Policy frameworks

Under Control Panel → Policy frameworks an organisation states its legal frame and adopts rule sets from law (ADR 0088). A rule set holds the settings it needs at a compliant value, asks for evidence and checks, withholds models that do not meet it, and shows whether the setup meets it.

Not legal advice

A rule set does not replace a legal review. The rule sets that come with AI OS are drafts that have not been reviewed yet; the console marks them Draft, not reviewed yet.

The legal frame

Under Legal frame you say where and how the organisation works: its regions, sector and size, its role under the AI Act, whether it has a works council, and whether its use is high-risk. Which rule sets apply follows from it.

The rule sets

Rule set	What it holds, for example
GDPR (General Data Protection Regulation (EU) 2016/679)	Personal data in prompts masked or refused; the memory bin at most 30 days; the tool call history at most 365 days; a personal-data step in pipelines; models withheld whose data is processed outside the EEA without a data processing agreement; evidence for further articles.
EU AI Act, for deployers (Regulation (EU) 2024/1689)	The audit log and the tool call history kept at least 184 days (Art. 26 logs); a legal-check step for oversight; AI literacy as evidence (Art. 4).
NIS2	The audit log kept at least 184 days; training, supply chain, multi-factor sign-in and reporting as evidence.
BetrVG (German Works Constitution Act, with a works council)	Evidence and checks for §87, §90 and §80.

What adopting one does

Adopt a rule set, and AI OS:

• holds the settings it names at their compliant value; where two rules hold one setting, the stricter holds;
• asks for evidence (Upload evidence) or a confirmed checklist;
• withholds models whose Data and processing do not meet a rule (Not offered: a rule set on the model);
• adds the pipeline steps it requires; a pipeline without them cannot be saved.

How strictly it asks is per rule set: A confirmed checklist, Evidence, or Checks, evidence and a confirmed checklist.

Each rule shows its state: Met, Not met, Evidence needed, Check needed, Exception or Coming (a rule that applies from a later date).

Exceptions

A setting a rule set holds can be loosened only by an exception: Ask for an exception, and another administrator approves it. Stop adopting ends the rule set for the organisation.

Draft rule sets

The rule sets are drafts until a legal review publishes them. A draft can be adopted only when the platform setting compliance.draftSets is on; it is off by default and meant for test installations. Versions drafted by AI from the official text and published after legal review are planned (ADR 0088).