Regulated AI Navigator

Turn an AI use case into its EU AI Act risk class, the regulations it triggers, the obligations, the architecture and the evidence you owe — in about two minutes.

Community-curated knowledge graph, peer-reviewed by experts across law, engineering and governance. Every change traceable →

Analyse a use case →Browse 35 profiles

Regulation coverage

Every regulation in the graph resolves into concrete technical components — through an article obligation, a control objective, a design pattern or an evidence artefact that a component must produce. Pick a regulation to see its technical surface, how each component is derived, and in which of the triggering use cases it is actually part of the required stack. The gap counts show where the graph reaches a component that no use case yet requires — those are open contribution targets, not settled answers. Open the full graph →

HIPAA (US Health Privacy)

US health-data regime (Privacy, Security & Breach Notification Rules): PHI minimum-necessary standard, BAA chains for AI vendors, audit controls and access logging. For clinical AI (scribing, diagnostics, prior-auth) it is the US-side twin of GDPR Art. 9 — evidence overlap: access logs, vendor due diligence, encryption attestation.

3 components0 articles / obligations4 triggering use casesopen in graph

WORM / Immutable Audit Vault

75% of use cases

Append-only, hash-chained audit vault (WORM object-lock storage, AES-256 at rest, TLS 1.3 in transit). Guarantees tamper-evidence within the organization's trust domain — which stops your own team, but not an admin who can rebuild the vault. Pair with an external trust anchor and key ceremonies outside the operating team for evidence that holds against the insider scenario.

  • evidence artefactHIPAA (US Health Privacy) → Event Logs & Decision Traces → produced by WORM / Immutable Audit VaultEvent Logs & Decision Traces
Required inDiagnostic Decision SupportPrior Authorisation & Coverage DecisionsClinical Imaging Triage & Patient Follow-Up
Triggered but not yet requiredClinical Documentation & Ambient Scribing
✓ Confirm✗ Dispute+ Add sourceSign in to validate — every vote requires a source

OpenTelemetry / FCoT Tracing

0% of use cases

Hierarchical trace spans for every sub-task, prompt, retrieved document and API call — the reconstructible decision path for Art. 12/14 and PLD disclosure.

  • evidence artefactHIPAA (US Health Privacy) → Event Logs & Decision Traces → produced by OpenTelemetry / FCoT TracingEvent Logs & Decision Traces
Triggered but not yet requiredClinical Documentation & Ambient ScribingDiagnostic Decision SupportPrior Authorisation & Coverage DecisionsClinical Imaging Triage & Patient Follow-Up
✓ Confirm✗ Dispute+ Add sourceSign in to validate — every vote requires a source

Vendor & Model Due-Diligence Kit

0% of use cases

Scoring model: jurisdiction (CLOUD Act exposure), zero-data-retention, BYOK support, audit evidence (C5/AIC4/ISO 42001/EN 18286:2026), tenant isolation.

Triggered but not yet requiredClinical Documentation & Ambient ScribingDiagnostic Decision SupportPrior Authorisation & Coverage DecisionsClinical Imaging Triage & Patient Follow-Up
✓ Confirm✗ Dispute+ Add sourceSign in to validate — every vote requires a source