How CID222 maps a detection onto GDPR, the EU AI Act, HIPAA and six other frameworks — what that mapping evidences, and what it does not.

CID222 counts what its detectors found and attributes each finding to the regulation articles it touches. That is a factual record of detections, not an assessment of your compliance.

The problem

An organisation is not audited on "we detect personal data". It is audited on an article — GDPR Art. 32, EU AI Act Art. 26(6) — and asked what evidence it holds. A gateway that reports detection counts by entity type answers a question nobody asked. A gateway that reports a compliance percentage answers a question it cannot honestly answer at all: it does not know your DPIA, your records of processing, or your human-oversight procedure.

How CID222 does it

What ships

Nine frameworks are seeded into the database from files that ride the product image: GDPR, HIPAA, the EU AI Act, KVKK, NIS2, BDDK, DORA, ISO/IEC 42001 and ISO/IEC 27001. With them come 56 articles and 39 entity-to-regulation mappings.

The mapping is the join: a detection of an entity type reaches a regulation, and through it the specific articles that entity type engages. Seeding runs on every boot, so an image update carries corrected facts onto an existing appliance and reconciles rows that disappeared from the source — without touching an administrator's own overrides.

Every fine structure carries its provenance: the statutory basis, the source, and the date the amounts were verified. The regulation card prints it, so staleness is visible rather than silent.

What is evidence, and what is not

This is the distinction the whole feature rests on.

Layer	Claim	Status
Counting and attribution	"N detections were logged in this period and map to this regulation"	Deterministic. Recomputable from the database through an independent code path.
Detection truth	"each of those N is a genuine violation"	Probabilistic for the ML detectors. Checksum-backed identifiers behave close to deterministically; free-text entities carry measured precision, not certainty.
Legal facts	"the articles and fine amounts shown match the real law"	Vendor-supplied, dated, and drifts. Verified against primary sources on a stated date and re-verified on named triggers.
Your compliance	"this organisation complies with GDPR"	Not claimed, and not computed. No score exists.

Warning

A detection counts toward every regulation its entity type maps to. A jailbreak counts under the EU AI Act, ISO 42001 and NIS2 at once, so per-regulation counts deliberately sum to more than the total number of detections. Reading them as a partition produces a number that is wrong by construction.

Monetary figures

Two different numbers appear, and they are labelled differently on purpose.

Statutory ceiling — the regulation's legal maximum. Constant, and therefore says nothing about your period.
Expected exposure — a saturation curve over observed volume: cap × (1 − 0.5^(detections / 50)). Zero detections give zero. Fifty give about half the cap; 350 give about 99% of it. It never reaches the cap.

Both are indicative projections. Neither is an actuarial or legal estimate, and the dashboard says so on the surfaces that show them. Below a minimum number of detections the projection is hidden entirely rather than shown as a small, unstable number.

Frozen periods

A capture records a period's figures as they stand and never recomputes them, with a content hash over the exact bytes. An evidence pack bundles them with per-regulation dossiers, a manifest and checksums, and pins the mapping version in force at capture time so the figures remain resolvable after the mappings change.

Note

The dashboard states the limit plainly: this is a checksum, not a signature. It shows whether a record changed after capture. It is not tamper-proof storage, it carries no trusted timestamp, and it does not stop anyone with database access.

Where you see it

Regulatory Compliance has four tabs: Impact Summary, Regulations, Detections and Decision Simulator. The dossier per regulation, the evidence pack and the frozen-period list sit alongside them.

The per-regulation dossier separates what the gateway can fill from what it cannot. Sections marked as the deployer's — a DPIA, a record of processing activities, a human-oversight procedure — are rendered empty and counted as evidence gaps rather than omitted, so an incomplete dossier cannot be mistaken for a finished one.

Limits and known gaps

No compliance score exists, by design. Nothing in the product computes a percentage of any framework met. A number like that would have to assert facts about your organisation that no gateway can observe.
The fine model counts detections, not incidents. Exposure scales with detection volume, so one leak detected forty times moves the number as forty separate events would. A defensible model would deduplicate to incident level; that is an open product decision.
Detector precision is not measured in production. The precision figures behind the "detection truth" row come from the test suite and red-team benchmarks, not from sampling your own traffic. There is no per-deployment measured precision.
Legal facts age. Amounts are revalued annually in several jurisdictions. The verified date on each regulation card is the honest statement of when it was last checked; an appliance that has not taken an image update carries the facts of the release it is running.
Vendor compliance assessments are not specifications. The framework-by-framework assessment circulated with this product dates from January 2026 and describes intent alongside implementation. Where it and this page disagree, this page is derived from the code.
Turning a finding into an action is manual. A finding is the one record a person writes; the gateway does not decide who owns a violation or when it is closed.

MITRE ATLAS and OWASP coverage — the attack-side reference catalogues, which are a different kind of mapping.
Data handling and retention — the records this mapping is computed from, and how long they last.
Compliance — operating the page day to day.

Regulatory mapping