# Promethean — EU Regulatory Coverage

> Coverage map for EU regulations applicable to AI-bearing products.

## Regulations with primers and evidence-mapping templates

- **EU AI Act** (Regulation (EU) 2024/1689) — Annex III high-risk recordkeeping (Art. 12), transparency (Art. 13), human oversight (Art. 14), deployer obligations (Art. 26), AI-system transparency (Art. 50), GPAI (Art. 53). Primer: https://promethean.software/eu-ai-act
- **GDPR** (Regulation (EU) 2016/679) — Art. 22 automated decision-making, Art. 25 by-design, Art. 30 records of processing, Art. 32 security. Primer: https://promethean.software/gdpr
- **PSD3 / Payment Services Regulation** — Strong Customer Authentication evidence (Art. 26 etc). Primer: https://promethean.software/psd3-psr
- **DORA** (Regulation (EU) 2022/2554) — ICT risk management (Art. 6–15), incident management (Art. 17–23), third-party providers (Art. 28). Primer: https://promethean.software/dora
- **NIS 2** (Directive (EU) 2022/2555) — cybersecurity risk-management measures (Art. 21), incident reporting (Art. 23). Primer: https://promethean.software/nis2
- **MDR** (Regulation (EU) 2017/745) — Annex I general safety/performance, Annex II technical documentation. Primer: https://promethean.software/mdr
- **IDD** (Directive (EU) 2016/97) — Insurance distribution product oversight (Art. 25). Primer: https://promethean.software/idd

## US regulations covered

- **HIPAA Security Rule** — 45 CFR § 164.312(b) audit controls, § 164.504(e) BAA. Primer: https://promethean.software/hipaa
- **CCPA / CPRA** — Cal. Civ. Code §§ 1798.100 et seq. Covered in /legal/privacy §7.5.

## Machine-readable

`/api/facts/regulatory-coverage` returns the full manifest as JSON.