Provision
What it requires
What CLS++ produces
EU AI Act
Art. 12
Automatic recording of events over the lifecycle of a high-risk system, retained six months minimum.
Continuous capture across every model and surface, hash-chained, exportable by team, period or single decision.
EU AI Act
Art. 13 & 26
Deployers must be able to interpret logs and monitor operation; documented human oversight.
Console views for actor, surface, model and region, with overrides and reviews recorded as first-class entries.
GDPR
Art. 30 & 32
Records of processing activities; security appropriate to risk, including encryption.
Processing record generated as a by-product of capture. Client-side encryption exceeds the Art. 32 baseline.
GDPR
Chapter V
Lawful basis and safeguards for transfers outside the EEA.
Region pinning keeps records in-jurisdiction. Ciphertext-only storage narrows what a transfer assessment must cover.
DORA
NIS2
ICT risk management and incident reconstruction for financial and essential entities.
A single timeline of AI-assisted actions that can be reconstructed during an incident rather than assembled after it.
India DPDP
+ RBI / SEBI / IRDAI
Data fiduciary duties, security safeguards, and sectoral localisation of payment, market and policy data.
ap-south-1 pinning with residency evidenced in export; erasure honoured as a recorded tombstone.
APAC
residency
Sectoral "must reside" clauses in Indonesia, Vietnam and China that surface during procurement.
Per-tenant region binding, so the answer to "where does our data live" is a document, not an assurance.