What it covers

Two regulations, held as a live record.

Most compliance tools produce a document. Kindlast keeps three registers, checks them against the GDPR and the EU AI Act every day, and tells you the moment one of them stops matching what your business actually does.

That difference is the product. A document is true on the day it is written. A register is either current or it is a finding.

What it keeps

ROPA

Records of processing

What personal data you handle, why, on what lawful basis, who else sees it, where it goes, and how long you keep it. Article 30 expects this to exist and to be current.

When an activity turns up with no entry behind it, that becomes a finding rather than something you discover during an audit.

DSAR log

Data subject requests

Every access, deletion, correction and portability request, with the statutory clock it is running against and where it has got to.

The clock is checked daily. Inside ten days, or already overdue, the request escalates on its own under Article 12(3).

AI system register

AI systems

The AI you build or deploy, sorted by the risk tier the EU AI Act puts it in, with the obligations that follow from that tier.

Operating an AI system with nothing in the register is itself a gap, and it surfaces on day one rather than at the deadline.

What it produces

Anatomy of a finding.

This is the unit of work. Not a score, not a report: one row, with everything needed to decide on it in the time it takes to read an email. Below is a real one, taken apart, with the column each part comes from.

The finding

Marketing analytics has no record of processing.

The obligationregulatory_obligation: GDPR Article 30; Drawn from the obligations catalogue rather than invented per finding, so two findings about the same rule cite the same rule.
The source textcitation_url: The article itself, with the paragraphs it turns on; The verbatim regulatory text sits behind the finding, so you can read what it actually says instead of taking the summary on trust.
How seriousseverity: High; One of low, medium, high or critical. It is what drives the red band on your dashboard and what gets a deadline alert sent early.
How much workeffort_estimate: Hours; Minutes, hours or days. A finding you cannot budget for is a finding you postpone.
The one thing to doproposed_action: Create the missing record of processing for marketing analytics; Exactly one action, phrased as an instruction. A deterministic critic rejects the draft and regenerates it if it hedges.
Its identitydedup_key: ropa-gap:marketing-analytics; Stable across runs, so tomorrow updates this finding rather than sending you a second copy of it.

What it reads

The regulation itself, not a summary of it.

Every finding is anchored to a passage of source text that ships in the repository. When a citation looks wrong, you can open the article and settle it, which is not something a model output on its own ever lets you do.

The GDPR: All 99 articles and 173 recitals, paragraph by paragraph.
The EU AI Act: All 113 articles, the recitals, and the Annex III high-risk list.
EDPB guidelines: The guidance the supervisory authorities themselves work from, where it bears on an obligation.
DPA enforcement decisions: Landmark decisions from national regulators, so a finding can point at how a rule has actually been applied.

What it will not do.

Nothing is written without your approval: There is no autonomous write path. The Executor runs on an explicit approval and on nothing else, and a finding you ignore simply stays open.
Every action leaves an audit log row: What was done, when, and who approved it, written immutably. That row is the artefact an auditor can actually use.
Isolation is enforced by the database: Tenant separation is row-level security in Postgres, not a where-clause in application code that one missed call site can defeat.
You can run the whole thing yourself: The engine is public under AGPL-3.0, so you can self-host it and keep your records inside your own infrastructure, or read it before you trust it.

Check any of this in the source

The part that matters

A feature list is a promise. The pipeline is the proof.

None of the above is worth much if it only happens when you remember to ask. Four agents keep it current on a schedule, and none of them can change a record without your explicit approval.

Follow one finding end to end