{
 "name": "Hidden legal duties that require provable AI records",
 "wording_rule": "The law is the authority. Each entry states what the law itself demands and links the official text. Evidence tools are listed as ways to satisfy a duty; no law requires any particular vendor.",
 "duties": [
  {
   "id": "gdpr-5-2",
   "name": "GDPR accountability: be able to demonstrate",
   "jurisdiction": "EU and UK",
   "reference": "Article 5(2)",
   "official_source": "https://eur-lex.europa.eu/eli/reg/2016/679/oj",
   "applies_from": "2018",
   "what_the_law_demands": "The controller is responsible for, and must be able to demonstrate, compliance with every data protection principle.",
   "why_records_are_needed": "Compliance you cannot demonstrate does not count. The burden is on you, not the regulator.",
   "page": "https://sebbi.pro/hidden-laws#gdpr-5-2",
   "evidence": [
    "https://sebbi.pro/checks/gdpr",
    "https://sebbi.pro/connect",
    "https://sebbi.pro/forever"
   ]
  },
  {
   "id": "schufa",
   "name": "SCHUFA: a score can be the decision",
   "jurisdiction": "EU",
   "reference": "CJEU C-634/21, 7 December 2023",
   "official_source": "https://curia.europa.eu/juris/liste.jsf?num=C-634/21",
   "applies_from": "2023",
   "what_the_law_demands": "Producing a score is itself an automated decision under GDPR Article 22 when a third party draws strongly on it to grant, refuse or set terms.",
   "why_records_are_needed": "Anyone who scores people for others is caught by the automated-decision rules, and needs a record of every score and its basis.",
   "page": "https://sebbi.pro/hidden-laws#schufa",
   "evidence": [
    "https://sebbi.pro/checks/gdpr",
    "https://sebbi.pro/dossier",
    "https://sebbi.pro/credit-ai"
   ]
  },
  {
   "id": "dun-bradstreet",
   "name": "Dun & Bradstreet Austria: explain what was actually done",
   "jurisdiction": "EU",
   "reference": "CJEU C-203/22, 27 February 2025",
   "official_source": "https://curia.europa.eu/juris/liste.jsf?num=C-203/22",
   "applies_from": "2025",
   "what_the_law_demands": "The right of access requires a concise, intelligible explanation of the procedure and principles actually applied to the person's data to reach the decision. Handing over a formula is not enough; trade secrets are weighed by the court or authority, not used as a blanket refusal.",
   "why_records_are_needed": "You must be able to reconstruct each individual decision, after the event, in plain language.",
   "page": "https://sebbi.pro/hidden-laws#dun-bradstreet",
   "evidence": [
    "https://sebbi.pro/dossier",
    "https://sebbi.pro/checks/gdpr",
    "https://sebbi.pro/ai-act/article-86"
   ]
  },
  {
   "id": "bridges",
   "name": "Bridges: unchecked bias made facial recognition unlawful",
   "jurisdiction": "England and Wales",
   "reference": "R (Bridges) v Chief Constable of South Wales Police [2020] EWCA Civ 1058",
   "official_source": "https://www.bailii.org/ew/cases/EWCA/Civ/2020/1058.html",
   "applies_from": "2020",
   "what_the_law_demands": "Use of live facial recognition was unlawful, in part because the force had not done enough to satisfy itself the software was not biased, as the Public Sector Equality Duty requires.",
   "why_records_are_needed": "A public body using AI must be able to show it checked the system for bias before and during use.",
   "page": "https://sebbi.pro/hidden-laws#bridges",
   "evidence": [
    "https://sebbi.pro/checks/eu-ai-act",
    "https://sebbi.pro/oversight-keys",
    "https://sebbi.pro/ai-act/article-14"
   ]
  },
  {
   "id": "psed",
   "name": "Public Sector Equality Duty",
   "jurisdiction": "Great Britain",
   "reference": "Equality Act 2010, s.149",
   "official_source": "https://www.legislation.gov.uk/ukpga/2010/15/section/149",
   "applies_from": "2011",
   "what_the_law_demands": "Public authorities, and anyone exercising public functions, must have due regard to eliminating discrimination and advancing equality of opportunity.",
   "why_records_are_needed": "Due regard has to be shown, at the time, before a decision. A record made afterwards does not satisfy it.",
   "page": "https://sebbi.pro/hidden-laws#psed",
   "evidence": [
    "https://sebbi.pro/checks/ai-liability-and-damages",
    "https://sebbi.pro/oversight-keys",
    "https://sebbi.pro/forever"
   ]
  },
  {
   "id": "atrs",
   "name": "Algorithmic Transparency Recording Standard",
   "jurisdiction": "UK central government",
   "reference": "ATRS mandatory scope and exemptions policy",
   "official_source": "https://www.gov.uk/government/publications/algorithmic-transparency-recording-standard-mandatory-scope-and-exemptions-policy/algorithmic-transparency-recording-standard-atrs-mandatory-scope-and-exemptions-policy",
   "applies_from": "2024",
   "what_the_law_demands": "Central government organisations must publish a record for each algorithmic tool that significantly influences decisions with public effect or interacts directly with the public.",
   "why_records_are_needed": "Suppliers to government need records their customers can publish.",
   "page": "https://sebbi.pro/hidden-laws#atrs",
   "evidence": [
    "https://sebbi.pro/ai-act",
    "https://sebbi.pro/law-graph.json",
    "https://sebbi.pro/connect"
   ]
  },
  {
   "id": "foia",
   "name": "Freedom of Information: AI records are disclosable",
   "jurisdiction": "UK",
   "reference": "Freedom of Information Act 2000",
   "official_source": "https://www.legislation.gov.uk/ukpga/2000/36",
   "applies_from": "2005",
   "what_the_law_demands": "Anyone can request information held by a public authority, which must answer within 20 working days unless an exemption applies.",
   "why_records_are_needed": "Records of how a public body's AI reached decisions can be requested by the public, so they need to exist and be reliable.",
   "page": "https://sebbi.pro/hidden-laws#foia",
   "evidence": [
    "https://sebbi.pro/connect",
    "https://sebbi.pro/dossier"
   ]
  },
  {
   "id": "data-act-36",
   "name": "Data Act: smart contracts need a kill switch and an archive",
   "jurisdiction": "EU",
   "reference": "Regulation (EU) 2023/2854, Article 36",
   "official_source": "https://eur-lex.europa.eu/eli/reg/2023/2854/oj",
   "applies_from": "12 September 2025",
   "what_the_law_demands": "Vendors of applications using smart contracts to execute data-sharing agreements must ensure robustness and access control, safe termination and interruption, archiving of transaction data, logic and code for an auditable record, and consistency with the agreement.",
   "why_records_are_needed": "Automated agents that execute agreements need a stop control and an auditable record of every transaction.",
   "page": "https://sebbi.pro/hidden-laws#data-act-36",
   "evidence": [
    "https://sebbi.pro/spend",
    "https://sebbi.pro/mandate",
    "https://sebbi.pro/plan-lock"
   ]
  },
  {
   "id": "eidas-41",
   "name": "eIDAS: electronic timestamps have legal effect",
   "jurisdiction": "EU",
   "reference": "Regulation (EU) No 910/2014 (as amended by 2024/1183), Article 41",
   "official_source": "https://eur-lex.europa.eu/eli/reg/2014/910/oj",
   "applies_from": "2016",
   "what_the_law_demands": "An electronic time stamp shall not be denied legal effect or admissibility as evidence solely because it is electronic or not qualified. Qualified time stamps enjoy a presumption of accurate date and time.",
   "why_records_are_needed": "A timestamp proving when a record existed is admissible evidence across the EU.",
   "page": "https://sebbi.pro/hidden-laws#eidas-41",
   "evidence": [
    "https://sebbi.pro/forever",
    "https://sebbi.pro/evidence",
    "https://sebbi.pro/uk-law"
   ]
  },
  {
   "id": "machinery",
   "name": "Machinery Regulation: self-evolving machines must record their safety decisions",
   "jurisdiction": "EU",
   "reference": "Regulation (EU) 2023/1230, Annex III",
   "official_source": "https://eur-lex.europa.eu/eli/reg/2023/1230/oj",
   "applies_from": "20 January 2027",
   "what_the_law_demands": "Machinery and safety components with fully or partially self-evolving behaviour must record data on the safety-related decision-making process, kept for a year, and log interventions and safety software versions.",
   "why_records_are_needed": "Robots and AI-driven machines need a tamper-proof decision log before they can carry a CE mark.",
   "page": "https://sebbi.pro/hidden-laws#machinery",
   "evidence": [
    "https://sebbi.pro/connect",
    "https://sebbi.pro/ai-act/annex-i",
    "https://sebbi.pro/forever"
   ]
  },
  {
   "id": "mifid-rts6",
   "name": "Algorithmic trading: records, kill switch and annual self-assessment",
   "jurisdiction": "EU",
   "reference": "MiFID II Article 17 and Delegated Regulation (EU) 2017/589 (RTS 6)",
   "official_source": "https://eur-lex.europa.eu/eli/reg_del/2017/589/oj",
   "applies_from": "2018",
   "what_the_law_demands": "Investment firms trading algorithmically must test algorithms, have kill functionality, monitor in real time, keep records and carry out an annual self-assessment.",
   "why_records_are_needed": "Every algorithmic order and control action needs a record a supervisor can check.",
   "page": "https://sebbi.pro/hidden-laws#mifid-rts6",
   "evidence": [
    "https://sebbi.pro/checks/fca",
    "https://sebbi.pro/spend",
    "https://sebbi.pro/connect"
   ]
  },
  {
   "id": "dsa-17",
   "name": "DSA statements of reasons, including automation",
   "jurisdiction": "EU",
   "reference": "Regulation (EU) 2022/2065, Articles 17 and 24(5)",
   "official_source": "https://eur-lex.europa.eu/eli/reg/2022/2065/oj",
   "applies_from": "17 February 2024",
   "what_the_law_demands": "Hosting services must give a clear statement of reasons for each restriction of content or accounts, including whether automated means were used, and online platforms submit these to the public DSA Transparency Database.",
   "why_records_are_needed": "Every automated moderation decision needs a record of what was decided, why, and whether a machine did it.",
   "page": "https://sebbi.pro/hidden-laws#dsa-17",
   "evidence": [
    "https://sebbi.pro/checks/digital-services-act",
    "https://sebbi.pro/dossier",
    "https://sebbi.pro/oversight-keys"
   ]
  },
  {
   "id": "p2b",
   "name": "Platform-to-Business: reasons and ranking",
   "jurisdiction": "EU",
   "reference": "Regulation (EU) 2019/1150, Articles 4 and 5",
   "official_source": "https://eur-lex.europa.eu/eli/reg/2019/1150/oj",
   "applies_from": "12 July 2020",
   "what_the_law_demands": "Online intermediation services must give business users a statement of reasons before restricting, suspending or terminating them, and set out the main parameters that determine ranking.",
   "why_records_are_needed": "Marketplaces and app stores need a record of each automated restriction and the ranking logic in force at the time.",
   "page": "https://sebbi.pro/hidden-laws#p2b",
   "evidence": [
    "https://sebbi.pro/dossier",
    "https://sebbi.pro/examiner",
    "https://sebbi.pro/connect"
   ]
  },
  {
   "id": "pay-transparency",
   "name": "Pay Transparency: the employer must prove no discrimination",
   "jurisdiction": "EU",
   "reference": "Directive (EU) 2023/970",
   "official_source": "https://eur-lex.europa.eu/eli/dir/2023/970/oj",
   "applies_from": "7 June 2026 (transposition)",
   "what_the_law_demands": "Pay structures must rest on objective, gender-neutral criteria; workers can request pay information; and where discrimination is presumed, the employer must prove there was none.",
   "why_records_are_needed": "AI used to set pay, grades or bonuses needs records showing the criteria applied to each decision.",
   "page": "https://sebbi.pro/hidden-laws#pay-transparency",
   "evidence": [
    "https://sebbi.pro/checks/ai-liability-and-damages",
    "https://sebbi.pro/oversight-keys",
    "https://sebbi.pro/platform-work"
   ]
  },
  {
   "id": "gpsr",
   "name": "General Product Safety Regulation",
   "jurisdiction": "EU",
   "reference": "Regulation (EU) 2023/988",
   "official_source": "https://eur-lex.europa.eu/eli/reg/2023/988/oj",
   "applies_from": "13 December 2024",
   "what_the_law_demands": "Products, including connected products with software features, must be safe; manufacturers keep technical documentation, handle complaints and notify accidents through the Safety Business Gateway.",
   "why_records_are_needed": "Software-driven products need a record of complaints, incidents and the version in use when something went wrong.",
   "page": "https://sebbi.pro/hidden-laws#gpsr",
   "evidence": [
    "https://sebbi.pro/incident",
    "https://sebbi.pro/checks/product-liability-directive",
    "https://sebbi.pro/pld"
   ]
  },
  {
   "id": "cra-14",
   "name": "Cyber Resilience Act: 24-hour exploited-vulnerability reports",
   "jurisdiction": "EU",
   "reference": "Regulation (EU) 2024/2847, Article 14",
   "official_source": "https://eur-lex.europa.eu/eli/reg/2024/2847/oj",
   "applies_from": "11 September 2026",
   "what_the_law_demands": "Manufacturers must notify actively exploited vulnerabilities and severe incidents with an early warning within 24 hours, a notification within 72 hours and a final report.",
   "why_records_are_needed": "You need provable timestamps of when you became aware and when you reported.",
   "page": "https://sebbi.pro/hidden-laws#cra-14",
   "evidence": [
    "https://sebbi.pro/incident",
    "https://sebbi.pro/checks/cyber-resilience-act",
    "https://sebbi.pro/forever"
   ]
  },
  {
   "id": "uk-adm",
   "name": "UK automated decision safeguards",
   "jurisdiction": "UK",
   "reference": "UK GDPR Articles 22A to 22D, inserted by the Data (Use and Access) Act 2025",
   "official_source": "https://www.legislation.gov.uk/ukpga/2025/18",
   "applies_from": "2025",
   "what_the_law_demands": "Significant decisions based solely on automated processing must come with safeguards: information about the decision, the ability to make representations, human intervention and the right to contest.",
   "why_records_are_needed": "Each automated decision needs a record of the decision, the information given and any human review.",
   "page": "https://sebbi.pro/hidden-laws#uk-adm",
   "evidence": [
    "https://sebbi.pro/oversight-keys",
    "https://sebbi.pro/dossier",
    "https://sebbi.pro/checks/gdpr"
   ]
  },
  {
   "id": "nyc-144",
   "name": "New York City bias audits",
   "jurisdiction": "New York City",
   "reference": "Local Law 144 of 2021",
   "official_source": "https://www.nyc.gov/site/dca/about/automated-employment-decision-tools.page",
   "applies_from": "5 July 2023",
   "what_the_law_demands": "Employers using automated employment decision tools must have an independent bias audit within the past year, publish its results and notify candidates.",
   "why_records_are_needed": "Hiring AI needs audited, dated evidence before use.",
   "page": "https://sebbi.pro/hidden-laws#nyc-144",
   "evidence": [
    "https://sebbi.pro/checks/us-state-ai-laws",
    "https://sebbi.pro/forever"
   ]
  }
 ]
}