docs(compliance): correct AI Act article numbers and scope NIS2 honestly - #542
Merged
Conversation
The transparency obligation is Art. 50 of Regulation (EU) 2024/1689, not Art. 52 (which covers GPAI with systemic risk in the final text). Fix the three places that carried the draft numbering. Add Art. 19 log retention, and a 'what grob does not do' table for both the AI Act and NIS2, mirroring the existing SOC 2 disclaimer. The NIS2 section now maps to the actual Art. 21 measures under the French 2025 transposition and states plainly that ANSSI notification deadlines are the operator's duty, not something an escalation webhook discharges. Also publish the SPDX SBOM as a release asset: it was generated in CI but only kept as a workflow artifact, which is useless as supply-chain evidence.
Destynova2
enabled auto-merge (squash)
August 6, 2026 06:58
Merged
Destynova2
added a commit
that referenced
this pull request
Aug 6, 2026
## 🤖 New release * `grob`: 0.36.95 -> 0.36.96 <details><summary><i><b>Changelog</b></i></summary><p> <blockquote> ## [0.36.96](v0.36.95...v0.36.96) - 2026-08-06 ### Other - delete the dead trait mocks and four redundant docs ([#543](#543)) - *(compliance)* correct AI Act article numbers and scope NIS2 honestly ([#542](#542)) - *(agents)* guard the streaming attribution path ([#541](#541)) - *(agents)* record the request path and the mutation findings ([#540](#540)) </blockquote> </p></details> --- This PR was generated with [release-plz](https://github.com/release-plz/release-plz/).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
Audit of the AI Act / NIS2 claims for a French deployment.
Factual error: the transparency obligation is Art. 50 of Regulation (EU) 2024/1689.
Art. 52was the draft numbering and now covers GPAI with systemic risk. Three public places carried it (README, features.md twice).Overclaim: the NIS2 row promised more than the code delivers. It now maps to the actual Art. 21 measures under the French 2025 transposition, marks access control and incident handling as partial, and states that ANSSI's 24h / 72h / 1-month notification deadlines are the operator's duty. An escalation webhook is a signal, not a filing.
Gap closed: the SPDX SBOM was generated in CI but only uploaded as a workflow artifact, expiring and invisible to users. It is now a release asset, which is what NIS2 supply-chain evidence actually needs.
Retention: Art. 19 requires at least 6 months of logs. Grob's audit log is strictly append-only (
current.jsonl, no rotation, no purge), so this holds by construction. Documented rather than adding a purge engine nobody asked for.Changes
README.md,docs/reference/features.md— Art. 52 becomes Art. 50docs/reference/features.md— Art. 19 retention row; "what grob does not do" tables for the AI Act and NIS2, mirroring the existing SOC 2 disclaimer.github/workflows/ci.yml— attachsbom-grob.spdx.jsonto GitHub releasesdocs/design/002-media-agents-delivery-plan.md— pending binary-size correction (17.3 MB, not 6 MB; the 6 MB figure is the musl container image)Verification
markdownlint clean, lychee offline link check passes, gitleaks passes. Docs plus one CI line; no Rust touched.