Compliance mapping

Map regulatory obligations to Fuze Agent fields, code paths, and span attributes.

GDPR

Art. 6, Lawfulness of processing

Each agent declares a lawfulBasis on defineAgent. Each tool's retention carries the set of lawful bases under which records may be retained. At run start, the loop refuses to proceed if the agent's lawful basis is not in the retention's allowed set. This is fail-stop.

defineAgent({
  lawfulBasis: 'consent', // Art. 6(1)(a)
  // ...
})

Allowed values map to Art. 6(1) bases: consent, contract, legal_obligation, vital_interests, public_task, legitimate_interests.

Art. 9, Processing of special categories

Tools handling special-category data must be defined with defineTool.specialCategory and supply art9Basis. The compiler rejects defineTool.public for these payloads. Allowed values map to Art. 9(2)(a)-(j).

Art. 12 / 15, Information and access

The evidence pipeline records every span with subjectRef when the data classification is non-public. The @fuze-ai/agent-cli exposes query --subject <ref> which lists every run that touched the subject's data, sourced from the hash-chained log.

Art. 17, Right to erasure

The evidence backend honors cascade(subjectRef), which walks the chain by subject reference and removes the full-content payload while retaining the hash + decision record. fullContentTtlDays, hashTtlDays, and decisionTtlDays are independent retention windows for this reason.

Art. 33 / 34, Personal data breach notification

See the breach-notification workflow in the Sovereign tier guide.

Cross-border transfers

FuzeModel.residency is one of 'eu' | 'eea' | 'us' | 'other'. The loop refuses to run if a tool requires egressDomains: 'none' but the model residency is non-EU, or if a tool's retention forbids the model's residency. This prevents silent third-country transfer.

EU AI Act

Art. 6 / Annex III, High-risk classification

defineAgent requires annexIIIDomain. Allowed values cover the eight Annex III domains plus 'none'. Setting any non-'none' value triggers the AI Act high-risk obligations below.

Art. 14, Human oversight

producesArt22Decision: true or any non-'none' annexIIIDomain requires the HITL primitive on at least one tool. The loop's suspend/resume branch produces a human.oversight.decision span recording the overseer's principal ID, decision, and timestamp. See evaluateApproval in @fuze-ai/agent.

Art. 22 GDPR + AI Act, Solely automated decisions

producesArt22Decision: true enforces that an oversight tool is present and that no run can complete without an evaluateApproval span. Without it, the loop halts with fuze.run.missing_oversight=true.

Art. 26, Deployer obligations

The evidence bundle exported by @fuze-ai/agent-cli export packages: the run-root, the hash-chained record stream, the model fingerprint, the policy bundle hash, the signing public key, and the transparency log proof. This is the deployer's "logs and traceability" deliverable.

Art. 33 / 34, Serious incident reporting

Any run that halts with fuze.policy.engine_error=true, fuze.guardrail.hard_block=true, or an unhandled provider error is flagged in the dashboard's incident view.

Annex IV, Technical documentation

@fuze-ai/agent-annex-iv generates the Annex IV technical file from the agent definition: purpose, intended deployment, training/data sources, evaluation, oversight measures.

Span attributes (audit-grade signals)