Platform — Compliance
One workload is under several regimes at once.
A Singapore bank with European customers is under PDPA and GDPR and the AI Act simultaneously, possibly running on a Canadian host. One enum cannot express that, and the failure is silent: the platform believes the wrong law applies and produces a pack that is internally consistent and wrong.
Three things that are not the same
| What it is | Determined by | |
|---|---|---|
| Residency | Where the data physically sits | The deployment |
| Jurisdiction | Whose law applies — and it is plural | The workload |
| Profile | What the product presents: locale, currency, clause maps | Packaging |
A German bank on-premise and a German bank on a European cloud are under identical law and radically different network posture. A model with one dimension has to pretend one of those facts is the other.
Resolved per decision, narrowest wins
A market profile resolves in order: an override on the decision, then the agent's, then the workspace's, then the organisation's, then the deployment default. Whichever level supplied it is recorded beside the answer — because a profile set on a workspace and one inherited from an organisation have very different blast radii when somebody changes them.
Sealed into the decision
The resolved regime is sealed with the record, so a pack states which laws this deployment believed applied at the moment the decision was made — rather than which are configured today.
observed →Some capabilities are a control, not a preference
Inferring ethnicity from surname and geography is the CFPB's own published methodology for US fair-lending analysis and processes special-category data without a lawful basis under GDPR Art. 9. Same code path, required in one market and unlawful in another — so it resolves from the jurisdiction and is enforced server-side. Hiding a menu item leaves the capability one API call away.
observed →Scored against what your regime selects
Readiness counts only the instruments your profile names. The others are listed, scored for reference and marked unselected — because whether one of them applies to you is your determination and your counsel's, not something this platform decides by hiding it.
observed →When a regime starts a clock
EU AI Act Article 73 is the clearest: a serious incident must reach a market surveillance authority within 15 days, 10 where a death may have been caused, and 2 for widespread infringement or a serious and irreversible disruption of critical infrastructure.
- The class is yours
- Whether an event is a serious incident is a legal judgement about what happened in the world. The platform records who made it and computes the deadline that follows. Getting the class wrong is itself a breach, so it traces to a named person.
- The clock starts at awareness
- Article 73(2) counts from the moment the provider became aware, which is a fact about them. Starting at the event would report a deadline already blown on the day you found out.
- A report is a chain
- Article 73(5) permits an initial incomplete report with supplements to follow. Each revision names its predecessor and is hashed over its own content, so supplementing does not look like changing your story — and the fear of that is what makes providers file late.
The limit, stated plainly. Rotascale does not determine whether anyone is compliant with anything. The platform assembles evidence, maps it to clauses, computes what it can and says what it could not find. Whether that evidence satisfies your obligations is a question of regulatory interpretation, and the responsibility rests with you and your counsel. That disclaimer sits inside the signed payload of every pack, so removing it invalidates the signature.