Regulatory mapping
Every clause, and whose job it is.
Four instruments are encoded clause by clause. For each one this page says how many clauses the map holds and how many of them the platform can produce evidence for — counted out of the files the engine loads, not typed onto a page.
What is encoded today
| Instrument | Where | Status | Clauses | We evidence | Yours |
|---|---|---|---|---|---|
| Regulation 10 on Personal Data Processed through Autonomous and Semi-Autonomous Systems DIFC Regulation 10 (under DIFC Law No. 5 of 2020) |
AE-DIFC DIFC Commissioner of Data Protection |
in-force | 9 | 7 | 2 |
| Regulation (EU) 2024/1689 — Artificial Intelligence Act Regulation (EU) 2024/1689 |
EU European Commission / national market surveillance authorities |
in-force | 14 | 14 | 0 |
| Regulation (EU) 2016/679 — General Data Protection Regulation Regulation (EU) 2016/679 |
EU National data protection authorities / EDPB |
in-force | 11 | 11 | 0 |
| AI Risk Management Framework 1.0 NIST AI 100-1 |
US NIST (voluntary framework) |
voluntary | 11 | 11 | 0 |
| Supervisory Guidance on Model Risk Management SR 11-7 / OCC Bulletin 2011-12 |
US Federal Reserve / OCC / FDIC |
guidance | 10 | 10 | 0 |
| UK GDPR (as amended by the Data (Use and Access) Act 2025) Retained Regulation (EU) 2016/679, as amended by DUAA 2025 s.80 and Sch. 6 |
GB Information Commissioner's Office |
in-force | 14 | 11 | 3 |
A map is not the whole instrument. It encodes the clauses where a
governance platform can contribute at all. The AI Act runs to 113
articles; the map below holds fourteen, and the rest are out of scope by
construction rather than unmet — obligations about training data
governance or conformity assessment are not things software can produce a
grant or a refusal for.
And “we evidence” is not “you comply”. It
counts the clauses in a map for which this platform can produce an
artefact — a grant, a refusal, a sealed record, a pack. Whether those
artefacts satisfy your regulator, for your deployment, is a determination
for you and your counsel. Rotascale governs the action; it does not
warrant the outcome.
The four with pages but no map
Four more instruments have pages on this site and no clause map. Two of them cannot have one — MAS FEAT asks a firm to define its own objective and the UK approach has no statute to enumerate. Two of them have numbered articles and are authoring work rather than engineering: DORA and ISO/IEC 42001. Each page says which of the two it is, in those words.
If you are a regulator
[email protected] reaches a person rather than a queue. Use it for consultation responses, supervisory enquiries, or to ask us to check something.
The specification is Apache 2.0 and unbranded, so it can be cited, adopted or extended without endorsing a vendor, and a competitor's engine may claim conformance to it. It is archived with a permanent DOI, 10.5281/zenodo.22016032, which does not depend on this site or on GitHub continuing to exist. The verifier checks a real refusal in your own browser with no account and nothing uploaded.
We respond to consultations where we have something implemented to report, and we say which parts of a mapping are ours and which are the customer's. Where we cannot evidence a clause we mark it rather than claim it.