Manufacturing & Supply Chain
AI Trade Compliance: Customs Classification, Export-Control & Sanctions Screening
Minimal RiskUnverifiedDiscuss / dispute
AI that turns BOMs, part numbers and shipping documents into trade decisions for an importer, exporter, forwarder or customs broker: tariff classification and origin (HS/CN/TARIC/HTSUS), restricted-party screening of counterparties, owners and end-uses, export-licence and dual-use determination, and drafting of customs declarations and licence applications. Scope: private-sector decisions about shipments, counterparties and filings; not a customs authority's own risk targeting or a financial institution's payment screening.
Consensus classification rationale: Minimal-risk under the AI Act (no Annex III area covers classifying goods, screening companies or drafting declarations for a private operator), but the outputs are legally operative and the duty sits with the person who files, exports or imports, not with the tool. In the EU, whoever lodges a customs declaration answers for the accuracy and completeness of its information, and a customs representative is equally bound (Union Customs Code Art. 15(2)); Annex I dual-use exports need an authorisation, and an exporter aware that a non-listed item is intended for a proscribed end-use must notify the authority (Regulation (EU) 2021/821 Arts 3(1), 4(2)); and Directive (EU) 2024/1226 requires criminal offences for intentional breaches of Union restrictive measures (making funds available to a designated person, failing to freeze), with a corporate fine maximum of not less than 5% of worldwide turnover or EUR 40 million, and serious negligence for trade in military and Annex I/IV dual-use goods. In the US, the importer of record must use reasonable care to enter, classify and value goods (19 U.S.C. § 1484(a)(1); penalties under § 1592), the EAR bar acting with knowledge of a violation (15 CFR 764.2(e)), and OFAC names screening software faults as a root cause of violations. Each regime is asked as a gate because its scope turns on facts a description rarely states; GDPR attaches only to the natural persons in the data (owners, directors, shipping contacts), not to data about legal persons.
Decision attributes in force
Autonomyhuman-in-the-loop — Drives the human-oversight duties (Art. 14, Art. 26(2)) and Art. 50 disclosure.
Profiling of natural personsno — Feeds the Art. 6(3) second-subparagraph override directly — profiling makes the derogation categorically unavailable.
Affected subjectsnatural-person — Instruments scoped to natural persons drop out of scope when only legal entities are assessed.
Deployer typeprivate-enterprise — Selects between the recorded alternate classification readings.
Role in the value chainboth — Splits provider duties, deployer duties and upstream GPAI duties.
Consequential scoringno — Consequential scoring of natural persons requires intrinsic interpretability, not post-hoc explanation only.
Indicative decision support, not legal advice. Risk classification depends on your concrete deployment context and can change with scope drift — validate the result with qualified counsel.
Target market(s)European UnionUnited States (federal)change
Changes which instruments below count as in scope for this profile.
Target markets: European Union, United States (federal)
Regulatory footprint
8 instruments across 3 of 7 regulatory domains, plus 5 standards references- AI law1 instrument
- Data protection1 instrument
- Cyber & resiliencenone triggered
- Online safety & platformsnone triggered
- Product safetynone triggered
- Financial servicesnone triggered
- Sector & employment6 instruments
- Standards5 references
By jurisdiction
- EU5European UnionEU AI Act, EU Directive on Criminal Penalties for Violating Union Restrictive Measures (2024/1226), EU Dual-Use Export Control Regulation (EU) 2021/821, GDPR, Union Customs Code - Regulation (EU) No 952/2013
- US3United States (federal)US Customs Entry and Penalty Regime (19 U.S.C. §§ 1484, 1592), US Export Administration Regulations (EAR), US OFAC Sanctions - IEEPA, Enforcement Guidelines and Compliance Framework
The AI Act is one dimension of this footprint, not the whole of it — every domain above carries its own obligations and deadlines. See the instruments in the graph →
Confidence in this chain of evidenceConfidence: Check-worthy
The chain holds, but at least one hop rests on a secondary source, an ageing verification or a practice-derived step. Check the flagged hops before you rely on them.
Computed weakest-link over 24 evaluated hops across 1 target market: a chain is only as strong as its weakest step, so the band follows the worst hop rather than an average that would hide it. Five factors per hop — source tier, verification age, status certainty, community hardening, derivation kind — all read from graph data, never from a hand-set score.
Why this band8 factors lowered the band — each links to the claim behind it
- Source tier: Union Customs Code - Regulation (EU) No 952/2013 carries no resolvable citation — the claim is uncited. open node →
- Source tier: US Export Administration Regulations (EAR) carries no resolvable citation — the claim is uncited. open node →
- Source tier: JTC 21 Technical Package (prEN 18228/18229/18281–83) rests on a secondary source (tracker or summary), not on the primary text. open node → primary source →
- Source tier: IEEE CertifAIEd™ carries no resolvable citation — the claim is uncited. open node →
- Source tier: prEN 18229-1 (Trustworthiness Framework, part 1) rests on a secondary source (tracker or summary), not on the primary text. open node → primary source →
- Status certainty: JTC 21 Technical Package (prEN 18228/18229/18281–83) is "draft", not settled in-force law. open node → primary source →
- Status certainty: prEN 18229-1 (Trustworthiness Framework, part 1) is "enquiry", not settled in-force law. open node → primary source →
- Verification age: IEEE CertifAIEd™ has no recorded verification date. open node →
Compliance brief
This use case is minimal-risk under the EU AI Act (Minimal Risk); no product-specific obligations beyond general AI literacy apply.
What is owed
- Art. 4. Providers and deployers must ensure sufficient AI literacy of staff dealing with AI systems.
- GDPR Art. 22. Right not to be subject to solely automated decisions with legal/similar effect; requires meaningful human involvement or explicit legal basis + safeguards.
- GDPR Art. 27. A controller or processor not established in the Union that falls within Art.
- GDPR Art. 17. Right to erasure collides with AI Act Art.
- GDPR Art. 25. Privacy by design & default: minimisation, pseudonymisation, PII filters in pipelines and vector stores.
Dates that bind
- 2024-08-01 — AI Act enters into force. Regulation (EU) 2024/1689 in force; countdown for all staged obligations starts.
- 2025-02-02 — Prohibitions + AI literacy. Art. 5 prohibited practices ban applies (manipulation, social scoring, untargeted face scraping, workplace emotion recognition); Art. 4 AI literacy duty.
Maximum exposure
- EU AI Act: Tiered: €35m / 7% (prohibited practices); €15m / 3% (Art. 9–15 high-risk obligations incl. data governance, documentation, logging); €7.5m / 1% (Art. 99(5) — incorrect, incomplete or misleading information to notified bodies or national competent authorities)
- GDPR: Up to €20m or 4% of worldwide annual turnover
- Union Customs Code - Regulation (EU) No 952/2013: Penalties are set by each Member State: Art. 42(1) requires them to be 'effective, proportionate and dissuasive', and Art. 42(2) names a pecuniary charge by the customs authorities or the revocation, suspension or amendment of an authorisation as possible administrative forms. The Regulation sets no EU-wide amounts.
- EU Dual-Use Export Control Regulation (EU) 2021/821: Art. 25(1): each Member State lays down the penalties applicable to infringements, which 'shall be effective, proportionate and dissuasive'. The Regulation sets no EU-wide amounts.
- EU Directive on Criminal Penalties for Violating Union Restrictive Measures (2024/1226): Natural persons: a maximum penalty of imprisonment (Art. 5(2)). Legal persons: fines whose maximum is not less than 5 % of total worldwide turnover or EUR 40 000 000 for the Art. 3(1)(a) to (g) offences (Art. 7(2)(b)), and possibly exclusion from public benefits, aid or funding, disqualification from business activities, withdrawal of permits, judicial supervision or winding-up (Art. 7(1)). The figures are minimum maxima that Member States must provide for in national law.
- US Customs Entry and Penalty Regime (19 U.S.C. §§ 1484, 1592): § 1592(c): civil penalty for fraud up to the domestic value of the merchandise; for gross negligence up to the lesser of the domestic value or four times the lawful duties, taxes and fees lost (40 percent of the dutiable value if the violation did not affect the assessment of duties); for negligence up to the lesser of the domestic value or two times the lawful duties, taxes and fees lost (20 percent of the dutiable value if the assessment of duties was not affected). A prior disclosure limits the penalty (§ 1592(c)(4)).
- US Export Administration Regulations (EAR): 15 CFR § 764.3: a civil monetary penalty per violation up to the amount set in ECRA (50 U.S.C. § 4819(c)(1)(A): the greater of a fixed dollar maximum, USD 300,000 in the statute and inflation-adjusted in 15 CFR § 6.3, or twice the value of the transaction), denial of export privileges, and exclusion of an attorney, accountant, consultant, freight forwarder or other representative from practice before BIS; willful violations are criminal, with a fine of up to USD 1,000,000 and, for an individual, imprisonment of up to 20 years (§ 764.3(b)).
- US OFAC Sanctions - IEEPA, Enforcement Guidelines and Compliance Framework: Civil penalty per violation up to the greater of a statutory amount or twice the underlying transaction (50 U.S.C. § 1705(b): USD 250,000; USD 377,700 in the inflation-adjusted figure printed in 31 CFR Part 501, Appendix A, Part V.B.2.a.v as retrieved); willful violations are criminal, with a fine of up to USD 1,000,000 and, for a natural person, imprisonment of up to 20 years (§ 1705(c)). The Framework is guidance with no penalty of its own; OFAC states that it may mitigate a civil monetary penalty on the basis of an effective sanctions compliance programme.
First five actions
- Confirm in writing whether this organisation builds/places the system on the market (provider) or only operates it (deployer), since the role is not yet established.
- Commission and confirm the Art. 4, GDPR Art. 22, GDPR Art. 27 obligations named above as active workstreams with an accountable owner.
- Design and document a human-oversight procedure appropriate to how this system is used.
- Produce the technical documentation and evidence artefacts already mapped to this use case (HITL Escalation Queue & Review UI, Adverse-Decision Reason Generator, Bitemporal Memory (GDPR×Art.12)) before they are requested.
- Put 2024-08-01 — AI Act enters into force — into the compliance calendar with an owner and lead time.
Terms used above: · · ·
Classification precedent
Consensus reading: Minimal Risk open in the graph →
Minimal-risk under the AI Act (no Annex III area covers classifying goods, screening companies or drafting declarations for a private operator), but the outputs are legally operative and the duty sits with the person who files, exports or imports, not with the tool. In the EU, whoever lodges a customs declaration answers for the accuracy and completeness of its information, and a customs representative is equally bound (Union Customs Code Art. 15(2)); Annex I dual-use exports need an authorisation, and an exporter aware that a non-listed item is intended for a proscribed end-use must notify the authority (Regulation (EU) 2021/821 Arts 3(1), 4(2)); and Directive (EU) 2024/1226 requires criminal offences for intentional breaches of Union restrictive measures (making funds available to a designated person, failing to freeze), with a corporate fine maximum of not less than 5% of worldwide turnover or EUR 40 million, and serious negligence for trade in military and Annex I/IV dual-use goods. In the US, the importer of record must use reasonable care to enter, classify and value goods (19 U.S.C. § 1484(a)(1); penalties under § 1592), the EAR bar acting with knowledge of a violation (15 CFR 764.2(e)), and OFAC names screening software faults as a root cause of violations. Each regime is asked as a gate because its scope turns on facts a description rarely states; GDPR attaches only to the natural persons in the data (owners, directors, shipping contacts), not to data about legal persons.
What the reading rests on — the provisions this classification actually pulls in:
- Art. 4 — AI Literacy
- EU AI Act (Regulation (EU) 2024/1689)
- GDPR (Regulation (EU) 2016/679)
- Union Customs Code - Regulation (EU) No 952/2013 (Regulation (EU) No 952/2013 of the European Parliament and of the Council of 9 October 2013 laying down the Union Customs Code)
- EU Dual-Use Export Control Regulation (EU) 2021/821 (Regulation (EU) 2021/821 of the European Parliament and of the Council of 20 May 2021 setting up a Union regime for the control of exports, brokering, technical assistance, transit and transfer of dual-use items (recast))
- EU Directive on Criminal Penalties for Violating Union Restrictive Measures (2024/1226) (Directive (EU) 2024/1226 of the European Parliament and of the Council of 24 April 2024 on the definition of criminal offences and penalties for the violation of Union restrictive measures and amending Directive (EU) 2018/1673)
- US Customs Entry and Penalty Regime (19 U.S.C. §§ 1484, 1592) (19 U.S.C. § 1484 (Entry of merchandise) and 19 U.S.C. § 1592 (Penalties for fraud, gross negligence, and negligence))
- US Export Administration Regulations (EAR) (Export Administration Regulations, 15 CFR Parts 730-774 (violations: 15 CFR § 764.2; knowledge: 15 CFR § 772.1))
No dissenting reading is recorded for this case. That means nobody has filed one yet — not that the classification is beyond argument. file a dissent with a source →
Baseline: of 100+, 40% were not definitively classifiable (18% clearly high-risk, 42% clearly low-risk). appliedAI Institute — AI Act risk classification of AI systems from a practical perspective
Applicable Regulations (8)
EU AI Act (Regulation (EU) 2024/1689)
unverified · verified 2026-08-12 source (as amended) EUR-LexAmended by Regulation (EU) 2026/1744. Verified 16 Aug 2026: the popular mirrors have not yet been updated — artificialintelligenceact.eu still serves the unamended 13 June 2024 text with no disclaimer, and the Commission's AI Act Service Desk pages still show pre-omnibus text with a visible omnibus disclaimer. Read the OJ or consolidated text on EUR-Lex. in force EU
Horizontal, risk-based product-safety law for AI systems and GPAI models. Extraterritorial market-place principle. Staged applicability 2025–2030 (Digital Omnibus: Art. 50 → 2 Aug 2026, Annex III → 2 Dec 2027, Annex I → 2 Aug 2028). (Digital Omnibus: Regulation (EU) 2026/1744, in force 27 July 2026).
Sanctions: Tiered: €35m / 7% (prohibited practices); €15m / 3% (Art. 9–15 high-risk obligations incl. data governance, documentation, logging); €7.5m / 1% (Art. 99(5) — incorrect, incomplete or misleading information to notified bodies or national competent authorities)
GDPR (Regulation (EU) 2016/679)
Applies unchanged next to the AI Act for all personal data in training, fine-tuning, RAG and inference. Key friction points: Art. 22 automated decisions, Art. 17 erasure vs. AI Act logging, Art. 35 DPIA.
Sanctions: Up to €20m or 4% of worldwide annual turnover
Union Customs Code - Regulation (EU) No 952/2013 (Regulation (EU) No 952/2013 of the European Parliament and of the Council of 9 October 2013 laying down the Union Customs Code)
in-force · verified 2026-09-21 in force EU
General rules and procedures for goods brought into or taken out of the customs territory of the Union (Art. 1(1)). Art. 15(2): lodging a customs declaration, a temporary storage, entry summary, exit summary or re-export declaration or notification, or an application for an authorisation or other decision, makes the person responsible for the accuracy and completeness of its information, the authenticity, accuracy and validity of supporting documents and, where applicable, compliance with the obligations of the customs procedure; a customs representative who lodges it is equally bound. Art. 33: binding tariff information (BTI) and binding origin information (BOI) decisions, valid for three years (Art. 33(3)). Art. 42(1): Member States must provide effective, proportionate and dissuasive penalties for failure to comply with the customs legislation. Regulation (EU) 2026/2108 repeals it (Art. 284(1)) and applies from 21 September 2027 (see statusNote).
Sanctions: Penalties are set by each Member State: Art. 42(1) requires them to be 'effective, proportionate and dissuasive', and Art. 42(2) names a pecuniary charge by the customs authorities or the revocation, suspension or amendment of an authorisation as possible administrative forms. The Regulation sets no EU-wide amounts.
EU Dual-Use Export Control Regulation (EU) 2021/821 (Regulation (EU) 2021/821 of the European Parliament and of the Council of 20 May 2021 setting up a Union regime for the control of exports, brokering, technical assistance, transit and transfer of dual-use items (recast))
Union regime for the control of exports, brokering, technical assistance, transit and transfer of dual-use items. Art. 3(1): an authorisation is required for the export of dual-use items listed in Annex I. Art. 4(1): an authorisation is also required for items not listed in Annex I where the exporter has been informed by the competent authority that they are or may be intended for chemical, biological or nuclear weapons or missile use, for a military end-use in an arms-embargoed destination, or as parts of unlawfully exported military items; Art. 4(2): where an exporter is aware that such items are intended for any of those uses it must notify the competent authority, which decides whether to make the export subject to authorisation. 'Export' (Art. 2(2)) includes an export procedure, a re-export, outward processing and electronic transmission of software or technology to a destination outside the customs territory of the Union; the 'exporter' is defined in Art. 2(3).
Sanctions: Art. 25(1): each Member State lays down the penalties applicable to infringements, which 'shall be effective, proportionate and dissuasive'. The Regulation sets no EU-wide amounts.
EU Directive on Criminal Penalties for Violating Union Restrictive Measures (2024/1226) (Directive (EU) 2024/1226 of the European Parliament and of the Council of 24 April 2024 on the definition of criminal offences and penalties for the violation of Union restrictive measures and amending Directive (EU) 2018/1673)
Minimum rules on criminal offences and penalties for the violation of Union restrictive measures (Art. 1). Art. 3(1) requires Member States to make intentional violations criminal offences, including making funds or economic resources available to a designated person, entity or body (point a), failing to freeze (point b) and trading, importing, exporting, selling, purchasing, transferring, transiting or transporting goods, or providing brokering services, technical assistance or other services relating to them, where a Union restrictive measure prohibits or restricts that conduct (point e); Art. 3(3) extends point (e) to serious negligence, at least for items on the Common Military List and dual-use items in Annexes I and IV to Regulation (EU) 2021/821. Legal persons can be held liable (Art. 6).
Sanctions: Natural persons: a maximum penalty of imprisonment (Art. 5(2)). Legal persons: fines whose maximum is not less than 5 % of total worldwide turnover or EUR 40 000 000 for the Art. 3(1)(a) to (g) offences (Art. 7(2)(b)), and possibly exclusion from public benefits, aid or funding, disqualification from business activities, withdrawal of permits, judicial supervision or winding-up (Art. 7(1)). The figures are minimum maxima that Member States must provide for in national law.
US Customs Entry and Penalty Regime (19 U.S.C. §§ 1484, 1592) (19 U.S.C. § 1484 (Entry of merchandise) and 19 U.S.C. § 1592 (Penalties for fraud, gross negligence, and negligence))
§ 1484(a)(1): the importer of record - one of the parties eligible under § 1484(a)(2)(B) to file the entry documentation, that is the owner or purchaser of the merchandise or, when designated by the owner, purchaser or consignee, a customs broker holding a licence under 19 U.S.C. § 1641 - must, 'using reasonable care', make entry and complete the entry by filing the declared value, classification and rate of duty applicable to the merchandise and the other information needed to assess duties, collect statistics and determine whether other legal requirements are met, in person or through an agent authorised in writing. § 1592(a)(1): no person, by fraud, gross negligence or negligence, may enter or introduce merchandise by a material false document, data, statement or act or a material omission, or aid or abet another to do so, whether or not the United States is deprived of duty; § 1592(a)(2): clerical errors and mistakes of fact are not violations unless part of a pattern of negligent conduct.
Sanctions: § 1592(c): civil penalty for fraud up to the domestic value of the merchandise; for gross negligence up to the lesser of the domestic value or four times the lawful duties, taxes and fees lost (40 percent of the dutiable value if the violation did not affect the assessment of duties); for negligence up to the lesser of the domestic value or two times the lawful duties, taxes and fees lost (20 percent of the dutiable value if the assessment of duties was not affected). A prior disclosure limits the penalty (§ 1592(c)(4)).
US Export Administration Regulations (EAR) (Export Administration Regulations, 15 CFR Parts 730-774 (violations: 15 CFR § 764.2; knowledge: 15 CFR § 772.1))
in-force · verified 2026-09-21 in force US
US controls on exports, reexports and in-country transfers of items subject to the EAR, which under 15 CFR § 734.3(a) include items in the United States, US-origin items wherever located, certain foreign-made items that incorporate controlled US-origin content and certain foreign-produced direct products. § 764.2(a): no person may engage in any transaction or take any action prohibited by or contrary to the EAR; § 764.2(e): no person may order, buy, store, sell, transport, forward or otherwise service an item with knowledge that a violation has occurred, is about to occur or is intended to occur; § 764.2(g)(1): no false or misleading representation, statement or certification, and no falsifying or concealing of a material fact, in connection with the preparation, submission, issuance, use or maintenance of an export control document. 'Knowledge' includes an awareness of a high probability (15 CFR § 772.1).
Sanctions: 15 CFR § 764.3: a civil monetary penalty per violation up to the amount set in ECRA (50 U.S.C. § 4819(c)(1)(A): the greater of a fixed dollar maximum, USD 300,000 in the statute and inflation-adjusted in 15 CFR § 6.3, or twice the value of the transaction), denial of export privileges, and exclusion of an attorney, accountant, consultant, freight forwarder or other representative from practice before BIS; willful violations are criminal, with a fine of up to USD 1,000,000 and, for an individual, imprisonment of up to 20 years (§ 764.3(b)).
US OFAC Sanctions - IEEPA, Enforcement Guidelines and Compliance Framework (International Emergency Economic Powers Act (50 U.S.C. § 1705, unlawful acts and penalties); OFAC Economic Sanctions Enforcement Guidelines, 31 CFR Part 501, Appendix A; OFAC, 'A Framework for OFAC Compliance Commitments' (2 May 2019, guidance))
The Office of Foreign Assets Control administers and enforces US economic sanctions. 50 U.S.C. § 1705(a) makes it unlawful to violate, attempt to violate, conspire to violate or cause a violation of any license, order, regulation or prohibition issued under IEEPA. The Enforcement Guidelines (31 CFR Part 501, Appendix A) weigh, among the general factors, the subject person's actual knowledge or reason to know 'based on all readily available information and with the exercise of reasonable due diligence' (Factor B) and the existence, nature and adequacy of its risk-based compliance programme (Factor E). OFAC's 2019 Framework names 'Sanctions Screening Software or Filter Faults' as root cause VI of apparent violations: failing to update screening software for SDN and SSI list changes, omitting pertinent identifiers and not accounting for alternative spellings.
Sanctions: Civil penalty per violation up to the greater of a statutory amount or twice the underlying transaction (50 U.S.C. § 1705(b): USD 250,000; USD 377,700 in the inflation-adjusted figure printed in 31 CFR Part 501, Appendix A, Part V.B.2.a.v as retrieved); willful violations are criminal, with a fine of up to USD 1,000,000 and, for a natural person, imprisonment of up to 20 years (§ 1705(c)). The Framework is guidance with no penalty of its own; OFAC states that it may mitigate a civil monetary penalty on the basis of an effective sanctions compliance programme.
Legal Obligations (10)
density
Art. 4 — AI Literacy
Providers and deployers must ensure sufficient AI literacy of staff dealing with AI systems. In force since 2 Feb 2025.
unverified · no verification date source (as amended) EUR-Lexconvenience mirror — not updated artificialintelligenceact.euAmended by Regulation (EU) 2026/1744. Verified 16 Aug 2026: the popular mirrors have not yet been updated — read the OJ or consolidated text on EUR-Lex.
GDPR Art. 22 — Automated Decisions
Right not to be subject to solely automated decisions with legal/similar effect; requires meaningful human involvement or explicit legal basis + safeguards.
unverified · no verification date read the article EUR-Lex
GDPR Art. 27 — EU Representative
A controller or processor not established in the Union that falls within Art. 3(2) scope (offering goods or services to, or monitoring the behaviour of, data subjects in the Union) must designate in writing a representative established in a Member State where the relevant data subjects are. The representative is mandated to be addressed by supervisory authorities and data subjects, in addition to or instead of the controller/processor, on all compliance issues — without prejudice to legal action against the controller/processor itself. Exempt: (a) occasional processing that does not involve large-scale special-category or criminal-conviction data and is unlikely to result in a risk to individuals, or (b) public authorities or bodies.
in-force · verified 2026-09-10 read the article EUR-Lex
GDPR Art. 17 — Erasure
Right to erasure collides with AI Act Art. 12 immutable logging — resolved architecturally via bitemporal data modelling + physical partition scrub.
unverified · no verification date read the article EUR-Lex
GDPR Art. 25 — Data Protection by Design
Privacy by design & default: minimisation, pseudonymisation, PII filters in pipelines and vector stores.
unverified · no verification date read the article EUR-Lex
GDPR Art. 35 — DPIA
Data-protection impact assessment for high-risk processing — pairs with AI Act fundamental-rights impact assessment (Art. 27) for public-facing high-risk systems.
unverified · no verification date read the article EUR-Lex
GDPR Art. 33/34 — Personal-Data Breach Notification
Notification of a personal-data breach to the supervisory authority and, where the risk to individuals is high, to the affected individuals themselves.
in-force · verified 2026-08-11 read the article EUR-Lex
GDPR Art. 32 — Security of Processing
Controller and processor implement technical and organisational measures appropriate to the risk, including pseudonymisation and encryption, and measures ensuring the ongoing confidentiality, integrity, availability and resilience of processing systems. Access to personal data by an unauthorised recipient — including one reached through a derived index such as a vector store — is the harm this article addresses.
in-force · verified 2026-08-17 read the article EUR-Lex
GDPR Art. 9 — Special Categories of Personal Data
Processing of health, biometric and other special-category data is prohibited unless one of the Art. 9(2) conditions applies; where it is permitted, the appropriate safeguards travel with it. This is the anchor for de-identification of clinical imaging and for the minimisation of health data in training and retrieval corpora.
in-force · verified 2026-08-17 read the article EUR-Lex
GDPR Art. 88 — Processing in the Employment Context
Opening clause: Member States may provide more specific rules for processing employees' personal data in the employment context, by law or by collective agreement, including suitable safeguards for human dignity, legitimate interests and fundamental rights, with particular regard to monitoring systems at the workplace. It is the bridge through which national employment rules — in Germany the BetrVG co-determination right and § 26 BDSG — govern workplace AI alongside the GDPR itself.
in-force · verified 2026-08-17 read the article EUR-Lex
Control Objectives (2)
obligation (article) → operationalized_by → control objective → satisfied_by → component/pattern; control objective → evidenced_by → evidence artifact
Art. 4
control layer: community mandate — propose objectives
GDPR Art. 22
control layer: community mandate — propose objectives
GDPR Art. 27
control layer: community mandate — propose objectives
GDPR Art. 17
control layer: community mandate — propose objectives
GDPR Art. 25
Vector & Chunk-Level Access Control
Practice-derived control objective (not named by any provision's own text): the requesting principal's read rights on every retrieved source segment are enforced before generation. Token- or claim-based ACL filtering is applied twice — at the chunker, which writes the source ACL into chunk metadata at ingestion, and at query time in the vector store, which filters candidates by the caller's entitlements — and a response-grounding check re-validates the caller's rights on each cited segment BEFORE the answer is composed. Testable: retrieval probe with a low-privilege principal against a restricted corpus; ACL drift reconciliation between source system and index; red-team reconstruction attempt from similarity results alone.
ISO/IEC 42001 clause A.7 (indicative)
evidenced by: Vector ACL Verification Report
GDPR Art. 35
control layer: community mandate — propose objectives
GDPR Art. 33/34
control layer: community mandate — propose objectives
GDPR Art. 32
Vector & Chunk-Level Access Control
Practice-derived control objective (not named by any provision's own text): the requesting principal's read rights on every retrieved source segment are enforced before generation. Token- or claim-based ACL filtering is applied twice — at the chunker, which writes the source ACL into chunk metadata at ingestion, and at query time in the vector store, which filters candidates by the caller's entitlements — and a response-grounding check re-validates the caller's rights on each cited segment BEFORE the answer is composed. Testable: retrieval probe with a low-privilege principal against a restricted corpus; ACL drift reconciliation between source system and index; red-team reconstruction attempt from similarity results alone.
ISO/IEC 42001 clause A.7 (indicative)
evidenced by: Vector ACL Verification Report
GDPR Art. 9
control layer: community mandate — propose objectives
GDPR Art. 88
control layer: community mandate — propose objectives
Take this into your GRC tooling
A control mapping your ISO/IEC 42001 or CSA AICM workbook can ingest, and an Annex IV skeleton to start the technical file from. Indicative mappings only — cells we are not confident about are exported empty rather than filled in.
Standards & Evidence
ISO/IEC 42005 (AI Impact Assessment)
Guidance for AI system impact assessments — supports DPIA/FRIA-style analyses.
unverified · no verification date publisher ISO
evidence for: GDPR Art. 35
ISO/IEC 27001:2022 + A.8.28
Information-security management; control A.8.28 (secure coding) is the natural anchor for AI code-generation and QA workflows alongside ISO 42001.
unverified · no verification date publisher ISO
evidence for: GDPR Art. 32
JTC 21 Technical Package (prEN 18228/18229/18281–83)
CEN-CENELEC JTC 21 technical package under standardisation request M/593 (prEN 18228 trustworthiness, 18229 risk management, 18281–83 CV/NLP evaluation et al.); staged drafts, none OJEU-cited yet — Annex III applicability (Dec 2027) is Omnibus-coupled to their availability.
evidence for: EU AI Act
IEEE CertifAIEd™
Ethics certification (transparency, accountability, algorithmic bias, privacy) for products and professionals; interfaces with the EU ALTAI assessment list.
unverified · no verification date
evidence for: EU AI Act
prEN 18229-1 (Trustworthiness Framework, part 1)
Part 1 of the JTC 21 trustworthiness deliverable — the framework layer other prEN 18xxx documents build on.
evidence for: EU AI Act
Evidence you will need (10)
The concrete deliverables this use case's obligations ask for — grouped by what kind of artifact they are. Documentation is the largest single conformity cost block, so the list is a work plan, not a reading list. Full evidence matrix →
Assessments (2)
A structured judgement about risk, rights or a management system.
FRIA / AI Impact Assessment (AIIA)text-derivedserves 3 obligations
Fundamental-rights impact assessment (Art. 27, deployer-side) generalized to the AI Impact Assessment: societal, legal and operational risk evaluation per ISO/IEC 42005 and ISO 42001 Clause 8.2, defining HITL intervention parameters and acceptable-use bounds. Cadence: pre-deployment, refreshed annually and on major model updates — a stale AIIA is a finding, not a document.
verifiability: documented artefact — verifiable on inspection
chain: Art. 26 — Deployer Obligations · Art. 27 — Fundamental Rights Impact Assessment · EU AI Act · Clinical Imaging Triage & Patient Follow-Up
Data Protection Impact Assessment (DPIA)text-derivedserves 2 obligations
GDPR Art. 35 assessment for high-risk processing; supervisory-authority consultation where residual risk stays high. ISO/IEC 42005 provides the AI-specific method.
verifiability: documented artefact — verifiable on inspection
chain: § 26 Abs. 1 S. 1 — Erforderlichkeit für Begründung, Durchführung, Beendigung · GDPR Art. 35 — DPIA
Test reports (2)
Measured results from testing, evaluation or red-teaming.
Accuracy, Robustness & Red-Teaming Reportspractice-derived — dispute welcomeserves 2 obligations
Art. 15 evidence: declared accuracy metrics, adversarial and corruption robustness results (DIN SPEC 92001-2, ISO 24029), penetration and jailbreak-resistance testing, groundedness evaluation scores.
verifiability: independently-attested
chain: Art. 15 — Accuracy, Robustness, Cybersecurity · Art. 15 — Accuracy, Robustness, Cybersecurity → CO: Adversarial Robustness Verified · Enterprise SDLC Code Automation & QA · LLM01 Prompt Injection
Vector ACL Verification Reportpractice-derived — dispute welcome
Practice-derived artifact: the measured result of probing the retrieval path with low-privilege principals, the ACL reconciliation between source repositories and the index, and the outcome of the response-grounding rights re-check. Records which corpora were probed, which principals were used and every segment that was returned without an entitlement.
verifiability: self-asserted
chain: GDPR Art. 32 — Security of Processing → CO: Vector & Chunk-Level Access Control
Log records (2)
Machine-generated records produced while the system runs.
Event Logs & Decision Tracestext-derivedserves 17 obligations
The single highest-leverage artifact: hash-chained, WORM-stored logs with structured decision traces. Required capability fields per FprEN ISO/IEC 24970: input/output traces, execution timestamps, acting user/agent identity, referenced sources, human overrides. Audit-packet spec per event: model version, system-prompt/context hash, hyper-parameters (temperature, top-p), output payload, confidence score, active policy-ruleset versions, human override record. Simultaneously serves AI Act Art. 12, GDPR accountability, DORA incident reporting, NIS2 logging, PLD disclosure duties and its rebuttable defect presumption; financial-sector regimes push retention to 7 years (SEC 17a-4-class WORM rules). Credibility bar: anchor hash-chain heads externally (qualified timestamp / eIDAS ledger) so integrity survives an insider with admin rights.
verifiability: externally-anchored
chain: Art. 12 — Record-Keeping / Logging · CRA Art. 14 — Vulnerability & Severe-Incident Reporting · DORA Art. 19 — Major ICT-Incident Reporting · GDPR Art. 33/34 — Personal-Data Breach Notification · HIPAA Breach Notification Rule · NIS2 Art. 23 — Significant-Incident Reporting · +21 more
Guardrail Telemetry & Sanitization Recordspractice-derived — dispute welcomeserves 3 obligations
Control-level evidence for the OWASP mappings: guardrail trigger records, blocked-prompt statistics (LLM01), runtime output-sanitization logs (LLM05), groundedness-check outcomes — the empirical proof that declared controls actually execute.
verifiability: tamper-evident
chain: Art. 15 — Accuracy, Robustness, Cybersecurity · Art. 50 — Transparency Duties → CO: AI Interaction & Content Disclosure · Art. 15 — Accuracy, Robustness, Cybersecurity → CO: Runtime Injection Defense · Dynamic Deal Desk & Quoting Engine · Enterprise Marketing Disclosure Compliance · LLM01 Prompt Injection · +3 more
Process records (4)
Traces that a process actually happened, and who did it.
Human-Oversight Protocol & Intervention Recordspractice-derived — dispute welcomeserves 5 obligations
Art. 14 evidence: documented oversight design (gates, thresholds, veto powers), reviewer qualification, and the record of actual approvals, overrides and escalations — also the GDPR Art. 22 meaningful-human-involvement proof.
verifiability: documented artefact — verifiable on inspection
chain: Art. 11 — automated individual decision-making · Art. 14 — Human Oversight · GDPR Art. 22 — Automated Decisions · Art. 12 — Record-Keeping / Logging → CO: Log Access & Retention Governance · Art. 14 — Human Oversight → CO: Oversight Competence & Authority · Clinical Imaging Triage & Patient Follow-Up
Individual Explanation Letters & Counterfactual Recordspractice-derived — dispute welcomeserves 5 obligations
Practice-derived artifact: the issued adverse-decision explanations together with the attribution run, model version and counterfactual scenario that each letter rested on, so an authority or a court can check that the stated reasons are the reasons the system actually used.
verifiability: self-asserted
chain: Art. 11 — automated individual decision-making · Art. 18 — Obligation to assess the creditworthiness of the consumer · Art. 21 — examination of an application · Art. 86 — Right to explanation of individual decision-making · GDPR Art. 22 — Automated Decisions
AI Literacy Training Recordspractice-derived — dispute welcomeserves 2 obligations
Art. 4 evidence: role-based training curricula and completion records for staff dealing with AI systems — the one obligation that applies at every risk level.
verifiability: documented artefact — verifiable on inspection
chain: Art. 4 — AI Literacy · Art. 14 — Human Oversight → CO: Oversight Competence & Authority
Personal-Data Breach Notification Recordtext-derivedserves 2 obligations
The GDPR Art. 33(5) record of every personal-data breach: facts, effects, remedial action, plus the notification sent to the supervisory authority and, where required, the data subjects.
verifiability: tamper-evident
chain: GDPR Art. 33/34 — Personal-Data Breach Notification · HIPAA Breach Notification Rule
Architecture Blueprint
Intent Policy Router with Confidence-Thresholded HITL Queue
Requests are classified into intent classes with explicit policy per class; anything below the calibrated confidence threshold, or in a class marked consequential, is routed to a human queue with its context attached instead of being answered.
Grounded Citational RAG
Retrieval architecture built for citability: temperature zeroised for the synthesis step, every factual sentence verified against its retrieved chunk by an NLI entailment check before it is emitted, and each source carried as an id plus a SHA-256 content hash so the exact text a claim rested on can be re-fetched and compared. Unentailed sentences are dropped or marked, never smoothed.
Deterministic Document-Validation Pipeline
Schema, completeness and duplicate checks implemented as deterministic rules with a model used only for extraction, never for judgement. The absence of an evaluative step is what keeps a narrow procedural task narrow — and what makes an Art. 6(3)(a) claim documentable.
Required Technical Components (18)
HITL Escalation Queue & Review UI
HITL escalation queue & review UI ('Human-as-a-Tool': the agent calls the human like any other tool via propose-action objects). Confidence- and risk-threshold routing, SLA timers, structured accept/modify/reject verdicts with digital reviewer signature at gate release — each verdict is itself Art. 14 evidence and feeds the active-learning loop.
from: GDPR Art. 22 · Intent Policy Router with Confidence-Thresholded HITL Queue
Adverse-Decision Reason Generator
Practice-derived component: converts feature attributions (SHAP or an equivalent attribution method) into an individually understandable, legally defensible explanation of an adverse decision — the role the AI system played, the main elements the decision rested on, and counterfactual scenarios stating what would have had to differ for a different outcome. Reason codes are generated from the decisioning path, not from a marketing template, and every issued letter is retained with the model version and the attribution run behind it. Honesty condition: a reason is only usable if acting on it would actually change the outcome, which non-monotonic feature interactions can break (see the post-hoc instability threat).
from: GDPR Art. 22
Bitemporal Memory (GDPR×Art.12)
valid_from/valid_to + transaction time on every record: GDPR erasure removes data from the active retrieval path while the HMAC-chained immutable log survives for Art. 12 / PLD defence; tenant-scoped partitions allow physical scrub of PII.
from: GDPR Art. 17
PII Scrubbing / DLP-NER Layer
Automated detection, pseudonymisation and blocking of personal data in inputs, retrievals and outputs.
from: GDPR Art. 25
Per-Tenant Retrieval Segmentation
Retrieval is scoped by tenant and by caller entitlement at query time, preventing cross-client and cross-role leakage through shared indexes.
from: GDPR Art. 25
Segmented Vector Store (RBAC + CMEK)
Vector indexes, embeddings and document stores are logically and physically partitioned per client, with role-based access and customer-managed encryption keys.
from: GDPR Art. 25 · GDPR Art. 32 · Grounded Citational RAG
PII/PHI Redaction & Tokenisation Engine
The engine behind inline tokenisation: pre-model interception that replaces identifiers with reversible tokens before a payload leaves the isolation boundary, plus a detokenisation gate that re-identifies only for authorised callers inside the boundary and logs every re-identification. Complements the DLP/NER scrubbing layer, which blocks or masks rather than preserving reversible reference.
from: GDPR Art. 25
DICOM De-Identification Pipeline
Practice-derived component: removal and replacement of identifying attributes in imaging studies before they leave the clinical system — header attributes per the DICOM confidentiality profiles, burned-in pixel text detected and masked, private tags dropped rather than trusted, and a consistent pseudonym per patient so longitudinal studies stay linkable without re-identifying anyone. Re-identification risk on the de-identified corpus is measured, not assumed.
from: GDPR Art. 25 · GDPR Art. 9
Live Risk Register / Posture Management
Continuously updated risk register wired to runtime posture: threat-model deltas, open defects, control status, exposure per system. Includes Shadow-AI discovery — continuous scanning for unsanctioned agents, MCP servers and AI API usage outside the register; an unregistered agent is an unmanaged Art. 12/26 liability and the empirical driver of proportionate (not blanket) controls.
from: GDPR Art. 35
Unified Incident-Response Runbook
One procedure reconciling AI Act Art. 73, GDPR Art. 33 (72h), DORA and NIS2 (24h/72h) timelines and recipients.
from: GDPR Art. 33/34
Retrieval Rails (ACL-aware RAG)
Relevance, freshness and per-user permission checks on every retrieved chunk; curated, versioned index.
from: GDPR Art. 32 · Grounded Citational RAG
Confidence Scoring & Threshold Gate
Computes a probabilistic confidence score for every output and holds the transaction when the score falls below the workflow's regulatory threshold.
from: Intent Policy Router with Confidence-Thresholded HITL Queue · Grounded Citational RAG
Deterministic Policy Engine (OPA / Cedar)
Policy-as-code decision point (PDP) with enforcement points (PEP) in front of every tool call: versioned policies in Git, microsecond evaluation, typed action schemas — authorization decided outside the model's reasoning space, never in the prompt.
from: Intent Policy Router with Confidence-Thresholded HITL Queue
Supervisor Attribution Chain
Every model inference, data interaction and client-facing artefact is bound to an authorised supervising natural person — never to a shared service account. Required for SEC Rule 204-2 attribution, SOX segregation of duties and AI Act Art. 26 deployer oversight records.
from: Grounded Citational RAG
Output Rails / Groundedness Check
Faithfulness scoring of answers against retrieved sources; deterministic fallback instead of hallucination; schema-validated structured output.
from: Grounded Citational RAG
Document Intelligence Engine
OCR, layout parsing and semantic clause extraction over filings, contracts and invoices, emitting structured records with span-level source references.
from: Deterministic Document-Validation Pipeline
AI Register & Model Registry / Factsheets
AI register & model registry: central inventory of every model, agent, RAG pipeline and embedded third-party SaaS AI across the estate, with factsheets per asset. v2.0 duty: every application — internal, open-source or procured — continuously publishes a machine-readable AI-BOM and Factsheet into the register; an asset without a current AI-BOM is an inventory gap, not a formality. Feeds Colorado AIA/ LL144 disclosure duties and the Art. 11 technical file; the enforcement backstop is Shadow-AI discovery on the risk register.
from: Deterministic Document-Validation Pipeline
WORM / Immutable Audit Vault
Append-only, hash-chained audit vault (WORM object-lock storage, AES-256 at rest, TLS 1.3 in transit). Guarantees tamper-evidence within the organization's trust domain — which stops your own team, but not an admin who can rebuild the vault. Pair with an external trust anchor and key ceremonies outside the operating team for evidence that holds against the insider scenario.
from: Deterministic Document-Validation Pipeline
Build or Buy — Vendor Layer (11)
The graph models vendor CATEGORIES as first-class nodes and keeps named vendors as community-maintained, disputable desc content with lastVerified dates. A category is stable; a vendor list is a currency-layer object like any standard node.
Agent Orchestration & SDLC Toolkits
Developer middleware for multi-agent networks, tool-use chains, RAG abstraction, state and memory persistence, and model routing. Named products live in marketExamples; prose here describes the class. Regulatory posture: orchestration code is where autonomy tiering, propose-action objects and fallback routing get implemented — the framework choice constrains which controls are cheap and which are retrofits. Selection metrics: see meta.marketLandscape.selectionMetrics.orchestration.
unverified · verified 2026-08-18 community-maintained
selection metrics: broad model-API abstraction, state/memory management, error recovery, fallback routing hooks
supplies: HITL Escalation Queue & Review UI
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| LangChain / LangGraph | agent framework | Graph-structured agent runtime; interrupt/pause nodes support implementing human approval at defined steps. Typical: multi-step agents, approval workflows. | not checked | supports implementing Art. 14 oversight (claimed)supports Art. 12 step logging (claimed) |
| LlamaIndex | RAG framework | Indexing and query abstractions over documents and structured sources. Typical: enterprise RAG, document agents. | open source | retrieval-governance positioning |
| Microsoft AutoGen | multi-agent framework | Conversational multi-agent patterns with pluggable tool executors. Typical: multi-agent research, code agents. | not checked | research/OSS, no vendor certification |
| CrewAI | multi-agent framework | Role-based agent teams with task delegation and process templates. Typical: process automation, role-based agents. | not checked | vendor-stated security posture |
and 6 more in the stack advisor →
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Agent Observability & Model Risk Management
Tracing, evaluation, drift monitoring and model-validation records. This layer is where Art. 12 record-keeping becomes technically real (step-level traces, prompt/response records, retention control) and where model-risk practice in the SR 11-7 tradition — validation evidence, performance and drift monitoring, challenger comparison — is operated. Gateways and tracing tools produce the logs; the retention, integrity and access regime around them is still yours.
unverified · verified 2026-08-18 community-maintained
selection metrics: Trace completeness per agent step; log retention and immutability options; drift/quality metrics available out of the box; evaluation dataset support; export into your audit vault; self-host option.
supplies: Adverse-Decision Reason Generator · Confidence Scoring & Threshold Gate · AI Register & Model Registry / Factsheets
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| LangSmith | agent tracing & evaluation | Trace capture and evaluation over LangChain/LangGraph runs with dataset-based scoring. Typical: step tracing, regression evaluation. | not checked | SOC 2 (claimed)supports Art. 12 record-keeping (claimed) |
| Langfuse | agent tracing & evaluation | Open-source tracing, prompt management and evaluation; self-hostable for retention control. Typical: self-hosted tracing, cost/latency analytics. | open source | GDPR-positionedsupports Art. 12 record-keeping (claimed) |
| Arize AI / Phoenix | ML & LLM observability | Production monitoring with drift and performance analysis; Phoenix is the open-source tracing side. Typical: drift monitoring, production analytics. | not checked | SOC 2 (claimed)drift-monitoring positioning (SR 11-7 style, claimed) |
| Helicone | LLM gateway & logging | Proxy-level logging of prompts, costs and latency across providers. Typical: gateway logging, cost control. | not checked | SOC 2 (claimed)supports Art. 12 record-keeping (claimed) |
and 11 more in the stack advisor →
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
AI GRC & Governance Platforms
Second-line systems of record: model/agent inventory incl. third-party SaaS AI, automated risk tiering, policy administration, cross-framework mapping and control deduplication, audit-evidence generation, intake workflows. Named products live in marketExamples, which is the single source of truth for this layer — prose here describes the class, not the field. What the class buys you: one register a second line can defend, and evidence assembled once and reused across frameworks. Selection metrics: see meta.marketLandscape.selectionMetrics.grc. One compilation-reported item is deliberately kept as unverified: a claimed updated US banking model-risk guidance 'SR 26-2'. Two secondary compilations repeating it is corroboration of the rumour, not of the guidance; it stays flagged pending verification against Federal Reserve primary sources, and a curator verification proposal is filed. All alignments in this layer are vendor-positioned claims, never certifications.
unverified · verified 2026-08-18 community-maintained
selection metrics: multi-model/multi-cloud cataloging incl. third-party SaaS, automated risk tiering, regulatory reporting, independent-2nd-line deployability, cross-framework control deduplication
supplies: Adverse-Decision Reason Generator · Live Risk Register / Posture Management · Supervisor Attribution Chain · AI Register & Model Registry / Factsheets
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| Credo AI | AI governance platform | Policy packs, risk tiering and evidence workflows mapped across frameworks. Typical: AI registry, policy administration. Scope overlap: Its scope overlaps this platform's own; we have a commercial interest in the comparison. | not checked | ISO 42001 alignment (claimed)EU AI Act readiness positioning |
| Holistic AI | AI governance & audit | Risk assessment, bias auditing and regulatory reporting workflows. Typical: bias audit, regulatory reporting. Scope overlap: Its scope overlaps this platform's own; we have a commercial interest in the comparison. | not checked | NYC LL144 audit support (claimed)EU AI Act readiness positioning |
| IBM watsonx.governance | AI governance platform | Governance, factsheets and monitoring integrated with the IBM stack. Typical: factsheets, model monitoring. Scope overlap: Its scope overlaps this platform's own; we have a commercial interest in the comparison. | not checked | ISO 42001 alignment (claimed)Art. 11 documentation support (claimed) |
| ModelOp | AI/model governance | Model and agent inventory with automated lifecycle controls for large estates. Typical: model inventory, control automation. Scope overlap: Its scope overlaps this platform's own; we have a commercial interest in the comparison. | not checked | model-risk positioning (SR 11-7 style, claimed)ISO 42001 alignment (claimed) |
and 3 more in the stack advisor →
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Grounding, Retrieval & Agent Memory
The grounding layer between raw sources and the model: document parsers, embedding models, vector databases and — new in the agentic era — persistent agent memory stores. Memory is the hard part: once a personal fact is embedded, GDPR Art. 17 erasure has to reach the vector and the memory record, not just the source row, and embeddings are partially reconstructable (see IronCore in the privacy layer). Retrieval quality is also a data-governance question under Art. 10: what got parsed, chunked and indexed is what the system 'knows'.
unverified · verified 2026-08-18 community-maintained
selection metrics: Parsing fidelity on your worst document class; retrieval precision/recall on a labelled set; tenant and ACL isolation model; per-vector encryption and erasure path; memory TTL and record semantics; self-host option.
supplies: Bitemporal Memory (GDPR×Art.12) · Per-Tenant Retrieval Segmentation · Segmented Vector Store (RBAC + CMEK) · Retrieval Rails (ACL-aware RAG) · Document Intelligence Engine
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| Docling | document parser | Open-source layout-aware parsing of PDFs and office formats into structured chunks. Typical: RAG ingestion, air-gapped pipelines. | self-hostable | EU sovereignty positioning |
| LlamaParse | document parser | Managed parsing service tuned for tables and complex documents feeding RAG. Typical: RAG ingestion, table extraction. | not checked | SOC 2 (claimed) |
| Amazon Textract | document parser | OCR and form/table extraction with per-page pricing inside AWS. Typical: document intake, claims processing. | not checked | SOC 2 (claimed)HIPAA-eligible (claimed)ISO 27001 (claimed) |
| Diffbot | web/knowledge extraction | Structured extraction and knowledge-graph construction from web sources. Typical: market monitoring, entity resolution. | not checked | vendor-stated security posture |
and 12 more in the stack advisor →
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Confidential Computing & Privacy Engines
Data-in-use protection and pre-model privacy interception: enclave and runtime encryption, key management, tokenisation vaults, PII detection and redaction, application-layer and vector encryption. Named products live in marketExamples; prose here describes the class. Select on: enclave attestation support, key custody model (external HSM / BYOK), detokenisation audit trail, latency added per call, and coverage of the identifier classes your regime actually names. Selection metrics: see meta.marketLandscape.selectionMetrics.privacy.
unverified · verified 2026-08-18 community-maintained
selection metrics: enclave attestation support, key custody (external HSM / BYOK), detokenisation audit trail, added latency per call, coverage of the identifier classes your regime names, in-boundary deployment option
supplies: PII/PHI Redaction & Tokenisation Engine · DICOM De-Identification Pipeline
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| Anjuna | confidential computing | Runs workloads inside hardware enclaves without application rewrites. Typical: data-in-use protection, regulated inference. | not checked | confidential-computing positioningDORA-positioned (claimed) |
| Fortanix | confidential computing & KMS | Enclave runtime plus key management and tokenisation services. Typical: key management, data-in-use protection. | not checked | FIPS 140-2 (claimed)DORA-positioned (claimed)HIPAA-positioned (claimed) |
| Skyflow | privacy vault | Polymorphic data vault de-identifying records before they reach a model. Typical: PII vaulting, pre-model redaction. | not checked | SOC 2 (claimed)HIPAA-positionedGDPR-positioned |
| Private AI | PII detection & redaction | Detection and redaction of identifiers across text, documents and audio. Typical: inline redaction, document de-identification. | not checked | GDPR-positionedHIPAA-positioned |
and 1 more in the stack advisor →
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Secure Data Infrastructure & Vector Storage
Governed retrieval substrate: vector databases, lakehouses and catalogs with tenant/namespace isolation, RBAC and client-managed keys (CMEK), lineage into RAG chunks, air-gap options, and code-level data and AI lineage. Named products live in marketExamples; prose here describes the class. What the class buys you: retrieval that can be scoped per requester and traced back to a source record. The Art. 10 runtime data-governance duties land here. Selection metrics: see meta.marketLandscape.selectionMetrics.data.
unverified · verified 2026-08-18 community-maintained
selection metrics: namespace/tenant isolation, RBAC + CMEK, lineage into RAG chunks, SOC 2 / ISO 27001 attestations, air-gap capability
supplies: Retrieval Rails (ACL-aware RAG)
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| Azure AI Search | managed retrieval | Managed hybrid search with security trimming against tenant identities. Typical: ACL-aware RAG, enterprise search. | not checked | ISO 27001 (claimed)SOC 2 (claimed) |
| Databricks Unity Catalog | governed lakehouse | Catalog and lineage spanning tables, features and RAG chunks. Typical: lineage evidence, governed RAG. | not checked | SOC 2 (claimed)lineage/Art. 10 support (claimed) |
| Relyance AI | code-level data & AI lineage | Parses source repositories to map data and inference flows at code level, with CI checks on changes to those flows. Typical: data lineage, shift-left privacy review. Scope overlap: Its AI-governance reporting scope overlaps this platform's own; we have a commercial interest in the comparison. | SaaS (vendor cloud) | GDPR programme tooling (claimed)EU AI Act readiness positioning |
| Snowflake Cortex | governed lakehouse | Model calls inside the warehouse boundary with masking and clean rooms. Typical: in-warehouse inference, governed analytics. | not checked | SOC 2 (claimed)ISO 27001 (claimed)HIPAA-eligible (claimed) |
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Runtime Guardrails & Enforcement
Policy enforcement in the request path: input/output validation, injection and exfiltration defence, structured-output constraints and action blocking. Distinct from observability layers because these products are in-line and can refuse. Selection questions: added latency at p95, whether enforcement is fail-open or fail-closed, whether policies are versioned artefacts, and whether the layer can be self-hosted inside your data boundary.
unverified · verified 2026-08-18 community-maintained
selection metrics: Where enforcement sits (inline proxy, sidecar, SDK) and the added latency at your token volumes; whether policy is versioned and testable as code; fail-open vs. fail-closed behaviour under guardrail outage; language and modality coverage; whether every block writes an evidence record you can cite later.
supplies: Deterministic Policy Engine (OPA / Cedar) · Output Rails / Groundedness Check
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| Guardrails AI | validation framework | Open-source validator framework for structured output and content policies in the request path. Typical: output validation, structured output. | open source | supports Art. 15 robustness measures (claimed) |
| NVIDIA NeMo Guardrails | dialogue policy rails | Programmable dialogue and topic rails placed around an LLM application. Typical: topic control, dialogue policy. | open source | supports Art. 50 interaction disclosure patterns (claimed) |
| Lakera AI | guardrail proxy | Inline prompt-injection and content detection at request time. Typical: injection defence, content filtering. | SaaS (vendor cloud) | SOC 2 (claimed)supports Art. 15 robustness measures (claimed) |
| Credal AI | enterprise access & policy layer | Permission-aware access layer with data-loss controls in front of enterprise assistants. Typical: access control, DLP. | SaaS (vendor cloud) | SOC 2 (claimed) |
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Cryptographic Evidence & Audit Ledger
Tamper-evident recording of what a system did: content-addressed decision records, hash chains and external anchoring, so a log can be shown not to have been rewritten after the fact. This is the layer that turns Art. 12 logging and Art. 19 retention from a storage question into an evidentiary one. AI Verify is carried in RAIN as a STANDARD node (sg-ai-verify), not duplicated here as a vendor.
unverified · verified 2026-08-18 community-maintained
selection metrics: Append-only guarantees and who can rotate or delete (including the vendor); anchoring mechanism (qualified timestamp, transparency log, notarisation) and whether verification works without the vendor; retention and export in a readable format at end of contract; throughput and cost at your event volume.
supplies: Supervisor Attribution Chain · WORM / Immutable Audit Vault
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| Fact0 | cryptographic evidence ledger | Positions itself as a tamper-evident ledger for AI decision records. Typical: decision records, audit trail. | not checked | supports Art. 12 record-keeping (claimed) |
| Traccia | audit trail & traceability | Positions itself around traceability of AI pipeline steps and artefacts. Typical: traceability, artifact lineage. | not checked | supports Art. 12 record-keeping (claimed) |
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Runtime Security & Guardrail Vendors
First-line inline enforcement: single-pass parallel input/output evaluation proxies, injection and exfiltration defense, PII masking, grounding checks, SecOps routing. Named products live in marketExamples; prose here describes the class. What the class buys you: a policy decision point in the request path that fails closed and emits telemetry an auditor can read. Selection metrics: single-pass latency (<20 ms class), catch rates, policy-version telemetry into the AI-BOM. Consolidation matters commercially: a guardrail acquired by a platform vendor tends to follow that platform's roadmap, which is a lock-in question rather than a security one — reported acquisitions are recorded per entry as reported, not asserted here.
unverified · verified 2026-08-18 community-maintained
selection metrics: single-pass parallel evaluation latency (<20 ms class), injection/hallucination catch rates, SecOps/SIEM routing, policy versioning surfaced into the AI-BOM
supplies: Output Rails / Groundedness Check
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| Lakera | guardrail proxy | Inline prompt-injection and content detection at request time. Typical: injection defence, content filtering. | not checked | SOC 2 (claimed)supports Art. 15 robustness measures (claimed) |
| HiddenLayer | model/agent detection & response | Model-layer detection and response with adversarial-attack telemetry. Typical: model threat detection, red-team telemetry. | not checked | SOC 2 (claimed)supports Art. 15 robustness measures (claimed) |
| Palo Alto Prisma AIRS | network-integrated AI security | AI runtime security folded into an existing enterprise network security estate. Typical: enterprise rollout, egress control. | not checked | SOC 2 (claimed)enterprise security integration (claimed) |
| Cisco AI Defense | network-integrated AI security | Discovery of AI usage plus inline enforcement across the corporate network. Typical: shadow-AI discovery, inline enforcement. | not checked | enterprise security integration (claimed) |
and 4 more in the stack advisor →
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Agentic Applications & Copilots
Finished agentic products bought rather than built: developer and productivity copilots, research assistants, SOC and support agents. The governance point is not the product but the wrapper: these tools act with delegated authority inside your estate, so they belong in the agent inventory, need scoped non-human identities and permission boundaries, and inherit deployer duties — buying the product does not buy the obligations away.
unverified · verified 2026-08-18 community-maintained
selection metrics: Permission model and identity scoping; audit log export; tenant data-handling and retention terms; deployer-duty support (disclosure, oversight, incident reporting); outcome pricing vs seat pricing.
supplies: Document Intelligence Engine
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| GitHub Copilot | developer copilot | Code completion and agent modes inside the IDE and repository workflow. Typical: software engineering, code review. | not checked | SOC 2 (claimed)enterprise data-handling commitments (claimed) |
| Microsoft 365 Copilot | productivity copilot | Assistant across mail, documents and meetings inheriting existing tenant permissions. Typical: knowledge work, meeting summaries. | not checked | ISO 27001 (claimed)SOC 2 (claimed)EU data-boundary positioning |
| Perplexity Enterprise | research assistant | Cited web and internal search with source attribution per answer. Typical: market research, citation-backed search. | not checked | SOC 2 (claimed)enterprise data-handling commitments (claimed) |
| Cursor | developer copilot | AI-native editor with repository-wide agent edits. Typical: software engineering, refactoring. | not checked | SOC 2 (claimed)privacy-mode option (claimed) |
and 5 more in the stack advisor →
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Public Transparency Registers & System Cards
Authoring and publishing the outward-facing record: public AI registers, system and model cards, conformity declarations and plain-language notices, with versioning so a published statement can be tied to the system version it described. The register content is produced elsewhere; this class is the publication and version-control surface for it. Selection metrics: see meta.marketLandscape.selectionMetrics.transparency.
unverified · verified 2026-08-17 community-maintained
selection metrics: Versioning of published statements against the system version they describe; whether a card is generated from your governance record or re-authored by hand; language coverage and accessibility of the published surface; export and self-hosting of the public register; whether unpublishing leaves an auditable trail.
supplies: AI Register & Model Registry / Factsheets
Filters to self-hostable, customer-VPC and open-source options when personal or confidential data cannot leave the EU.
| Example | Sub-category | What it does | Hosting | Claimed alignments |
|---|---|---|---|---|
| Saidot | public AI register | AI register with published system cards and regulation-mapped documentation workflows. Typical: public AI register, system cards. Scope overlap: Its documentation and register scope overlaps this platform's own; we have a commercial interest in the comparison. | SaaS (vendor cloud) | EU AI Act documentation positioningISO 42001 alignment (claimed) |
Community-maintained, disputable examples — not an endorsement and not a ranking. Alignments are as claimed by vendors or the source compilation, not verified by RAIN; a certification is shown as a certification only where a certificate or registry reference is recorded.
Disclosure: RAI·N·avigator operates in this category too, so we have a commercial interest in any comparison here. That is why this layer maps product classes to control objectives and lists named products as community-maintained examples — we publish no rankings, no quadrants and no coverage assertions about any vendor, including ourselves.
Procurement rule: Derived from three-lines-of-defense separation: the second-line GRC platform must be procured and deployed independently of any first-line runtime or model vendor — a governance tool that only sees its own vendor's models cannot govern a multi-model estate, and closed third-party SaaS AI can only be governed contractually (intake, attestation, AI-BOM disclosure), never by inline inspection.
Outsourced delivery BPO · SaaS · Service-as-a-Software caveats
Delivery Model — BPO · SaaS · Service-as-a-Software
Spectrum
BPO: input-priced (billable hours/FTEs), linear headcount scaling, human error & attrition as primary risk
SaaS: capability-priced (software access), client operates the workload, implementation/adoption failure as primary risk
Service-as-a-Software: outcome-priced (SLA on completed work), provider-managed AI executes 60–80% of cognitive tasks with specialist supervision, algorithmic bias & non-compliance as primary risk
Caveats in regulated markets
— Outcome SLAs move compliance risk onto the provider — but NOT the buyer's deployer duties: Art. 26 oversight, log retention and FRIA obligations stay with the enterprise even when execution is outsourced.
— Provider role analysis is the central legal question: a productized platform that fine-tunes, re-purposes or chains models can flip into the Art. 25 provider role with full high-risk obligations.
— Certified operations (ISO 42001) function as a procurement moat and shortcut third-party risk assessment — but organizational certificate ≠ product conformity (never conflate, see meta.assuranceEcosystem).
— The buyer's evidence chain must reach into the provider: contractually mandated AI-BOM disclosure, ZDR certificates, bias-audit reports and logging-ledger access are the artifacts that make an outsourced workflow auditable.
Threat Profile
LLM01 Prompt Injection
Direct or indirect (RAG/files/web) instructions override system prompts — the primary attack vector on the perception layer.
mitigate with: Input Rails / Prompt Shields, Guardrail Sidecar / Interception, Trinity Defense (TCB + Command Gates + IFC), Divided-Focus Memory Tiering, Dual-Gate Validation Pipeline
LLM02 Sensitive Info Disclosure
Leakage of PII, trade secrets or system prompts in outputs.
mitigate with: PII Scrubbing / DLP-NER Layer, Output Rails / Groundedness Check, PII/PHI Redaction & Tokenisation Engine
LLM09 Misinformation
Hallucinated or wrong outputs create liability and decision risk.
mitigate with: Output Rails / Groundedness Check, Explainability API (SHAP/LIME/CoT)