Add GDPR Art. 22 urgency, AI-vendor segment, sharpen boundaries - #12
Merged
Conversation
A client brief surfaced that the site's whole urgency case runs on the AI Act clock, which just slipped 16 months. GDPR Article 22 has applied since 2018 and doesn't move with any AI Act date; the CJEU's Schufa ruling extends that exposure to whoever produces a decisive score, not just whoever acts on it. Adds that as a second urgency callout, adds an AI-vendor strip under the industry cards (the horizontal layer the three verticals sit on, not a fourth peer card), and sharpens the boundaries section's triangulation.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Generalizes regulatoryReality's three named singleton callouts (inForceNow, gdprUrgency, procurement) into a callouts[] array rendered via .map(), since a third named callout made the copy-paste-per-addition pattern a repeating cost rather than a one-off. Also tightens boundaries.items[2] to drop an internal restatement, and dedups the GDPR Article 22 / Schufa fact across CLAUDE.md, legal-deferred.md, and site-copy.md down to one full explanation with two pointers, instead of three near-duplicates.
The snippet stopped at init(), implying the rationale/reviewer capture the site claims elsewhere (structured rationale, reviewer ID) happens automatically. It doesn't: capturing why a decision was made and who signed off is a distinct explicit call for the calls that need it, not folded into the two-line setup. Adds that call.
cmin764
added
documentation
TypeScript already infers {title, body} from the object literal.
The example implied a customer manually writes a rationale string and pays for a second explicit call to capture it. Neither is true: init() alters the customer's own prompt templates so the same LLM call that produces the output also produces its rationale, parsed from that one response. Traced AI never runs or bills for the underlying LLM call, that stays on the customer's own infrastructure and cost. Only the human sign-off is a genuinely separate, optional step, since it happens after the fact. Also sharpens the AI-vendor pitch and pricing page with a concrete, plan-independent guarantee: a provider embedding Traced AI can export logs to their own downstream customers on demand, on every plan, not gated to Enterprise.
decision read as a second act of decision-making happening on Traced AI's behalf, possibly a new, billed LLM call. It's just the return value of the client's own already-existing call. sign_off attaches an optional human confirmation to that response, it does not make or remake the decision.
Still described a single 'enterprise procurement callout' after the section grew to three callouts in the callouts[] refactor.
ruleRegistry now states reviewer ID and feedback are captured together only when a human signs off, not that feedback is an optional extra within that call. Tightened the code example's comment to match: signing off is optional, feedback isn't once you do. Also extends regulatoryReality.sourceAttr to cite GDPR Article 22, since the section now carries a callout grounded in that instrument and not just the AI Act.
cosmin@company.com could read as if the founder were personally the reviewer on someone else's setup.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
A client brief written for a recruitment-AI prospect surfaced that the site's entire urgency case runs on the AI Act clock, which just slipped 16 months (Annex III now Dec 2027). GDPR Article 22 has applied since 2018 and doesn't move with any AI Act deadline; the CJEU's Schufa ruling (Case C-634/21) extends that exposure to whoever produces a decisive score, not just whoever acts on it, which also means the site's
builtForcards were missing AI/SaaS vendors entirely (they only addressed deployers).Value
Gives the regulatory-reality section a second, date-independent urgency leg. Adds a horizontal strip beneath the three industry cards for AI vendors whose product is the scoring system, who can carry Article 22-style exposure directly and resell the evidence layer to their own downstream customers. Sharpens the "what Traced AI is not" section with a cleaner process/model-behavior/per-decision-proof triangulation, without naming competitors.
To check
/Regulatory Reality: 3 callouts render in order (in-force-now, GDPR, procurement), both themes/Built For: 3 industry cards in a row, thinner full-width vendor strip beneath reading as a base layer, both themes, mobile stacks to 1 column/productBoundaries section reads correctly with the sharpened triangulation