Jurisdictions
What the obligation library covers today in the European Union, the United States and South Africa, and what it does not.
Jurisdiction
European Union
The library holds three EU instruments: the GDPR, the EU AI Act and the Carbon Border Adjustment Mechanism (CBAM). Which ones apply to you is decided by explicit rules on your organisation profile, not by a model.
EU AI Act
The AI Act applies when your profile says you operate in the EU and ship AI features. LedgerAI then tracks four obligations: classify each AI system’s risk level (Articles 6 and 7), transparency (Article 13), human oversight for high-risk systems (Article 14) and technical documentation (Article 11).
GDPR and CBAM
The GDPR applies when you operate in the EU and process personal data. It brings obligations for lawful basis (Article 6), transparency notices (Articles 13 and 14), data subject rights (Articles 15 to 22) and security (Article 32), plus Article 22 safeguards when you use automated decision-making.
CBAM, which covers exports of iron and steel, aluminium, cement, fertilisers, hydrogen and electricity into the EU, is in the library with four obligations: embedded emissions, quarterly reporting, emission factors and data retention. The app does not yet apply it to a workspace automatically.
Jurisdiction
United States
US coverage is deliberately narrow. LedgerAI tracks two instruments: FTC guidance on AI and the California Consumer Privacy Act (CCPA).
What Is Tracked
The FTC guidance applies when you operate in the US and ship AI features or use automated decision-making. It brings three obligations: AI system accuracy, bias mitigation, and disclosing AI use to consumers under Section 5 of the FTC Act.
The CCPA applies when you operate in the US, process personal data and have 51 or more staff. It brings obligations for a notice at collection and consumer rights requests, plus automated decision-making transparency under the CPRA amendments when you use automated decisions.
Jurisdiction
South Africa
South Africa is where the library is deepest: 49 researched instruments and 264 obligations, each with its section reference, plus the South African Carbon Tax.
What Is Covered
POPIA and PAIA, the FIC Act and its directives, the Companies Act and CIPC filings, FAIS and FSCA rules, Prudential Authority standards for banks and insurers, the Joint Standards on IT governance, outsourcing and cybersecurity, JSE Listings Requirements, SARS and employer returns, B-BBEE reporting and exchange control.
POPIA and Automated Decisions
POPIA section 71 restricts decisions with legal or substantial effect that are based solely on automated processing of personal information. When your profile says you use automated decision-making, LedgerAI adds a section 71 obligation to your list.
Cross-Border Compliance
Operating Across Jurisdictions
You keep one workspace, not three. The operating regions in your organisation profile decide which regulations apply, and the obligation list is rebuilt from that profile, so adding or removing a region changes what you are asked to cover.
The library is researched in advance and updated with LedgerAI releases. There is no live regulation change feed, so check the source text for anything that has moved since the last release.