{ "captured_at": "2026-10-19T18:12:44+00:00", "call_seconds": 1.38, "declaration": { "activities": [ "deploys_chatbot", "records_text_chat" ], "jurisdictions": [ "us", "us/ca", "eu", "de", "gb" ] }, "meta": { "lint": "0 errors, 61 warnings, 29 info: review the warnings below", "activities": [ "deploys_chatbot", "records_text_chat" ], "jurisdictions": [ "us", "us/ca", "eu", "de", "gb" ], "corpus_built_at": "2026-10-19T07:47:05+0000", "run_at": "2026-10-19T18:12:44.964Z", "replay": "lexlint-replay:1:1.54.1:20261019T074705Z:20261019T181244Z:6fd8aca62c15", "latest_version": "1.54.1", "freshness_window_days": 60, "notice": "LexLint findings are research summaries of public legal sources, not legal advice, not a certification, and not authorization to access any system. For decisions that matter, consult qualified counsel in the relevant jurisdiction." }, "findings": [ { "id": "us:not-researched:liability", "kind": "coverage", "severity": "warn", "jurisdiction": "us", "jurisdiction_name": "United States (federal only)", "jurisdiction_flag": "🇺🇸", "summary": "LexLint has not researched product and AI liability law for this jurisdiction. Unlinted is not clean: check it by hand.", "citation": null, "as_of_date": "2026-10-17", "confidence": "high", "stale": false }, { "id": "us:15-u-s-c-section-45", "kind": "obligation", "severity": "warn", "jurisdiction": "us", "jurisdiction_name": "United States (federal only)", "jurisdiction_flag": "🇺🇸", "summary": "FTC Act Section 5, Unfair or Deceptive Acts or Practices (privacy and data-security enforcement): Prohibits unfair or deceptive acts or practices in or affecting commerce and empowers the FTC, not private plaintiffs, to investigate and enforce against them.", "detail": "Prohibits unfair or deceptive acts or practices in or affecting commerce and empowers the FTC, not private plaintiffs, to investigate and enforce against them. This is the primary federal vehicle for privacy and data-security enforcement in the absence of a comprehensive statute, reaching misrepresentations about data collection or protection and unfair data practices that cause substantial, unavoidable consumer injury. The Commission's 2023 Policy Statement on Biometric Information applies this authority to biometric identifiers, including those derived from photographs, videos, or voice recordings.", "citation": "15 U.S.C. Section 45", "url": "https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title15-section45&num=0&edition=prelim", "note_url": "https://lexlint.io/l/us-15-u-s-c-45", "requires": [ "Do not engage in unfair or deceptive practices when collecting, using, or sharing personal data.", "Assess foreseeable privacy harms before deploying a system that collects or uses biometric identifiers derived from photographs, videos, or voice recordings, and disclose material facts about that collection." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-08-23", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [ "disclosure" ] }, "applies_to": "private", "stale": false, "effective_date": "1914-09-26", "in_force": { "state": "in_force", "dated": true, "from": "1914-09-26", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 1914-09-26", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 1914-09-26", "commencement_established": true }, "settledness": { "band": "developing", "guidance_url": "https://www.ftc.gov/legal-library/browse/ftc-policy-statement-unfairness", "guidance_body": "Federal Trade Commission", "case_citation": "Federal Trade Commission v. Wyndham Worldwide Corp., 799 F.3d 236 (3d Cir. 2015)", "case_url": "https://www2.ca3.uscourts.gov/opinarch/143514p.pdf", "open_questions": [ "Does a failure to use reasonable data security cause or likely cause \"substantial injury to consumers\" under 15 U.S.C. 45(n) when personal information was exposed but no consumer is shown to have been harmed by the exposure?" ], "as_of": "2026-10-15" }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 1914-09-26" } }, { "id": "us:18-u-s-c-2511-2520", "kind": "obligation", "severity": "warn", "jurisdiction": "us", "jurisdiction_name": "United States (federal only)", "jurisdiction_flag": "🇺🇸", "summary": "Wiretap Act: It is unlawful to intentionally intercept, or procure another person to intercept, a wire, oral, or electronic communication, but federal law requires the consent of only one party to the communication: a person who is themselves a party to the call, or who has the prior consent of one of the parties, may record or disclose it without the other party's knowledge, unless the interception is for the purpose of committing a crime or a tort.", "detail": "It is unlawful to intentionally intercept, or procure another person to intercept, a wire, oral, or electronic communication, but federal law requires the consent of only one party to the communication: a person who is themselves a party to the call, or who has the prior consent of one of the parties, may record or disclose it without the other party's knowledge, unless the interception is for the purpose of committing a crime or a tort. A person whose communication is intercepted, disclosed, or used in violation of this chapter has a civil action for the greater of actual damages plus the violator's profits, or statutory damages of $100 a day per violation or $10,000, whichever is greater, plus punitive damages and attorney's fees. An intentional violation is also a federal crime punishable by a fine or up to five years' imprisonment. The provisions this entry describes came into force on different days.", "citation": "18 U.S.C. 2511, 2520", "url": "https://uscode.house.gov/view.xhtml?req=granuleid:USC-prelim-title18-section2511&num=0&edition=prelim", "note_url": "https://lexlint.io/l/us-18-u-s-c-2511-2520", "requires": [ "Get the consent of at least one party to a wire, oral, or electronic communication before intercepting, recording, transcribing, or disclosing its contents; consent from a person who is themselves a party to the call is enough under federal law even without the other party's knowledge, unless the interception is for the purpose of committing a crime or a tort.", "Expect a civil suit from anyone whose communication you intercept, disclose, or use without the required consent, for the greater of actual damages plus your profits, or statutory damages of $100 a day per violation or $10,000, whichever is greater, plus punitive damages and the plaintiff's attorney's fees.", "Expect criminal exposure of a fine or up to five years' imprisonment for an intentional violation." ], "why": "Pulled in because the app keeps or monitors what users type in a chat, and the law library tags this instrument for exactly that.", "basis": "in_effect (in force)", "as_of_date": "2026-09-24", "confidence": "high", "matched_by": { "activities": [ "records_text_chat" ], "flags": [ "records_text_chat" ], "categories": [] }, "applies_to": "both", "stale": false, "effective_date": null, "in_force": { "state": "in_force", "dated": false, "from": null, "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": null, "commencement_established": false }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "recorded as in force, with no commencement date to measure" } }, { "id": "us:discussion-draft-119th-cong-june-4-2026", "kind": "pending", "severity": "info", "jurisdiction": "us", "jurisdiction_name": "United States (federal only)", "jurisdiction_flag": "🇺🇸", "summary": "Great American AI Act (Discussion Draft): Released June 4, 2026, by Representatives Obernolte and Trahan, this bipartisan 269-page discussion draft is the most comprehensive proposed federal AI framework to date, covering frontier model transparency and safety, third-party audits via Independent Verification Organizations, critical safety incident reporting, whistleblower protections, AI-driven mass layoff notice requirements, cybersecurity, and a three-year preemption clause restricting state laws that specifically regulate AI model development.", "detail": "Released June 4, 2026, by Representatives Obernolte and Trahan, this bipartisan 269-page discussion draft is the most comprehensive proposed federal AI framework to date, covering frontier model transparency and safety, third-party audits via Independent Verification Organizations, critical safety incident reporting, whistleblower protections, AI-driven mass layoff notice requirements, cybersecurity, and a three-year preemption clause restricting state laws that specifically regulate AI model development. Would formally authorize the Center for AI Standards and Innovation (CAISI) at Commerce with $100 million per year. As of this review it remains a discussion draft, soliciting stakeholder feedback, with no introduced bill number and no committee referral.", "citation": "Discussion Draft, 119th Cong. (June 4, 2026)", "url": "https://obernolte.house.gov/media/press-releases/obernolte-trahan-release-discussion-draft-great-american-ai-act", "note_url": null, "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "not law yet (status \"proposed\")", "as_of_date": "2026-08-12", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [ "agent_txn", "disclosure" ] }, "applies_to": "both", "stale": false, "effective_date": null, "in_force": { "state": "proposed", "dated": false, "from": null, "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "proposed", "as_of": "2026-10-19" }, "status": "proposed", "lifecycle": { "band": "proposed", "label": "PROPOSED", "tone": "pending", "detail": "draft date not recorded", "commencement_established": false }, "certainty": { "resultset": "forward", "rung": null, "label": null, "prediction": null, "detail": "not law yet, and no stage is recorded to rank it by" } }, { "id": "us:h-r-1694-119th-cong-2025-2026", "kind": "pending", "severity": "info", "jurisdiction": "us", "jurisdiction_name": "United States (federal only)", "jurisdiction_flag": "🇺🇸", "summary": "AI Accountability Act: Introduced February 27, 2025, by Representatives Harder and Kelly, this bill directs the National Telecommunications and Information Administration (NTIA) to study and report on accountability measures for AI systems used in communications technologies, including how to make AI system information available to the public.", "detail": "Introduced February 27, 2025, by Representatives Harder and Kelly, this bill directs the National Telecommunications and Information Administration (NTIA) to study and report on accountability measures for AI systems used in communications technologies, including how to make AI system information available to the public. Referred to the House Committee on Energy and Commerce; a study-and-report measure rather than a direct regulatory requirement.", "citation": "H.R.1694, 119th Cong. (2025-2026)", "url": "https://www.congress.gov/bill/119th-congress/house-bill/1694", "note_url": null, "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "not law yet (status \"in_committee\")", "as_of_date": "2026-08-12", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [ "disclosure" ] }, "applies_to": "private", "stale": false, "effective_date": null, "in_force": { "state": "proposed", "dated": false, "from": null, "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "proposed", "as_of": "2026-10-19" }, "status": "in_committee", "lifecycle": { "band": "proposed", "label": "PROPOSED", "tone": "pending", "detail": "draft date not recorded", "commencement_established": false }, "certainty": { "resultset": "forward", "rung": null, "label": null, "prediction": null, "detail": "not law yet, and no stage is recorded to rank it by" } }, { "id": "us:h-r-6489-119th-cong-2025-2026", "kind": "pending", "severity": "info", "jurisdiction": "us", "jurisdiction_name": "United States (federal only)", "jurisdiction_flag": "🇺🇸", "summary": "SAFE BOTs Act (Safeguarding Adolescents From Exploitative BOTs Act): Would require chatbot providers to clearly disclose at the start of each interaction that the chatbot is an AI system and not a human professional, with disclosures in age-appropriate plain language for minors under 17.", "detail": "Would require chatbot providers to clearly disclose at the start of each interaction that the chatbot is an AI system and not a human professional, with disclosures in age-appropriate plain language for minors under 17. Mandates crisis resource referrals, break reminders after three hours, and policies against harmful content. Enforced by the FTC with state attorney general authority; requirements take effect one year after enactment. No committee action reported since the May 2026 review.", "citation": "H.R.6489, 119th Cong. (2025-2026)", "url": "https://www.congress.gov/bill/119th-congress/house-bill/6489/text", "note_url": null, "requires": [ "This measure is in committee and binds nobody yet; what follows is what it would require if it is enacted in this form.", "Disclose at the start of each interaction that the chatbot is an AI system, not a human professional.", "Provide that disclosure in age-appropriate plain language when the user is a minor under 17.", "Provide crisis resource referrals.", "Send a break reminder after three hours of use.", "Adopt a policy against harmful content." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "not law yet (status \"in_committee\")", "as_of_date": "2026-08-12", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [ "disclosure" ] }, "applies_to": "private", "stale": false, "effective_date": null, "in_force": { "state": "proposed", "dated": false, "from": null, "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "proposed", "as_of": "2026-10-19" }, "status": "in_committee", "lifecycle": { "band": "proposed", "label": "PROPOSED", "tone": "pending", "detail": "draft date not recorded", "commencement_established": false }, "certainty": { "resultset": "forward", "rung": null, "label": null, "prediction": null, "detail": "not law yet, and no stage is recorded to rank it by" } }, { "id": "us:h-r-7985-119th-cong-2025-2026", "kind": "pending", "severity": "info", "jurisdiction": "us", "jurisdiction_name": "United States (federal only)", "jurisdiction_flag": "🇺🇸", "summary": "CHATBOT Act (Curbing Harmful AI Tools By Offering Transparency Act): Introduced March 18, 2026, this bill would prohibit AI chatbot operators in licensed professions (finance, insurance, health care) from implying that their chatbot output is provided or verified by a licensed human professional.", "detail": "Introduced March 18, 2026, this bill would prohibit AI chatbot operators in licensed professions (finance, insurance, health care) from implying that their chatbot output is provided or verified by a licensed human professional. Targets deceptive chatbot personas that simulate professional expertise; remains referred to the House Committee on Energy and Commerce with no further action reported since May 2026.", "citation": "H.R.7985, 119th Cong. (2025-2026)", "url": "https://www.congress.gov/bill/119th-congress/house-bill/7985/text/ih", "note_url": null, "requires": [ "This measure is in committee and binds nobody yet; what follows is what it would require if it is enacted in this form.", "Do not imply that a chatbot's output is provided or verified by a licensed human professional, if you operate in a licensed profession such as finance, insurance, or health care." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "not law yet (status \"in_committee\")", "as_of_date": "2026-08-12", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [ "disclosure" ] }, "applies_to": "private", "stale": false, "effective_date": null, "in_force": { "state": "proposed", "dated": false, "from": null, "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "proposed", "as_of": "2026-10-19" }, "status": "in_committee", "lifecycle": { "band": "proposed", "label": "PROPOSED", "tone": "pending", "detail": "draft date not recorded", "commencement_established": false }, "certainty": { "resultset": "forward", "rung": null, "label": null, "prediction": null, "detail": "not law yet, and no stage is recorded to rank it by" } }, { "id": "us:no-6-24-cv-1903-acc-uam-m-d-fla-may-21-2025", "kind": "obligation", "severity": "warn", "jurisdiction": "us", "jurisdiction_name": "United States (federal only)", "jurisdiction_flag": "🇺🇸", "summary": "Garcia v. Character Technologies, Inc.: On a motion to dismiss, the U.S. District Court for the Middle District of Florida held that the developer of an AI chatbot app could assert the First Amendment rights of the app's users.", "detail": "On a motion to dismiss, the U.S. District Court for the Middle District of Florida held that the developer of an AI chatbot app could assert the First Amendment rights of the app's users. The court was not prepared at that stage to hold that the chatbot's output is speech. At that stage, the court held that the chatbot app is a product for the purposes of the product liability claims so far as those claims arise from defects in the app rather than ideas or expressions within the app. It held that the plaintiff sufficiently alleged that the defendants owed a duty, because releasing the chatbot to the public created a foreseeable risk of harm for which they were in a position to control. It dismissed the claim for intentional infliction of emotional distress without leave to amend and denied the motions to dismiss as to the remaining claims, which include negligence, failure to warn, deceptive and unfair trade practices, and unjust enrichment.", "citation": "No. 6:24-cv-1903-ACC-UAM (M.D. Fla. May 21, 2025)", "url": "https://www.courthousenews.com/wp-content/uploads/2025/05/garcia-v-character-technologies-order.pdf", "note_url": "https://lexlint.io/l/us-no-6-24-cv-1903-acc-uam-m-d-fla-may-21-2025", "requires": [ "Treat the design of a conversational AI app as open to product liability claims: on a motion to dismiss, the court held the app a product so far as claims arise from defects in the app, such as the alleged failure to confirm users' ages, omission of reporting mechanisms, programming of characters to employ human mannerisms, and users' inability to exclude indecent content, rather than from ideas or expressions within it.", "Do not assume a chatbot's output is protected speech: at the pleading stage the court was not prepared to hold that the output of the large language model behind the app is speech.", "Take precautions against foreseeable harm to users: at the pleading stage the court held that releasing the chatbot to the public created a foreseeable risk of harm that the developer was in a position to control, which sufficed to allege a duty.", "Do not present chatbot characters as real people or as licensed mental health professionals: at the pleading stage the court held that allegations that characters insist they are real people and are labeled as psychologists or therapists pleaded deceptive conduct under Florida's deceptive and unfair trade practices statute." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-09-30", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "private", "stale": false, "effective_date": "2025-05-21", "in_force": { "state": "in_force", "dated": true, "from": "2025-05-21", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2025-05-21", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2025-05-21", "commencement_established": true }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2025-05-21" } }, { "id": "us:omb-memo-m-25-21-apr-3-2025", "kind": "obligation", "severity": "warn", "jurisdiction": "us", "jurisdiction_name": "United States (federal only)", "jurisdiction_flag": "🇺🇸", "summary": "OMB Memorandum M-25-21 — Accelerating Federal Use of AI through Innovation, Governance, and Public Trust: Requires all executive agencies to appoint Chief AI Officers, create AI governance boards, develop AI strategies by September 30, 2025, and maintain public-facing inventories of AI use cases flagging safety-impacting and rights-impacting systems.", "detail": "Requires all executive agencies to appoint Chief AI Officers, create AI governance boards, develop AI strategies by September 30, 2025, and maintain public-facing inventories of AI use cases flagging safety-impacting and rights-impacting systems. Replaces the Biden-era M-24-10 while preserving requirements for risk management of high-impact AI. Establishes the primary framework governing how federal agencies must govern, disclose, and manage automated decision systems affecting the public.", "citation": "OMB Memo M-25-21 (Apr. 3, 2025)", "url": "https://www.whitehouse.gov/wp-content/uploads/2025/02/M-25-21-Accelerating-Federal-Use-of-AI-through-Innovation-Governance-and-Public-Trust.pdf", "note_url": null, "requires": [ "Appoint a Chief AI Officer.", "Create an AI governance board.", "Develop an AI strategy.", "Maintain a public-facing inventory of AI use cases that flags safety-impacting and rights-impacting systems." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "enacted and in force", "as_of_date": "2026-08-12", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [ "disclosure" ] }, "applies_to": "government", "stale": false, "effective_date": "2025-04-03", "in_force": { "state": "in_force", "dated": true, "from": "2025-04-03", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2025-04-03", "as_of": "2026-10-19" }, "status": "enacted", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2025-04-03", "commencement_established": true }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2025-04-03" } }, { "id": "us:omb-memo-m-26-04-dec-11-2025", "kind": "obligation", "severity": "warn", "jurisdiction": "us", "jurisdiction_name": "United States (federal only)", "jurisdiction_flag": "🇺🇸", "summary": "OMB Memorandum M-26-04 — Increasing Public Trust in AI Through Unbiased AI Principles: Issued pursuant to Executive Order 14319 (Preventing Woke AI in the Federal Government, July 2025), this memorandum requires agencies to contractually mandate that any procured large language model comply with truth-seeking and ideological neutrality principles.", "detail": "Issued pursuant to Executive Order 14319 (Preventing Woke AI in the Federal Government, July 2025), this memorandum requires agencies to contractually mandate that any procured large language model comply with truth-seeking and ideological neutrality principles. Agencies must update procurement policies by March 11, 2026; non-compliance is grounds for contract termination. Represents a significant shift to enforceable contractual obligations for AI systems used in government.", "citation": "OMB Memo M-26-04 (Dec. 11, 2025)", "url": "https://www.whitehouse.gov/wp-content/uploads/2025/12/M-26-04-Increasing-Public-Trust-in-Artificial-Intelligence-Through-Unbiased-AI-Principles-1.pdf", "note_url": null, "requires": [ "Contractually require any procured large language model to comply with truth-seeking and ideological neutrality principles." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "enacted and in force", "as_of_date": "2026-08-12", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [ "disclosure" ] }, "applies_to": "government", "stale": false, "effective_date": "2025-12-11", "in_force": { "state": "in_force", "dated": true, "from": "2025-12-11", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2025-12-11", "as_of": "2026-10-19" }, "status": "enacted", "lifecycle": { "band": "recent", "label": "RECENT", "tone": "live", "detail": "in force 10 months", "commencement_established": true }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2025-12-11" } }, { "id": "us:pub-l-116-260-div-u-title-i-2020-consolidated-appropriations", "kind": "obligation", "severity": "warn", "jurisdiction": "us", "jurisdiction_name": "United States (federal only)", "jurisdiction_flag": "🇺🇸", "summary": "AI in Government Act of 2020: Directs the Office of Management and Budget to issue guidance for how federal agencies use artificial intelligence, and requires OMB to establish an AI Center of Excellence.", "detail": "Directs the Office of Management and Budget to issue guidance for how federal agencies use artificial intelligence, and requires OMB to establish an AI Center of Excellence. Sets foundational requirements for agency AI governance and transparency that subsequent memoranda build upon. Forms part of the statutory basis for the OMB M-24-10 and M-25-21 memoranda.", "citation": "Pub. L. 116-260, Div. U, Title I (2020 Consolidated Appropriations Act)", "url": "https://www.congress.gov/bill/116th-congress/house-bill/6216", "note_url": null, "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "enacted and in force", "as_of_date": "2026-08-12", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [ "disclosure" ] }, "applies_to": "government", "stale": false, "effective_date": "2020-12-27", "in_force": { "state": "in_force", "dated": true, "from": "2020-12-27", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2020-12-27", "as_of": "2026-10-19" }, "status": "enacted", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2020-12-27", "commencement_established": true }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2020-12-27" } }, { "id": "us:pub-l-117-263-div-g-title-lviii-fy2023-ndaa", "kind": "obligation", "severity": "warn", "jurisdiction": "us", "jurisdiction_name": "United States (federal only)", "jurisdiction_flag": "🇺🇸", "summary": "Advancing American AI Act: Directs OMB to develop means to ensure AI acquisitions align with AI-in-Government Act guidance, requires agencies to inventory AI use cases, and directs a catalogue of agency AI use to be made publicly available.", "detail": "Directs OMB to develop means to ensure AI acquisitions align with AI-in-Government Act guidance, requires agencies to inventory AI use cases, and directs a catalogue of agency AI use to be made publicly available. Extends the framework for responsible AI deployment in federal agencies with an emphasis on demonstrating AI benefits while managing risks to rights and safety.", "citation": "Pub. L. 117-263, Div. G, Title LVIII (FY2023 NDAA)", "url": "https://www.congress.gov/bill/117th-congress/senate-bill/1353", "note_url": null, "requires": [ "Maintain an inventory of AI use cases.", "Make the catalogue of agency AI use publicly available." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "enacted and in force", "as_of_date": "2026-08-12", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [ "disclosure" ] }, "applies_to": "government", "stale": false, "effective_date": "2022-12-23", "in_force": { "state": "in_force", "dated": true, "from": "2022-12-23", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2022-12-23", "as_of": "2026-10-19" }, "status": "enacted", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2022-12-23", "commencement_established": true }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2022-12-23" } }, { "id": "us:pub-l-119-12-s-146-119th-cong-2025", "kind": "obligation", "severity": "warn", "jurisdiction": "us", "jurisdiction_name": "United States (federal only)", "jurisdiction_flag": "🇺🇸", "summary": "TAKE IT DOWN Act: Criminalizes the knowing nonconsensual publication of an intimate visual depiction of an identifiable individual, including an AI-generated depiction, and requires covered platforms to establish a process to remove such content within 48 hours of a valid request from the depicted individual or their representative, enforced by the FTC as an unfair or deceptive practice.", "detail": "Criminalizes the knowing nonconsensual publication of an intimate visual depiction of an identifiable individual, including an AI-generated depiction, and requires covered platforms to establish a process to remove such content within 48 hours of a valid request from the depicted individual or their representative, enforced by the FTC as an unfair or deceptive practice. The Act's criminal prohibition on nonconsensual publication took effect immediately upon its enactment on May 19, 2025. The Section 3 platform notice-and-removal duty described by this row's own penalty and enforcement fields did not take effect until May 19, 2026, one year after enactment.", "citation": "Pub. L. 119-12, S. 146, 119th Cong. (2025)", "url": "https://www.congress.gov/bill/119th-congress/senate-bill/146", "note_url": "https://lexlint.io/l/us-pub-l-119-12-s-146-119th-cong-2025", "requires": [ "Establish a process to remove a nonconsensual intimate visual depiction, including an AI-generated depiction, within 48 hours of a valid request from the depicted individual or their representative." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-08-23", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [ "disclosure" ] }, "applies_to": "both", "stale": false, "effective_date": "2026-05-19", "in_force": { "state": "in_force", "dated": true, "from": "2026-05-19", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2026-05-19", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "recent", "label": "RECENT", "tone": "live", "detail": "in force 5 months", "commencement_established": true }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2026-05-19" } }, { "id": "us:s-1213-h-r-5272-119th-cong-2025-2026", "kind": "pending", "severity": "info", "jurisdiction": "us", "jurisdiction_name": "United States (federal only)", "jurisdiction_flag": "🇺🇸", "summary": "Protect Elections from Deceptive AI Act: Bipartisan bill reintroduced March 31, 2025, in the Senate and September 11, 2025, in the House; would amend the Federal Election Campaign Act to prohibit distribution of materially deceptive AI-generated audio, images, or video depicting federal candidates in political ads.", "detail": "Bipartisan bill reintroduced March 31, 2025, in the Senate and September 11, 2025, in the House; would amend the Federal Election Campaign Act to prohibit distribution of materially deceptive AI-generated audio, images, or video depicting federal candidates in political ads. Federal candidates targeted by such content could seek court orders for removal and damages. Includes carve-outs for parody, satire, and news broadcast use.", "citation": "S.1213 / H.R.5272, 119th Cong. (2025-2026)", "url": "https://www.congress.gov/bill/119th-congress/senate-bill/1213", "note_url": null, "requires": [ "This measure is in committee and binds nobody yet; what follows is what it would require if it is enacted in this form.", "Do not distribute materially deceptive AI-generated audio, image, or video depicting a federal candidate in a political ad." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "not law yet (status \"in_committee\")", "as_of_date": "2026-08-12", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [ "disclosure" ] }, "applies_to": "both", "stale": false, "effective_date": null, "in_force": { "state": "proposed", "dated": false, "from": null, "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "proposed", "as_of": "2026-10-19" }, "status": "in_committee", "lifecycle": { "band": "proposed", "label": "PROPOSED", "tone": "pending", "detail": "draft date not recorded", "commencement_established": false }, "certainty": { "resultset": "forward", "rung": null, "label": null, "prediction": null, "detail": "not law yet, and no stage is recorded to rank it by" } }, { "id": "us:s-2164-119th-cong-2025-2026", "kind": "pending", "severity": "info", "jurisdiction": "us", "jurisdiction_name": "United States (federal only)", "jurisdiction_flag": "🇺🇸", "summary": "Algorithmic Accountability Act of 2025: Introduced June 25, 2025, by Senator Ron Wyden, this bill would direct the FTC to require large companies to conduct and disclose impact assessments of automated decision systems used in high-stakes contexts including housing, employment, credit, and education.", "detail": "Introduced June 25, 2025, by Senator Ron Wyden, this bill would direct the FTC to require large companies to conduct and disclose impact assessments of automated decision systems used in high-stakes contexts including housing, employment, credit, and education. Creates consumer rights to transparency about when automated systems are used and empowers opt-out choices. Remains in the Senate Committee on Commerce, Science, and Transportation with no reported committee action since May 2026.", "citation": "S.2164, 119th Cong. (2025-2026)", "url": "https://www.congress.gov/bill/119th-congress/senate-bill/2164/text", "note_url": null, "requires": [ "This measure is in committee and binds nobody yet; what follows is what it would require if it is enacted in this form.", "Conduct an impact assessment of an automated decision system used in a high-stakes context such as housing, employment, credit, or education.", "Disclose the impact assessment.", "Tell consumers when an automated decision system is being used to make a decision about them.", "Let consumers opt out of the use of an automated decision system." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "not law yet (status \"in_committee\")", "as_of_date": "2026-08-12", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [ "disclosure" ] }, "applies_to": "private", "stale": false, "effective_date": null, "in_force": { "state": "proposed", "dated": false, "from": null, "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "proposed", "as_of": "2026-10-19" }, "status": "in_committee", "lifecycle": { "band": "proposed", "label": "PROPOSED", "tone": "pending", "detail": "draft date not recorded", "commencement_established": false }, "certainty": { "resultset": "forward", "rung": null, "label": null, "prediction": null, "detail": "not law yet, and no stage is recorded to rank it by" } }, { "id": "us:s-4591-119th-cong-2025-2026", "kind": "pending", "severity": "info", "jurisdiction": "us", "jurisdiction_name": "United States (federal only)", "jurisdiction_flag": "🇺🇸", "summary": "NO FAKES Act of 2026 (Nurture Originals, Foster Art, and Keep Entertainment Safe Act): Reintroduced as S.4591 in May 2026 by Senators Blackburn and Coons with Representatives Salazar and Dean, this revised NO FAKES Act would establish a federal right of publicity covering any person's voice and visual likeness, living or dead, and create civil liability for unauthorized AI-generated digital replicas, with statutory damages starting at $5,000 per work for individuals and $25,000 per work for platforms hosting unauthorized replicas.", "detail": "Reintroduced as S.4591 in May 2026 by Senators Blackburn and Coons with Representatives Salazar and Dean, this revised NO FAKES Act would establish a federal right of publicity covering any person's voice and visual likeness, living or dead, and create civil liability for unauthorized AI-generated digital replicas, with statutory damages starting at $5,000 per work for individuals and $25,000 per work for platforms hosting unauthorized replicas. The Senate Judiciary Committee unanimously advanced the bill on June 18, 2026; it now awaits a full Senate floor vote and has not been enacted.", "citation": "S.4591, 119th Cong. (2025-2026)", "url": "https://www.congress.gov/bill/119th-congress/senate-bill/4591", "note_url": null, "requires": [ "This measure is in committee and binds nobody yet; what follows is what it would require if it is enacted in this form.", "Do not create or use an unauthorized AI-generated digital replica of a person's voice or visual likeness.", "Do not host an unauthorized AI-generated digital replica of a person's voice or visual likeness." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "not law yet (status \"in_committee\")", "as_of_date": "2026-08-12", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [ "disclosure" ] }, "applies_to": "private", "stale": false, "effective_date": null, "in_force": { "state": "proposed", "dated": false, "from": null, "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "proposed", "as_of": "2026-10-19" }, "status": "in_committee", "lifecycle": { "band": "proposed", "label": "PROPOSED", "tone": "pending", "detail": "draft date not recorded", "commencement_established": false }, "certainty": { "resultset": "forward", "rung": null, "label": null, "prediction": null, "detail": "not law yet, and no stage is recorded to rank it by" } }, { "id": "us:soft-law", "kind": "coverage", "severity": "info", "jurisdiction": "us", "jurisdiction_name": "United States (federal only)", "jurisdiction_flag": "🇺🇸", "summary": "2 matched record(s) are policy or guidance, not law: FTC Proposed Policy Statement Concerning the Suppression of Accuracy in Artificial Intelligence Systems; White House National AI Policy Framework (Legislative Recommendations). They bind nobody on their own, so they are not findings; read them as context.", "citation": null, "as_of_date": "2026-10-17", "confidence": "high", "stale": false }, { "id": "us:public-sector-undeclared", "kind": "coverage", "severity": "info", "jurisdiction": "us", "jurisdiction_name": "United States (federal only)", "jurisdiction_flag": "🇺🇸", "summary": "4 finding(s) below carry duties that bind only public bodies. Nobody said whether a public body runs this software or buys it, so those duties are shown as yours. Ask, and send public_sector (body, supplier or none) to route them.", "citation": null, "as_of_date": "2026-10-17", "confidence": "high", "stale": false }, { "id": "us:untagged-instruments", "kind": "coverage", "severity": "warn", "jurisdiction": "us", "jurisdiction_name": "United States (federal only)", "jurisdiction_flag": "🇺🇸", "summary": "1 instrument(s) for this jurisdiction carry no behaviour tags at all, so no declared activity can match them. They are outside this run: review them by hand.", "citation": null, "as_of_date": "2026-10-17", "confidence": "high", "stale": false }, { "id": "us/ca:cal-bus-prof-code-22650-et-seq-sb-11-2025-2026-reg-sess", "kind": "pending", "severity": "info", "jurisdiction": "us/ca", "jurisdiction_name": "US-California", "summary": "Digital Replica Consumer Warning Requirement (SB 11): Requires any person or entity that makes available AI technology capable of creating digital replicas of real individuals to display a consumer warning by December 1, 2026, reading that unlawful use of the technology to depict another person without prior consent may result in civil or criminal liability for the user.", "detail": "Requires any person or entity that makes available AI technology capable of creating digital replicas of real individuals to display a consumer warning by December 1, 2026, reading that unlawful use of the technology to depict another person without prior consent may result in civil or criminal liability for the user. The warning must be hyperlinked on pages where consumers enter prompts and included in the platform's terms and conditions. The act also amends Civil Code § 3344 and adds provisions to the Evidence Code (Art. 2.5, commencing with § 1425) and Penal Code (Ch. 9, commencing with § 540).", "citation": "Cal. Bus. & Prof. Code § 22650 et seq. (SB 11, 2025–2026 Reg. Sess.)", "url": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB11", "note_url": null, "requires": [ "This law is enacted but does not take effect until 2026-12-01; what follows applies from that date.", "If you make available AI technology capable of creating digital replicas of real people, display a consumer warning stating that unlawful use of the technology to depict another person without prior consent may result in civil or criminal liability for the user.", "If you make available AI technology capable of creating digital replicas of real people, hyperlink that warning on the pages where users enter prompts.", "If you make available AI technology capable of creating digital replicas of real people, include that warning in your terms and conditions." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "enacted, not yet in force, from 2026-12-01", "as_of_date": "2026-08-12", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [ "disclosure" ] }, "applies_to": "private", "stale": false, "effective_date": "2026-12-01", "in_force": { "state": "not_yet_in_force", "dated": true, "from": "2026-12-01", "until": null, "reason": null, "days": 43, "countdown": "in 6 weeks", "stage": null, "words": "not yet in force, from 2026-12-01, in 6 weeks", "as_of": "2026-10-19" }, "status": "enacted", "lifecycle": { "band": "imminent", "label": "IMMINENT", "tone": "live", "detail": "in force in 43 days", "commencement_established": true }, "certainty": { "resultset": "forward", "rung": 1, "label": "enacted, commencement dated", "prediction": "none", "detail": "in force 2026-12-01, so nothing here is predicted" } }, { "id": "us/ca:cal-bus-and-prof-code-section-22758-5-cal-civ-code-sections", "kind": "pending", "severity": "info", "jurisdiction": "us/ca", "jurisdiction_name": "US-California", "summary": "Health Care Services Artificial Intelligence Act (AB 1979): AB 1979 was chaptered on 2026-09-30 as Chapter 854 of the Statutes of 2026.", "detail": "AB 1979 was chaptered on 2026-09-30 as Chapter 854 of the Statutes of 2026. A health facility, clinic, physician's office, or office of a group practice must take reasonable steps to ensure that a licensed health care provider keeps the ability to exercise independent professional judgment whenever care is informed by the output of a clinical decision support system. Those providers may not use an AI tool, system, or device to independently perform a clinical function the law requires a licensed person to perform. A business that offers a health care chatbot to a consumer to manage the individual's information, or for diagnosis, treatment, or management of a medical condition, is deemed a provider of health care subject to the Confidentiality of Medical Information Act. A violation of the clinical-function limits by a physician is subject to the jurisdiction of the Medical Board of California or the Osteopathic Medical Board of California.", "citation": "Cal. Bus. and Prof. Code Section 22758.5; Cal. Civ. Code Sections 56.05 and 56.06 (AB 1979, Ch. 854, Stats. 2026)", "url": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB1979", "note_url": "https://lexlint.io/l/us-ca-cal-bus-prof-22758-5-cal-civ-sections-56-0", "requires": [ "Take reasonable steps to ensure that a licensed health care provider, acting within their scope of practice, keeps the ability to exercise independent professional judgment whenever a patient's care is informed by the output of a clinical decision support system", "Do not use or deploy an AI tool, system, or device to direct, guide, supervise, or instruct unlicensed personnel in a clinical function that the law requires a licensed person to perform, or to perform such a function independently", "If you offer a health care chatbot to a consumer to manage the consumer's information or for diagnosis, treatment, or management of a medical condition, handle the information as a provider of health care under the Confidentiality of Medical Information Act" ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "enacted, not yet in force, from 2027-01-01", "as_of_date": "2026-10-15", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "private", "stale": false, "effective_date": "2027-01-01", "in_force": { "state": "not_yet_in_force", "dated": true, "from": "2027-01-01", "until": null, "reason": null, "days": 74, "countdown": "in 2 months", "stage": null, "words": "not yet in force, from 2027-01-01, in 2 months", "as_of": "2026-10-19" }, "status": "enacted", "lifecycle": { "band": "imminent", "label": "IMMINENT", "tone": "live", "detail": "in force in 74 days", "commencement_established": true }, "certainty": { "resultset": "forward", "rung": 1, "label": "enacted, commencement dated", "prediction": "none", "detail": "in force 2027-01-01, so nothing here is predicted" } }, { "id": "us/ca:cal-bus-and-prof-code-sections-17940-to-17943", "kind": "obligation", "severity": "warn", "jurisdiction": "us/ca", "jurisdiction_name": "US-California", "summary": "Bolstering Online Transparency Act (SB 1001): Makes it unlawful to use a bot to communicate with a person in California with intent to mislead them about the bot's artificial identity, for the purpose of deceiving them to incentivize a commercial transaction or influence a vote.", "detail": "Makes it unlawful to use a bot to communicate with a person in California with intent to mislead them about the bot's artificial identity, for the purpose of deceiving them to incentivize a commercial transaction or influence a vote. A safe harbor applies where the bot operator clearly and conspicuously discloses that the user is interacting with a bot. No enacted amendment, repeal, or litigation affecting this statute was found; AB 410 (2025-2026 session), which would add AI-related definitions and tighten the disclosure duty to require upfront disclosure at first contact, was held under submission in the Senate Appropriations Committee as of 2025-08-29 and carried over to the 2026 session with no further enactment confirmed.", "citation": "Cal. Bus. and Prof. Code Sections 17940 to 17943", "url": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180SB1001", "note_url": "https://lexlint.io/l/us-ca-cal-bus-prof-sections-17940-17943", "requires": [ "Clearly and conspicuously disclose that the user is interacting with a bot, which is the statute's safe harbor", "The prohibition reaches using a bot to mislead a Californian about its artificial identity in order to incentivize a commercial transaction or influence a vote" ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-08-14", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "both", "stale": false, "effective_date": "2019-07-01", "in_force": { "state": "in_force", "dated": true, "from": "2019-07-01", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2019-07-01", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2019-07-01", "commencement_established": true }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2019-07-01" } }, { "id": "us/ca:cal-bus-and-prof-code-sections-22601-to-22606", "kind": "obligation", "severity": "warn", "jurisdiction": "us/ca", "jurisdiction_name": "US-California", "summary": "Companion Chatbot Safety and Accountability Act (SB 243): California's Companion Chatbot Safety and Accountability Act was added by SB 243, chaptered as Stats 2025 Chapter 677, and is effective 2026-01-01 per the code's own history note.", "detail": "California's Companion Chatbot Safety and Accountability Act was added by SB 243, chaptered as Stats 2025 Chapter 677, and is effective 2026-01-01 per the code's own history note. An operator of a companion chatbot platform, one providing an adaptive, human-like AI system capable of sustaining an emotionally or socially engaging relationship across multiple interactions, to issue a clear and conspicuous notification that the companion chatbot is artificially generated and not human whenever a reasonable person interacting with it could be misled otherwise. An operator may not let a companion chatbot engage with users unless it maintains, and publishes on its website, a protocol for preventing the chatbot from producing suicidal-ideation, suicide, or self-harm content, including a crisis-service referral notification. For a user the operator knows is a minor, Section 22602(c) requires the operator to disclose that the user is interacting with artificial intelligence, provide a break reminder by default at least every three hours, and take reasonable measures to keep the chatbot from producing sexually explicit visual material or urging the minor toward sexually explicit conduct. The operator must also disclose, wherever a user can access the platform, that companion chatbots may not be suitable for some minors. SB 1119 was chaptered on 2026-09-10 as Chapter 190 of the Statutes of 2026. It amends Section 22602 to delete the provisions that apply to a user the operator knows is a minor. Under Article IV, section 8(c)(1) of the California Constitution, a statute enacted at a regular session goes into effect on the January 1 next following a 90-day period from its enactment, which for that amendment is January 1, 2027. It amends no other section of the companion chatbot chapter. Beginning 2027-07-01, an operator must report annually to the Office of Suicide Prevention on crisis-referral notifications issued and protocols in place. A person who suffers injury in fact from a violation may bring a civil action for injunctive relief, the greater of actual damages or $1,000 per violation, and attorney's fees and costs; the chapter excludes bots used only for customer service or internal business purposes, video-game bots limited to game-related replies, and stand-alone voice-command consumer devices that do not sustain a relationship across interactions. Confirmed against leginfo's chaptered bill text.", "citation": "Cal. Bus. and Prof. Code Sections 22601 to 22606", "url": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB243", "note_url": "https://lexlint.io/l/us-ca-cal-bus-prof-sections-22601-22606", "requires": [ "If a reasonable person interacting with your companion chatbot could be misled into believing they are talking to a human, issue a clear and conspicuous notification that the chatbot is artificially generated and not human", "Do not let a companion chatbot on your platform engage with users unless you maintain, and publish on your website, a protocol for preventing it from producing suicidal ideation, suicide, or self-harm content, including a notification referring the user to a crisis hotline or crisis text line", "For a user you know is a minor, disclose that they are interacting with artificial intelligence, and provide a clear and conspicuous break reminder by default at least every three hours during continuing interactions (Section 22602(c)(1) and (2), deleted by SB 1119 effective January 1, 2027)", "For a user you know is a minor, take reasonable measures to prevent your companion chatbot from producing visual sexually explicit material or directly telling the minor to engage in sexually explicit conduct (Section 22602(c)(3), deleted by SB 1119 effective January 1, 2027)", "Disclose, wherever a user can access your companion chatbot platform, that companion chatbots may not be suitable for some minors (Section 22604)", "Beginning 2027-07-01, report annually to the Office of Suicide Prevention on the crisis-referral notifications you issued and the protocols you have in place, without including user identifiers or personal information", "A companion chatbot used only for customer service, internal business purposes, or as a limited video-game feature, or a stand-alone voice-command consumer device that does not sustain a relationship across interactions, falls outside this chapter" ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-09-08", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "both", "stale": false, "effective_date": "2026-01-01", "in_force": { "state": "in_force", "dated": true, "from": "2026-01-01", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2026-01-01", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "recent", "label": "RECENT", "tone": "live", "detail": "in force 10 months", "commencement_established": true }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2026-01-01" } }, { "id": "us/ca:cal-bus-and-prof-code-sections-22757-to-22757-6", "kind": "obligation", "severity": "warn", "jurisdiction": "us/ca", "jurisdiction_name": "US-California", "summary": "California AI Transparency Act (SB 942, as amended by AB 853, SB 1000 and AB 2713): A covered provider must make a disclosure verification tool available at no cost to the user, one that lets a user assess whether image, video, or audio content was created or altered, other than by a minor modification, by the provider's generative AI system and that outputs any system provenance data detected in the content.", "detail": "A covered provider must make a disclosure verification tool available at no cost to the user, one that lets a user assess whether image, video, or audio content was created or altered, other than by a minor modification, by the provider's generative AI system and that outputs any system provenance data detected in the content. To the extent it is technically feasible, a covered provider must also include in that content a latent disclosure that names the provider, the system and its version, the time and date of creation or alteration, a unique identifier, and whether the system created or altered the content, and that is permanent or extraordinarily difficult to remove or tamper with. A covered provider is a person that creates, codes, or otherwise produces a generative AI system that is publicly accessible within California. SB 1000 was chaptered on 2026-09-30 as Chapter 861 of the Statutes of 2026. It is an urgency statute and went into immediate effect. SB 1000 deleted the user threshold from the definition of covered provider, replaced the term AI detection tool with disclosure verification tool, and deleted the requirement that a covered provider offer the user the option to include a manifest disclosure in content. A violator of the chapter is liable for a civil penalty of $5,000 per violation, collected in a civil action filed by the Attorney General, a city attorney, or a county counsel, and each day of violation is a discrete violation. SB 1000 added Section 22757.4.1, which sets a civil penalty of $50,000 per violation, collected in a civil action filed by the Attorney General, a city attorney, or a county counsel, for a violation of Section 22757.3(d), and which is repealed on January 1, 2029. A covered provider shall not falsely represent that a generative AI system is designed to primarily function as assistive technology. Before January 1, 2029, the chapter does not apply to a generative AI system that is designed to primarily function as assistive technology. Until 2026-09-29 the definition of covered provider carried a user-count threshold that the chapter no longer contains. AB 853 (2025) moved the chapter's operative date from 2026-01-01 to 2026-08-02. AB 853 also added duties for large online platforms and GenAI hosting platforms from 2027-01-01 and for capture device manufacturers from 2028-01-01. AB 2713 was chaptered on 2026-09-30 as Chapter 856 of the Statutes of 2026. AB 2713 revised the duties and prohibitions applicable to a large online platform in Section 22757.3.1, which is operative on 2027-01-01. Under AB 2713 a large online platform must detect whether any provenance data is embedded into, attached to, or otherwise associated with content distributed on the platform. It must provide a user interface that reliably indicates whether any system provenance data or digital signature associated with content identifies the content as generated or substantially altered by a GenAI system or captured by a capture device. It must allow a user to inspect any system provenance data associated with the content in an easily accessible manner. The section does not require a large online platform to take any action with respect to provenance data, system provenance data, or digital signatures that are not compliant or interoperable with widely adopted specifications issued by an established standards-setting body. The version of the section that AB 853 enacted required a large online platform to detect only provenance data compliant with widely adopted specifications adopted by an established standards-setting body. The chapter is Chapter 25 (commencing with Section 22757) of Division 8 of the Business and Professions Code. A Section 22756 to 22756.6 range sometimes cited for the chapter does not exist.", "citation": "Cal. Bus. and Prof. Code Sections 22757 to 22757.6", "url": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202320240SB942", "note_url": "https://lexlint.io/l/us-ca-cal-bus-prof-sections-22757-22757-6", "requires": [ "Make available, at no cost to the user, a disclosure verification tool that lets a user assess whether image, video, or audio content was created or altered, other than by a minor modification, by your generative AI system and that outputs any system provenance data detected in the content", "To the extent it is technically feasible, embed in image, video, and audio content your system creates or alters a latent disclosure carrying your name, the system's name and version, the time and date, a unique identifier, and whether the system created or altered the content, and make it permanent or extraordinarily difficult to remove", "Do not collect, use, retain, sell, share, or otherwise make available personal information derived from a user of the verification tool or from content it processes beyond what is strictly necessary, and do not make access to your system or the tool depend on a user providing personal information beyond that", "If you license your system, tell the licensee its obligations under the chapter; if you know a licensee modified it so that it no longer complies, end the licensee's authorization or notify the licensee within 72 hours, and report an unresolved licensee's noncompliance to the Attorney General", "Do not falsely represent that your generative AI system is designed to primarily function as assistive technology", "If you run a large online platform, from 2027-01-01 detect provenance data in content distributed on it, show users a clear indication of whether any system provenance data or digital signature identifies the content as generated, substantially altered, or captured by a device, let users inspect that data, and, to the extent technically feasible, do not knowingly strip it", "Later phases add duties for GenAI hosting platforms from 2027-01-01 and for capture device manufacturers from 2028-01-01" ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-08-14", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "private", "stale": false, "effective_date": "2026-08-02", "in_force": { "state": "in_force", "dated": true, "from": "2026-08-02", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2026-08-02", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "new", "label": "NEW", "tone": "force", "detail": "in force 78 days", "commencement_established": true }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2026-08-02" } }, { "id": "us/ca:cal-civ-code-section-1798-100-et-seq-ccpa-as-amended-by-the", "kind": "obligation", "severity": "warn", "jurisdiction": "us/ca", "jurisdiction_name": "US-California", "summary": "California Consumer Privacy Act, as amended by the California Privacy Rights Act (Proposition 24): Governs private-sector for-profit businesses that meet the CCPA's revenue or data-volume threshold and determine the purposes and means of processing a California consumer's personal information.", "detail": "Governs private-sector for-profit businesses that meet the CCPA's revenue or data-volume threshold and determine the purposes and means of processing a California consumer's personal information. Duties run on a notice-and-purpose-limitation model rather than a consent-gated lawful basis, and are allocated among four defined roles: business, service provider, contractor, and third party. The original CCPA (AB 375) became operative January 1, 2020; the California Privacy Rights Act (Proposition 24) substantially expanded it, and the amended law now in force became operative January 1, 2023. AB 1008 (2024) separately expanded the personal-information definition to reach data held in AI systems capable of outputting it.", "citation": "Cal. Civ. Code section 1798.100 et seq. (CCPA, as amended by the CPRA)", "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.100.", "note_url": "https://lexlint.io/l/us-ca-cal-civ-1798-100-et-seq-ccpa-as-amended-by", "requires": [ "If your app is a for-profit business meeting the CCPA's revenue or data-volume threshold and it determines the purposes and means of processing a California consumer's personal information, honor the CCPA/CPRA's notice, opt-out, and non-discrimination duties before collecting, selling, or sharing that data.", "Disclose at or before collection the categories of personal information you collect, your purpose for collecting it, and the retention period or the criteria you use to set it.", "Limit your collection, use, retention, and sharing of a California consumer's personal information to what is reasonably necessary and proportionate to the purpose you disclosed." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-08-23", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "private", "stale": false, "effective_date": "2023-01-01", "in_force": { "state": "in_force", "dated": true, "from": "2020-01-01", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2020-01-01", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2020-01-01", "commencement_established": true }, "settledness": { "band": "developing", "guidance_url": "https://cppa.ca.gov/pdf/enfadvisory202401.pdf", "guidance_body": "California Privacy Protection Agency, Enforcement Division", "open_questions": [ "Does a trained artificial intelligence model count as an \"artificial intelligence system that is capable of outputting personal information\" under Civil Code section 1798.140(v)(4)(C), so that a consumer's right to delete reaches the model itself?" ], "as_of": "2026-10-15" }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2020-01-01" } }, { "id": "us/ca:cal-civ-code-section-1798-81-5-as-amended-by-ab-825-2021-ch", "kind": "obligation", "severity": "warn", "jurisdiction": "us/ca", "jurisdiction_name": "US-California", "summary": "Customer Records Act, Reasonable Security Procedures: A business that owns, licenses, or maintains personal information about a California resident must implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect it from unauthorized access, destruction, use, modification, or disclosure; where the business instead discloses that information to a nonaffiliated third party by contract, it must require the same standard of the third party by contract.", "detail": "A business that owns, licenses, or maintains personal information about a California resident must implement and maintain reasonable security procedures and practices appropriate to the nature of the information, to protect it from unauthorized access, destruction, use, modification, or disclosure; where the business instead discloses that information to a nonaffiliated third party by contract, it must require the same standard of the third party by contract. Covered personal information reaches a California resident's name paired with a Social Security, driver's license, state identification, passport, military identification, or tax identification number, a financial account or payment card number together with its access code, medical information, health insurance information, unique biometric data used to authenticate a specific individual, genetic data, or a username or email address paired with a password or security question that would permit access to an online account. The duty exempts a health care provider, health plan, or contractor already regulated by the Confidentiality of Medical Information Act, a financial institution subject to the California Financial Information Privacy Act, a HIPAA covered entity as to HIPAA-regulated medical privacy and security rules, an entity receiving Vehicle Code confidentiality-protected information, and a business already subject to state or federal law that provides greater protection to personal information on the same subject, which is deemed compliant instead. Civil Code section 1798.84(b), within the same Customer Records title, gives a customer injured by a violation of this duty a civil action to recover damages, with no statutory cap of its own. The $500 to $3,000 per-violation civil penalty that section 1798.84(c) provides is reserved, by its own terms, for a violation of section 1798.83's Shine the Light disclosure duty rather than a violation of this section. Where the violation is a breach of nonencrypted or nonredacted personal information, the CCPA/CPRA's own statutory-damages private right of action, Civil Code section 1798.150, is a further and separate remedy, already researched as this jurisdiction's privacy row.", "citation": "Cal. Civ. Code section 1798.81.5, as amended by AB 825 (2021, Ch. 527)", "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.81.5.", "note_url": "https://lexlint.io/l/us-ca-cal-civ-1798-81-5-as-amended-by-ab-825-202", "requires": [ "This binds a business that owns, licenses, or maintains personal information about a California resident, and by contract extends the same duty to a nonaffiliated third party the business discloses that information to; it exempts a health care provider, plan, or contractor already regulated by the Confidentiality of Medical Information Act, a financial institution subject to the California Financial Information Privacy Act, a HIPAA covered entity as to HIPAA-regulated activity, and a business already subject to state or federal law providing greater protection on the same subject, deemed compliant with this duty instead.", "Implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information you own, license, or maintain, to protect it from unauthorized access, destruction, use, modification, or disclosure.", "Covered personal information reaches a name paired with a Social Security, driver's license, state ID, passport, military ID, or tax ID number, a financial account or payment card number with its access code, medical or health insurance information, unique biometric data used to authenticate a person, genetic data, or a username or email address paired with a password or security question that unlocks an online account.", "A customer injured by a violation of this duty may bring a civil action for damages under Civil Code section 1798.84(b); where the violation is a breach of nonencrypted or nonredacted personal information, the CCPA/CPRA's own statutory-damages private right of action, Civil Code section 1798.150, is a separate and further remedy, researched as this jurisdiction's privacy row." ], "why": "Pulled in because the app deploys a chatbot and keeps or monitors what users type in a chat, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-09-12", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot", "records_text_chat" ], "flags": [ "deploys_chatbot", "records_text_chat" ], "categories": [] }, "applies_to": "private", "stale": false, "effective_date": "2022-01-01", "in_force": { "state": "in_force", "dated": true, "from": "2022-01-01", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2022-01-01", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2022-01-01", "commencement_established": true }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2022-01-01" } }, { "id": "us/ca:cal-civ-code-section-1798-82-as-amended-by-sb-446-2025-ch-31", "kind": "obligation", "severity": "warn", "jurisdiction": "us/ca", "jurisdiction_name": "US-California", "summary": "California Data Breach Notification Law, as amended by SB 446: Requires a business that owns or licenses computerized personal information of a California resident to notify that resident on discovery or notification of a security breach.", "detail": "Requires a business that owns or licenses computerized personal information of a California resident to notify that resident on discovery or notification of a security breach. As amended by SB 446 (signed October 3, 2025), the statute now fixes that duty at 30 calendar days, replacing the prior open-ended most-expedient-time-possible standard, and requires notice to the Attorney General within 15 days of consumer notification where a breach affects more than 500 California residents.", "citation": "Cal. Civ. Code section 1798.82, as amended by SB 446 (2025, Ch. 319)", "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.82.", "note_url": "https://lexlint.io/l/us-ca-cal-civ-1798-82-as-amended-by-sb-446-2025", "requires": [ "Notify affected California residents of a breach of their unencrypted personal information within 30 calendar days of discovery or notification.", "Notify the California Attorney General within 15 days of consumer notification when a breach affects more than 500 California residents." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-08-23", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "private", "stale": false, "effective_date": "2026-01-01", "in_force": { "state": "in_force", "dated": true, "from": "2026-01-01", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2026-01-01", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "recent", "label": "RECENT", "tone": "live", "detail": "in force 10 months", "commencement_established": true }, "settledness": { "band": "developing", "guidance_url": "https://oag.ca.gov/privacy/databreach/reporting", "guidance_body": "Office of the Attorney General of California", "open_questions": [ "When does a business \"discover\" a breach of the security of the system, so that the 30 calendar days in Civil Code section 1798.82(a)(2)(A) begin to run, given that subparagraph (B) allows delay \"as necessary to determine the scope of the breach\"?" ], "as_of": "2026-10-15" }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2026-01-01" } }, { "id": "us/ca:cal-civ-code-sections-1798-100-1798-105-1798-106-1798-110-17", "kind": "obligation", "severity": "warn", "jurisdiction": "us/ca", "jurisdiction_name": "US-California", "summary": "CCPA/CPRA Consumer Rights: Access, Deletion, Correction, and Opt-Out: Gives California consumers the right to know and access what personal information a business holds and its source, the right to delete it, the right to correct it, a right to a portable copy, and the right to opt out of the sale or sharing of their personal information to third parties, all exercisable against the business rather than directly against its service providers or contractors.", "detail": "Gives California consumers the right to know and access what personal information a business holds and its source, the right to delete it, the right to correct it, a right to a portable copy, and the right to opt out of the sale or sharing of their personal information to third parties, all exercisable against the business rather than directly against its service providers or contractors. A business may not discriminate against a consumer for exercising these rights.", "citation": "Cal. Civ. Code sections 1798.100, 1798.105, 1798.106, 1798.110, 1798.115, 1798.120, 1798.125, 1798.130", "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.100.", "note_url": "https://lexlint.io/l/us-ca-cal-civ-sections-1798-100-1798-105-1798-10", "requires": [ "Provide a California consumer a verifiable way to request access to, deletion of, correction of, and a portable copy of their personal information, and respond within the CCPA's statutory timeline.", "Honor a Global Privacy Control signal or another recognized opt-out preference signal as a valid request to opt out of the sale or sharing of personal information.", "Do not deny goods or services, charge a different price, or provide a different quality of service to a California consumer because they exercised a CCPA right." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-08-23", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "private", "stale": false, "effective_date": "2023-01-01", "in_force": { "state": "in_force", "dated": true, "from": "2020-01-01", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2020-01-01", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2020-01-01", "commencement_established": true }, "settledness": { "band": "developing", "guidance_url": "https://cppa.ca.gov/pdf/enfadvisory202401.pdf", "guidance_body": "California Privacy Protection Agency, Enforcement Division", "open_questions": [ "When does a business's duty under Civil Code section 1798.105(c)(1) to notify third parties to delete a consumer's personal information become something that \"proves impossible or involves disproportionate effort\"?" ], "as_of": "2026-10-15" }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2020-01-01" } }, { "id": "us/ca:cal-civ-code-sections-1798-150-1798-155-1798-199-10-1798-199", "kind": "obligation", "severity": "warn", "jurisdiction": "us/ca", "jurisdiction_name": "US-California", "summary": "CCPA/CPRA Enforcement: California Privacy Protection Agency and Private Right of Action: The California Privacy Protection Agency, which assumed enforcement authority July 1, 2023, and the Attorney General share administrative enforcement of the CCPA/CPRA, with civil penalties currently up to $2,663 per violation or $7,988 per intentional violation or one involving a consumer known to be under 16, inflation-adjusted for 2025 under a streamlined adjustment mechanism AB 3286 (2024) put in place.", "detail": "The California Privacy Protection Agency, which assumed enforcement authority July 1, 2023, and the Attorney General share administrative enforcement of the CCPA/CPRA, with civil penalties currently up to $2,663 per violation or $7,988 per intentional violation or one involving a consumer known to be under 16, inflation-adjusted for 2025 under a streamlined adjustment mechanism AB 3286 (2024) put in place. There is no general private right of action for a CCPA violation; a narrow one exists only under section 1798.150 for a business's failure to maintain reasonable security resulting in a breach of unencrypted, unredacted personal information, carrying statutory damages of $100 to $750 per consumer per incident and a 30-day cure notice that does not excuse a breach already suffered.", "citation": "Cal. Civ. Code sections 1798.150, 1798.155, 1798.199.10, 1798.199.90", "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.155.", "note_url": "https://lexlint.io/l/us-ca-cal-civ-sections-1798-150-1798-155-1798-19", "requires": [ "Expect administrative enforcement from the California Privacy Protection Agency and the Attorney General, with civil penalties up to $7,988 for an intentional violation or one involving a consumer under 16 (the 2025 inflation-adjusted amount).", "Maintain reasonable security procedures for a California consumer's unencrypted, unredacted personal information; a breach caused by their absence exposes your business to a private lawsuit for $100 to $750 in statutory damages per consumer per incident, which cannot be cured by improving security after the fact." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-08-23", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "private", "stale": false, "effective_date": "2023-07-01", "in_force": { "state": "in_force", "dated": true, "from": "2023-07-01", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2023-07-01", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2023-07-01", "commencement_established": true }, "settledness": { "band": "developing", "guidance_url": "https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf", "guidance_body": "California Privacy Protection Agency", "open_questions": [ "When is a cure \"possible\" under Civil Code section 1798.150(b) for a breach in which personal information has already been exfiltrated, given that later implementation of reasonable security procedures \"does not constitute a cure with respect to that breach\"?" ], "as_of": "2026-10-15" }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2023-07-01" } }, { "id": "us/ca:cal-code-regs-tit-11-sections-7120-to-7124", "kind": "obligation", "severity": "warn", "jurisdiction": "us/ca", "jurisdiction_name": "US-California", "summary": "CCPA Cybersecurity Audit Regulations: Article 9 of the California Privacy Protection Agency's CCPA regulations, adopted by the Agency Board on July 24, 2025 and effective January 1, 2026, requires a business whose processing of personal information meets the CCPA's revenue-from-data-sales threshold, or its revenue threshold combined with processing the personal information of 250,000 or more consumers or households or the sensitive personal information of 50,000 or more consumers in the preceding calendar year, to complete a cybersecurity audit using a qualified, independent auditor, who may be internal or external to the business, and to submit a written certification of that completion to the Agency each year by April 1.", "detail": "Article 9 of the California Privacy Protection Agency's CCPA regulations, adopted by the Agency Board on July 24, 2025 and effective January 1, 2026, requires a business whose processing of personal information meets the CCPA's revenue-from-data-sales threshold, or its revenue threshold combined with processing the personal information of 250,000 or more consumers or households or the sensitive personal information of 50,000 or more consumers in the preceding calendar year, to complete a cybersecurity audit using a qualified, independent auditor, who may be internal or external to the business, and to submit a written certification of that completion to the Agency each year by April 1. The underlying audit report is not filed with the Agency; the business and auditor must retain it for five years, and it goes only to an executive with direct responsibility for the cybersecurity program. First certifications are due on a staggered schedule starting April 1, 2028 for businesses with 2026 annual gross revenue over $100 million, then April 1, 2029 for the $50 million to $100 million tier, and April 1, 2030 for smaller covered businesses, after which every covered business audits and certifies annually.", "citation": "Cal. Code Regs. tit. 11, Sections 7120 to 7124", "url": "https://cppa.ca.gov/regulations/pdf/ccpa_updates_cyber_risk_admt_appr_text.pdf", "note_url": "https://lexlint.io/l/us-ca-cal-regs-tit-11-sections-7120-7124", "requires": [ "If your business meets the CCPA's business-scale thresholds, deriving 50 percent or more of annual revenue from selling or sharing personal information, or having more than $25 million in annual gross revenue and having processed the personal information of 250,000 or more consumers or households, or the sensitive personal information of 50,000 or more consumers, in the preceding calendar year, complete a cybersecurity audit.", "Complete that audit using a qualified, objective, independent auditor, who may be internal or external to the business, and who did not develop, implement, or maintain the cybersecurity program being audited.", "If you use an internal auditor, have the highest-ranking auditor report to, and have their performance evaluation and compensation determined by, a member of executive management who does not have direct responsibility for the cybersecurity program.", "Retain all documents relevant to each cybersecurity audit for at least five years, and give the audit report only to a member of executive management with direct responsibility for the cybersecurity program.", "Submit a written certification of completion to the California Privacy Protection Agency by April 1 following each year you were required to complete an audit, starting April 1, 2028 for the largest businesses and reaching every covered business by April 1, 2030." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-09-15", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "private", "stale": false, "effective_date": "2026-01-01", "in_force": { "state": "in_force", "dated": true, "from": "2026-01-01", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2026-01-01", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "recent", "label": "RECENT", "tone": "live", "detail": "in force 10 months", "commencement_established": true }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2026-01-01" } }, { "id": "us/ca:cal-executive-order-n-5-26-march-30-2026", "kind": "obligation", "severity": "warn", "jurisdiction": "us/ca", "jurisdiction_name": "US-California", "summary": "Executive Order N-5-26: Responsible AI Procurement: Directs the Department of General Services and the Department of Technology to develop AI vendor certification standards for state contractors within 120 days, requiring attestations on bias governance, harmful-content safeguards, and civil rights protections.", "detail": "Directs the Department of General Services and the Department of Technology to develop AI vendor certification standards for state contractors within 120 days, requiring attestations on bias governance, harmful-content safeguards, and civil rights protections. Also directs state agencies to expand employee access to generative AI tools, issue guidance on watermarking AI-generated government content, and review federal procurement designations. Applies to vendors seeking state contracts but does not retroactively apply to existing contracts.", "citation": "Cal. Executive Order N-5-26 (March 30, 2026)", "url": "https://www.gov.ca.gov/wp-content/uploads/2026/03/3.30-FINAL-Trusted-AI-Procurement-EO-N-5-26.pdf", "note_url": null, "requires": [ "If you are the state department of general services or the state department of technology, develop AI vendor certification standards for state contractors within 120 days.", "If you are seeking a new contract with a California state agency, be ready to attest to your bias governance, your harmful-content safeguards, and your civil rights protections; contracts you already hold are not covered.", "Expand employee access to generative AI tools.", "Issue guidance on watermarking AI-generated government content.", "Review federal procurement designations." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "enacted and in force", "as_of_date": "2026-08-12", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [ "disclosure" ] }, "applies_to": "government", "stale": false, "effective_date": "2026-03-30", "in_force": { "state": "in_force", "dated": true, "from": "2026-03-30", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2026-03-30", "as_of": "2026-10-19" }, "status": "enacted", "lifecycle": { "band": "recent", "label": "RECENT", "tone": "live", "detail": "in force 7 months", "commencement_established": true }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2026-03-30" } }, { "id": "us/ca:cal-penal-code-13663-sb-524-2025-2026-reg-sess-ch-587", "kind": "obligation", "severity": "warn", "jurisdiction": "us/ca", "jurisdiction_name": "US-California", "summary": "Law Enforcement AI Report Disclosure Act (SB 524): Requires every California law enforcement agency that uses generative AI to draft officer reports to maintain a policy under which any report written fully or partially with AI identifies each specific AI program used and carries the prominent statement \"This report was written either fully or in part using artificial intelligence,\" plus the signature of the officer attesting they reviewed the report and that its facts are accurate.", "detail": "Requires every California law enforcement agency that uses generative AI to draft officer reports to maintain a policy under which any report written fully or partially with AI identifies each specific AI program used and carries the prominent statement \"This report was written either fully or in part using artificial intelligence,\" plus the signature of the officer attesting they reviewed the report and that its facts are accurate. Agencies must retain the first AI-generated draft for as long as the official report is retained and keep audit trails of who used the AI and which audio or video footage it drew on. Vendors may not share, sell, or reuse the agency's data outside the agency's purposes or a court order. Approved by the Governor October 10, 2025 (Chapter 587).", "citation": "Cal. Penal Code § 13663 (SB 524, 2025–2026 Reg. Sess., Ch. 587)", "url": "https://leginfo.legislature.ca.gov/faces/billNavClient.xhtml?bill_id=202520260SB524", "note_url": null, "requires": [ "If you are a law enforcement agency using generative AI to draft officer reports, maintain a policy governing that use.", "In a law enforcement report written fully or partly with artificial intelligence, identify each specific AI program used.", "On a law enforcement report drafted with artificial intelligence, carry the prominent statement that the report was written either fully or in part using artificial intelligence.", "Have the officer sign an AI-drafted law enforcement report, attesting that they reviewed it and that its facts are accurate.", "As a law enforcement agency, keep the first AI-generated draft for as long as you keep the official report.", "As a law enforcement agency, keep audit trails of who used the AI and which audio or video footage it drew on.", "If you supply an AI tool to a law enforcement agency, do not share, sell, or reuse that agency's data outside the agency's purposes or a court order." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "enacted and in force", "as_of_date": "2026-08-12", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [ "disclosure" ] }, "applies_to": "government", "stale": false, "effective_date": "2026-01-01", "in_force": { "state": "in_force", "dated": true, "from": "2026-01-01", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2026-01-01", "as_of": "2026-10-19" }, "status": "enacted", "lifecycle": { "band": "recent", "label": "RECENT", "tone": "live", "detail": "in force 10 months", "commencement_established": true }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2026-01-01" } }, { "id": "us/ca:cal-penal-code-631-632-632-7-633-5-637-2", "kind": "obligation", "severity": "warn", "jurisdiction": "us/ca", "jurisdiction_name": "US-California", "summary": "California Invasion of Privacy Act, Recording and Interception of Communications: Section 631 makes it a crime to tap or make an unauthorized connection with a telephone or telegraph wire, line, cable, or internal telephonic communication system, or to learn or try to learn the contents of a message while it is in transit, without the consent of all parties or other authorization.", "detail": "Section 631 makes it a crime to tap or make an unauthorized connection with a telephone or telegraph wire, line, cable, or internal telephonic communication system, or to learn or try to learn the contents of a message while it is in transit, without the consent of all parties or other authorization. Section 632 separately makes it a crime to use an electronic amplifying or recording device to eavesdrop on or record a confidential communication, whether conducted in person or by telephone, without the consent of every party, and the section excludes a person known by every party to be listening in or recording. A communication is confidential where a party has an objectively reasonable expectation that it is not being overheard or recorded. Section 632.7 separately makes it a crime to intercept or record, without the consent of all parties, a communication transmitted between a cellular or cordless telephone and another telephone. Enacted in 1992, it reaches every such communication regardless of whether it is confidential. The California Supreme Court has held that section 632.7 applies to a party to the call and not only to a third-party eavesdropper, remanding the further question whether an audible warning tone alone gave the plaintiff adequate notice to establish consent. Section 633.5 lifts the consent requirement of sections 631, 632, and 632.7 only where a party reasonably believes the recording will produce evidence of extortion, kidnapping, bribery, a violent felony including human trafficking, a violation of Section 653m, or domestic violence, and creates no general business-purpose exception. Sections 631 and 632.7 also exempt a public utility or telephone company from these prohibitions where the acts are for the purpose of constructing, maintaining, conducting, or operating its own communications services and facilities. A 2022 amendment, SB 1272, extended this exemption, previously limited to a public utility, to a telephone company as well, without changing either section's fine amounts. Section 637.2 gives a person injured by a violation of this chapter a civil action for the greater of $5,000 per violation or three times actual damages, with no need to prove actual loss, plus injunctive relief. The California Supreme Court has held that section 632 applies when a confidential communication takes place in part in California and in part in another state. It applied California law to the alleged secret recording of calls by a brokerage firm's Georgia branch with its California clients. The court allowed the claim for an injunction to go forward. It relieved the firm of liability for damages for its past recording of conversations. A first violation of section 631 is punishable by a fine of up to $2,500, imprisonment in county jail for up to one year or under subdivision (h) of Penal Code section 1170, or both a fine and imprisonment. A first violation of section 632 is punishable by a fine of up to $2,500 per violation, imprisonment in county jail for up to one year or in state prison, or both. A first violation of section 632.7 is punishable by a fine of up to $2,500, imprisonment in county jail for up to one year or in state prison, or both. After a prior conviction under section 631, 632, 632.5, 632.6, 632.7 or 636 the fine rises to $10,000, with the same terms of imprisonment. The sections this entry groups came into force on different days.", "citation": "Cal. Penal Code §§ 631, 632, 632.7, 633.5, 637.2", "url": "https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=PEN§ionNum=631.", "note_url": "https://lexlint.io/l/us-ca-cal-penal-631-632-632-7-633-5-637-2", "requires": [ "Do not tap or make an unauthorized connection with a telephone or telegraph wire, line, cable, or internal telephonic communication system, or learn or try to learn the contents of a message while it is in transit, without the consent of all parties or other authorization.", "Get the consent of every party before using an electronic amplifying or recording device to eavesdrop on or record a confidential communication, whether the parties are in each other's presence or on a call; a communication is confidential where a party has an objectively reasonable expectation it is not being overheard or recorded, and disclosing that you are listening or recording, so that every party knows it, takes the recording outside this duty.", "Get the consent of every party before intercepting or recording a communication transmitted between a cellular or cordless telephone and another telephone; this reaches you even if you are a party to the call yourself, not only a third party who intercepts it.", "Section 633.5 lets a party record without the others' consent only where the party reasonably believes the recording will produce evidence of extortion, kidnapping, bribery, a violent felony (including human trafficking), a violation of Section 653m, or domestic violence; it is not a business or compliance exception, so get every party's consent for any other recording.", "These duties do not reach a public utility or telephone company, or its officers, employees, or agents, acting to construct, maintain, conduct, or operate its own communications services and facilities; this exemption does not reach a general business messaging its own customers.", "This all-party consent rule reaches a business's routine recording, from an office outside California, of calls with a party in California; the California Supreme Court has not decided how its choice-of-law analysis applies to an isolated personal call recorded from outside California, or to a recording made because of a reasonable, individualized belief that a caller is engaged in wrongdoing." ], "why": "Pulled in because the app deploys a chatbot and keeps or monitors what users type in a chat, and the law library tags this instrument for exactly that.", "basis": "in_effect (in force)", "as_of_date": "2026-09-26", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot", "records_text_chat" ], "flags": [ "deploys_chatbot", "records_text_chat" ], "categories": [] }, "applies_to": "both", "stale": false, "effective_date": null, "in_force": { "state": "in_force", "dated": false, "from": null, "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": null, "commencement_established": false }, "settledness": { "band": "developing", "case_citation": "Smith v. LoanMe, Inc. (2021) 11 Cal.5th 183", "case_url": "https://www.courts.ca.gov/opinions/documents/S260391.PDF", "open_questions": [ "Does a warning tone alone, without a verbal disclosure that the call is being recorded, give the called party adequate notice to establish consent under section 632.7 when the person continues the conversation after hearing it?" ], "as_of": "2026-09-26" }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "recorded as in force, with no commencement date to measure" } }, { "id": "us/ca:sb-867-ch-189-stats-2026-cal-bus-and-prof-code-section-22604", "kind": "pending", "severity": "info", "jurisdiction": "us/ca", "jurisdiction_name": "US-California", "summary": "Toys with Companion Chatbots Ban (SB 867): SB 867 was chaptered on 2026-09-10 as Chapter 189 of the Statutes of 2026.", "detail": "SB 867 was chaptered on 2026-09-10 as Chapter 189 of the Statutes of 2026. Section 22604.5 of the Business and Professions Code bars a person from manufacturing, selling or exchanging, possessing with intent to sell or exchange, or exposing or offering for sale or exchange to a retailer a toy that includes a companion chatbot. A toy is a physical product designed, marketed, or manufactured for use in play by children under 16 years of age. A companion chatbot is an artificial intelligence system with a natural language interface that provides adaptive, human-like responses to user inputs and is capable of meeting a user's social needs, and the definition excludes a bot used only for customer service or similar business purposes, a limited video game bot and a stand-alone voice-command speaker. The act makes a violation subject to the same civil liability as a violation of the provisions applicable to operators of companion chatbots. A person who suffers injury in fact as a result of a violation of that chapter may recover injunctive relief, damages equal to the greater of actual damages or $1,000 per violation, and reasonable attorney's fees and costs. The section remains in effect only until January 1, 2031, and is repealed on that date. Under Article IV, section 8(c)(1) of the California Constitution, a statute enacted at a regular session goes into effect on the January 1 next following a 90-day period from its enactment, which for this act is January 1, 2027.", "citation": "SB 867 (Ch. 189, Stats. 2026), Cal. Bus. and Prof. Code Section 22604.5", "url": "https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB867", "note_url": "https://lexlint.io/l/us-ca-sb-867-ch-189-stats-2026-cal-bus-prof-2260", "requires": [ "If you manufacture, sell or exchange toys, possess toys with intent to sell or exchange them, or offer toys to a retailer, do not include a companion chatbot in a toy, meaning a physical product designed, marketed, or manufactured for use in play by children under 16 years of age (Section 22604.5(a)).", "Do not supply a toy that includes an artificial intelligence system with a natural language interface that gives adaptive, human-like responses to user inputs and can sustain a relationship across multiple interactions, other than a bot limited to customer service or similar business purposes, a limited video game bot or a stand-alone voice-command speaker (Sections 22601(b), 22604.5(a))." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "enacted, not yet in force, from 2027-01-01", "as_of_date": "2026-10-17", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "private", "stale": false, "effective_date": "2027-01-01", "in_force": { "state": "not_yet_in_force", "dated": true, "from": "2027-01-01", "until": null, "reason": null, "days": 74, "countdown": "in 2 months", "stage": null, "words": "not yet in force, from 2027-01-01, in 2 months", "as_of": "2026-10-19" }, "status": "enacted", "lifecycle": { "band": "imminent", "label": "IMMINENT", "tone": "live", "detail": "in force in 74 days", "commencement_established": true }, "certainty": { "resultset": "forward", "rung": 1, "label": "enacted, commencement dated", "prediction": "none", "detail": "in force 2027-01-01, so nothing here is predicted" } }, { "id": "us/ca:public-sector-undeclared", "kind": "coverage", "severity": "info", "jurisdiction": "us/ca", "jurisdiction_name": "US-California", "summary": "2 finding(s) below carry duties that bind only public bodies. Nobody said whether a public body runs this software or buys it, so those duties are shown as yours. Ask, and send public_sector (body, supplier or none) to route them.", "citation": null, "as_of_date": "2026-09-30", "confidence": "high", "stale": false }, { "id": "eu:com-2025-837-final", "kind": "pending", "severity": "info", "jurisdiction": "eu", "jurisdiction_name": "European Union", "jurisdiction_flag": "🇪🇺", "summary": "Digital Omnibus Regulation Proposal, GDPR and ePrivacy Reform: Published by the European Commission on 19 November 2025, the proposal would amend the GDPR alongside the ePrivacy Directive, NIS2 and other digital legislation to fold cookie consent into the GDPR, limit breach notification to the supervisory authority to breaches likely to result in a high risk, set EU-level impact assessment lists, a template and a methodology, and restate Article 22 so that a solely automated decision may be taken only on three conditions, including contract necessity assessed regardless of whether the decision could be taken otherwise than by solely automated means.", "detail": "Published by the European Commission on 19 November 2025, the proposal would amend the GDPR alongside the ePrivacy Directive, NIS2 and other digital legislation to fold cookie consent into the GDPR, limit breach notification to the supervisory authority to breaches likely to result in a high risk, set EU-level impact assessment lists, a template and a methodology, and restate Article 22 so that a solely automated decision may be taken only on three conditions, including contract necessity assessed regardless of whether the decision could be taken otherwise than by solely automated means. As of 6 October 2026 it is in the ordinary legislative procedure, awaiting a committee decision in the European Parliament. A note of 22 June 2026 from the Council's General Secretariat put the text of a mandate for negotiations with the European Parliament to the Permanent Representatives Committee for confirmation.", "citation": "COM(2025) 837 final", "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex:52025PC0837", "note_url": "https://lexlint.io/l/eu-com-2025-837-final", "requires": [ "If the Commission's text is adopted as proposed, the GDPR would fold in cookie consent, breach notification to the supervisory authority would be limited to breaches likely to result in a high risk, impact assessment lists, a template and a methodology would be set at EU level, and a solely automated decision under Article 22 would be allowed only on three stated conditions, including contract necessity assessed regardless of whether the decision could be taken otherwise than by solely automated means." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "not law yet (status \"proposed\")", "as_of_date": "2026-08-23", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "both", "stale": false, "effective_date": null, "in_force": { "state": "proposed", "dated": false, "from": null, "until": null, "reason": null, "days": null, "countdown": null, "stage": "in committee", "words": "proposed, in committee", "as_of": "2026-10-19" }, "status": "proposed", "lifecycle": { "band": "proposed", "label": "PROPOSED", "tone": "pending", "detail": "draft of 2025-11-19", "commencement_established": false }, "settledness": { "band": "unsettled", "open_questions": [ "If the Commission finds that the single-entry point does not function properly, do the high-risk threshold and the 96-hour period in the replacement Article 33(1) of the GDPR apply from 18 months after entry into force, while only the duty to report through the single-entry point waits until 24 months?", "Does proposed Article 22(1)(a) of the GDPR, which allows a solely automated decision where it is necessary for a contract 'regardless of whether the decision could be taken otherwise than by solely automated means', also carry the duty in recital 38 to use the less intrusive solution when several equally effective automated solutions exist, although the Article text states no such duty?" ], "as_of": "2026-10-12" }, "certainty": { "resultset": "forward", "rung": 4, "label": "in committee or introduced", "prediction": "most of it", "detail": "in committee, on the print published 2025-11-19" } }, { "id": "eu:commission-delegated-regulation-eu-2025-1140-art-2-2-and-ann", "kind": "obligation", "severity": "warn", "jurisdiction": "eu", "jurisdiction_name": "European Union", "jurisdiction_flag": "🇪🇺", "summary": "Crypto-Asset Service Providers, Records of Communication with Clients: Article 68(9) of Regulation (EU) 2023/1114 requires crypto-asset service providers to arrange for records to be kept of all crypto-asset services, activities, orders, and transactions undertaken by them.", "detail": "Article 68(9) of Regulation (EU) 2023/1114 requires crypto-asset service providers to arrange for records to be kept of all crypto-asset services, activities, orders, and transactions undertaken by them. The records are provided to clients upon request and are kept for five years and, where requested by the competent authority before five years have elapsed, for up to seven years. Article 68(10) of that Regulation provides for regulatory technical standards that further specify the records to be kept of all crypto-asset services, activities, orders and transactions undertaken. Article 3(1), point (15), of that Regulation defines a crypto-asset service provider as a legal person or other undertaking whose occupation or business is the provision of one or more crypto-asset services to clients on a professional basis, and that is allowed to provide crypto-asset services in accordance with Article 59. Article 2(2) of Commission Delegated Regulation (EU) 2025/1140 requires crypto-asset service providers to keep the records listed in Section 1 of its Annex, depending upon the nature of their services and activities. The Annex lists, under communication with clients, records of telephone conversations or electronic communications relating to transactions or to the reception, transmission and execution of client orders, including where such conversations or communications do not result in the conclusion of a transaction or in the provision of the services of reception and transmission of orders or execution of order. Article 2(1) requires the records to be retained in a medium that lets the competent authority access them readily, ascertain any corrections and the contents before them, and that does not allow the records to be manipulated or altered. Article 111(1) of Regulation (EU) 2023/1114 requires Member States to provide for competent authorities to have the power to take administrative penalties and other administrative measures for infringements of Articles 65 to 83, which include Article 68, and lets Member States decline to lay down administrative penalties for infringements already subject to criminal penalties in their national law by 30 June 2024. Regulation (EU) 2023/1114 applies from 30 December 2024. Article 18 of the Delegated Regulation provides that it enters into force on the twentieth day following that of its publication in the Official Journal of the European Union.", "citation": "Commission Delegated Regulation (EU) 2025/1140, Art. 2(2) and Annex, Section 1; Regulation (EU) 2023/1114, Art. 68(9)", "url": "https://eur-lex.europa.eu/eli/reg_del/2025/1140/oj/eng", "note_url": "https://lexlint.io/l/eu-commission-delegated-eu-2025-1140-2-2-annex-1", "requires": [ "Delegated Regulation (EU) 2025/1140 is binding in its entirety and directly applicable in all Member States and entered into force on the twentieth day after its publication on 10 June 2025 (Article 18); it specifies the records that Article 68(9) of Regulation (EU) 2023/1114 requires crypto-asset service providers to keep (Article 68(10) of that Regulation).", "It reaches you if you are a crypto-asset service provider, meaning a legal person or other undertaking whose occupation or business is the provision of one or more crypto-asset services to clients on a professional basis and that is allowed to provide crypto-asset services in accordance with Article 59 of Regulation (EU) 2023/1114 (Article 3(1), point (15), of that Regulation): keep records of telephone conversations or electronic communications relating to transactions or to the reception, transmission and execution of client orders, including where such conversations or communications do not result in the conclusion of a transaction or in the provision of the services of reception and transmission of orders or execution of order (Article 2(2) and Annex, Section 1, communication with clients).", "Retain the records in a medium that lets the competent authority access them readily and reconstitute each key stage of the processing of each crypto-asset service, activity, order or transaction, lets any corrections or other amendments and the earlier contents be ascertained, and does not allow the records to be manipulated or altered (Article 2(1)).", "Provide the records to clients upon request and keep them for five years and, where the competent authority requests before five years have elapsed, for up to seven years (Article 68(9) of Regulation (EU) 2023/1114)." ], "why": "Pulled in because the app keeps or monitors what users type in a chat, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-10-10", "confidence": "high", "matched_by": { "activities": [ "records_text_chat" ], "flags": [ "records_text_chat" ], "categories": [] }, "applies_to": "private", "stale": false, "effective_date": "2025-06-30", "in_force": { "state": "in_force", "dated": true, "from": "2025-06-30", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2025-06-30", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2025-06-30", "commencement_established": true }, "settledness": { "band": "unsettled", "open_questions": [ "Does the duty in Section 1 of the Annex to keep 'records of telephone conversations or electronic communications' require a crypto-asset service provider to record the content of each conversation, or only to keep a record that the communication took place?" ], "as_of": "2026-10-12" }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2025-06-30" } }, { "id": "eu:commission-implementing-decision-eu-2019-419", "kind": "obligation", "severity": "warn", "jurisdiction": "eu", "jurisdiction_name": "European Union", "jurisdiction_flag": "🇪🇺", "summary": "Japan Adequacy Decision, Commission Implementing Decision (EU) 2019/419: Article 1(1) provides that, for the purposes of Article 45 of Regulation (EU) 2016/679, Japan ensures an adequate level of protection for personal data transferred from the European Union to personal information handling business operators in Japan subject to the Act on the Protection of Personal Information as complemented by the Supplementary Rules set out in Annex I, together with the official representations, assurances and commitments contained in Annex II.", "detail": "Article 1(1) provides that, for the purposes of Article 45 of Regulation (EU) 2016/679, Japan ensures an adequate level of protection for personal data transferred from the European Union to personal information handling business operators in Japan subject to the Act on the Protection of Personal Information as complemented by the Supplementary Rules set out in Annex I, together with the official representations, assurances and commitments contained in Annex II. Article 1(2) provides that the Decision does not cover personal data transferred to broadcasting institutions, newspaper publishers, communication agencies or other press organizations, persons engaged in professional writing, universities and other academic organizations, religious bodies or political bodies, to the extent the purposes of processing correspond to the press, writing, academic, religious or political purposes listed. Article 2 requires a Member State whose competent authorities exercise their powers under Article 58 of Regulation (EU) 2016/679 leading to the suspension or definitive ban of data flows to a specific business operator in Japan within the scope of Article 1 to inform the Commission without delay. Article 3(4) requires the Commission, within two years from the date of the notification of the Decision to the Member States and subsequently at least every four years, to evaluate the finding in Article 1(1) on the basis of all available information, including the information received as part of the Joint Review carried out together with the relevant Japanese authorities. Article 3(5) provides that, where the Commission has indications that an adequate level of protection is no longer ensured, it informs the competent Japanese authorities and, if necessary, may decide to suspend, amend or repeal the Decision, or limit its scope, in particular where business operators in Japan do not comply with the additional safeguards in the Supplementary Rules in Annex I or there is insufficient oversight and enforcement in this regard. Article 4 provides that the Decision is addressed to the Member States. The Commission's report on the first review of the functioning of the Decision (COM(2023) 275 final) concludes that Japan continues to ensure an adequate level of protection for personal data from the European Union to personal information handling business operators in Japan subject to the Act on the Protection of Personal Information as complemented by the Supplementary Rules.", "citation": "Commission Implementing Decision (EU) 2019/419", "url": "https://eur-lex.europa.eu/eli/dec_impl/2019/419/oj/eng", "note_url": "https://lexlint.io/l/eu-commission-implementing-decision-eu-2019-419", "requires": [ "A transfer of personal data from the European Union to a personal information handling business operator in Japan subject to the Act on the Protection of Personal Information as complemented by the Supplementary Rules in Annex I may take place on the basis of Article 1(1) of the Decision, without any specific authorization (Article 45(1) of Regulation (EU) 2016/679).", "The finding does not cover a transfer to a broadcasting institution, newspaper publisher, communication agency or other press organization, a person engaged in professional writing, a university or other academic organization, a religious body or a political body, to the extent the purposes of processing correspond to the purpose listed for that category (Article 1(2))." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-10-07", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "both", "stale": false, "effective_date": "2019-01-23", "in_force": { "state": "in_force", "dated": true, "from": "2019-01-23", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2019-01-23", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2019-01-23", "commencement_established": true }, "settledness": { "band": "unsettled", "open_questions": [ "Does the adequacy finding in Article 1(1) of Decision (EU) 2019/419 reach a transfer to a Japanese university for research, which Article 1(2), point (c), excludes, now that the Commission says the reform of the Japanese framework may pave the way for an extension to research?" ], "as_of": "2026-10-12" }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2019-01-23" } }, { "id": "eu:commission-implementing-decision-eu-2021-1772", "kind": "obligation", "severity": "warn", "jurisdiction": "eu", "jurisdiction_name": "European Union", "jurisdiction_flag": "🇪🇺", "summary": "United Kingdom Adequacy Decision, Implementing Decision (EU) 2021/1772 as renewed by Implementing Decision (EU) 2025/2574: Article 1(1) of Implementing Decision (EU) 2021/1772 provides that, for the purposes of Article 45 of Regulation (EU) 2016/679, the United Kingdom ensures an adequate level of protection for personal data transferred within the scope of that Regulation from the European Union to the United Kingdom.", "detail": "Article 1(1) of Implementing Decision (EU) 2021/1772 provides that, for the purposes of Article 45 of Regulation (EU) 2016/679, the United Kingdom ensures an adequate level of protection for personal data transferred within the scope of that Regulation from the European Union to the United Kingdom. Article 4 of the original Decision provided that it would expire on 27 June 2025, unless extended in accordance with the procedure referred to in Article 93(2) of Regulation (EU) 2016/679. Implementing Decision (EU) 2025/1226 of 24 June 2025 replaced Article 4 of the original Decision so that it would expire on 27 December 2025, unless extended in accordance with the procedure referred to in Article 93(2) of Regulation (EU) 2016/679. Implementing Decision (EU) 2025/2574 of 19 December 2025 records the Commission's conclusion that, on the basis of its assessment of developments including the amendments introduced by the Data (Use and Access) Act, the United Kingdom continues to ensure an adequate level of protection for personal data transferred within the scope of Regulation (EU) 2016/679 from the European Union to the United Kingdom. Article 4 of the Decision, as replaced by Implementing Decision (EU) 2025/2574, provides that the Decision expires on 27 December 2031, unless extended in accordance with the procedure referred to in Article 93(2) of Regulation (EU) 2016/679. Article 1(2) of the original Decision excluded personal data transferred for the purposes of United Kingdom immigration control from the finding. Article 1 of Implementing Decision (EU) 2025/2574 repealed Article 1(2) of the original Decision. Article 3(1) requires the Commission to monitor continuously the application of the legal framework on which the Decision is based, including the conditions under which onward transfers are carried out, individual rights are exercised and United Kingdom public authorities have access to data transferred on the basis of the Decision. Article 3(4) provides that, where the Commission has indications that an adequate level of protection is no longer ensured, it informs the competent United Kingdom authorities and may suspend, repeal or amend the Decision. Article 5 provides that the Decision is addressed to the Member States.", "citation": "Commission Implementing Decision (EU) 2021/1772", "url": "https://eur-lex.europa.eu/eli/dec_impl/2021/1772/oj/eng", "note_url": "https://lexlint.io/l/eu-commission-implementing-decision-eu-2021-1772", "requires": [ "A transfer of personal data within the scope of Regulation (EU) 2016/679 from the Union to the United Kingdom may take place on the basis of Article 1(1) of the Decision, without any specific authorization (Article 45(1) of Regulation (EU) 2016/679)." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-10-07", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "both", "stale": false, "effective_date": "2021-06-28", "in_force": { "state": "in_force", "dated": true, "from": "2021-06-28", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2021-06-28", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2021-06-28", "commencement_established": true }, "settledness": { "band": "unsettled", "open_questions": [ "Can the powers the Data (Use and Access) Act 2025 gives the Secretary of State to change the rules on international transfers, automated decision-making and the governance of the Information Commissioner by secondary regulations take the United Kingdom framework below the essentially equivalent protection on which Decision (EU) 2021/1772 rests?" ], "as_of": "2026-10-12" }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2021-06-28" } }, { "id": "eu:commission-implementing-decision-eu-2021-914", "kind": "obligation", "severity": "warn", "jurisdiction": "eu", "jurisdiction_name": "European Union", "jurisdiction_flag": "🇪🇺", "summary": "Standard Contractual Clauses for Transfers to Third Countries, Commission Implementing Decision (EU) 2021/914: Article 1(1) provides that the standard contractual clauses set out in the Annex are considered to provide appropriate safeguards within the meaning of Article 46(1) and (2)(c) of Regulation (EU) 2016/679 for a transfer by a controller or processor to a controller or (sub-)processor whose processing of the data is not subject to that Regulation.", "detail": "Article 1(1) provides that the standard contractual clauses set out in the Annex are considered to provide appropriate safeguards within the meaning of Article 46(1) and (2)(c) of Regulation (EU) 2016/679 for a transfer by a controller or processor to a controller or (sub-)processor whose processing of the data is not subject to that Regulation. The Annex sets out the Clauses in four Modules: transfer controller to controller, controller to processor, processor to processor and processor to controller. Clause 2(a) treats the Clauses as appropriate safeguards provided they are not modified, except to select the appropriate Module or Modules or to add or update information in the Appendix. Recital 7 states that the Clauses may be used for such transfers only to the extent that the processing by the importer does not fall within the scope of Regulation (EU) 2016/679. Under Clause 14(a) the Parties warrant that they have no reason to believe that the laws and practices of the third country of destination applicable to the processing of the personal data by the data importer prevent the data importer from fulfilling its obligations under the Clauses. Clause 14(d) requires the Parties to document the assessment of those laws and practices and to make it available to the competent supervisory authority on request. Clause 14(f) requires the data exporter to suspend the data transfer if it considers that no appropriate safeguards can be ensured, or if instructed to do so by the competent supervisory authority or, in Module Three, by the controller. Under Clause 15.1(a) the data importer notifies the data exporter and, where possible, the data subject promptly if it receives a legally binding request from a public authority for disclosure of the transferred personal data. Under Clause 15.2(a) the data importer reviews the legality of a request for disclosure and challenges it if, after careful assessment, it concludes that there are reasonable grounds to consider the request unlawful under the laws of the country of destination. Article 2 requires a Member State whose competent authorities exercise corrective powers under Article 58 of Regulation (EU) 2016/679 in response to the data importer being or becoming subject to laws or practices that prevent compliance with the Clauses, leading to the suspension or ban of data transfers, to inform the Commission without delay. Article 4(1) provides that the Decision enters into force on the twentieth day following that of its publication in the Official Journal of the European Union. Article 4(2) and (3) repeal Decision 2001/497/EC and Decision 2010/87/EU with effect from 27 September 2021. Article 4(4) deems contracts concluded before 27 September 2021 on the basis of Decision 2001/497/EC or Decision 2010/87/EU to provide appropriate safeguards until 27 December 2022, provided the processing operations that are the subject matter of the contract remain unchanged and that reliance on those clauses ensures that the transfer is subject to appropriate safeguards.", "citation": "Commission Implementing Decision (EU) 2021/914", "url": "https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj/eng", "note_url": "https://lexlint.io/l/eu-commission-implementing-decision-eu-2021-914", "requires": [ "A transfer by a controller or processor to a controller or (sub-)processor whose processing of the data is not subject to Regulation (EU) 2016/679 is treated as having appropriate safeguards under Article 46(1) and (2)(c) where the Clauses in the Annex are used (Article 1(1)); the Clauses may not be modified, except to select the appropriate Module or to add or update information in the Appendix (Clause 2(a)).", "The data exporter and the data importer warrant that they have no reason to believe that the laws and practices of the third country of destination prevent the importer from fulfilling its obligations under the Clauses, having taken due account of the circumstances of the transfer, the laws and practices of the destination and any supplementary safeguards (Clause 14(a) and (b)).", "The Parties document the assessment under Clause 14(b) and make it available to the competent supervisory authority on request (Clause 14(d)).", "The data importer notifies the data exporter promptly if it has reason to believe that it is or has become subject to laws or practices not in line with Clause 14(a); the data exporter then promptly identifies appropriate measures and suspends the transfer if it considers that no appropriate safeguards can be ensured, or if instructed to do so by the competent supervisory authority (Clause 14(e) and (f)).", "The data importer notifies the data exporter and, where possible, the data subject promptly of a legally binding request from a public authority for disclosure of the transferred data or of any direct access by public authorities, and reviews the legality of the request and challenges it where there are reasonable grounds to consider it unlawful (Clauses 15.1(a) and 15.2(a)).", "Each Party is able to demonstrate compliance with the Clauses, and the data importer keeps appropriate documentation of its processing and makes it available to the competent supervisory authority on request (Clause 8.9 in Modules One to Three).", "For Modules One to Three, the Clauses are governed by the law of an EU Member State that allows third-party beneficiary rights and disputes are resolved by the courts of an EU Member State, and a data subject may also bring proceedings in the courts of the Member State of habitual residence (Clauses 17 and 18)." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-10-07", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "both", "stale": false, "effective_date": "2021-06-27", "in_force": { "state": "in_force", "dated": true, "from": "2021-06-27", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2021-06-27", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2021-06-27", "commencement_established": true }, "settledness": { "band": "developing", "guidance_url": "https://www.edpb.europa.eu/system/files/2023-02/edpb_guidelines_05-2021_interplay_between_the_application_of_art3-chapter_v_of_the_gdpr_v2_en_0.pdf", "guidance_body": "European Data Protection Board", "case_citation": "Case C-311/18 Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems, judgment of 16 July 2020 (Grand Chamber), on Decision 2010/87/EU", "case_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62018CJ0311", "open_questions": [ "Which Article 46 safeguard may an exporter rely on for a transfer to an importer in a third country whose processing of the data is subject to Regulation (EU) 2016/679 under its Article 3(2), given that Article 1 of Decision 2021/914 covers only importers whose processing is not subject to that Regulation?", "Which 'other relevant, objective elements' must support documented practical experience of receiving no disclosure requests before the Parties may conclude under Clause 14, footnote 12, that the data importer will not be prevented from complying with the Clauses where the law of the destination country permits such access?" ], "as_of": "2026-10-12" }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2021-06-27" } }, { "id": "eu:commission-implementing-decision-eu-2022-254", "kind": "obligation", "severity": "warn", "jurisdiction": "eu", "jurisdiction_name": "European Union", "jurisdiction_flag": "🇪🇺", "summary": "Republic of Korea Adequacy Decision, Commission Implementing Decision (EU) 2022/254: Article 1(1) provides that, for the purpose of Article 45 of Regulation (EU) 2016/679, the Republic of Korea ensures an adequate level of protection for personal data transferred from the European Union to entities in the Republic of Korea subject to the Personal Information Protection Act as complemented by the additional safeguards set out in Annex I, together with the official representations, assurances and commitments contained in Annex II.", "detail": "Article 1(1) provides that, for the purpose of Article 45 of Regulation (EU) 2016/679, the Republic of Korea ensures an adequate level of protection for personal data transferred from the European Union to entities in the Republic of Korea subject to the Personal Information Protection Act as complemented by the additional safeguards set out in Annex I, together with the official representations, assurances and commitments contained in Annex II. Article 1(2) provides that the Decision does not cover personal data transferred to religious organizations processing it for their missionary activities, political parties processing it in the context of the nomination of candidates, or entities subject to oversight by the Financial Services Commission for the processing of personal credit information pursuant to the Credit Information Act, to the extent they process such information. Article 2 requires a Member State whose competent authorities exercise their powers under Article 58 of Regulation (EU) 2016/679 over data transfers within the scope of Article 1 to inform the Commission without delay. Article 3(4) requires the Commission, after three years from the date of the notification of the Decision to the Member States and subsequently at least every four years, to evaluate the finding in Article 1(1) on the basis of all available information, including the information received as part of the review carried out together with the relevant Korean authorities. Article 3(5) provides that, where the Commission has indications that an adequate level of protection is no longer ensured, it informs the competent Korean authorities and, if necessary, may decide to suspend, amend or repeal the Decision, or limit its scope, in accordance with Article 45(5) of Regulation (EU) 2016/679. Article 4 provides that the Decision is addressed to the Member States. The Commission announced on 23 July 2026 that it had concluded its first review of the Decision and found that the Republic of Korea continues to provide an adequate level of protection of personal data.", "citation": "Commission Implementing Decision (EU) 2022/254", "url": "https://eur-lex.europa.eu/eli/dec_impl/2022/254/oj/eng", "note_url": "https://lexlint.io/l/eu-commission-implementing-decision-eu-2022-254", "requires": [ "A transfer of personal data from the European Union to an entity in the Republic of Korea subject to the Personal Information Protection Act as complemented by the additional safeguards in Annex I may take place on the basis of Article 1(1) of the Decision, without any specific authorization (Article 45(1) of Regulation (EU) 2016/679).", "The finding does not cover a transfer to a religious organization, to the extent it processes the data for its missionary activities, to a political party, to the extent it processes the data in the context of the nomination of candidates, or to an entity subject to oversight by the Financial Services Commission for the processing of personal credit information pursuant to the Credit Information Act, to the extent it processes such information (Article 1(2))." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-10-07", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "both", "stale": false, "effective_date": "2021-12-17", "in_force": { "state": "in_force", "dated": true, "from": "2021-12-17", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2021-12-17", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2021-12-17", "commencement_established": true }, "settledness": { "band": "unsettled", "open_questions": [ "Which Korean recipients are 'entities that are subject to oversight by the Financial Services Commission for the processing of personal credit information' under Article 1(2), point (c), of Decision (EU) 2022/254, so that a transfer to them falls outside the adequacy finding?" ], "as_of": "2026-10-12" }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2021-12-17" } }, { "id": "eu:commission-implementing-decision-eu-2023-1795", "kind": "obligation", "severity": "warn", "jurisdiction": "eu", "jurisdiction_name": "European Union", "jurisdiction_flag": "🇪🇺", "summary": "EU-US Data Privacy Framework Adequacy Decision, Commission Implementing Decision (EU) 2023/1795: Article 1 provides that, for the purpose of Article 45 of Regulation (EU) 2016/679, the United States ensures an adequate level of protection for personal data transferred from the Union to organizations in the United States that are included in the Data Privacy Framework List maintained and made publicly available by the United States Department of Commerce.", "detail": "Article 1 provides that, for the purpose of Article 45 of Regulation (EU) 2016/679, the United States ensures an adequate level of protection for personal data transferred from the Union to organizations in the United States that are included in the Data Privacy Framework List maintained and made publicly available by the United States Department of Commerce. Article 2 requires a Member State whose competent authorities exercise their powers under Article 58 of Regulation (EU) 2016/679 over data transfers referred to in Article 1 to inform the Commission without delay. Article 3(1) requires the Commission to monitor continuously the application of the legal framework that is the object of the Decision, including the conditions under which onward transfers are carried out, individual rights are exercised and public authorities in the United States have access to data transferred on the basis of the Decision. Article 3(4) requires the Commission to evaluate the finding in Article 1(1) after one year from the date of the notification of the Decision to the Member States, and subsequently at a periodicity decided in close consultation with the committee established under Article 93(1) of Regulation (EU) 2016/679 and the European Data Protection Board. Article 3(5) provides that, where the Commission has indications that an adequate level of protection is no longer ensured, it informs the competent authorities of the United States and, if necessary, decides to suspend, amend or repeal the Decision, or limit its scope, in accordance with Article 45(5) of Regulation (EU) 2016/679. Article 4 provides that the Decision is addressed to the Member States. The Commission published its report on the first review of the functioning of the Decision on 9 October 2024. The General Court dismissed an action for annulment of the Decision in Latombe v Commission (Case T-553/23, 3 September 2025). An appeal against that judgment is pending before the Court of Justice as Case C-703/25 P.", "citation": "Commission Implementing Decision (EU) 2023/1795", "url": "https://eur-lex.europa.eu/eli/dec_impl/2023/1795/oj/eng", "note_url": "https://lexlint.io/l/eu-commission-implementing-decision-eu-2023-1795", "requires": [ "A transfer of personal data from the Union to an organization in the United States that is included in the Data Privacy Framework List may take place on the basis of Article 1 of the Decision, without any specific authorization (Article 45(1) of Regulation (EU) 2016/679).", "A transfer to an organization in the United States that is not included in the Data Privacy Framework List is outside the finding in Article 1." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-10-07", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "both", "stale": false, "effective_date": "2023-07-10", "in_force": { "state": "in_force", "dated": true, "from": "2023-07-10", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2023-07-10", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2023-07-10", "commencement_established": true }, "settledness": { "band": "unsettled", "guidance_url": "https://www.edpb.europa.eu/system/files/2023-07/edpb_informationnoteadequacydecisionus_en.pdf", "guidance_body": "European Data Protection Board", "case_citation": "Case T-553/23 Latombe v Commission, judgment of the General Court (Tenth Chamber, Extended Composition) of 3 September 2025 (ECLI:EU:T:2025:831)", "case_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62023TJ0553", "under_challenge": true, "open_questions": [ "Do the rules for appointing and dismissing the judges of the Data Protection Review Court meet the independence and impartiality that the second paragraph of Article 47 of the Charter of Fundamental Rights and Article 45(2) of Regulation (EU) 2016/679 require, as the first ground of appeal in Case C-703/25 P asks the Court of Justice to decide?" ], "as_of": "2026-10-12" }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2023-07-10" }, "court_action": { "rulings": [], "under_challenge": true } }, { "id": "eu:commission-implementing-decision-eu-2025-1382", "kind": "obligation", "severity": "warn", "jurisdiction": "eu", "jurisdiction_name": "European Union", "jurisdiction_flag": "🇪🇺", "summary": "European Patent Organisation Adequacy Decision, Commission Implementing Decision (EU) 2025/1382: Article 1 provides that, for the purpose of Article 45 of Regulation (EU) 2016/679, the European Patent Organisation ensures an adequate level of protection for personal data transferred from the Union to the European Patent Organisation.", "detail": "Article 1 provides that, for the purpose of Article 45 of Regulation (EU) 2016/679, the European Patent Organisation ensures an adequate level of protection for personal data transferred from the Union to the European Patent Organisation. Recital 6 states that transfers from controllers and processors in the Union to the European Patent Organisation may take place without the need to obtain any further authorization. Recital 6 adds that the Decision does not affect the direct application of Regulation (EU) 2016/679 to such entities where the conditions regarding the territorial scope laid down in Article 3 of that Regulation are fulfilled. Recital 14 identifies the Data Protection Rules adopted by the Administrative Council of the Organisation as the rules that regulate the processing of personal data by the European Patent Office. Article 2 requires a Member State whose competent authorities exercise their powers under Article 58 of Regulation (EU) 2016/679 over data transfers within the scope of Article 1 to inform the Commission without delay. Article 3(3) requires the Commission, at least every four years, to evaluate the finding in Article 1 on the basis of all available information, including the information received as part of a review carried out together with the European Patent Organisation. Article 3(4) provides that, where the Commission has indications that an adequate level of protection is no longer ensured, it informs the Organisation and, if necessary, may decide to suspend, amend or repeal the Decision, or limit its scope, in accordance with Article 45(5) of Regulation (EU) 2016/679. Article 4 provides that the Decision is addressed to the Member States.", "citation": "Commission Implementing Decision (EU) 2025/1382", "url": "https://eur-lex.europa.eu/eli/dec_impl/2025/1382/oj/eng", "note_url": "https://lexlint.io/l/eu-commission-implementing-decision-eu-2025-1382", "requires": [ "A transfer of personal data from the Union to the European Patent Organisation may take place on the basis of Article 1 of the Decision, without any specific authorization (Article 45(1) of Regulation (EU) 2016/679)." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-10-07", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "both", "stale": false, "effective_date": "2025-07-15", "in_force": { "state": "in_force", "dated": true, "from": "2025-07-15", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2025-07-15", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2025-07-15", "commencement_established": true }, "settledness": { "band": "unsettled", "open_questions": [ "Which data protection safeguards apply when the European Patent Organisation transmits personal data to a national industrial property office in the patent granting procedure, a point the EDPB found not fully clear?" ], "as_of": "2026-10-12" }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2025-07-15" } }, { "id": "eu:commission-implementing-decision-eu-2026-179", "kind": "obligation", "severity": "warn", "jurisdiction": "eu", "jurisdiction_name": "European Union", "jurisdiction_flag": "🇪🇺", "summary": "Brazil Adequacy Decision, Commission Implementing Decision (EU) 2026/179: Article 1 provides that, for the purpose of Article 45 of Regulation (EU) 2016/679, Brazil ensures an adequate level of protection for personal data transferred from the European Union to controllers and processors in Brazil subject to the General Data Protection Law (LGPD).", "detail": "Article 1 provides that, for the purpose of Article 45 of Regulation (EU) 2016/679, Brazil ensures an adequate level of protection for personal data transferred from the European Union to controllers and processors in Brazil subject to the General Data Protection Law (LGPD). The Decision cites the LGPD as Law No 13.709 of 14 August 2018, the General Data Protection Law (Lei Geral de Proteção de Dados Pessoais). Article 2 requires a Member State whose competent authorities exercise their powers under Article 58 of Regulation (EU) 2016/679 over data transfers within the scope of Article 1 to inform the Commission without delay. Article 3(1) requires the Commission to monitor continuously the application of the legal framework upon which the Decision is based with a view to assessing whether Brazil continues to ensure an adequate level of protection within the meaning of Article 1. Article 3(2) requires the Member States and the Commission to inform each other of cases where the Brazilian Data Protection Authority (Agência Nacional de Proteção de Dados, ANPD), or any other competent Brazilian authority, fails to ensure compliance with the legal framework upon which the Decision is based. Article 3(4) requires the Commission, after four years from the date of the notification of the Decision to the Member States and subsequently at least every four years, to evaluate the finding in Article 1 on the basis of all available information, including the information received as part of the review carried out together with the relevant Brazilian authorities. Article 3(5) provides that, where the Commission has indications that an adequate level of protection is no longer ensured, it informs the competent Brazilian authorities and may suspend, repeal, or amend the Decision. Article 3(6) provides that the Commission may also suspend, repeal, or amend the Decision if the lack of cooperation of the Brazilian government prevents the Commission from determining whether the finding in Article 1 is affected. Article 4 provides that the Decision is addressed to the Member States.", "citation": "Commission Implementing Decision (EU) 2026/179", "url": "https://eur-lex.europa.eu/eli/dec_impl/2026/179/oj/eng", "note_url": "https://lexlint.io/l/eu-commission-implementing-decision-eu-2026-179", "requires": [ "A transfer of personal data from the European Union to a controller or processor in Brazil subject to the General Data Protection Law (LGPD) may take place on the basis of Article 1 of the Decision, without any specific authorization (Article 45(1) of Regulation (EU) 2016/679).", "A transfer to a controller or processor in Brazil that is not subject to the General Data Protection Law (LGPD) is outside the finding in Article 1." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-10-10", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "both", "stale": false, "effective_date": "2026-01-26", "in_force": { "state": "in_force", "dated": true, "from": "2026-01-26", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2026-01-26", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "recent", "label": "RECENT", "tone": "live", "detail": "in force 9 months", "commencement_established": true }, "settledness": { "band": "unsettled", "open_questions": [ "How far may a Brazilian controller rely on the LGPD's limitation for 'commercial and industrial secrecy' to withhold information from a data subject or from the national authority, a limitation the EDPB asked the Commission to monitor in practice?" ], "as_of": "2026-10-12" }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2026-01-26" } }, { "id": "eu:directive-eu-2020-1828-arts-2-1-4-7-9-and-annex-i-point-56", "kind": "obligation", "severity": "warn", "jurisdiction": "eu", "jurisdiction_name": "European Union", "jurisdiction_flag": "🇪🇺", "summary": "Representative Actions Directive, Collective Redress for GDPR Infringements (Articles 2(1), 4 and 7 to 9 and Annex I point (56)): Article 2(1) applies the Directive to representative actions brought against infringements by traders of the provisions of Union law referred to in Annex I, including such provisions as transposed into national law, that harm or may harm the collective interests of consumers.", "detail": "Article 2(1) applies the Directive to representative actions brought against infringements by traders of the provisions of Union law referred to in Annex I, including such provisions as transposed into national law, that harm or may harm the collective interests of consumers. Annex I, point (56), lists Regulation (EU) 2016/679, the General Data Protection Regulation, among those provisions. The Directive applies to domestic and cross-border infringements, including infringements that ceased before the representative action was brought or concluded. Article 3, point (2), defines a trader as any natural person, or any legal person irrespective of whether privately or publicly owned, that acts for purposes relating to that person's trade, business, craft or profession. Article 3, point (4), defines a qualified entity as an organization or public body representing consumers' interests that has been designated by a Member State as qualified to bring representative actions. Article 3, point (5), defines a representative action as an action for the protection of the collective interests of consumers that is brought by a qualified entity as a claimant party on behalf of consumers to seek an injunctive measure, a redress measure, or both.\n\nArticle 4(1) requires Member States to ensure that representative actions can be brought by qualified entities that the Member States have designated for this purpose. Article 7(4) requires Member States to ensure that qualified entities are entitled to seek at least injunctive measures and redress measures. Article 8(1) requires Member States to make injunctive measures available as a provisional measure to cease or prohibit a practice deemed to be an infringement and as a definitive measure to cease or prohibit a practice found to be an infringement. To seek an injunctive measure, Article 8(3) provides that individual consumers are not required to express their wish to be represented and that the qualified entity is not required to prove actual loss or damage to the consumers or intent or negligence on the part of the trader. Article 9(1) provides that a redress measure requires a trader to provide the consumers concerned with remedies such as compensation, repair, replacement, price reduction, contract termination or reimbursement of the price paid, as appropriate and as available under Union or national law. Article 9(8) requires Member States to ensure that qualified entities can bring representative actions for a redress measure without a court or administrative authority having previously established an infringement in separate proceedings. Article 19(1) requires Member States to lay down the rules on penalties applicable to the failure or refusal to comply with an injunctive measure.\n\nArticle 24(1) required Member States to adopt and publish the laws, regulations and administrative provisions necessary to comply with the Directive by 25 December 2022 and to apply those measures from 25 June 2023.", "citation": "Directive (EU) 2020/1828, Arts. 2(1), 4, 7-9 and Annex I point (56)", "url": "https://eur-lex.europa.eu/eli/dir/2020/1828/oj/eng", "note_url": "https://lexlint.io/l/eu-2020-1828-2-1-4-7-9-annex-i-point-56", "requires": [ "This Directive is addressed to the Member States (Article 26), which had to adopt and publish the measures necessary to comply with it by 25 December 2022 and apply them from 25 June 2023 (Article 24(1)), so a trader meets these rules through each Member State's national law.", "Member States must ensure that a qualified entity they have designated can bring a representative action for an injunctive measure or a redress measure against a trader whose infringement of Regulation (EU) 2016/679, listed in Annex I at point (56), harms or may harm the collective interests of consumers (Articles 2(1), 4(1) and 7(4)).", "Cease, or refrain from, a practice that a provisional or definitive injunctive measure orders to cease or prohibits (Article 8(1)).", "Provide the consumers concerned with the remedies a redress measure requires, such as compensation, repair, replacement, price reduction, contract termination or reimbursement of the price paid, as appropriate and as available under Union or national law (Article 9(1)). A redress measure entitles those consumers to benefit from the remedies without bringing a separate action (Article 9(6))." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-10-07", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "both", "stale": false, "effective_date": "2023-06-25", "in_force": { "state": "in_force", "dated": true, "from": "2023-06-25", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2023-06-25", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2023-06-25", "commencement_established": true }, "settledness": { "band": "unsettled", "open_questions": [ "Does a representative action under Article 2(1) and Annex I, point (56), reach a GDPR infringement that harms natural persons acting in the course of their trade or profession, given that Recital 14 confines the Directive to persons who are 'consumers' within Article 3, point (1)?", "Does a qualified entity's representative action under Article 7 and Annex I, point (56), preclude, or run alongside, the enforcement mechanisms based on Regulation (EU) 2016/679, such as those of its Article 80, that Recital 15 says could still be used for the collective interests of consumers?" ], "as_of": "2026-10-12" }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2023-06-25" } }, { "id": "eu:directive-eu-2023-2673-inserting-article-16d-1-3-and-4-into", "kind": "obligation", "severity": "warn", "jurisdiction": "eu", "jurisdiction_name": "European Union", "jurisdiction_flag": "🇪🇺", "summary": "Consumer Rights Directive, Adequate Explanations and Human Intervention in Online Tools for Distance Financial Services Contracts (Article 16d): Article 16d(1) of Directive 2011/83/EU, as inserted, requires Member States to ensure that traders provide the consumer, free of charge and before the contract is concluded, with adequate explanations of the proposed financial services contract that make it possible to assess whether the contract and ancillary services are adapted to the consumer's needs and financial situation.", "detail": "Article 16d(1) of Directive 2011/83/EU, as inserted, requires Member States to ensure that traders provide the consumer, free of charge and before the contract is concluded, with adequate explanations of the proposed financial services contract that make it possible to assess whether the contract and ancillary services are adapted to the consumer's needs and financial situation. Article 16d(3) requires Member States to ensure that, where the trader uses online tools, the consumer has a right to request and obtain human intervention at the pre-contractual stage and, in justified cases, after the distance contract has been concluded, in the same language as the pre-contractual information. Under Article 16d(4), the burden of proof of compliance with the adequate explanation requirements is on the trader. Article 2(1) of Directive (EU) 2023/2673 requires Member States to adopt and publish the necessary measures by 19 December 2025 and to apply them from 19 June 2026.", "citation": "Directive (EU) 2023/2673, inserting Article 16d(1), (3) and (4) into Directive 2011/83/EU", "url": "https://eur-lex.europa.eu/eli/dir/2023/2673/oj/eng", "note_url": "https://lexlint.io/l/eu-2023-2673-inserting-16d-1-3-4-into-2011-83-eu", "requires": [ "This Directive is addressed to the Member States (Article 5), which had to adopt and publish the measures necessary to comply with it by 19 December 2025 and apply them from 19 June 2026 (Article 2(1)), so a trader meets these rules through each Member State's national law.", "If you are a trader concluding a financial services contract with a consumer at a distance, give the consumer free of charge, before the contract is concluded, adequate explanations that make it possible to assess whether the proposed contract and ancillary services are adapted to the consumer's needs and financial situation (Article 16d(1)).", "If you use online tools, let the consumer request and obtain human intervention at the pre-contractual stage and, in justified cases, after the distance contract is concluded, in the same language as the pre-contractual information (Article 16d(3)).", "Be ready to prove that you gave the adequate explanations, since the burden of proof is on the trader (Article 16d(4))." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-10-12", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "both", "stale": false, "effective_date": "2026-06-19", "in_force": { "state": "in_force", "dated": true, "from": "2026-06-19", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2026-06-19", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "recent", "label": "RECENT", "tone": "live", "detail": "in force 4 months", "commencement_established": true }, "settledness": { "band": "unsettled", "open_questions": [ "Does a chatbot or robo-advice tool that a trader uses before a distance financial services contract is concluded count as 'online tools' under Article 16d(3), so that the consumer may request human intervention?" ], "as_of": "2026-10-12" }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2026-06-19" } }, { "id": "eu:directive-eu-2024-2853", "kind": "pending", "severity": "info", "jurisdiction": "eu", "jurisdiction_name": "European Union", "jurisdiction_flag": "🇪🇺", "summary": "Product Liability Directive, liability for defective products including software: Article 1 lays down common rules on the liability of economic operators for damage suffered by natural persons and caused by defective products.", "detail": "Article 1 lays down common rules on the liability of economic operators for damage suffered by natural persons and caused by defective products. Article 4(1) defines a product to include software. Recital 13 says software is a product irrespective of the mode of its supply or usage, whether it is stored on a device, accessed through a communication network or cloud technologies, or supplied through a software-as-a-service model. Recital 13 says a developer or producer of software, including an AI system provider within the meaning of Regulation (EU) 2024/1689, should be treated as a manufacturer. Article 2(1), as corrected by a corrigendum published on 7 May 2026, applies the Directive to products placed on the market or put into service after 8 December 2026. Article 2(2) provides that the Directive does not apply to free and open-source software that is developed or supplied outside the course of a commercial activity. Recital 14 says the Directive applies where software is supplied in exchange for a price, or for personal data used other than exclusively for improving the security, compatibility or interoperability of the software. Article 7(2)(f) counts relevant product safety requirements, including safety-relevant cybersecurity requirements, among the circumstances taken into account in assessing the defectiveness of a product. Article 9(1) requires a defendant to disclose relevant evidence at its disposal when the claimant has presented facts and evidence sufficient to support the plausibility of the claim for compensation. Article 10(2)(a) presumes the product defective where the defendant fails to disclose relevant evidence under Article 9(1). Article 10(2)(b) and (c) also presume defectiveness where the claimant demonstrates non-compliance with mandatory product safety requirements intended to protect against the risk of the damage suffered, or that the damage was caused by an obvious malfunction of the product during reasonably foreseeable use or under ordinary circumstances. Article 10(3) presumes the causal link where it has been established that the product is defective and that the damage caused is of a kind typically consistent with the defect in question. Article 10(4) requires a national court to presume defectiveness or the causal link, or both, where, despite the disclosure of evidence under Article 9, the claimant faces excessive difficulties, in particular due to technical or scientific complexity, and demonstrates that it is likely that the product is defective or that there is a causal link. Article 8(1) makes liable the manufacturer of a defective product and the manufacturer of a defective component that was integrated into or inter-connected with a product within the manufacturer’s control and caused that product to be defective. Where the manufacturer is established outside the Union, Article 8(1)(c) makes the importer, the authorized representative and, where there is neither, the fulfilment service provider liable. Article 8(2) treats a person that substantially modifies a product outside the manufacturer’s control and thereafter makes it available on the market or puts it into service as its manufacturer. Article 8(4) applies the distributor rule of Article 8(3) to a provider of an online platform that allows consumers to conclude distance contracts with traders and is not an economic operator, where the conditions of Article 6(3) of Regulation (EU) 2022/2065 are fulfilled. Article 6(1) covers death or personal injury, damage to or destruction of property except the defective product itself, a product damaged by a defective component integrated into or inter-connected with it by its manufacturer or within that manufacturer’s control, and property used exclusively for professional purposes, and the destruction or corruption of data that are not used for professional purposes. Article 11(1)(e) exempts an economic operator that proves the objective state of scientific and technical knowledge at the time the product was placed on the market or put into service, or during the period in which it was within the manufacturer’s control, was not such that the defectiveness could be discovered. Article 11(2) removes the exemption of Article 11(1), point (c), for a defect that did not exist when the product was placed on the market or came into being afterwards, where the defectiveness is due, within the manufacturer’s control, to a related service, software including updates or upgrades, a lack of software updates or upgrades necessary to maintain safety, or a substantial modification. Article 15 bars limiting or excluding an economic operator’s liability to the injured person by a contractual provision or by national law. Article 16 sets a limitation period of three years from the day the injured person became aware, or should reasonably have become aware, of the damage, the defectiveness and the identity of the economic operator that can be held liable. Article 17(1) ends the right to compensation on the expiry of 10 years from the date the defective product was placed on the market or put into service, or, for a substantially modified product, made available on the market or put into service after the modification, unless the injured person has in the meantime initiated proceedings against an economic operator that can be held liable. Article 17(2) extends that period to 25 years where the injured person could not initiate proceedings within 10 years because a personal injury was latent. Article 3 forbids Member States from maintaining or introducing provisions diverging from the Directive, including more stringent or less stringent provisions, unless the Directive provides otherwise. Article 18(1) lets a Member State maintain, by derogation from Article 11(1)(e), existing measures under which economic operators are liable even if they prove that the state of scientific and technical knowledge did not allow the defectiveness to be discovered, if it notifies the text of the measures to the Commission no later than 9 December 2026. Article 21 repeals Directive 85/374/EEC with effect from 9 December 2026, and that Directive continues to apply to products placed on the market or put into service before that date. Article 22(1) requires Member States to bring into force the laws, regulations and administrative provisions necessary to comply with the Directive by 9 December 2026. Article 23 provides that the Directive enters into force on the twentieth day following that of its publication in the Official Journal. The Directive was published in the Official Journal on 18 November 2024.", "citation": "Directive (EU) 2024/2853", "url": "https://eur-lex.europa.eu/eli/dir/2024/2853/oj/eng", "note_url": "https://lexlint.io/l/eu-2024-2853", "requires": [ "The Directive does not apply to free and open-source software that you develop or supply outside the course of a commercial activity (Art. 2(2)).", "If you develop or produce software, or have it developed under your name or trademark, and make it available in the course of a commercial activity, you answer as its manufacturer for damage it causes by a defect (Arts. 4(1), 4(10) and 8(1)(a)).", "Keep supplying the software updates and upgrades needed to keep the product safe while it is within your control; a defect caused by their absence, or by software, updates or upgrades within your control, is not excused because it arose after you placed the product on the market (Art. 11(2)(b) and (c)).", "Meet the product safety requirements that apply to your product, safety-relevant cybersecurity requirements included: they count in deciding whether it is defective (Art. 7(2)(f)), and failing a mandatory product safety requirement that protects against the damage suffered presumes it defective (Art. 10(2)(b)).", "Account for what your product learns or acquires after release: the effect of any ability to continue to learn or acquire new features after it is placed on the market is weighed in deciding whether it is defective (Art. 7(2)(c)).", "Keep technical documentation you could produce if a court orders disclosure; failing to disclose presumes the product defective (Arts. 9(1), 10(2)(a)).", "If you are outside the EU, the importer or your authorized representative answers for the product in your place (Art. 8(1)(c)).", "If you substantially modify a product outside its manufacturer's control and then make it available on the market or put it into service, you are treated as its manufacturer (Art. 8(2)).", "Do not count on a contract term to limit or exclude your liability to an injured person; Article 15 bars it.", "Be able to show when you placed the product on the market or put it into service: you are not liable if you prove you did not, or that the defect probably did not exist at that time (Art. 11(1)(a) and (c))." ], "why": "Pulled in because the app deploys a chatbot and keeps or monitors what users type in a chat, and the law library tags this instrument for exactly that.", "basis": "enacted, not yet in force, from 2026-12-09", "as_of_date": "2026-10-12", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot", "records_text_chat" ], "flags": [ "deploys_chatbot", "records_text_chat" ], "categories": [] }, "applies_to": "private", "stale": false, "effective_date": "2026-12-09", "in_force": { "state": "not_yet_in_force", "dated": true, "from": "2026-12-09", "until": null, "reason": null, "days": 51, "countdown": "in 7 weeks", "stage": null, "words": "not yet in force, from 2026-12-09, in 7 weeks", "as_of": "2026-10-19" }, "status": "enacted", "lifecycle": { "band": "imminent", "label": "IMMINENT", "tone": "live", "detail": "in force in 51 days", "commencement_established": true }, "settledness": { "band": "unsettled", "open_questions": [ "How far does a 'related service' in Article 4(3), a digital service whose absence would prevent the product from performing one or more of its functions, reach a cloud backend that a mobile app calls?", "When is free and open-source software supplied 'outside the course of a commercial activity' under Article 2(2) where its developer also takes donations or sells support?" ], "as_of": "2026-10-12" }, "certainty": { "resultset": "forward", "rung": 1, "label": "enacted, commencement dated", "prediction": "none", "detail": "in force 2026-12-09, so nothing here is predicted" } }, { "id": "eu:directive-2002-58-ec-art-5-1-and-2", "kind": "obligation", "severity": "warn", "jurisdiction": "eu", "jurisdiction_name": "European Union", "jurisdiction_flag": "🇪🇺", "summary": "ePrivacy Directive, Confidentiality of Communications: Article 5(1) requires Member States to prohibit listening to, tapping, storing, or otherwise intercepting or surveilling a communication and its related traffic data by anyone other than the users, without the users' consent, except where legally authorised under Article 15(1), which lets a Member State restrict that confidentiality by legislation when the restriction is a necessary, appropriate and proportionate measure to safeguard national security, defence or public security, or for the prevention, investigation, detection and prosecution of criminal offences or of unauthorised use of the electronic communication system.", "detail": "Article 5(1) requires Member States to prohibit listening to, tapping, storing, or otherwise intercepting or surveilling a communication and its related traffic data by anyone other than the users, without the users' consent, except where legally authorised under Article 15(1), which lets a Member State restrict that confidentiality by legislation when the restriction is a necessary, appropriate and proportionate measure to safeguard national security, defence or public security, or for the prevention, investigation, detection and prosecution of criminal offences or of unauthorised use of the electronic communication system. Article 5(2) leaves untouched any legally authorised recording made in the course of lawful business practice to provide evidence of a commercial transaction or of any other business communication; the Directive's own recitals expect the parties to be told before such a recording is made, though that expectation is not stated as an operative duty of the Article itself, and whether a given recording is legally authorised, and on what further conditions, is for each Member State's own law.", "citation": "Directive 2002/58/EC, Art. 5(1) and (2)", "url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02002L0058-20091219", "note_url": "https://lexlint.io/l/eu-2002-58-ec-5-1-2", "requires": [ "Under the national law that transposes Article 5(1), do not listen to, tap, store, or otherwise intercept or monitor, as a person other than its users, the content or related traffic data of a communication carried over a public electronic communications network without the consent of the users concerned, unless legislation adopted under Article 15(1) authorises it as a necessary, appropriate and proportionate measure to safeguard national security, defence or public security, or for the prevention, investigation, detection and prosecution of criminal offences or of unauthorised use of the electronic communication system.", "A recording that national law legally authorises and that is made in the course of lawful business practice to provide evidence of a commercial transaction or other business communication is not caught by the consent rule above; check the Member State's own law for whether, and on what further conditions, it authorises such recording." ], "why": "Pulled in because the app keeps or monitors what users type in a chat, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-10-10", "confidence": "high", "matched_by": { "activities": [ "records_text_chat" ], "flags": [ "records_text_chat" ], "categories": [] }, "applies_to": "both", "stale": false, "effective_date": "2003-10-31", "in_force": { "state": "in_force", "dated": true, "from": "2003-10-31", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2003-10-31", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2003-10-31", "commencement_established": true }, "settledness": { "band": "developing", "case_citation": "Court of Justice, Case C-623/17, Privacy International, EU:C:2020:790", "case_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0623", "open_questions": [ "Which conditions must national law attach to a recording to make it 'legally authorised' under Article 5(2) of Directive 2002/58, so that a recording made in the course of lawful business practice to provide evidence of a commercial transaction falls outside the consent rule of Article 5(1)?", "Does the ban on 'other kinds of interception or surveillance' in Article 5(1) of Directive 2002/58 reach automated scanning of message content by the service provider for its own purposes, such as spam or abuse detection, where the users have not consented and no legislation under Article 15(1) applies?" ], "as_of": "2026-10-12" }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2003-10-31" } }, { "id": "eu:directive-2014-65-eu-art-16-7-commission-delegated-regulatio", "kind": "obligation", "severity": "warn", "jurisdiction": "eu", "jurisdiction_name": "European Union", "jurisdiction_flag": "🇪🇺", "summary": "MiFID II, Recording of Telephone Conversations and Electronic Communications: Article 16(7) of Directive 2014/65/EU requires the records of an investment firm to include the recording of telephone conversations or electronic communications relating to, at least, transactions concluded when dealing on own account and the provision of client order services that relate to the reception, transmission and execution of client orders.", "detail": "Article 16(7) of Directive 2014/65/EU requires the records of an investment firm to include the recording of telephone conversations or electronic communications relating to, at least, transactions concluded when dealing on own account and the provision of client order services that relate to the reception, transmission and execution of client orders. Those telephone conversations and electronic communications include the ones intended to result in such transactions or services, even if they do not result in them. An investment firm must take all reasonable steps to record relevant telephone conversations and electronic communications made with, sent from or received by equipment the firm provides to an employee or contractor, or whose use by an employee or contractor the firm has accepted or permitted. The firm must notify new and existing clients that telephone communications or conversations between the firm and its clients that result or may result in transactions will be recorded, and the notification may be made once, before the provision of investment services. The firm may not provide, by telephone, investment services and activities relating to the reception, transmission and execution of client orders to a client who has not been notified in advance about the recording of the client's telephone communications or conversations. The records are provided to the client involved upon request and are kept for five years and, where requested by the competent authority, for up to seven years. Article 76(1) of Commission Delegated Regulation (EU) 2017/565 requires an investment firm to establish, implement and maintain an effective written policy on recording telephone conversations and electronic communications, appropriate to the size and organization of the firm and the nature, scale and complexity of its business. Article 76(8) of that Delegated Regulation requires the firm to inform the client, before providing services relating to the reception, transmission and execution of orders, that conversations and communications are being recorded and that a copy of the recording will be available on request for five years and, where requested by the competent authority, for up to seven years. Article 76(9) requires the firm to record in a durable medium all relevant information related to relevant face-to-face conversations with clients, including at least the date and time, the location, the attendees, the initiator and relevant information about the client order. Article 76(10) requires records to be stored in a durable medium that allows them to be replayed or copied and to be retained in a format that does not allow the original record to be altered or deleted. Article 4(1), point (1), of Directive 2014/65/EU defines an investment firm as any legal person whose regular occupation or business is the provision of one or more investment services to third parties and/or the performance of one or more investment activities on a professional basis. Article 93(1) of Directive 2014/65/EU, as originally adopted, required Member States to apply the measures transposing it from 3 January 2017. Article 1, point (7), of Directive (EU) 2016/1034 replaced the date 3 January 2017 in Article 93(1) of Directive 2014/65/EU with 3 January 2018. Article 91 of the Delegated Regulation applies that Regulation from the date that appears first in the second subparagraph of Article 93(1) of Directive 2014/65/EU. Article 70(1) of Directive 2014/65/EU requires Member States to ensure that their competent authorities may impose administrative sanctions and measures that are effective, proportionate and dissuasive for infringements of the Directive. Article 70(3), point (a)(iv), lists Article 16(1) to (11) among the provisions whose infringement Member States must regard as an infringement of the Directive.", "citation": "Directive 2014/65/EU, Art. 16(7); Commission Delegated Regulation (EU) 2017/565, Art. 76", "url": "https://eur-lex.europa.eu/eli/dir/2014/65/oj/eng", "note_url": "https://lexlint.io/l/eu-2014-65-eu-16-7-commission-delegated-eu-2017", "requires": [ "Directive 2014/65/EU is addressed to the Member States (Article 97), which had to adopt and publish the measures necessary to comply with it by 3 July 2017 and apply them from 3 January 2018 (Article 93(1), as amended by Directive (EU) 2016/1034), so you meet its rules through each Member State's transposing law. Commission Delegated Regulation (EU) 2017/565 is directly applicable and applies from the same date (Article 91).", "It reaches you if you are an investment firm, meaning a legal person whose regular occupation or business is the provision of one or more investment services to third parties and/or the performance of one or more investment activities on a professional basis (Article 4(1), point (1), of the Directive): record the telephone conversations and electronic communications relating to, at least, transactions concluded when dealing on own account and the provision of client order services that relate to the reception, transmission and execution of client orders, including those intended to result in such transactions or services even if they do not (Article 16(7)).", "Take all reasonable steps to record the relevant telephone conversations and electronic communications made with, sent from or received by equipment you provide to an employee or contractor, or whose use by an employee or contractor you have accepted or permitted, and all reasonable steps to prevent an employee or contractor from making, sending or receiving relevant conversations and communications on privately-owned equipment you are unable to record or copy (Article 16(7)).", "Notify new and existing clients that telephone communications or conversations between you and your clients that result or may result in transactions will be recorded. The notification may be made once, before you provide investment services to the client (Article 16(7)).", "Before you provide services relating to the reception, transmission and execution of orders to a new or existing client, inform the client that conversations and communications are being recorded and that a copy of the recording will be available on request for five years and, where the competent authority requests, for up to seven years, in the same language or languages as you use to provide investment services to clients (Article 76(8)).", "Do not provide, by telephone, investment services and activities relating to the reception, transmission and execution of client orders to a client who has not been notified in advance about the recording of the client's telephone communications or conversations. A client may place orders through other channels, but those communications must be made in a durable medium such as mails, faxes, emails or documentation of client orders made at meetings (Article 16(7)).", "Record in a durable medium all relevant information related to relevant face-to-face conversations with clients, including at least the date and time of the meeting, its location, the identity of the attendees, the initiator of the meeting and relevant information about the client order including the price, volume, type of order and when it is to be transmitted or executed (Article 76(9)).", "Provide the records to the client involved upon request and keep them for five years and, where the competent authority requests, for up to seven years, counted from the date the record is created (Article 16(7) of the Directive and Article 76(11)).", "Store the records in a durable medium that allows them to be replayed or copied, retain them in a format that does not allow the original record to be altered or deleted, keep them readily accessible and available to clients on request, and ensure the quality, accuracy and completeness of the records of all telephone recordings and electronic communications (Article 76(10)).", "Establish, implement and maintain a written policy on recording telephone conversations and electronic communications, appropriate to the size and organization of the firm and the nature, scale and complexity of its business, which identifies the conversations and communications subject to recording and sets out the procedures to follow where exceptional circumstances leave you unable to record on devices you issued, accepted or permitted, with the evidence of those circumstances retained and accessible to competent authorities (Article 76(1)).", "Give the management body effective oversight and control over the recording policies and procedures, keep the arrangements technology-neutral and evaluate them periodically (adopting further measures at least when a new medium of communication is accepted or permitted), keep and regularly update a record of the individuals with firm devices or approved privately owned devices, train employees in the procedures, monitor the records of transactions and orders periodically on a risk-based and proportionate basis, and demonstrate the policies, procedures and management oversight to the competent authorities on request (Article 76(2) to (7))." ], "why": "Pulled in because the app keeps or monitors what users type in a chat, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-10-10", "confidence": "high", "matched_by": { "activities": [ "records_text_chat" ], "flags": [ "records_text_chat" ], "categories": [] }, "applies_to": "private", "stale": false, "effective_date": "2018-01-03", "in_force": { "state": "in_force", "dated": true, "from": "2018-01-03", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2018-01-03", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2018-01-03", "commencement_established": true }, "settledness": { "band": "developing", "guidance_url": "https://www.esma.europa.eu/publications-data/questions-answers/1766", "guidance_body": "European Securities and Markets Authority", "open_questions": [ "Does the recording duty in Article 16(7) reach a conversation of back-office staff that relates to the reception, transmission or execution of a client order, given that ESMA would not ordinarily expect persons carrying on back-office functions to be captured?" ], "as_of": "2026-10-12" }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2018-01-03" } }, { "id": "eu:regulation-eu-2016-679", "kind": "obligation", "severity": "warn", "jurisdiction": "eu", "jurisdiction_name": "European Union", "jurisdiction_flag": "🇪🇺", "summary": "General Data Protection Regulation (GDPR), Comprehensive Regime: Establishes the lawful basis, purpose limitation, and controller and processor accountability framework for processing personal data of people in the EU.", "detail": "Establishes the lawful basis, purpose limitation, and controller and processor accountability framework for processing personal data of people in the EU. Article 6(1) requires one of six lawful bases for any processing, Articles 24-28 allocate duties between controllers, joint controllers and processors, and the Regulation applies extraterritorially to any controller or processor offering goods or services to, or monitoring, people in the EU (Article 3). It binds public authorities as well as private sector controllers, though Article 83(7) lets Member States decide whether administrative fines apply to their own public bodies.", "citation": "Regulation (EU) 2016/679", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng", "note_url": "https://lexlint.io/l/eu-2016-679", "requires": [ "Establish and document a lawful basis under Article 6 before processing any personal data of a person in the EU.", "Allocate and document controller and processor responsibilities in a written agreement wherever a third party processes personal data on your behalf, and appoint a Data Protection Officer where your core activities involve large scale monitoring or large scale special category processing." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-08-23", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "both", "stale": false, "effective_date": "2018-05-25", "in_force": { "state": "in_force", "dated": true, "from": "2018-05-25", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2018-05-25", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2018-05-25", "commencement_established": true }, "settledness": { "band": "developing", "guidance_url": "https://www.edpb.europa.eu/system/files/2024-12/edpb_opinion_202428_ai-models_en.pdf", "guidance_body": "European Data Protection Board", "case_citation": "Case C-621/22 Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens, judgment of 4 October 2024 (Ninth Chamber)", "case_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0621", "open_questions": [ "Which commercial interests of a controller can be 'legitimate interests' under Article 6(1)(f), and when is a disclosure of personal data for consideration 'strictly necessary' for one, as Case C-621/22 requires, while the Board's guidelines on Article 6(1)(f) remain a consultation draft?", "Which threshold of 'large scale' makes an activity 'regular and systematic monitoring of data subjects on a large scale' under Article 37(1)(b), which obliges a controller or processor to appoint a data protection officer, when the Article names no figure?" ], "as_of": "2026-10-12" }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2018-05-25" } }, { "id": "eu:regulation-eu-2016-679-art-30", "kind": "obligation", "severity": "warn", "jurisdiction": "eu", "jurisdiction_name": "European Union", "jurisdiction_flag": "🇪🇺", "summary": "General Data Protection Regulation, Records of Processing Activities (Article 30): Article 30(1) requires each controller and, where applicable, the controller's representative to maintain a record of processing activities under its responsibility.", "detail": "Article 30(1) requires each controller and, where applicable, the controller's representative to maintain a record of processing activities under its responsibility. Article 30(1) provides that the record shall contain the name and contact details of the controller, the purposes of the processing, a description of the categories of data subjects and of personal data, the categories of recipients, transfers to a third country or international organization where applicable, and, where possible, the envisaged time limits for erasure and a general description of the technical and organizational security measures. Article 30(2) requires each processor and, where applicable, the processor's representative to maintain a record of all categories of processing activities carried out on behalf of a controller. Article 30(3) provides that the records shall be in writing, including in electronic form. Article 30(4) provides that the controller or the processor and, where applicable, their representative shall make the record available to the supervisory authority on request. Article 30(5) provides that the record-keeping obligations do not apply to an enterprise or an organization employing fewer than 250 persons unless the processing it carries out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data referred to in Article 9(1) or personal data relating to criminal convictions and offences referred to in Article 10. Article 83(4), point (a), subjects infringements of the obligations of the controller and the processor pursuant to Articles 8, 11, 25 to 39 and 42 and 43, a range that includes Article 30, to administrative fines up to EUR 10,000,000 or, in the case of an undertaking, up to 2 percent of the total worldwide annual turnover of the preceding financial year, whichever is higher. Article 82(1) gives any person who has suffered material or non-material damage as a result of an infringement of the Regulation the right to receive compensation from the controller or processor for the damage suffered. Article 79(1) gives each data subject the right to an effective judicial remedy where he or she considers that his or her rights under the Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with the Regulation. Article 99(2) provides that the Regulation applies from 25 May 2018.", "citation": "Regulation (EU) 2016/679, Art. 30", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng", "note_url": "https://lexlint.io/l/eu-2016-679-30", "requires": [ "If you are a controller, a processor or the representative of either, keep the records of processing activities that Article 30(1) and (2) require, unless you are an enterprise or organization employing fewer than 250 persons and none of the three conditions in Article 30(5) is met: the processing you carry out is likely to result in a risk to the rights and freedoms of data subjects, the processing is not occasional, or the processing includes special categories of data referred to in Article 9(1) or personal data relating to criminal convictions and offences referred to in Article 10 (Article 30(5)).", "If you are a controller or the controller's representative, maintain a record of processing activities under your responsibility containing the name and contact details of the controller, any joint controller, the representative and the data protection officer, the purposes of the processing, a description of the categories of data subjects and of personal data, the categories of recipients, and, where applicable, transfers to a third country or international organization with the documentation of suitable safeguards for the transfers referred to in the second subparagraph of Article 49(1) (Article 30(1), points (a) to (e)).", "In the controller's record, include where possible the envisaged time limits for erasure of the different categories of data and a general description of the technical and organizational security measures referred to in Article 32(1) (Article 30(1), points (f) and (g)).", "If you are a processor or the processor's representative, maintain a record of all categories of processing activities carried out on behalf of a controller, containing the name and contact details of the processor and of each controller, the categories of processing carried out on behalf of each controller, where applicable the transfers to a third country or international organization, and where possible a general description of the technical and organizational security measures referred to in Article 32(1) (Article 30(2)).", "Keep the records in writing, including in electronic form (Article 30(3)).", "Make the record available to the supervisory authority on request (Article 30(4))." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-10-10", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "both", "stale": false, "effective_date": "2018-05-25", "in_force": { "state": "in_force", "dated": true, "from": "2018-05-25", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2018-05-25", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2018-05-25", "commencement_established": true }, "settledness": { "band": "developing", "guidance_url": "https://www.edpb.europa.eu/our-work-tools/our-documents/guidelines/position-paper-derogations-obligation-maintain-records_en", "guidance_body": "European Data Protection Board", "case_citation": "Case C-60/22 UZ v Bundesrepublik Deutschland, judgment of 4 May 2023 (Fifth Chamber)", "case_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0060", "open_questions": [ "Does the Article 30(5) exemption for an organisation employing fewer than 250 persons ever apply to a controller whose processing is not occasional, when the Board and the European Data Protection Supervisor say the exception would typically not be applicable to very small organisations as soon as the processing is not of an occasional nature?" ], "as_of": "2026-10-12" }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2018-05-25" } }, { "id": "eu:regulation-eu-2016-679-art-5", "kind": "obligation", "severity": "warn", "jurisdiction": "eu", "jurisdiction_name": "European Union", "jurisdiction_flag": "🇪🇺", "summary": "General Data Protection Regulation, Principles Relating to Processing of Personal Data and Accountability (Article 5): Article 5(1), point (a), provides that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject.", "detail": "Article 5(1), point (a), provides that personal data shall be processed lawfully, fairly and in a transparent manner in relation to the data subject. Article 5(1), point (b), provides that personal data shall be collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes. Article 5(1), point (c), provides that personal data shall be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed. Article 5(1), point (d), provides that personal data shall be accurate and, where necessary, kept up to date, and that every reasonable step must be taken to ensure that inaccurate personal data are erased or rectified without delay. Article 5(1), point (e), provides that personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed. Article 5(1), point (e), also provides that personal data may be stored for longer periods insofar as they will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1), subject to the appropriate technical and organizational measures the Regulation requires in order to safeguard the rights and freedoms of the data subject. Article 5(1), point (f), provides that personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures. Article 5(2) provides that the controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1. Article 83(5), point (a), subjects infringements of the basic principles for processing, including conditions for consent, pursuant to Articles 5, 6, 7 and 9 to administrative fines up to EUR 20,000,000 or, in the case of an undertaking, up to 4 percent of the total worldwide annual turnover of the preceding financial year, whichever is higher. Article 82(1) gives any person who has suffered material or non-material damage as a result of an infringement of the Regulation the right to receive compensation from the controller or processor for the damage suffered. Article 79(1) gives each data subject the right to an effective judicial remedy where he or she considers that his or her rights under the Regulation have been infringed as a result of the processing of his or her personal data in non-compliance with the Regulation. Article 99(2) provides that the Regulation applies from 25 May 2018.", "citation": "Regulation (EU) 2016/679, Art. 5", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng", "note_url": "https://lexlint.io/l/eu-2016-679-5", "requires": [ "If you process personal data, apply the principles in Article 5(1) to that processing; if you are the controller, you are responsible for compliance with them and must be able to demonstrate it (Article 5(1) and (2)).", "Process personal data lawfully, fairly and in a transparent manner in relation to the data subject (Article 5(1), point (a)).", "Collect personal data for specified, explicit and legitimate purposes and do not further process it in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes is not considered incompatible, in accordance with Article 89(1) (Article 5(1), point (b)).", "Limit personal data to what is adequate, relevant and necessary in relation to the purposes for which it is processed, data minimization (Article 5(1), point (c)).", "Keep personal data accurate and, where necessary, up to date, and take every reasonable step to ensure that inaccurate personal data, having regard to the purposes for which it is processed, are erased or rectified without delay (Article 5(1), point (d)).", "Keep personal data in a form which permits identification of data subjects for no longer than is necessary for the purposes for which it is processed, storage limitation; store it for longer only insofar as it will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1), subject to the technical and organizational measures the Regulation requires to safeguard the rights and freedoms of the data subject (Article 5(1), point (e)).", "Process personal data in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures (Article 5(1), point (f)).", "If you are the controller, be responsible for, and be able to demonstrate compliance with, each of the principles in Article 5(1) (Article 5(2))." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-10-10", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "both", "stale": false, "effective_date": "2018-05-25", "in_force": { "state": "in_force", "dated": true, "from": "2018-05-25", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2018-05-25", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2018-05-25", "commencement_established": true }, "settledness": { "band": "developing", "guidance_url": "https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_201904_dataprotection_by_design_and_by_default_v2.0_en.pdf", "guidance_body": "European Data Protection Board", "case_citation": "Case C-77/21 Digi Távközlési és Szolgáltató, judgment of 20 October 2022 (First Chamber)", "case_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0077", "open_questions": [ "Does processing that a data subject would not reasonably expect, which the Board's guidelines list among the elements of fairness, breach Article 5(1)(a) even where a basis under Article 6 applies?", "Which of the Article 6(4) criteria decide whether further processing, for instance to test or train a system, is compatible with the purposes for which the personal data were first collected under Article 5(1)(b)?" ], "as_of": "2026-10-12" }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2018-05-25" } }, { "id": "eu:regulation-eu-2016-679-arts-12-21", "kind": "obligation", "severity": "warn", "jurisdiction": "eu", "jurisdiction_name": "European Union", "jurisdiction_flag": "🇪🇺", "summary": "GDPR Articles 12-21, Data Subject Rights: Articles 12-21 give a data subject access (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18), portability (Article 20) and objection (Article 21) rights against the controller, ordinarily to be honored within one month.", "detail": "Articles 12-21 give a data subject access (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18), portability (Article 20) and objection (Article 21) rights against the controller, ordinarily to be honored within one month. Article 22 itself applies only where a decision described in Article 22(1) is made, and the Article 13(2)(f), 14(2)(g) and 15(1)(h) duties to disclose the existence of automated decision-making, and meaningful information about its logic, cover at least the decisions described in Article 22(1) and (4).", "citation": "Regulation (EU) 2016/679, Arts. 12-21", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng", "note_url": "https://lexlint.io/l/eu-2016-679-12-22", "requires": [ "Honor a data subject's request to access, rectify, erase, restrict, port, or object to processing of their personal data within one month of receipt, a period that can be extended by two further months where necessary given the complexity and number of requests (Article 12(3))." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-09-23", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "both", "stale": false, "effective_date": "2018-05-25", "in_force": { "state": "in_force", "dated": true, "from": "2018-05-25", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2018-05-25", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2018-05-25", "commencement_established": true }, "settledness": { "band": "developing", "guidance_url": "https://www.edpb.europa.eu/system/files/2023-04/edpb_guidelines_202201_data_subject_rights_access_v2_en.pdf", "guidance_body": "European Data Protection Board", "case_citation": "Case C-307/22 FT v DW, judgment of 26 October 2023 (First Chamber)", "case_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0307", "open_questions": [ "Outside a doctor-patient relationship, when does Article 15(3) entitle a data subject to a full copy of the documents containing the personal data, rather than a faithful and intelligible reproduction of the data themselves?", "How often may a data subject repeat an Article 15 request before it is 'excessive' under Article 12(5), given that the Board's guidelines say excessiveness depends on the sector and on how often the controller's database changes?" ], "as_of": "2026-10-12" }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2018-05-25" } }, { "id": "eu:regulation-eu-2016-679-arts-33-34", "kind": "obligation", "severity": "warn", "jurisdiction": "eu", "jurisdiction_name": "European Union", "jurisdiction_flag": "🇪🇺", "summary": "GDPR Articles 33-34, Breach Notification: Article 33(1) requires the controller to notify the competent supervisory authority without undue delay, and where feasible within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to risk individuals' rights and freedoms, and a processor must notify its controller without undue delay.", "detail": "Article 33(1) requires the controller to notify the competent supervisory authority without undue delay, and where feasible within 72 hours of becoming aware of a personal data breach, unless the breach is unlikely to risk individuals' rights and freedoms, and a processor must notify its controller without undue delay. Article 34 requires notice to affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms, unless the exposed data was rendered unintelligible, for example by strong encryption, or the controller has since eliminated the high risk.", "citation": "Regulation (EU) 2016/679, Arts. 33-34", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng", "note_url": "https://lexlint.io/l/eu-2016-679-33-34", "requires": [ "Notify the competent supervisory authority without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting EU personal data, unless the breach is unlikely to risk individuals' rights and freedoms.", "Notify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-08-23", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "both", "stale": false, "effective_date": "2018-05-25", "in_force": { "state": "in_force", "dated": true, "from": "2018-05-25", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2018-05-25", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2018-05-25", "commencement_established": true }, "settledness": { "band": "settled", "guidance_url": "https://www.edpb.europa.eu/system/files/2023-04/edpb_guidelines_202209_personal_data_breach_notification_v2.0_en.pdf", "guidance_body": "European Data Protection Board", "as_of": "2026-10-12" }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2018-05-25" } }, { "id": "eu:regulation-eu-2016-679-arts-44-50", "kind": "obligation", "severity": "warn", "jurisdiction": "eu", "jurisdiction_name": "European Union", "jurisdiction_flag": "🇪🇺", "summary": "GDPR Chapter V, Cross-Border Transfer Restrictions: Chapter V bars any transfer of personal data outside the EEA unless the European Commission has issued an adequacy decision (Article 45), the transfer is covered by an appropriate safeguard such as Binding Corporate Rules or Standard Contractual Clauses, or a narrow Article 49 derogation applies.", "detail": "Chapter V bars any transfer of personal data outside the EEA unless the European Commission has issued an adequacy decision (Article 45), the transfer is covered by an appropriate safeguard such as Binding Corporate Rules or Standard Contractual Clauses, or a narrow Article 49 derogation applies. For transfers on standard clauses, the Court of Justice's Schrems II judgment (Case C-311/18, 16 July 2020) requires the exporter to verify case by case that the law of the destination country ensures adequate protection, adding safeguards where necessary. Transfers to United States organisations on the Data Privacy Framework List can rely on the EU-US Data Privacy Framework, found adequate by Commission Implementing Decision (EU) 2023/1795. The General Court upheld that adequacy decision at first instance in Latombe v Commission (Case T-553/23, 3 September 2025). An appeal against that judgment is pending before the Court of Justice as Case C-703/25 P, with no hearing date set as of the date shown.", "citation": "Regulation (EU) 2016/679, Arts. 44-50", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng", "note_url": "https://lexlint.io/l/eu-2016-679-44-50", "requires": [ "Rely on a Commission adequacy decision, Standard Contractual Clauses with a transfer impact assessment, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data covered by the Regulation outside the EEA." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-08-23", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "both", "stale": false, "effective_date": "2018-05-25", "in_force": { "state": "in_force", "dated": true, "from": "2018-05-25", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2018-05-25", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2018-05-25", "commencement_established": true }, "settledness": { "band": "developing", "guidance_url": "https://www.edpb.europa.eu/system/files/2023-02/edpb_guidelines_05-2021_interplay_between_the_application_of_art3-chapter_v_of_the_gdpr_v2_en_0.pdf", "guidance_body": "European Data Protection Board", "case_citation": "Case C-311/18 Data Protection Commissioner v Facebook Ireland and Schrems, judgment of 16 July 2020 (Grand Chamber)", "case_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62018CJ0311", "open_questions": [ "Which Article 46 safeguard may an exporter rely on for a transfer to an importer in a third country whose processing of the data is subject to Regulation (EU) 2016/679 under its Article 3(2), given that Article 1 of Decision 2021/914 covers only importers whose processing is not subject to that Regulation?" ], "as_of": "2026-10-12" }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2018-05-25" } }, { "id": "eu:regulation-eu-2016-679-arts-51-59-68-76-77-84", "kind": "obligation", "severity": "warn", "jurisdiction": "eu", "jurisdiction_name": "European Union", "jurisdiction_flag": "🇪🇺", "summary": "GDPR Articles 51-59, 68-76 and 77-84, Supervisory Authorities, Penalties and Remedies: Each Member State designates an independent supervisory authority (Article 51) with investigative and corrective powers, including orders and bans on processing (Article 58); cross border cases route through a lead authority under the one stop shop mechanism (Articles 56, 60-63), coordinated by the European Data Protection Board (Articles 68-76).", "detail": "Each Member State designates an independent supervisory authority (Article 51) with investigative and corrective powers, including orders and bans on processing (Article 58); cross border cases route through a lead authority under the one stop shop mechanism (Articles 56, 60-63), coordinated by the European Data Protection Board (Articles 68-76). Article 83 sets administrative fines up to the higher of EUR 20,000,000 or 4 percent of global annual turnover for infringements of the basic processing principles, data subjects' rights, transfer rules and supervisory authority orders (Article 83(5)), and up to the higher of EUR 10,000,000 or 2 percent for the controller and processor obligations in Articles 8, 11, 25 to 39, 42 and 43 (Article 83(4)). Article 82(1) arms a direct private right of action, letting any person who suffered material or non-material damage claim compensation from the controller or processor, though the Court of Justice held actual, if not necessarily serious, damage must be shown rather than the mere fact of infringement (UI v Österreichische Post, Case C-300/21, 4 May 2023). Article 80 lets a not for profit body pursue a complaint or judicial remedy on a data subject's behalf. The Representative Actions Directive (EU) 2020/1828 separately lists Regulation (EU) 2016/679 in its Annex I, letting a qualified entity bring a representative action for collective consumer redress over a GDPR infringement. The Dutch, Italian and French data protection authorities each took enforcement action against Clearview AI over the same underlying conduct, the Netherlands imposing EUR 30.5 million in a decision dated 16 May 2024. The Hellenic Data Protection Authority separately fined Clearview EUR 20,000,000 on 13 July 2022 for infringing the principles of lawfulness and transparency (Articles 5, 6 and 9) and Articles 12, 14, 15 and 27 in connection with its facial recognition service.", "citation": "Regulation (EU) 2016/679, Arts. 51-59, 68-76, 77-84", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng", "note_url": "https://lexlint.io/l/eu-2016-679-51-59-68-76-77-84", "requires": [ "Where you process personal data in the context of an establishment in the Union, or from outside it offer goods or services to people in the Union or monitor their behaviour there, provide the supervisory authority with any information it orders you to provide for the performance of its tasks, and give it access to all personal data and information necessary for those tasks and to your premises and data-processing equipment (Article 58(1), points (a), (e) and (f))." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-08-23", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "both", "stale": false, "effective_date": "2018-05-25", "in_force": { "state": "in_force", "dated": true, "from": "2018-05-25", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2018-05-25", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2018-05-25", "commencement_established": true }, "settledness": { "band": "developing", "case_citation": "Case C-300/21 UI v Österreichische Post, judgment of 4 May 2023 (Third Chamber)", "case_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0300", "open_questions": [ "How can a supervisory authority enforce an Article 58(1)(a) order to provide information against a controller outside the Union that has not designated a representative under Article 27, when the Article names only the controller, the processor and their representative as addressees?", "Which national rule fixes the amount of compensation under Article 82 for non-material damage, given the Court's ruling that national courts apply the domestic rules on the extent of financial compensation, subject to the principles of equivalence and effectiveness?" ], "as_of": "2026-10-12" }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2018-05-25" } }, { "id": "eu:regulation-eu-2024-1689-article-12", "kind": "pending", "severity": "info", "jurisdiction": "eu", "jurisdiction_name": "European Union", "jurisdiction_flag": "🇪🇺", "summary": "AI Act, Article 12 (record-keeping): High-risk AI systems must be technically capable of automatically recording events, in logs, over the system's lifetime.", "detail": "High-risk AI systems must be technically capable of automatically recording events, in logs, over the system's lifetime. The logging capability must enable recording of events relevant to identifying a risk under Article 79(1) or a substantial modification, to supporting the post-market monitoring required by Article 72, and to the deployer monitoring required by Article 26(5). For a remote biometric identification system, one of the Annex III use cases classified as high-risk under Article 6(2), the logs must at minimum record the start and end date and time of each use, the reference database checked against the input data, the input data for which a search produced a match, and the identity of the natural persons who verified the results under Article 14(5); this minimum contents list does not extend to high-risk systems generally. Article 12 does not itself set how long a log must be kept or who may demand access to one: retention is Article 19's duty for a provider and Article 26(6)'s for a deployer, and access is Article 21(2)'s. Article 12 sits in Chapter III, Section 2, so it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 2026-07-27) wrote into Article 113: 2027-12-02 for a system classified as high-risk under Article 6(2) and Annex III, and 2028-08-02 for a system classified as high-risk under Article 6(1) and Annex I, rather than the Regulation's general 2026-08-02 application date. Article 12 does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.", "citation": "Regulation (EU) 2024/1689, Article 12", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng", "note_url": "https://lexlint.io/l/eu-2024-1689-12", "requires": [ "This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.", "Build automatic event logging into a high-risk AI system so it can record events over the system's lifetime, if you are its provider.", "Design the logging capability to support identifying an emerging risk or a substantial modification, post-market monitoring, and a deployer's monitoring of the system's operation.", "For a remote biometric identification system, log the start and end date and time of each use, the reference database checked, the input data that produced a match, and the identity of the person who verified the result." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "enacted, not yet in force, from 2027-12-02", "as_of_date": "2026-10-10", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [ "agent_txn" ] }, "applies_to": "both", "stale": false, "effective_date": "2027-12-02", "in_force": { "state": "not_yet_in_force", "dated": true, "from": "2027-12-02", "until": null, "reason": null, "days": 409, "countdown": "in 13 months", "stage": null, "words": "not yet in force, from 2027-12-02, in 13 months", "as_of": "2026-10-19" }, "status": "enacted", "lifecycle": { "band": "imminent", "label": "IMMINENT", "tone": "live", "detail": "in force in 409 days", "commencement_established": true }, "settledness": { "band": "unsettled", "open_questions": [ "Which events are 'relevant for identifying situations that may result in the high-risk AI system presenting a risk' under Article 12(2), point (a), so that a provider must build logging that records them?" ], "as_of": "2026-10-12" }, "certainty": { "resultset": "forward", "rung": 1, "label": "enacted, commencement dated", "prediction": "none", "detail": "in force 2027-12-02, so nothing here is predicted" } }, { "id": "eu:regulation-eu-2024-1689-article-25", "kind": "pending", "severity": "info", "jurisdiction": "eu", "jurisdiction_name": "European Union", "jurisdiction_flag": "🇪🇺", "summary": "AI Act, Article 25 (responsibilities along the AI value chain): Article 25 decides who counts as the provider of a high-risk AI system along its supply chain.", "detail": "Article 25 decides who counts as the provider of a high-risk AI system along its supply chain. A distributor, importer, deployer, or other third party is treated as the provider, and takes on the Article 16 provider obligations, if it puts its own name or trademark on a high-risk system already on the market, makes a substantial modification that keeps it high-risk, or changes an AI system's intended purpose so it becomes high-risk. As amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 2026-07-27), paragraph 2 then requires the initial provider to closely cooperate with the new provider, in particular by making available technical documentation sufficient to assess Article 16 compliance, informing the new provider of known limitations and failure modes, and providing targeted technical access, including for testing and validation, unless the initial provider clearly specified that its system was not to be changed into a high-risk one. A product manufacturer is treated as the provider where a high-risk AI system is a safety component placed on the market or put into service under the manufacturer's own name or trademark. Paragraph 4, also amended by the Digital Omnibus to add 'AI model' to the list of what a third party may supply, requires the provider of a high-risk AI system and a third party supplying an AI system, AI model, tool, service, component, or process the system integrates to specify by written agreement the necessary information, technical access, and other assistance, unless the component is supplied under a free and open-source licence by a party other than a general-purpose AI model provider. The Digital Omnibus inserted Article 99(4), point (da), fining non-compliance with the paragraph 2 and paragraph 4 obligations up to EUR 15,000,000 or 3% of worldwide annual turnover, whichever is higher, with the lower of the two for an SME or a small mid-cap enterprise. Article 25 sits in Chapter III, Section 3, so like Articles 12, 19, 21 and 26 it takes effect on the schedule the Digital Omnibus wrote into Article 113: 2 December 2027 for a system classified as high-risk under Article 6(2) and Annex III, and 2 August 2028 for one classified under Article 6(1) and Annex I. Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by 2 August 2030. Article 25 does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.", "citation": "Regulation (EU) 2024/1689, Article 25", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng", "note_url": "https://lexlint.io/l/eu-2024-1689-25", "requires": [ "This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, and on 2 August 2028 for one classified under Article 6(1) and Annex I (Article 113, third paragraph, point (c), as replaced by Regulation (EU) 2026/1744), other than a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.", "If you are a distributor, importer, deployer, or other third party who puts your name or trademark on a high-risk AI system already on the market, makes a substantial modification to one that keeps it high-risk, or changes an AI system's intended purpose so it becomes high-risk, you are treated as its provider and take on the Article 16 provider obligations.", "If you are the initial provider and one of those events happens, closely cooperate with the new provider: make available technical documentation sufficient to assess compliance with Article 16, inform them of known limitations and failure modes, and give them targeted technical access, including for testing and validation, unless you clearly specified that your system was not to be changed into a high-risk one.", "If you are a product manufacturer and a high-risk AI system is a safety component placed on the market or put into service under your name or trademark, you are treated as its provider.", "If you are the provider of a high-risk AI system, or a third party supplying an AI system, AI model, tool, service, component, or process it integrates, specify by written agreement the necessary information, capabilities, technical access, and other assistance needed for the provider to comply with this Regulation, unless the third party makes the tool, service, process or component available to the public under a free and open-source licence; that exception never covers a general-purpose AI model." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "enacted, not yet in force, from 2027-12-02", "as_of_date": "2026-10-10", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [ "agent_txn" ] }, "applies_to": "both", "stale": false, "effective_date": "2027-12-02", "in_force": { "state": "not_yet_in_force", "dated": true, "from": "2027-12-02", "until": null, "reason": null, "days": 409, "countdown": "in 13 months", "stage": null, "words": "not yet in force, from 2027-12-02, in 13 months", "as_of": "2026-10-19" }, "status": "enacted", "lifecycle": { "band": "imminent", "label": "IMMINENT", "tone": "live", "detail": "in force in 409 days", "commencement_established": true }, "settledness": { "band": "unsettled", "open_questions": [ "Does retraining a high-risk AI system on a deployer's own data count as a 'substantial modification' under Article 25(1), point (b), that makes the deployer the provider?" ], "as_of": "2026-10-12" }, "certainty": { "resultset": "forward", "rung": 1, "label": "enacted, commencement dated", "prediction": "none", "detail": "in force 2027-12-02, so nothing here is predicted" } }, { "id": "eu:regulation-eu-2024-1689-article-26-11", "kind": "pending", "severity": "info", "jurisdiction": "eu", "jurisdiction_name": "European Union", "jurisdiction_flag": "🇪🇺", "summary": "AI Act, Article 26(11) (informing individuals subject to an Annex III decision): Without prejudice to the Article 50 transparency duties, a deployer of a high-risk AI system listed in Annex III that makes a decision, or assists in making one, about a natural person must inform that person that they are subject to the use of the high-risk AI system.", "detail": "Without prejudice to the Article 50 transparency duties, a deployer of a high-risk AI system listed in Annex III that makes a decision, or assists in making one, about a natural person must inform that person that they are subject to the use of the high-risk AI system. For a system used for law-enforcement purposes, Article 13 of the Law Enforcement Directive applies instead. This individual-notification duty reaches the whole Annex III catalogue, including the Annex III point 4 employment use cases and the Annex III point 8(a) administration-of-justice use case. Article 26 sits in Chapter III, Section 3, so it takes effect on the schedule the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 2026-07-27) wrote into Article 113: 2027-12-02 for a system classified as high-risk under Article 6(2) and Annex III. Article 26(11) reaches only a high-risk AI system referred to in Annex III, so the later date in that schedule for a system classified under Article 6(1) and Annex I brings no further system within it. Under Article 111(2), as the Digital Omnibus on AI rewrote it, the Regulation reaches the operators of a high-risk AI system placed on the market or put into service before the date Chapter III applies only if, from that date, the system's design changes significantly; in any case, the providers and deployers of a high-risk AI system intended to be used by public authorities must take the necessary steps to comply with the Regulation's requirements and obligations by 2 August 2030. Article 26(11) does not apply to a high-risk AI system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I, to which, under Article 2(2), only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation.", "citation": "Regulation (EU) 2024/1689, Article 26(11)", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng", "note_url": "https://lexlint.io/l/eu-2024-1689-26-11", "requires": [ "This duty takes effect on 2 December 2027 for a high-risk AI system classified under Article 6(2) and Annex III, the only classification this duty reaches, so the later date of 2 August 2028 for one classified under Article 6(1) and Annex I adds no system to it; a system related to a product covered by the Union harmonisation legislation listed in Section B of Annex I is outside it too, since under Article 2(2) only Article 6(1), Article 60a and Articles 102 to 112 apply, and Articles 57, 58 and 59 apply only in so far as the requirements for high-risk AI systems under this Regulation have been integrated in that Union harmonisation legislation; a system already placed on the market or put into service before its date is reached only once its design changes significantly, or by 2 August 2030 if it is intended for use by public authorities.", "If you are the deployer of a high-risk AI system listed in Annex III that makes, or assists in making, a decision about a natural person, inform that person that they are subject to the use of the high-risk AI system.", "If the system is used for law enforcement purposes, follow Article 13 of Directive (EU) 2016/680 instead of this duty." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "enacted, not yet in force, from 2027-12-02", "as_of_date": "2026-10-10", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [ "disclosure" ] }, "applies_to": "both", "stale": false, "effective_date": "2027-12-02", "in_force": { "state": "not_yet_in_force", "dated": true, "from": "2027-12-02", "until": null, "reason": null, "days": 409, "countdown": "in 13 months", "stage": null, "words": "not yet in force, from 2027-12-02, in 13 months", "as_of": "2026-10-19" }, "status": "enacted", "lifecycle": { "band": "imminent", "label": "IMMINENT", "tone": "live", "detail": "in force in 409 days", "commencement_established": true }, "settledness": { "band": "unsettled", "open_questions": [ "Does the duty in Article 26(11) to inform natural persons that they are subject to the use of a high-risk AI system apply to a deployer whose Annex III system only produces a score or recommendation that a person then uses, given that the paragraph reaches deployers that 'make decisions or assist in making decisions related to natural persons'?", "What must the Article 26(11) notice say and when must it be given, when the paragraph states neither its content nor its timing and is stated to be 'without prejudice to Article 50'?" ], "as_of": "2026-10-12" }, "certainty": { "resultset": "forward", "rung": 1, "label": "enacted, commencement dated", "prediction": "none", "detail": "in force 2027-12-02, so nothing here is predicted" } }, { "id": "eu:regulation-eu-2024-1689-article-4", "kind": "obligation", "severity": "warn", "jurisdiction": "eu", "jurisdiction_name": "European Union", "jurisdiction_flag": "🇪🇺", "summary": "AI Act, Article 4 (AI literacy): Providers and deployers of AI systems must take measures to support the development of AI literacy of their staff and other persons who operate or use AI systems on their behalf, taking into account their technical knowledge, experience, education, training, and the context of use, and considering the persons or groups the AI systems are used on.", "detail": "Providers and deployers of AI systems must take measures to support the development of AI literacy of their staff and other persons who operate or use AI systems on their behalf, taking into account their technical knowledge, experience, education, training, and the context of use, and considering the persons or groups the AI systems are used on. The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 2026-07-27) replaced this Article: the original text required providers and deployers to ensure, to their best extent, a sufficient level of AI literacy; the current text asks them only to support its development and states expressly that it does not require guaranteeing any specific level of AI literacy of any individual. The Commission and Member States must support and facilitate providers' and deployers' efforts, in particular for SMEs, including by publishing practical compliance examples, and the European Artificial Intelligence Board must adopt recommendations setting common objectives for the promotion of AI literacy. Article 113, third paragraph, point (a), places this Article in Chapter I, which applies from 2 February 2025; the Digital Omnibus's amendment of that point carves out an exception only for the new Article 5(1), first subparagraph, points (ba) and (bb), and Article 5(1a) and (1b), so Article 4's own application date is unchanged.", "citation": "Regulation (EU) 2024/1689, Article 4", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng", "note_url": "https://lexlint.io/l/eu-2024-1689-4", "requires": [ "Take measures to support the development of AI literacy among your staff and other people who operate or use AI systems on your behalf, if you are a provider or deployer of an AI system, taking into account their technical knowledge, experience, education and training, the context the AI systems are to be used in, and the persons or groups of persons the AI systems are to be used on.", "This duty does not require you to guarantee any specific level of AI literacy for any individual." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-10-10", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "both", "stale": false, "effective_date": "2025-02-02", "in_force": { "state": "in_force", "dated": true, "from": "2025-02-02", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2025-02-02", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2025-02-02", "commencement_established": true }, "settledness": { "band": "developing", "guidance_url": "https://digital-strategy.ec.europa.eu/en/faqs/ai-literacy-questions-answers", "guidance_body": "European Commission", "open_questions": [ "Is a client of a provider or deployer a person 'dealing with the operation and use of AI systems on their behalf' under Article 4(1), when the Commission's questions and answers list a client among the examples but also describe such persons as 'broadly under the organisational remit'?", "What shows that a provider or deployer has 'supported the development' of AI literacy under Article 4(1), when the Commission says the Article does not require measuring staff knowledge or guaranteeing a specific level of AI literacy of any individual?" ], "as_of": "2026-10-12" }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2025-02-02" } }, { "id": "eu:regulation-eu-2024-1689-article-5", "kind": "obligation", "severity": "warn", "jurisdiction": "eu", "jurisdiction_name": "European Union", "jurisdiction_flag": "🇪🇺", "summary": "AI Act, Article 5 (prohibited AI practices): Article 5 bans eight AI practices outright: subliminal, manipulative or deceptive techniques that materially distort a person's behaviour and cause or are reasonably likely to cause significant harm; exploiting the vulnerabilities of a person or group due to age, disability, or social or economic situation to the same effect; evaluating or classifying people by social behaviour or personal characteristics in a way that leads to unjustified or unrelated detrimental treatment (social scoring); assessing or predicting a person's risk of committing a crime based solely on profiling or personality traits, unless supporting a human assessment already grounded in objective, verifiable facts; building or expanding facial recognition databases by untargeted scraping of facial images from the internet or CCTV footage; inferring emotions in the workplace or education, except for medical or safety reasons; biometric categorisation to infer race, political opinions, trade union membership, religious or philosophical beliefs, sex life, or sexual orientation, other than any labelling or filtering of lawfully acquired biometric datasets based on biometric data, or categorising of biometric data in the area of law enforcement; and 'real-time' remote biometric identification in publicly accessible spaces for law enforcement, unless a Member State has provided for it in national law and it is strictly necessary for a targeted search for a specific victim or missing person, a specific and imminent threat to life or a genuine terrorist threat, or the localisation or identification of a suspect of an Annex II offence punishable by a custodial sentence or detention order of at least four years' maximum, and, in the ordinary case, only after prior authorisation from a judicial or independent administrative authority and a fundamental rights impact assessment.", "detail": "Article 5 bans eight AI practices outright: subliminal, manipulative or deceptive techniques that materially distort a person's behaviour and cause or are reasonably likely to cause significant harm; exploiting the vulnerabilities of a person or group due to age, disability, or social or economic situation to the same effect; evaluating or classifying people by social behaviour or personal characteristics in a way that leads to unjustified or unrelated detrimental treatment (social scoring); assessing or predicting a person's risk of committing a crime based solely on profiling or personality traits, unless supporting a human assessment already grounded in objective, verifiable facts; building or expanding facial recognition databases by untargeted scraping of facial images from the internet or CCTV footage; inferring emotions in the workplace or education, except for medical or safety reasons; biometric categorisation to infer race, political opinions, trade union membership, religious or philosophical beliefs, sex life, or sexual orientation, other than any labelling or filtering of lawfully acquired biometric datasets based on biometric data, or categorising of biometric data in the area of law enforcement; and 'real-time' remote biometric identification in publicly accessible spaces for law enforcement, unless a Member State has provided for it in national law and it is strictly necessary for a targeted search for a specific victim or missing person, a specific and imminent threat to life or a genuine terrorist threat, or the localisation or identification of a suspect of an Annex II offence punishable by a custodial sentence or detention order of at least four years' maximum, and, in the ordinary case, only after prior authorisation from a judicial or independent administrative authority and a fundamental rights impact assessment. Non-compliance with any of these prohibitions is fined up to EUR 35,000,000 or 7% of worldwide annual turnover, whichever is higher, with the lower of the two applying to an SME. The Digital Omnibus on AI (Regulation (EU) 2026/1744, in force since 2026-07-27) adds two further prohibited practices, on AI-generated non-consensual intimate imagery and AI-generated or manipulated child sexual abuse material, recorded as a separate instrument because they apply from a later date, 2 December 2026.", "citation": "Regulation (EU) 2024/1689, Article 5", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng", "note_url": "https://lexlint.io/l/eu-2024-1689-5", "requires": [ "Do not place on the market, put into service, or use an AI system that deploys subliminal, manipulative or deceptive techniques to materially distort a person's behaviour in a way that causes or is reasonably likely to cause significant harm.", "Do not place on the market, put into service, or use an AI system that exploits a person's or group's vulnerabilities due to age, disability, or social or economic situation, to materially distort their behaviour in a way that causes or is reasonably likely to cause significant harm.", "Do not place on the market, put into service, or use an AI system to evaluate or classify people by social behaviour or personal characteristics in a way that leads to unjustified or unrelated detrimental treatment (social scoring).", "Do not place on the market, put into service, or use an AI system to assess or predict a person's risk of committing a crime based solely on profiling or personality traits, unless it supports a human assessment already based on objective, verifiable facts directly linked to criminal activity.", "Do not place on the market, put into service, or use an AI system to build or expand facial recognition databases through untargeted scraping of facial images from the internet or CCTV footage.", "Do not place on the market, put into service, or use an AI system to infer emotions in the workplace or in education, except for medical or safety reasons.", "Do not place on the market, put into service, or use a biometric categorisation system that infers race, political opinions, trade union membership, religious or philosophical beliefs, sex life, or sexual orientation from biometric data, other than any labelling or filtering of lawfully acquired biometric datasets based on biometric data, or categorising of biometric data in the area of law enforcement.", "Do not use 'real-time' remote biometric identification in publicly accessible spaces for law enforcement unless a Member State has provided for it in national law and the use is strictly necessary for a targeted search for specific victims of abduction, trafficking or sexual exploitation or for missing persons, for preventing a specific, substantial and imminent threat to life or physical safety or a genuine terrorist threat, or for localising or identifying a person suspected of an offence listed in Annex II that is punishable in the Member State concerned by a custodial sentence or detention order of at least four years' maximum; and, in the ordinary case, only after prior authorisation from a judicial or independent administrative authority, a completed fundamental rights impact assessment, and EU database registration. In a duly justified urgent case, use may begin before the authorisation is granted, if it is requested without undue delay and at the latest within 24 hours, and before the EU database registration, if it is completed without undue delay." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-10-10", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [ "disclosure" ] }, "applies_to": "both", "stale": false, "effective_date": "2025-02-02", "in_force": { "state": "in_force", "dated": true, "from": "2025-02-02", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2025-02-02", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2025-02-02", "commencement_established": true }, "settledness": { "band": "developing", "guidance_url": "https://digital-strategy.ec.europa.eu/en/library/commission-publishes-guidelines-prohibited-artificial-intelligence-ai-practices-defined-ai-act", "guidance_body": "European Commission", "open_questions": [ "Does an AI agent that takes actions autonomously fall within the prohibitions on harmful manipulation and exploitation of vulnerabilities in Article 5(1), points (a) and (b), when the Commission describes its regulatory considerations on AI agents as 'only preliminary at this stage'?" ], "as_of": "2026-10-12" }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2025-02-02" } }, { "id": "eu:regulation-eu-2024-1689-article-50", "kind": "obligation", "severity": "warn", "jurisdiction": "eu", "jurisdiction_name": "European Union", "jurisdiction_flag": "🇪🇺", "summary": "AI Act, Article 50 (transparency obligations for AI systems and synthetic content): Providers of AI systems that interact directly with people must ensure users are informed they are dealing with an AI system unless obvious from context, and providers of generative AI must mark synthetic audio, image, video, or text output in a machine-readable, detectable format.", "detail": "Providers of AI systems that interact directly with people must ensure users are informed they are dealing with an AI system unless obvious from context, and providers of generative AI must mark synthetic audio, image, video, or text output in a machine-readable, detectable format. Deployers of emotion-recognition or biometric-categorization systems must inform exposed individuals, and deployers of deepfakes or AI-generated public-interest text must disclose the artificial origin unless the content underwent human review with editorial responsibility. The Article reaches providers and deployers outside the EU whose system's output is used in the EU. A four-month transition, to 2026-12-02, applies only to the machine-readable marking sub-duty for generative systems already on the market before 2026-08-02, added by the Digital Omnibus on AI.", "citation": "Regulation (EU) 2024/1689, Article 50", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng", "note_url": "https://lexlint.io/l/eu-2024-1689-50", "requires": [ "If you are a provider of an AI system intended to interact directly with natural persons, design and develop it so that the people it interacts with are informed that they are interacting with an AI system, unless that is obvious to a reasonably well-informed, observant and circumspect person, taking into account the circumstances and the context of use (Article 50(1)). This does not apply to an AI system authorized by law to detect, prevent, investigate or prosecute criminal offenses, subject to appropriate safeguards for the rights and freedoms of third parties, unless the system is available for the public to report a criminal offense.", "If you are a provider of an AI system, including a general-purpose AI system, that generates synthetic audio, image, video or text content, ensure that its outputs are marked in a machine-readable format and detectable as artificially generated or manipulated, using technical solutions that are effective, interoperable, robust and reliable as far as technically feasible, taking into account the specificities and limitations of various types of content, the costs of implementation and the generally acknowledged state of the art (Article 50(2)). This marking duty is the provider's; a deployer's disclosure duties are in Article 50(3) and (4). It does not apply to the extent the system performs an assistive function for standard editing or does not substantially alter the input data the deployer provided or its semantics, or where authorized by law to detect, prevent, investigate or prosecute criminal offenses.", "If you are a provider of an AI system that generates synthetic audio, image, video or text content and was placed on the market before 2 August 2026, take the necessary steps to comply with the Article 50(2) marking duty by 2 December 2026 (Article 111(4), inserted by Regulation (EU) 2026/1744).", "If you are a deployer of an emotion recognition system or a biometric categorisation system, inform the natural persons exposed to it of the operation of the system, and process their personal data in accordance with Regulations (EU) 2016/679 and (EU) 2018/1725 and Directive (EU) 2016/680, as applicable (Article 50(3)). This does not apply to an AI system used for biometric categorisation and emotion recognition that is permitted by law to detect, prevent or investigate criminal offenses, subject to appropriate safeguards for the rights and freedoms of third parties and in accordance with Union law.", "If you are a deployer of an AI system that generates or manipulates image, audio or video content constituting a deep fake, disclose that the content has been artificially generated or manipulated (Article 50(4)). A deep fake is AI-generated or manipulated image, audio or video content that resembles existing persons, objects, places, entities or events and would falsely appear to a person to be authentic or truthful (Article 3, point (60)). Where the content forms part of an evidently artistic, creative, satirical, fictional or analogous work or programme, the disclosure is limited to the existence of the generated or manipulated content, in an appropriate manner that does not hamper the display or enjoyment of the work. This does not apply where the use is authorized by law to detect, prevent, investigate or prosecute criminal offenses.", "If you are a deployer of an AI system that generates or manipulates text that is published with the purpose of informing the public on matters of public interest, disclose that the text has been artificially generated or manipulated (Article 50(4)). This does not apply where the use is authorized by law to detect, prevent, investigate or prosecute criminal offenses, or where the AI-generated content has undergone a process of human review or editorial control and a natural or legal person holds editorial responsibility for the publication of the content.", "If you owe the information required by Article 50(1) to (4), provide it to the natural persons concerned in a clear and distinguishable manner at the latest at the time of the first interaction or exposure, in a form that conforms to the applicable accessibility requirements (Article 50(5))." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-10-10", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [ "disclosure" ] }, "applies_to": "both", "stale": false, "effective_date": "2026-08-02", "in_force": { "state": "in_force", "dated": true, "from": "2026-08-02", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2026-08-02", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "new", "label": "NEW", "tone": "force", "detail": "in force 78 days", "commencement_established": true }, "settledness": { "band": "developing", "guidance_url": "https://digital-strategy.ec.europa.eu/en/library/guidelines-transparency-obligations-providers-and-deployers-ai-systems", "guidance_body": "European Commission", "open_questions": [ "Does Article 111(4), which has a provider of a generative AI system placed on the market before 2 August 2026 comply with Article 50(2) by 2 December 2026, reach a new version of that system that is placed on the market after 2 August 2026?" ], "as_of": "2026-10-12" }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2026-08-02" } }, { "id": "eu:soft-law", "kind": "coverage", "severity": "info", "jurisdiction": "eu", "jurisdiction_name": "European Union", "jurisdiction_flag": "🇪🇺", "summary": "3 matched record(s) are policy or guidance, not law: AI Literacy - Questions & Answers, the European Commission's reading of Article 4 of the AI Act; Commission Guidelines on prohibited AI practices under the AI Act (C(2025) 5052 final); European Commission Guidelines on the implementation of the transparency obligations for certain AI systems under Article 50 of the AI Act. They bind nobody on their own, so they are not findings; read them as context.", "citation": null, "as_of_date": "2026-10-10", "confidence": "high", "stale": false }, { "id": "eu:public-sector-undeclared", "kind": "coverage", "severity": "info", "jurisdiction": "eu", "jurisdiction_name": "European Union", "jurisdiction_flag": "🇪🇺", "summary": "2 finding(s) below carry duties that bind only public bodies. Nobody said whether a public body runs this software or buys it, so those duties are shown as yours. Ask, and send public_sector (body, supplier or none) to route them.", "citation": null, "as_of_date": "2026-10-10", "confidence": "high", "stale": false }, { "id": "eu:ai-role-undeclared", "kind": "coverage", "severity": "info", "jurisdiction": "eu", "jurisdiction_name": "European Union", "jurisdiction_flag": "🇪🇺", "summary": "5 finding(s) here carry duties that bind only one role under the EU AI Act (provider, deployer, importer, distributor, product_manufacturer or authorised_representative). Nobody said which role this software's maker holds, so those duties are shown as yours. Ask, and send roles ({\"ai_system\": [...]}, or [\"none\"]) to route them.", "citation": null, "as_of_date": "2026-10-10", "confidence": "high", "stale": false }, { "id": "eu:data-role-undeclared", "kind": "coverage", "severity": "info", "jurisdiction": "eu", "jurisdiction_name": "European Union", "jurisdiction_flag": "🇪🇺", "summary": "5 finding(s) here carry duties that bind only one role under the GDPR (controller or processor). Nobody said which role this software's maker holds, so those duties are shown as yours. Ask, and send roles ({\"personal_data\": [...]}, or [\"none\"]) to route them.", "citation": null, "as_of_date": "2026-10-10", "confidence": "high", "stale": false }, { "id": "eu:untagged-instruments", "kind": "coverage", "severity": "warn", "jurisdiction": "eu", "jurisdiction_name": "European Union", "jurisdiction_flag": "🇪🇺", "summary": "1 instrument(s) for this jurisdiction carry no behaviour tags at all, so no declared activity can match them. They are outside this run: review them by hand.", "citation": null, "as_of_date": "2026-10-10", "confidence": "high", "stale": false }, { "id": "de:bundesdatenschutzgesetz-bdsg-bgbl-i-s-2097-2017-as-amended", "kind": "obligation", "severity": "warn", "jurisdiction": "de", "jurisdiction_name": "Germany", "jurisdiction_flag": "🇩🇪", "summary": "Bundesdatenschutzgesetz (BDSG), Federal Data Protection Act: The GDPR applies directly in Germany, and the Bundesdatenschutzgesetz (BDSG), BGBl.", "detail": "The GDPR applies directly in Germany, and the Bundesdatenschutzgesetz (BDSG), BGBl. I S. 2097 (2017) as amended, supplies domestic derogations and procedural rules, most significantly Section 26 (employment data), Section 31 (scoring and credit reports) and Section 37 (automated decisions in insurance). The BDSG adds rules of its own on the lawfulness of processing beside GDPR Article 6, in Section 4 (video surveillance), Section 22 (special categories), Section 24 (further use for other purposes) and Section 26 (employment). Enforcement is divided between the federal BfDI and the supervisory authorities of the Laender. The BfDI supervises federal public bodies and companies providing telecommunications services under BDSG Section 9(1). The BfDI also supervises companies providing postal services, under Section 71(1) of the Postgesetz. The authorities designated under Land law supervise private-sector bodies under BDSG Section 40(1). The independent data protection authorities of the federation and the Laender make up the Datenschutzkonferenz.", "citation": "Bundesdatenschutzgesetz (BDSG), BGBl. I S. 2097 (2017), as amended", "url": "https://www.gesetze-im-internet.de/bdsg_2018/BJNR209710017.html", "note_url": "https://lexlint.io/l/de-bundesdatenschutzgesetz-bdsg-bgbl-i-s-2097-20", "requires": [ "Establish and document a lawful basis under GDPR Article 6 before processing any personal data of a person in Germany.", "Where you process employee data, including biometric data for workplace access or time and attendance, satisfy BDSG Section 26(3)'s stricter conditions rather than relying on employee consent alone." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-08-24", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "both", "stale": false, "effective_date": "2018-05-25", "in_force": { "state": "in_force", "dated": true, "from": "2018-05-25", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2018-05-25", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2018-05-25", "commencement_established": true }, "settledness": { "band": "developing", "guidance_url": "https://www.datenschutzkonferenz-online.de/media/kp/dsk_kpnr_14.pdf", "guidance_body": "Konferenz der unabhängigen Datenschutzaufsichtsbehörden des Bundes und der Länder (Datenschutzkonferenz, joint body of the German data protection authorities)", "case_citation": "Case C-34/21 Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium v Minister des Hessischen Kultusministeriums, judgment of the Court of Justice of 30 March 2023 (First Chamber)", "case_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0034", "open_questions": [ "Does Section 26(1) sentence 1 of the Bundesdatenschutzgesetz satisfy the conditions of Article 88(2) of Regulation (EU) 2016/679, so that it can apply as a more specific rule on employee data, after the Court of Justice's ruling in Case C-34/21?" ], "as_of": "2026-10-12" }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2018-05-25" } }, { "id": "de:diskussionsentwurf-der-rundfunkkommission-der-l-nder-f-r-ein", "kind": "pending", "severity": "info", "jurisdiction": "de", "jurisdiction_name": "Germany", "jurisdiction_flag": "🇩🇪", "summary": "Digitale Medien-Staatsvertrag Teil 2 (Discussion Draft), Rules for Providers of AI Information Systems (Proposed Sections 77a to 77g of the Medienstaatsvertrag): The Rundfunkkommission der Länder deliberated on proposals titled Digitale Medien-Staatsvertrag Teil 2 for a reform of the Medienstaatsvertrag and the Jugendmedienschutz-Staatsvertrag on 16 September 2026 and put them up for discussion.", "detail": "The Rundfunkkommission der Länder deliberated on proposals titled Digitale Medien-Staatsvertrag Teil 2 for a reform of the Medienstaatsvertrag and the Jugendmedienschutz-Staatsvertrag on 16 September 2026 and put them up for discussion. The discussion draft states that its texts are not finally agreed. Comments on the draft are invited until 13 November 2026. The draft would add a new category of telemedia, the KI-Informationssystem (AI information system), which provides new content to an undetermined circle of users, individualized and automated, also on the basis of third-party journalistic and editorial offerings. Its proposed rules would not apply, apart from the first two paragraphs of section 77b, to an AI information system that reaches fewer than one million users per month in Germany on a six-month average. A provider of an AI information system would be responsible for the content its system generates. A provider would have to keep easily perceivable, directly accessible and permanently available information on how the system works, in understandable language. For news and political information content, a provider would also have to state how likely the statements in newly generated content are to be accurate. An AI information system would not be allowed to discriminate against third-party journalistic and editorial offerings. A provider would have to ensure that reproduced news and political content reflects the sources used without distorting their meaning.", "citation": "Diskussionsentwurf der Rundfunkkommission der Länder für einen Digitale Medien-Staatsvertrag (DMStV) Teil 2, Medienstaatsvertrag §§ 77a bis 77g (neu)", "url": "https://rundfunkkommission.rlp.de/fileadmin/rundfunkkommission/Dokumente/DMStV_2/Dokumente/2026-09-28_ANHOERUNG_DMStV_II_RFK.pdf", "note_url": "https://lexlint.io/l/de-diskussionsentwurf-der-rundfunkkommission-der", "requires": [ "Name an authorized recipient of service in Germany and point to that person in an easily recognizable and directly accessible way in your offering.", "Take responsibility for the content your AI information system generates.", "Keep easily perceivable, directly accessible and permanently available information on how your AI information system works, in understandable language.", "For news and political information content, state how likely the statements in newly generated content are to be accurate.", "Do not discriminate against third-party journalistic and editorial offerings without an objective reason.", "Make sure reproduced news and political content reflects the sources used without distorting their meaning.", "Hand the documents the state media authority asks for to that authority." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "not law yet (status \"proposed\")", "as_of_date": "2026-10-12", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "private", "stale": false, "effective_date": null, "in_force": { "state": "proposed", "dated": false, "from": null, "until": null, "reason": null, "days": null, "countdown": null, "stage": "a published draft that has not reached a legislature", "words": "proposed, a published draft that has not reached a legislature", "as_of": "2026-10-19" }, "status": "proposed", "lifecycle": { "band": "proposed", "label": "PROPOSED", "tone": "pending", "detail": "draft date not recorded", "commencement_established": false }, "settledness": { "band": "unsettled", "open_questions": [ "Does 'Angaben dazu, mit welcher Wahrscheinlichkeit ... zutreffend sind' in proposed section 77c(1) No. 2 require a stated probability for each generated answer, or does a general statement about the system's reliability meet it?", "Who decides whether a system will reach one million users per month 'in ihrer prognostizierten Entwicklung' under proposed section 77a: the provider or the state media authority?" ], "as_of": "2026-10-12" }, "certainty": { "resultset": "forward", "rung": 4, "label": "in committee or introduced", "prediction": "most of it", "detail": "a published draft that has not reached a legislature, on the print published 2026-09-28" } }, { "id": "de:entwurf-eines-gesetzes-zur-modernisierung-des-produkthaftung", "kind": "pending", "severity": "info", "jurisdiction": "de", "jurisdiction_name": "Germany", "jurisdiction_flag": "🇩🇪", "summary": "Gesetz zur Modernisierung des Produkthaftungsrechts und zur Änderung weiterer Vorschriften (Bundesrat Drucksache 584/26), new Produkthaftungsgesetz transposing Directive (EU) 2024/2853: The Bundestag adopted the government bill to modernize product liability law on 8 October 2026.", "detail": "The Bundestag adopted the government bill to modernize product liability law on 8 October 2026. It adopted the bill in the version recommended by its Committee on Legal Affairs and Consumer Protection. The adopted text carries the title Gesetz zur Modernisierung des Produkthaftungsrechts und zur Änderung weiterer Vorschriften (Act to Modernize Product Liability Law and to Amend Further Provisions). The Bundesrat printed the adopted text as Drucksache 584/26 on 9 October 2026. The Bundesrat classes it as an Einspruchsgesetz (a law the Bundesrat may object to but need not consent to). On 16 October 2026 the Bundesrat decided not to request the Mediation Committee (Vermittlungsausschuss) on the Act the Bundestag adopted on 8 October 2026. Under Article 78 of the Basic Law, a law adopted by the Bundestag is passed when the Bundesrat does not make that request. Under Article 82 of the Basic Law, a law so passed is signed by the Federal President after countersignature and promulgated in the Federal Law Gazette (Bundesgesetzblatt). The bill transposes Directive (EU) 2024/2853 as a new Produkthaftungsgesetz. The committee report says that, because of the number of changes, the Produkthaftungsgesetz is to be restated. Under the bill the new Act applies from 9 December 2026. Article 2 of the bill ends the Produkthaftungsgesetz of 1989 on 9 December 2026. The bill adds that the Produkthaftungsgesetz of 1989 stays in application for products put into circulation or into operation up to and including 8 December 2026, in the version in force up to that date. Section 2(1) No. 3 makes software a product, except free and open-source software that is developed or supplied outside a business activity. The Bundestag's report states that software counts as a product regardless of how it is supplied. Section 4(2) counts as a component any thing, any intangible object and any connected service that is integrated into or connected with a product. Section 1(1) makes the manufacturer liable for damage to a natural person whose body or health is injured through a defect in a product. Liability also covers a thing other than the defective product that is not used exclusively for professional purposes, and data that is not used for professional purposes. Section 8(2) fixes the time for judging a defect at the moment the product left the manufacturer's control where the manufacturer kept control after putting it into circulation. The manufacturer's control exists where it or a third party with its consent integrates, connects or provides a component including a software update or upgrade, or changes the product, or where it is able to provide software updates or upgrades itself or through a third party. The manufacturer is not liable for a defect that could not be recognized according to the objective state of science and technology at the relevant time. Section 9(2) also excludes the manufacturer's liability where it is probable that the product did not yet have the defect when it was put into circulation. That exclusion does not apply where section 8(2) applies and the defect is due to a connected service, to software including updates or upgrades, to the lack of software updates or upgrades needed to maintain safety, or to a substantial modification. Section 10 makes an importer from a third country and a representative established in the European Union liable like the manufacturer where the manufacturer is established outside the Union. Where there is no importer or representative established in the European Union, the fulfilment service provider is also liable. The Bundestag's committee changed the provisions on disclosure of evidence. Section 19 has the court order the defendant or a third party to disclose relevant evidence in its control on the application of a claimant who has presented facts and evidence sufficient to support the plausibility of a claim for compensation. A third party need not disclose evidence where it may refuse to testify under sections 383 to 385 of the Code of Civil Procedure. A defect is presumed where the defendant fails to disclose relevant evidence despite a court order. A defect is also presumed where the claimant shows that the product does not meet binding product-safety requirements that protect against the risk of the injury suffered. The claim for compensation lapses three years after the creditor learned, or should have learned, of the defect, the damage and the identity of the debtor. The Bundesrat's opinion on the government bill gives, as examples of changes from current law, tightened rules of evidence and the dropping of limits on liability such as the deductible for damage to things and the ceiling for personal injury. Section 18 bars departing from the manufacturer's liability to the disadvantage of the injured person. The claim expires ten years after the product was put into circulation or into operation. The ten-year period extends to 25 years where a latent personal injury prevented the creditor from starting proceedings within ten years.", "citation": "Entwurf eines Gesetzes zur Modernisierung des Produkthaftungsrechts", "url": "https://dserver.bundestag.de/brd/2026/0584-26.pdf", "note_url": "https://lexlint.io/l/de-entwurf-eines-gesetzes-zur-modernisierung-des", "requires": [ "If you develop or make software, or have it designed or made, you answer as its manufacturer; free and open-source software developed or supplied outside a business activity is outside the definition of a product (§§ 2(1) No. 3 and 3).", "Keep supplying the software updates and upgrades needed to keep the product safe while the product is within your control: if you are able to provide them yourself or through a third party you keep control, and a defect caused by software, by an update or upgrade, or by a missing necessary update is not excused because it arose after you put the product into circulation (§§ 8(2) and 9(2)).", "Meet the product-safety requirements that apply to your product, safety-relevant cybersecurity requirements included: they count in judging whether it is defective (§ 7 No. 5), and failing a binding product-safety requirement that protects against the injury presumes it defective (§ 20(1) No. 2).", "Account for what your product learns or acquires after it is put into circulation: the effect of that ability is weighed in judging whether it is defective (§ 7 No. 3).", "Keep records you could produce if a court orders disclosure on a claimant's plausible claim; failing to disclose despite the order presumes the product defective (§§ 19(1) and 20(1) No. 1).", "If you hold relevant evidence for a product liability claim against someone else, the court can, on the claimant's application, order you as a third party to disclose it, limited to what is necessary and proportionate, except to the extent you may refuse to testify under sections 383 to 385 of the Code of Civil Procedure (§ 19(1) and (3)).", "If you are a manufacturer outside the EU, your importer into the EU market and your representative appointed in writing and established in the EU are liable as the manufacturer is, and where there is neither, the fulfilment service provider is liable too (§§ 10 and 11).", "If you make a product available in the supply chain without being its manufacturer or importer, or run an online platform that lets consumers conclude distance contracts with traders where the conditions of Article 6(3) of the Digital Services Act are met, you are liable as the manufacturer is when no manufacturer, importer, representative or fulfilment service provider established in the EU can be identified, unless within one month of receiving the injured person's request you name one of them or your own supplier of the product (§§ 12 and 13).", "If you substantially modify a product without the manufacturer's consent and then make it available on the market or put it into operation, you are the manufacturer of the modified product (§ 5(1)).", "Do not rely on a contract term to limit or exclude your liability to an injured person; departing from the Act to their disadvantage is not allowed (§ 18).", "You are excused if you did not put the product into circulation, if the defect results from the product meeting legal requirements, or if the defect could not be recognized according to the objective state of science and technology at the relevant time (§ 9(1)).", "Claims lapse three years after the creditor learned, or should have learned, of the defect, the damage and the identity of the debtor, and expire ten years after the product was put into circulation or into operation, or 25 years for a latent personal injury (§§ 16 and 17)." ], "why": "Pulled in because the app deploys a chatbot and keeps or monitors what users type in a chat, and the law library tags this instrument for exactly that.", "basis": "not law yet (status \"proposed\")", "as_of_date": "2026-10-16", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot", "records_text_chat" ], "flags": [ "deploys_chatbot", "records_text_chat" ], "categories": [] }, "applies_to": "private", "stale": false, "effective_date": null, "in_force": { "state": "proposed", "dated": false, "from": null, "until": null, "reason": null, "days": null, "countdown": null, "stage": "finalized, with one agreed text", "words": "proposed, finalized, with one agreed text", "as_of": "2026-10-19" }, "status": "proposed", "lifecycle": { "band": "proposed", "label": "PROPOSED", "tone": "pending", "detail": "draft date not recorded", "commencement_established": false }, "certainty": { "resultset": "forward", "rung": 3, "label": "passed a chamber or enrolled", "prediction": "the remainder", "detail": "finalized, with one agreed text, on the print published 2026-10-09" } }, { "id": "de:gesetz-gegen-den-unlauteren-wettbewerb-uwg-bgbl-i-s-2949-200", "kind": "obligation", "severity": "warn", "jurisdiction": "de", "jurisdiction_name": "Germany", "jurisdiction_flag": "🇩🇪", "summary": "German Act Against Unfair Competition (Gesetz gegen den unlauteren Wettbewerb — UWG) — Sections 5 and 5a (Misleading AI Disclosure): Sections 5 and 5a UWG prohibit misleading commercial practices, including by omission.", "detail": "Sections 5 and 5a UWG prohibit misleading commercial practices, including by omission. German courts and commentators apply these provisions to AI systems: deployers of AI chatbots used for commercial communications must disclose the AI nature of the interaction, and falsely representing a product as AI-powered, or concealing that a communication is automated, can constitute a misleading omission. Operators bear liability for misleading AI-chatbot statements, including hallucinated claims about products or competitors. No change since the prior research pass.", "citation": "Gesetz gegen den unlauteren Wettbewerb (UWG), BGBl. I S. 2949 (2004), zuletzt geändert, §§ 5, 5a", "url": "https://www.gesetze-im-internet.de/uwg_2004/", "note_url": null, "requires": [ "Do not engage in misleading commercial practices, including misleading by omission.", "Disclose the AI nature of an interaction when using an AI chatbot for commercial communications.", "Do not falsely represent a product as AI-powered.", "Do not conceal that a communication is automated.", "Do not make misleading statements through an AI chatbot, including hallucinated claims about products or competitors." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "enacted and in force", "as_of_date": "2026-08-12", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [ "disclosure" ] }, "applies_to": "private", "stale": false, "effective_date": "2004-07-08", "in_force": { "state": "in_force", "dated": true, "from": "2004-07-08", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2004-07-08", "as_of": "2026-10-19" }, "status": "enacted", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2004-07-08", "commencement_established": true }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2004-07-08" } }, { "id": "de:medienstaatsvertrag-mstv-18-abs-3", "kind": "obligation", "severity": "warn", "jurisdiction": "de", "jurisdiction_name": "Germany", "jurisdiction_flag": "🇩🇪", "summary": "Medienstaatsvertrag (MStV) Section 18(3), Labelling of Automatically Created Content in Social Networks: Section 18(3) of the Medienstaatsvertrag requires providers of telemedia in social networks to make clear that content or messages were created automatically by means of a computer programme, where the user account used was provided, by its outward appearance, for use by natural persons.", "detail": "Section 18(3) of the Medienstaatsvertrag requires providers of telemedia in social networks to make clear that content or messages were created automatically by means of a computer programme, where the user account used was provided, by its outward appearance, for use by natural persons. The notice must be placed legibly before or beside the content or message and must state that it was created and sent automatically using a computer programme that controls the user account. Creating includes not only generating content immediately before sending but also falling back on prepared content or a pre-programmed message when sending. Under section 93(4), providers of media intermediaries that offer social networks must ensure that telemedia within the meaning of section 18(3) are labelled. Failing to make the labelling that section 18(3) requires is an administrative offence under section 115. Section 115(2) allows a fine of up to EUR 500,000, with lower ceilings only for offences numbered 1, 49 and 50 in the second sentence of section 115(1). The treaty that contains the Medienstaatsvertrag entered into force on 7 November 2020.", "citation": "Medienstaatsvertrag (MStV), § 18 Abs. 3", "url": "https://www.die-medienanstalten.de/fileadmin/user_upload/Rechtsgrundlagen/Gesetze_Staatsvertraege/Medienstaatsvertrag_MStV.pdf", "note_url": "https://lexlint.io/l/de-medienstaatsvertrag-mstv-18-abs-3", "requires": [ "If you operate an automated account in a social network whose profile looks like one provided for natural persons, label each piece of content or message that a computer programme creates automatically as created and sent automatically using a programme that controls the account (Medienstaatsvertrag, section 18(3)).", "Place the notice legibly before or beside the content or message; it counts as automatic creation also where the programme sends a prepared content or a pre-programmed message (section 18(3)).", "If you provide a media intermediary that offers a social network, ensure that telemedia within the meaning of section 18(3) are labelled (section 93(4))." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-10-12", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "both", "stale": false, "effective_date": "2020-11-07", "in_force": { "state": "in_force", "dated": true, "from": "2020-11-07", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2020-11-07", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2020-11-07", "commencement_established": true }, "settledness": { "band": "unsettled", "open_questions": [ "Does 'seinem äußeren Erscheinungsbild nach für die Nutzung durch natürliche Personen bereitgestellt' in section 18(3) cover a brand or company account, or only an account that presents itself as a private individual?", "Does 'unmittelbar vor dem Versenden automatisiert generiert' in section 18(3), third sentence, include a post that an AI system drafted and a person approved before sending?" ], "as_of": "2026-10-12" }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2020-11-07" } }, { "id": "de:regulation-eu-2016-679-arts-12-21-bundesdatenschutzgesetz-bd", "kind": "obligation", "severity": "warn", "jurisdiction": "de", "jurisdiction_name": "Germany", "jurisdiction_flag": "🇩🇪", "summary": "GDPR Articles 12-21 and BDSG Sections 34 and 35, Data Subject Rights in Germany: Under GDPR Articles 12 to 21, a person in Germany can ask a controller for access to their personal data and for its rectification, erasure, restriction or portability, or object to its processing, and the controller must answer within one month, a period it may extend by two further months for complex or numerous requests.", "detail": "Under GDPR Articles 12 to 21, a person in Germany can ask a controller for access to their personal data and for its rectification, erasure, restriction or portability, or object to its processing, and the controller must answer within one month, a period it may extend by two further months for complex or numerous requests. BDSG Sections 34 and 35 narrow the rights of access and erasure for any controller. Section 34(1) number 2 removes the access right for data kept only because a statutory or bylaw-based retention duty forbids deleting them. Section 34(1) number 2 also removes it for data kept exclusively for data backup or data-protection audit, but only where access would take disproportionate effort and processing for any other purpose is excluded by suitable technical and organisational measures. Section 35 replaces erasure with restriction where non-automated storage makes erasure impossible or disproportionately costly and the person's interest in erasure is minor, unless the data were processed unlawfully.", "citation": "Regulation (EU) 2016/679, Arts. 12-21; Bundesdatenschutzgesetz (BDSG) §§ 34, 35", "url": "https://www.gesetze-im-internet.de/bdsg_2018/BJNR209710017.html", "note_url": "https://lexlint.io/l/de-eu-2016-679-12-21-bundesdatenschutzgesetz-bds", "requires": [ "Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Germany within one month of receipt.", "You need not give a person in Germany access under GDPR Article 15 to personal data you keep only because a statutory or bylaw-based retention duty forbids deleting them. You also need not give access to personal data that serve exclusively data backup or data-protection audit, but only where giving access would take disproportionate effort and you have excluded any other use of the data by suitable technical and organisational measures, under BDSG Section 34(1) number 2.", "Where non-automated storage makes erasing a person's data in Germany impossible or disproportionately costly and their interest in erasure is minor, restrict processing of the data instead of erasing it, unless the data were processed unlawfully, under BDSG Section 35(1)." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-09-26", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "both", "stale": false, "effective_date": "2018-05-25", "in_force": { "state": "in_force", "dated": true, "from": "2018-05-25", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2018-05-25", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2018-05-25", "commencement_established": true }, "settledness": { "band": "developing", "guidance_url": "https://www.datenschutzkonferenz-online.de/media/kp/dsk_kpnr_6.pdf", "guidance_body": "Konferenz der unabhängigen Datenschutzaufsichtsbehörden des Bundes und der Länder (Datenschutzkonferenz)", "open_questions": [ "Do the limits on access in Section 34(1) number 2 of the Bundesdatenschutzgesetz apply to a controller's refusal at all, given the primacy of Regulation (EU) 2016/679 and its Article 23, which the Datenschutzkonferenz leaves to a decision in each individual case?" ], "as_of": "2026-10-12" }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2018-05-25" } }, { "id": "de:regulation-eu-2016-679-arts-33-34", "kind": "obligation", "severity": "warn", "jurisdiction": "de", "jurisdiction_name": "Germany", "jurisdiction_flag": "🇩🇪", "summary": "GDPR Articles 33-34, Breach Notification in Germany: A controller must notify the competent supervisory authority without undue delay and within 72 hours where feasible, after becoming aware of a personal data breach, and must notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms.", "detail": "A controller must notify the competent supervisory authority without undue delay and within 72 hours where feasible, after becoming aware of a personal data breach, and must notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms. BDSG Section 43(4) allows a notification under Article 33 or a communication under Article 34(1) to be used in administrative-offence proceedings against the person who made it, or that person's relatives, only with that person's consent.", "citation": "Regulation (EU) 2016/679, Arts. 33-34", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng", "note_url": "https://lexlint.io/l/de-eu-2016-679-33-34", "requires": [ "Notify the competent data protection authority without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Germany, unless the breach is unlikely to risk their rights and freedoms.", "Notify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-08-24", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "both", "stale": false, "effective_date": "2018-05-25", "in_force": { "state": "in_force", "dated": true, "from": "2018-05-25", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2018-05-25", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2018-05-25", "commencement_established": true }, "settledness": { "band": "developing", "guidance_url": "https://datenschutz-hamburg.de/service-information/datenpanne-melden", "guidance_body": "Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (Hamburg Commissioner for Data Protection and Freedom of Information)", "open_questions": [ "Does the bar in Section 43(4) of the Bundesdatenschutzgesetz on using a breach notification in administrative-offence proceedings without the notifier's consent apply to a fine under Article 83 of Regulation (EU) 2016/679?" ], "as_of": "2026-10-12" }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2018-05-25" } }, { "id": "de:regulation-eu-2016-679-arts-44-49", "kind": "obligation", "severity": "warn", "jurisdiction": "de", "jurisdiction_name": "Germany", "jurisdiction_flag": "🇩🇪", "summary": "GDPR Chapter V, Cross-Border Transfer of Personal Data from Germany: Transferring personal data of a person in Germany outside the European Economic Area requires a European Commission adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the highest Article 83(5) fine tier.", "detail": "Transferring personal data of a person in Germany outside the European Economic Area requires a European Commission adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the highest Article 83(5) fine tier.", "citation": "Regulation (EU) 2016/679, Arts. 44-49", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng", "note_url": "https://lexlint.io/l/de-eu-2016-679-44-49", "requires": [ "Rely on a European Commission adequacy decision, Standard Contractual Clauses with a transfer impact assessment, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Germany outside the European Economic Area." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-08-24", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "both", "stale": false, "effective_date": "2018-05-25", "in_force": { "state": "in_force", "dated": true, "from": "2018-05-25", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2018-05-25", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2018-05-25", "commencement_established": true }, "settledness": { "band": "developing", "guidance_url": "https://www.bfdi.bund.de/DE/Fachthemen/Datenschutzpraxis/Internationaler-Datentransfer/Internationaler-Datentransfer-node.html", "guidance_body": "Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (Federal Commissioner for Data Protection and Freedom of Information)", "case_citation": "Case C-311/18 Data Protection Commissioner v Facebook Ireland and Maximillian Schrems (Schrems II), judgment of the Court of Justice of 16 July 2020 (Grand Chamber)", "case_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62018CJ0311", "open_questions": [ "Does a transfer that relies on the adequacy decision for the EU-U.S. Data Privacy Framework, Commission Implementing Decision (EU) 2023/1795, stay lawful under Article 45 of Regulation (EU) 2016/679 while the appeal in Case C-703/25 P seeks its annulment?" ], "as_of": "2026-10-12" }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2018-05-25" } }, { "id": "de:regulation-eu-2016-679-arts-82-83-bundesdatenschutzgesetz-bd", "kind": "obligation", "severity": "warn", "jurisdiction": "de", "jurisdiction_name": "Germany", "jurisdiction_flag": "🇩🇪", "summary": "GDPR Article 82, BDSG Sections 41-43, and BfDI and Landesdatenschutzbehörden Enforcement in Germany: The Datenschutzkonferenz consists of the independent data protection authorities of the federation and the Laender.", "detail": "The Datenschutzkonferenz consists of the independent data protection authorities of the federation and the Laender. BDSG Section 42 adds criminal offenses, punishable by imprisonment of up to three years or a fine, for knowingly passing on or making available non-public personal data of a large number of people without authorization and on a commercial basis. Article 82 gives any person who has suffered material or non-material damage a right to compensation from the controller or processor. In Case C-300/21, the CJEU held that Article 82(1) precludes a national rule or practice that makes compensation for non-material damage subject to the damage reaching a certain degree of seriousness. In Case C-319/20 (Verbraucherzentrale Bundesverband v Meta Platforms Ireland), the CJEU held that Article 80(2) does not preclude national legislation allowing a consumer protection association to bring proceedings without a mandate from a data subject, on the basis of a breach of consumer protection law. Under Section 4(1) of the Verbraucherrechtedurchsetzungsgesetz (VDuG), a qualified body's representative action is admissible only if it shows that the claims of at least 50 consumers may be affected by a redress action, or that the claims or legal relationships of at least 50 consumers may depend on the declaratory aims.", "citation": "Regulation (EU) 2016/679, Arts. 82-83; Bundesdatenschutzgesetz (BDSG) §§41-43", "url": "https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng", "note_url": "https://lexlint.io/l/de-eu-2016-679-82-83-bundesdatenschutzgesetz-bds", "requires": [ "Compensate any person who suffered material or non-material damage from your infringement, as controller or processor, under GDPR Article 82." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-09-02", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "both", "stale": false, "effective_date": "2018-05-25", "in_force": { "state": "in_force", "dated": true, "from": "2018-05-25", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2018-05-25", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2018-05-25", "commencement_established": true }, "settledness": { "band": "developing", "case_citation": "Case C-300/21 UI v Österreichische Post AG, judgment of 4 May 2023 (Third Chamber)", "case_url": "https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0300", "open_questions": [ "Which German rules on the extent of financial compensation apply to an award for non-material damage under Article 82(1), given that the Court of Justice in Case C-300/21 leaves that extent to the domestic rules of each Member State, subject to the principles of equivalence and effectiveness?", "Does the Bundesgerichtshof's assessment of about EUR 100 for loss of control alone, in the Facebook scraping facts of its judgment of 18 November 2024 (VI ZR 10/24), carry over to loss of control through a different kind of personal data or a different kind of incident under Article 82(1) of Regulation (EU) 2016/679?" ], "as_of": "2026-10-12" }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2018-05-25" } }, { "id": "de:regulation-eu-2024-1689-art-26-and-annex-iii-directly-applic", "kind": "pending", "severity": "info", "jurisdiction": "de", "jurisdiction_name": "Germany", "jurisdiction_flag": "🇩🇪", "summary": "EU Artificial Intelligence Act — Article 26 / Annex III (High-Risk AI: Public-Authority Deployer Obligations): German public authorities deploying high-risk AI systems listed in Annex III must conduct a Fundamental Rights Impact Assessment, register the system, inform affected individuals, maintain logs, and ensure human oversight.", "detail": "German public authorities deploying high-risk AI systems listed in Annex III must conduct a Fundamental Rights Impact Assessment, register the system, inform affected individuals, maintain logs, and ensure human oversight. The EU Digital Omnibus on AI, provisionally agreed 7 May 2026, endorsed by Parliament 16 June 2026, and finally approved by the Council 29 June 2026, confirmed the deferral of stand-alone Annex III obligations to 2 December 2027 (Annex I product-embedded systems deferred to 2 August 2028).", "citation": "Regulation (EU) 2024/1689, Art. 26 and Annex III — directly applicable in Germany", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng", "note_url": null, "requires": [ "This law is enacted but does not take effect until 2027-12-02; what follows applies from that date.", "Complete a Fundamental Rights Impact Assessment before deploying a high-risk AI system.", "Register the high-risk AI system.", "Inform affected individuals that a high-risk AI system is being used.", "Maintain logs of the high-risk AI system.", "Ensure human oversight of the high-risk AI system." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "enacted, not yet in force, from 2027-12-02", "as_of_date": "2026-08-12", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [ "disclosure" ] }, "applies_to": "government", "stale": false, "effective_date": "2027-12-02", "in_force": { "state": "not_yet_in_force", "dated": true, "from": "2027-12-02", "until": null, "reason": null, "days": 409, "countdown": "in 13 months", "stage": null, "words": "not yet in force, from 2027-12-02, in 13 months", "as_of": "2026-10-19" }, "status": "enacted", "lifecycle": { "band": "imminent", "label": "IMMINENT", "tone": "live", "detail": "in force in 409 days", "commencement_established": true }, "certainty": { "resultset": "forward", "rung": 1, "label": "enacted, commencement dated", "prediction": "none", "detail": "in force 2027-12-02, so nothing here is predicted" } }, { "id": "de:regulation-eu-2024-1689-arts-5-50-directly-applicable-in-ger", "kind": "obligation", "severity": "warn", "jurisdiction": "de", "jurisdiction_name": "Germany", "jurisdiction_flag": "🇩🇪", "summary": "EU Artificial Intelligence Act — Articles 5 and 50 (Prohibited Practices; Bot Disclosure and Synthetic-Content Labeling): The EU AI Act is directly applicable in Germany without requiring transposition.", "detail": "The EU AI Act is directly applicable in Germany without requiring transposition. Article 5 prohibitions became effective 2 February 2025. Article 50 requires deployers of AI chatbots and voice agents to inform users they are interacting with AI, and requires generative-AI providers to mark outputs as artificially generated in machine-readable form; both became enforceable 2 August 2026, unaffected by the Digital Omnibus's Annex III/I deferrals. The Bundesnetzagentur, formally designated under the now-enacted KI-MIG, is Germany's central market surveillance and complaints authority for these obligations from that date.", "citation": "Regulation (EU) 2024/1689, Arts. 5, 50 — directly applicable in Germany as EU Member State", "url": "https://eur-lex.europa.eu/eli/reg/2024/1689/oj/eng", "note_url": null, "requires": [ "Tell users they are interacting with an AI chatbot or voice agent.", "Mark generative AI outputs as artificially generated in machine-readable form." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "enacted and in force", "as_of_date": "2026-08-12", "confidence": "high", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [ "disclosure" ] }, "applies_to": "both", "stale": false, "effective_date": "2026-08-02", "in_force": { "state": "in_force", "dated": true, "from": "2026-08-02", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2026-08-02", "as_of": "2026-10-19" }, "status": "enacted", "lifecycle": { "band": "new", "label": "NEW", "tone": "force", "detail": "in force 78 days", "commencement_established": true }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2026-08-02" } }, { "id": "de:soft-law", "kind": "coverage", "severity": "info", "jurisdiction": "de", "jurisdiction_name": "Germany", "jurisdiction_flag": "🇩🇪", "summary": "1 matched record(s) are policy or guidance, not law: Federal Ministry of the Interior Guidelines for AI Use in the Federal Administration (Leitlinien Künstliche Intelligenz in der Bundesverwaltung). They bind nobody on their own, so they are not findings; read them as context.", "citation": null, "as_of_date": "2026-09-22", "confidence": "high", "stale": false }, { "id": "de:public-sector-undeclared", "kind": "coverage", "severity": "info", "jurisdiction": "de", "jurisdiction_name": "Germany", "jurisdiction_flag": "🇩🇪", "summary": "1 finding(s) below carry duties that bind only public bodies. Nobody said whether a public body runs this software or buys it, so those duties are shown as yours. Ask, and send public_sector (body, supplier or none) to route them.", "citation": null, "as_of_date": "2026-09-22", "confidence": "high", "stale": false }, { "id": "gb:consumer-rights-act-2015-c-15-s-46", "kind": "obligation", "severity": "warn", "jurisdiction": "gb", "jurisdiction_name": "United Kingdom", "jurisdiction_flag": "🇬🇧", "summary": "Consumer Rights Act 2015, section 46, remedy for damage that digital content causes to a consumer's device or other digital content: If the consumer requires a remedy, a trader that supplied digital content to a consumer under a contract must either repair the damage the digital content causes to the consumer's device or to other digital content that belongs to the consumer, or compensate the consumer with an appropriate payment, where the damage is of a kind that would not have occurred if the trader had exercised reasonable care and skill.", "detail": "If the consumer requires a remedy, a trader that supplied digital content to a consumer under a contract must either repair the damage the digital content causes to the consumer's device or to other digital content that belongs to the consumer, or compensate the consumer with an appropriate payment, where the damage is of a kind that would not have occurred if the trader had exercised reasonable care and skill. Digital content means data which are produced and supplied in digital form. A consumer is an individual acting for purposes that are wholly or mainly outside that individual's trade, business, craft or profession. A trader is a person acting for purposes relating to that person's trade, business, craft or profession. To repair, the trader must repair the damage within a reasonable time and without significant inconvenience to the consumer, and bear the necessary costs of repair. A compensation payment must be made without undue delay, and in any event within 14 days beginning with the day on which the trader agrees that the consumer is entitled to it. A consumer with a right to a remedy may bring a claim in civil proceedings to enforce it. The Limitation Act 1980 applies to the claim as if it were an action founded on simple contract. Business includes the activities of any government department or local or public authority. Section 46 has been in force since October 1, 2015.", "citation": "Consumer Rights Act 2015, c. 15, s. 46", "url": "https://www.legislation.gov.uk/ukpga/2015/15/section/46", "note_url": "https://lexlint.io/l/gb-consumer-rights-2015-c-15-s-46", "requires": [ "This binds a trader that supplies digital content to a consumer under a contract; a trader acts for purposes relating to its trade, business, craft or profession, and a consumer is an individual acting wholly or mainly outside them (sections 2(2), 2(3) and 46(1)).", "If your digital content damages the consumer's device or other digital content, and the damage would not have occurred had you exercised reasonable care and skill, repair the damage within a reasonable time and without significant inconvenience to the consumer, bearing the necessary costs, or compensate the consumer with an appropriate payment (section 46(1) to (3)).", "Pay any compensation without undue delay and within 14 days of agreeing that the consumer is entitled to it, and charge the consumer no fee for the payment (section 46(5) and (6))." ], "why": "Pulled in because the app deploys a chatbot and keeps or monitors what users type in a chat, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-10-12", "confidence": "medium", "matched_by": { "activities": [ "deploys_chatbot", "records_text_chat" ], "flags": [ "deploys_chatbot", "records_text_chat" ], "categories": [] }, "applies_to": "both", "stale": false, "effective_date": "2015-10-01", "in_force": { "state": "in_force", "dated": true, "from": "2015-10-01", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2015-10-01", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2015-10-01", "commencement_established": true }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2015-10-01" } }, { "id": "gb:council-of-europe-framework-convention-on-artificial-intelli", "kind": "pending", "severity": "info", "jurisdiction": "gb", "jurisdiction_name": "United Kingdom", "jurisdiction_flag": "🇬🇧", "summary": "Council of Europe Framework Convention on Artificial Intelligence, signed by the United Kingdom: The Council of Europe Treaty Office's chart of signatures and ratifications records the United Kingdom's signature on 5 September 2024, the day the Convention opened for signature, and no ratification by the United Kingdom.", "detail": "The Council of Europe Treaty Office's chart of signatures and ratifications records the United Kingdom's signature on 5 September 2024, the day the Convention opened for signature, and no ratification by the United Kingdom. The only ratification the chart records, as of its status date of 12 September 2026, is the European Union's, on 15 May 2026. Under Article 30(3) the Convention enters into force on the first day of the month following three months after five signatories, including at least three Council of Europe member states, have expressed their consent to be bound by it. The Convention requires each Party to adopt measures that keep activities within the lifecycle of an artificial intelligence system consistent with human dignity, equality and non-discrimination, privacy, transparency and accountability, including carrying out iterative risk and impact assessments on human rights, democracy and the rule of law and establishing prevention and mitigation measures. It covers use of an AI system by a public authority, including a private actor acting on the authority's behalf, and by a private actor generally, and it requires each Party to seek to ensure, as appropriate for the context, that persons interacting with an AI system are notified that they are interacting with such a system rather than with a human being, and to adopt or maintain measures for accessible and effective remedies, as far as its international obligations require and its domestic legal system allows, including measures to ensure that information about an AI system is sufficient for affected persons to contest a decision made or substantially informed by its use.", "citation": "Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law, Council of Europe Treaty Series No. 225, opened for signature 5 September 2024; signed by the United Kingdom, not yet ratified", "url": "https://www.coe.int/en/web/artificial-intelligence/the-framework-convention-on-artificial-intelligence", "note_url": "https://lexlint.io/l/gb-council-europe-framework-convention-artificia", "requires": [ "Each Party to the Convention must adopt or maintain measures for the identification, assessment, prevention and mitigation of risks posed by artificial intelligence systems, considering their actual and potential impacts on human rights, democracy and the rule of law (Article 16(1)).", "Each Party must seek to ensure, as appropriate for the context, that persons interacting with an AI system are notified that they are interacting with such a system rather than with a human, and must adopt or maintain measures for accessible and effective remedies, as far as its international obligations require and its domestic legal system allows, including measures to ensure that information about an AI system is sufficient for affected persons to contest a decision made or substantially informed by its use." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "not law yet (status \"proposed\")", "as_of_date": "2026-09-12", "confidence": "medium", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "both", "stale": false, "effective_date": null, "in_force": { "state": "proposed", "dated": false, "from": null, "until": null, "reason": null, "days": null, "countdown": null, "stage": "signed, with consent not yet expressed", "words": "proposed, signed, with consent not yet expressed", "as_of": "2026-10-19" }, "status": "proposed", "lifecycle": { "band": "proposed", "label": "PROPOSED", "tone": "pending", "detail": "draft date not recorded", "commencement_established": false }, "certainty": { "resultset": "forward", "rung": 3, "label": "passed a chamber or enrolled", "prediction": "the remainder", "detail": "signed, with consent not yet expressed, on the print published 2025-04-30" } }, { "id": "gb:crime-and-policing-act-2026-c-20-ss-248-249-inserting-s-216a", "kind": "obligation", "severity": "warn", "jurisdiction": "gb", "jurisdiction_name": "United Kingdom", "jurisdiction_flag": "🇬🇧", "summary": "Power to Amend the Online Safety Act 2023 for Illegal AI-Generated Content (New Section 216A), with Progress Report Duty: Section 248 of the Crime and Policing Act 2026 inserts section 216A into the Online Safety Act 2023, and the section came into force at Royal Assent.", "detail": "Section 248 of the Crime and Policing Act 2026 inserts section 216A into the Online Safety Act 2023, and the section came into force at Royal Assent. Section 249, which requires a progress report on regulations under section 216A, also came into force at Royal Assent. Royal Assent was given on 29 April 2026. Section 216A(1) lets the Secretary of State by regulations amend any provision of the Online Safety Act for or in connection with minimizing or mitigating the risks of harm to individuals in the United Kingdom presented by illegal AI-generated content and by the use of AI services for the commission or facilitation of priority offenses. In section 216A, 'AI' is short for artificial intelligence. An 'AI service' is an internet service that is capable, or part of which is capable, of generating AI-generated content, no matter what proportion of the content on the service is AI-generated. The regulations may impose on providers of AI services the duties that sections 9 and 10 of the Online Safety Act impose on providers of regulated user-to-user services, and those that sections 26 and 27 impose on providers of regulated search services, or duties corresponding or similar to them. The regulations may also impose on providers of AI services the fraudulent advertising duties of sections 38 and 39 and the requirement in section 66 to report child sexual exploitation and abuse content, or corresponding or similar requirements. The regulations may confer on Ofcom, in relation to AI services, functions corresponding to its fees, information and enforcement functions, including powers to impose monetary penalties. The regulations may make provision having the effect that AI services provided from outside the United Kingdom are regulated by the Act. The regulations may not amend section 234 of the Online Safety Act ('harm' etc). Section 249 requires the Secretary of State to lay before Parliament, no later than 31 December 2026, a report about the progress made towards making regulations under section 216A, unless a draft of a statutory instrument containing regulations under that section is laid before Parliament before that date.", "citation": "Crime and Policing Act 2026, c. 20, ss. 248-249, inserting s. 216A into the Online Safety Act 2023", "url": "https://www.legislation.gov.uk/ukpga/2026/20/section/248", "note_url": "https://lexlint.io/l/gb-crime-policing-2026-c-20-ss-248-249-inserting", "requires": [ "This provision lets the Secretary of State make regulations and imposes no duty on an app or organization by itself; duties on providers of AI services would arise only if regulations are made under section 216A of the Online Safety Act 2023.", "If regulations are made, they may impose on providers of AI services, meaning internet services capable of generating AI-generated content, duties like those on regulated user-to-user and search services in sections 9, 10, 26 and 27 of the Online Safety Act 2023 in relation to illegal AI-generated content and the use of AI services to commit or facilitate priority offenses.", "If regulations are made, they may extend to AI services provided from outside the United Kingdom.", "The Secretary of State must lay a progress report on regulations under section 216A before Parliament by 31 December 2026, unless a draft instrument containing such regulations is laid before then." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-10-07", "confidence": "medium", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "government", "stale": false, "effective_date": "2026-04-29", "in_force": { "state": "in_force", "dated": true, "from": "2026-04-29", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2026-04-29", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "recent", "label": "RECENT", "tone": "live", "detail": "in force 6 months", "commencement_established": true }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2026-04-29" } }, { "id": "gb:data-protection-act-2018-c-12-uk-gdpr-as-amended-by-the-data", "kind": "obligation", "severity": "warn", "jurisdiction": "gb", "jurisdiction_name": "United Kingdom", "jurisdiction_flag": "🇬🇧", "summary": "UK GDPR and Data Protection Act 2018, as Amended by the Data (Use and Access) Act 2025: The UK retained a copy of the GDPR at Brexit (UK GDPR) alongside the Data Protection Act 2018 (DPA 2018), but that copy has now materially diverged: the Data (Use and Access) Act 2025 (DUA Act, Royal Assent 19 June 2025), whose main data protection reforms took effect 5 February 2026, added a new closed-list \"recognised legitimate interests\" lawful basis (Article 6(1)(ea)) needing no balancing test, whose Annex 1 conditions cover disclosure for a public-task purpose under Article 6(1)(e), national security, public security and defence, emergencies, detecting, investigating or preventing crime, and safeguarding a vulnerable individual.", "detail": "The UK retained a copy of the GDPR at Brexit (UK GDPR) alongside the Data Protection Act 2018 (DPA 2018), but that copy has now materially diverged: the Data (Use and Access) Act 2025 (DUA Act, Royal Assent 19 June 2025), whose main data protection reforms took effect 5 February 2026, added a new closed-list \"recognised legitimate interests\" lawful basis (Article 6(1)(ea)) needing no balancing test, whose Annex 1 conditions cover disclosure for a public-task purpose under Article 6(1)(e), national security, public security and defence, emergencies, detecting, investigating or preventing crime, and safeguarding a vulnerable individual. Direct marketing and intra-group administrative sharing remain examples of the pre-existing Article 6(1)(f) legitimate-interests basis, not purposes of the new closed list. This basis is unavailable to a public authority exercising its own core functions, and has no equivalent in the EU GDPR Article 6 list.", "citation": "Data Protection Act 2018 (c. 12); UK GDPR, as amended by the Data (Use and Access) Act 2025, c. 18", "url": "https://www.legislation.gov.uk/ukpga/2025/18", "note_url": "https://lexlint.io/l/gb-data-protection-2018-c-12-uk-gdpr-as-amended", "requires": [ "Establish and document a lawful basis under UK GDPR Article 6 before processing any personal data of a person in the United Kingdom, including the new closed-list recognised legitimate interests basis where it applies.", "Do not rely on the recognised legitimate interests basis if you are a public authority exercising your own core functions; a necessity test still applies even though no balancing test is required." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-08-24", "confidence": "medium", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "both", "stale": false, "effective_date": "2018-05-25", "in_force": { "state": "in_force", "dated": true, "from": "2018-05-25", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2018-05-25", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2018-05-25", "commencement_established": true }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2018-05-25" } }, { "id": "gb:investigatory-powers-act-2016-ss-3-8-44-and-46-s-i-2018-356", "kind": "obligation", "severity": "warn", "jurisdiction": "gb", "jurisdiction_name": "United Kingdom", "jurisdiction_flag": "🇬🇧", "summary": "Investigatory Powers Act 2016, Unlawful Interception and Lawful Business Monitoring: Section 3 makes it a criminal offence to intentionally intercept a communication in the course of its transmission by a public or private telecommunication system or a public postal service in the United Kingdom without lawful authority, though a private system's own controller, or someone with that person's express or implied consent, does not commit this offence by intercepting on it.", "detail": "Section 3 makes it a criminal offence to intentionally intercept a communication in the course of its transmission by a public or private telecommunication system or a public postal service in the United Kingdom without lawful authority, though a private system's own controller, or someone with that person's express or implied consent, does not commit this offence by intercepting on it. Under section 4 a person intercepts a communication only if the effect of what they do is to make its content available to a person who is not its sender or intended recipient, so a party who records a call for their own use is outside the offence. Section 44 gives lawful authority to intercept where both the sender and the intended recipient have consented, or where one of them has consented and surveillance by that interception is separately authorised under Part 2 of the Regulation of Investigatory Powers Act 2000. Section 46, read with the Investigatory Powers (Interception by Businesses etc. for Monitoring and Record-keeping Purposes) Regulations 2018, gives lawful authority to a business, government department, public authority, or other body exercising a statutory function to intercept its own communications for a listed purpose, such as establishing facts, checking regulatory compliance, or securing the system's effective operation, on conditions including that the body has made all reasonable efforts to inform every person who may use the system that their communications may be intercepted. Section 8 gives the sender or the intended recipient of a communication a civil claim against a private telecommunication system's own controller who intercepts it without lawful authority. The Regulation of Investigatory Powers Act 2000's own interception offence and civil-liability provisions were repealed in stages during 2018 as this Act's provisions came into force.", "citation": "Investigatory Powers Act 2016, ss. 3, 8, 44 and 46; S.I. 2018/356", "url": "https://www.legislation.gov.uk/ukpga/2016/25/section/3", "note_url": "https://lexlint.io/l/gb-investigatory-powers-2016-ss-3-8-44-46-s-i-20", "requires": [ "Do not intentionally intercept, or procure another person to intercept, a communication in the course of its transmission by a telecommunication system or a public postal service in the United Kingdom unless you have lawful authority to do so.", "Before you make the content of a call or message available to anyone who is neither its sender nor its intended recipient, a recording, transcription or monitoring vendor included, get the consent of both the sender and the intended recipient or rely on the business-monitoring authority below; recording a call you are a party to, for your own use, is not interception.", "If you are a business, a government department, a public authority, or another body exercising a statutory function, you may record or monitor communications on your own telecommunication system for a listed legitimate purpose, such as establishing facts, checking compliance with regulatory standards, or securing the system's own effective operation, if you have made all reasonable efforts to tell every person who may use the system that their communications on it may be intercepted.", "If you control a private telecommunication system, do not intercept communications on it without lawful authority: the criminal offence excludes you, but the sender or the intended recipient can sue you for it." ], "why": "Pulled in because the app keeps or monitors what users type in a chat, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-09-25", "confidence": "medium", "matched_by": { "activities": [ "records_text_chat" ], "flags": [ "records_text_chat" ], "categories": [] }, "applies_to": "both", "stale": false, "effective_date": "2018-06-27", "in_force": { "state": "in_force", "dated": true, "from": "2018-06-27", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2018-06-27", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2018-06-27", "commencement_established": true }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2018-06-27" } }, { "id": "gb:online-safety-act-2023-c-50", "kind": "obligation", "severity": "warn", "jurisdiction": "gb", "jurisdiction_name": "United Kingdom", "jurisdiction_flag": "🇬🇧", "summary": "Online Safety Act 2023 — AI-generated and deepfake content: The Online Safety Act 2023 requires the provider of a regulated user-to-user service with links to the United Kingdom to assess the risk of illegal content on the service, to use proportionate measures to prevent users encountering priority illegal content, and to take illegal content down swiftly once alerted to it, duties in force since 10 January 2024.", "detail": "The Online Safety Act 2023 requires the provider of a regulated user-to-user service with links to the United Kingdom to assess the risk of illegal content on the service, to use proportionate measures to prevent users encountering priority illegal content, and to take illegal content down swiftly once alerted to it, duties in force since 10 January 2024. Section 188 of the Act inserted into the Sexual Offences Act 2003 the offence of sharing, or threatening to share, an intimate photograph or film of a person without consent, in force since 31 January 2024, and for that offence a photograph or film includes an image made or altered by computer graphics or in any other way that appears to be one, which reaches an AI-generated intimate image. Sharing an intimate image without consent is priority illegal content, and since 29 June 2026 creating or requesting a purported intimate image of an adult, offences the Data (Use and Access) Act 2025 created, are priority offences too. Since 29 June 2026 a user-to-user service must also take down reported intimate image content, including an AI-generated intimate image, no later than 48 hours after a report by the person it shows or someone acting on their behalf. Before making any significant change to the service's design or operation, the provider must carry out a further illegal content risk assessment.", "citation": "Online Safety Act 2023, c. 50", "url": "https://www.legislation.gov.uk/ukpga/2023/50", "note_url": null, "requires": [ "If you run a user-to-user service with links to the United Kingdom, assess the risk of illegal content, use proportionate measures to prevent users encountering priority illegal content, and take illegal content down swiftly once alerted to it.", "Do not share, or threaten to share, an intimate photograph or film of a person without their consent, including an AI-generated one.", "Take down reported intimate image content, including an AI-generated intimate image, no later than 48 hours after a report by the person it shows or someone acting on their behalf.", "Carry out a further illegal content risk assessment before making any significant change to the service's design or operation." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "enacted and in force", "as_of_date": "2026-08-12", "confidence": "medium", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [ "disclosure" ] }, "applies_to": "private", "stale": false, "effective_date": "2024-01-10", "in_force": { "state": "in_force", "dated": true, "from": "2024-01-10", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2024-01-10", "as_of": "2026-10-19" }, "status": "enacted", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2024-01-10", "commencement_established": true }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2024-01-10" } }, { "id": "gb:uk-gdpr-arts-33-34-privacy-and-electronic-communications-reg", "kind": "obligation", "severity": "warn", "jurisdiction": "gb", "jurisdiction_name": "United Kingdom", "jurisdiction_flag": "🇬🇧", "summary": "UK GDPR Articles 33-34 and PECR, Breach Notification in the United Kingdom: UK GDPR Articles 33 and 34 retain the same 72-hour and without-undue-delay structure as EU GDPR, with no threshold for how serious a breach must be before it is notifiable.", "detail": "UK GDPR Articles 33 and 34 retain the same 72-hour and without-undue-delay structure as EU GDPR, with no threshold for how serious a breach must be before it is notifiable. The DUA Act lengthened the separate PECR breach-notification window for telecoms and ISP-type breaches from 24 hours to 72 hours where feasible, in force 20 August 2025, aligning it with the UK GDPR timeline. From 5 February 2026 it also raised the maximum penalty for most PECR contraventions to GBP 17.5 million or 4 percent of worldwide turnover, up from GBP 500,000, but a failure to notify a PECR breach under regulation 5A is excluded from that penalty-notice power.", "citation": "UK GDPR, Arts. 33-34; Privacy and Electronic Communications Regulations (PECR), as amended by the Data (Use and Access) Act 2025", "url": "https://www.legislation.gov.uk/eur/2016/679/article/33", "note_url": "https://lexlint.io/l/gb-uk-gdpr-33-34-privacy-electronic-communicatio", "requires": [ "Notify the Information Commission without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in the United Kingdom, unless the breach is unlikely to risk their rights and freedoms.", "Notify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms, and if you are a telecoms or ISP-type provider, notify a PECR breach to the Information Commission within 72 hours." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-08-24", "confidence": "medium", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "both", "stale": false, "effective_date": "2018-05-25", "in_force": { "state": "in_force", "dated": true, "from": "2018-05-25", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2018-05-25", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2018-05-25", "commencement_established": true }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2018-05-25" } }, { "id": "gb:uk-gdpr-arts-44a-50-as-amended-by-the-data-use-and-access-ac", "kind": "obligation", "severity": "warn", "jurisdiction": "gb", "jurisdiction_name": "United Kingdom", "jurisdiction_flag": "🇬🇧", "summary": "UK GDPR Articles 44A-50, Cross-Border Transfer of Personal Data from the United Kingdom: The European Commission's own adequacy decisions for the UK were renewed 18 December 2025 and now run to 27 December 2031.", "detail": "The European Commission's own adequacy decisions for the UK were renewed 18 December 2025 and now run to 27 December 2031. For UK-outbound transfers, the International Data Transfer Agreement (IDTA) and the IDTA Addendum, both issued by the ICO, are standard data protection clauses a transfer can rely on as its appropriate safeguard where no UK adequacy regulation covers the destination. The Information Commission took over the Information Commissioner's functions on 30 September 2026. The DUA Act restructured UK GDPR's transfer chapter: the original Article 44 was omitted and replaced from 5 February 2026 by a new Article 44A, which requires that a transfer either be approved by regulations, made subject to appropriate safeguards, or made in reliance on a derogation for specific situations, the same three-track adequacy, safeguards, or derogation structure as EU GDPR Chapter V, run through the UK's own instruments rather than the EU's. This is a real, structured condition on outbound transfer, not an absence of restriction.", "citation": "UK GDPR, Arts. 44A-50, as amended by the Data (Use and Access) Act 2025", "url": "https://www.legislation.gov.uk/eur/2016/679/article/44A", "note_url": "https://lexlint.io/l/gb-uk-gdpr-44a-50-as-amended-by-data-use-access", "requires": [ "Before moving personal data of a person in the United Kingdom outside the UK, either rely on a UK adequacy regulation, put appropriate safeguards in place such as the ICO's International Data Transfer Agreement or Addendum, or rely on a narrow Article 49 derogation, under UK GDPR Article 44A." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-08-24", "confidence": "medium", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "both", "stale": false, "effective_date": "2026-02-05", "in_force": { "state": "in_force", "dated": true, "from": "2018-05-25", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2018-05-25", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2018-05-25", "commencement_established": true }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2018-05-25" } }, { "id": "gb:uk-gdpr-arts-82-83-data-protection-act-2018-169", "kind": "obligation", "severity": "warn", "jurisdiction": "gb", "jurisdiction_name": "United Kingdom", "jurisdiction_flag": "🇬🇧", "summary": "UK GDPR Article 82, Data Protection Act 2018 Section 169, and Information Commission Enforcement: The Information Commission is the UK's single supervisory authority, unlike Germany's 17-authority structure, with UK GDPR Article 83 fines up to the greater of GBP 17.5 million or 4 percent of global turnover.", "detail": "The Information Commission is the UK's single supervisory authority, unlike Germany's 17-authority structure, with UK GDPR Article 83 fines up to the greater of GBP 17.5 million or 4 percent of global turnover. The Information Commission took over the Information Commissioner's functions on 30 September 2026. Section 169 DPA 2018 supplies a private right of action for contravention of data protection legislation other than UK GDPR itself, while UK GDPR's own Article 82 covers contraventions of the Regulation directly; both cover material and non-material damage. The UK's own Supreme Court has gone further than the CJEU in limiting what counts: Lloyd v Google LLC [2021] UKSC 50 (10 November 2021) unanimously rejected a representative claim brought on behalf of 4.4 million iPhone users, holding that compensation for a non-trivial data protection breach requires the individual to show tangible financial loss or distress, not a bare loss of control alone, and that such a claim cannot succeed without showing unlawful use and resulting damage for each individual claimant rather than the group as a whole.", "citation": "UK GDPR, Arts. 82-83; Data Protection Act 2018 §169", "url": "https://www.legislation.gov.uk/eur/2016/679/article/82", "note_url": "https://lexlint.io/l/gb-uk-gdpr-82-83-data-protection-2018-169", "requires": [ "Expect the Information Commission to have jurisdiction and fining power, up to the higher of GBP 17,500,000 or 4 percent of global annual turnover, over your processing of personal data of a person in the United Kingdom.", "Expect any person who suffered material or non-material damage from an infringement to have a direct right to claim compensation from you as controller or processor, under UK GDPR Article 82, but expect a UK representative claim to require proof of unlawful use and resulting damage for each individual claimant, not a bare loss-of-control theory, per Lloyd v Google." ], "why": "Pulled in because the app deploys a chatbot, and the law library tags this instrument for exactly that.", "basis": "in_effect and in force", "as_of_date": "2026-08-24", "confidence": "medium", "matched_by": { "activities": [ "deploys_chatbot" ], "flags": [ "deploys_chatbot" ], "categories": [] }, "applies_to": "both", "stale": false, "effective_date": "2018-05-25", "in_force": { "state": "in_force", "dated": true, "from": "2018-05-25", "until": null, "reason": null, "days": null, "countdown": null, "stage": null, "words": "in force since 2018-05-25", "as_of": "2026-10-19" }, "status": "in_effect", "lifecycle": { "band": "in_force", "label": "IN FORCE", "tone": "live", "detail": "in force since 2018-05-25", "commencement_established": true }, "certainty": { "resultset": "present", "rung": null, "label": null, "prediction": null, "detail": "in force since 2018-05-25" } }, { "id": "gb:public-sector-undeclared", "kind": "coverage", "severity": "info", "jurisdiction": "gb", "jurisdiction_name": "United Kingdom", "jurisdiction_flag": "🇬🇧", "summary": "2 finding(s) below carry duties that bind only public bodies. Nobody said whether a public body runs this software or buys it, so those duties are shown as yours. Ask, and send public_sector (body, supplier or none) to route them.", "citation": null, "as_of_date": "2026-10-17", "confidence": "medium", "stale": false } ] }