for processing anyone else's personal data caught up in it. Where the data set mixes personal and non-personal data, both regimes apply to the same transfer."
    },
    {
      "id": "ov-dataact-dora-exit",
      "title": "Cloud switching rights meet financial exit strategies",
      "packs": [
        "data-act",
        "dora"
      ],
      "when": "(f, fired) => fired.has(\"da-switching-contract\") && fired.has(\"dora-third-party\")",
      "provisions": [
        "Data Act Chapter VI",
        "DORA Articles 28 to 30"
      ],
      "detail": "Both regimes reach the same cloud contract from opposite directions: one gives the customer a right to leave, the other requires the financial customer to have a documented exit strategy and specific contractual terms. One contract review satisfies both if it is scoped that way; two separate ones usually contradict each other."
    },
    {
      "id": "ov-eaa-ai-transparency",
      "title": "Accessibility requirements meet AI transparency duties",
      "packs": [
        "eaa",
        "ai-act"
      ],
      "when": "(f, fired) => fired.has(\"eaa-requirements\") && fired.has(\"aia-t-interaction\")",
      "provisions": [
        "EAA Annex I",
        "AI Act Article 50(1)"
      ],
      "detail": "Telling a person they are speaking to an AI system only counts if they can perceive the notice. A disclosure delivered in a way that fails the accessibility requirements satisfies neither instrument."
    },
    {
      "id": "ov-dsa-eaa",
      "title": "A consumer platform is covered twice over",
      "packs": [
        "dsa",
        "eaa"
      ],
      "when": "(f, fired) => fired.has(\"dsa-terms\") && fired.has(\"eaa-requirements\")",
      "provisions": [
        "DSA Article 14",
        "EAA Annex I"
      ],
      "detail": "The DSA requires terms in plain, intelligible language; the Accessibility Act requires the interface delivering them to be perceivable and operable. Plain language in an inaccessible interface fails the second test while passing the first."
    },
    {
      "id": "ov-ai-in-product",
      "title": "An AI system inside a regulated product",
      "packs": [
        "ai-act",
        "cra"
      ],
      "when": "(f) => (f.nature || []).includes(\"ai-system\") && (f.nature || []).includes(\"product-digital-elements\")",
      "provisions": [
        "AI Act Article 6(1)",
        "CRA Article 12"
      ],
      "detail": "Being a product with digital elements does not by itself make the AI high-risk, and being high-risk does not by itself trigger the CRA. Check both routes separately; they share a technical file but not a test."
    }
  ]
}