Compliance — Vauban Trust Center
Audience: regulators + auditors + investors + DPO
Last updated:
Compliance Matrix
Vauban targets multi-régulation compliance avec timing window asymmétrique pour positioning institutional. Phase 0 done_when targets Q4 2026 = juste APRÈS EU AI Act + Colorado AI Act enforcement.
Compliance Matrix
| Régulation | Enforcement Date | Status Vauban | Coverage | Evidence |
|---|---|---|---|---|
| EU AI Act (Article 12 audit trail) | August 2026 | 🟡 Phase 0 in progress | Brain decision chains anchored L3 sprint-483 pattern | eu-ai-act-readiness |
| Colorado AI Act | June 2026 | 🟡 Phase 0 in progress | Same audit trail | colorado-ai-act-readiness |
| GDPR | Active since 2018 | 🟡 Phase 0 — DPIA per produit Phase 1+ | DPO contact + sub-processors documented | sub-processors + DPIA roadmap |
| eIDAS (EU digital identity) | Phase 1+ | 🟡 Glacis Identity Phase 1+ target | Post-quantum signatures + Glacis sub-charter Phase 1+ | TBD Phase 1+ |
| DORA (Digital Operational Resilience Act) | Active 2026 | 🟡 Vauban Finance applicable | DR runbooks sprint-487 sealed + multi-region failover Phase 1+ | DR runbooks |
| NIS2 (Network and Information Security 2) | Active 2026 | 🟡 Vauban Auth + Vauban Finance applicable | Incident response SLA + audit trail | .claude/rules/core/incident-response.md |
| CSPN Visa (ANSSI) | Phase 0 done_when target Q4 2026 | 🟡 Dossier in preparation | Pair 2 standards engagement + Rempart audit firm partnership | docs/standards/ (Pair 2 deep RETAINED) |
| SOC2 Type II | Phase 2+ post-CSPN visa | ⏳ Planned Phase 2+ | Audit firm selection Phase 1+ | TBD Phase 2+ |
| ISO 27001 | Phase 2+ | ⏳ Planned Phase 2+ | Audit firm selection Phase 1+ | TBD Phase 2+ |
| AFNOR commission identité numérique 2026 | Active 2026 | 🟡 Standards engagement (per ADR-ECO-011) | Mirror committee participation | docs/standards/ |
| Annexe Arcom (audiovisual) | TBD per produit applicable | ⏳ TBD | Per Pair 4 legal RETAINED | docs/legal/ |
Légende : 🟢 Compliant + audited · 🟡 In progress · ⏳ Planned · ❌ Gap
EU AI Act — Article-by-Article Coverage
Article 9 Risk Management
- Status : 🟡 Active
- Evidence :
governance/threat-model/per-product-surface.md(10 F-THREAT × 14 produits scoring) +docs/threat-model/*Pair 5 deep - Risk register :
governance/risks/ecosystem-risk-register.md
Article 10 Data Governance
- Status : 🟡 Active
- Evidence :
.claude/rules/core/security-boundaries.md(no PII unencrypted, validate boundaries) + ZK Privacy patterns
Article 11 Technical Documentation
- Status : 🟢 Active
- Evidence :
governance/architecture/00-vision-framework-canonical.md+docs/architecture/Pair 1 deep + 14 charters
Article 12 Audit Trail (Record Keeping)
- Status : 🟢 Active
- Evidence : Brain Protocol decision chains (986+ entries) anchored L3 Cairo MerkleAnchor mainnet (sprint-483 universal proof-layer pattern sealed 2026-04-23)
Article 13 Transparency
- Status : 🟢 Active
- Evidence : This Trust Center (10 pages structurées self-hosted Astro static site) + 14 charters public + 13 ADR-ECO public
Article 14 Human Oversight
- Status : 🟢 Active
- Evidence :
governance/council/charter.md(founder-solo Phase 0 → 3-person quorum Phase 1+) +.claude/rules/ai/tiered-gates.md(T1-T4 capability tiers, T4 require founder approval + L3 anchor)
Article 15 Accuracy, Robustness, Cybersecurity
- Status : 🟢 Active
- Evidence :
.claude/rules/core/craft-standards.md(Robust + Reusable + Resilient + Anti-fragile + Quality) +.claude/rules/security/mcp-tool-hardening.md+ axiom Robuste enforcement
GDPR Coverage
Data Subject Rights
- Right to access : DPO contact dpo@vauban.tech
- Right to erasure : implementing per produit (Phase 1+)
- Right to portability : Brain export + audit reports portable Markdown
Data Processing
- Sub-processors : sub-processors
- Data flows : per produit DPIA Phase 1+
- Retention policies : per produit Phase 1+
Cross-references
- EU AI Act details :
governance/compliance/eu-ai-act-readiness.md - Colorado AI Act details :
governance/compliance/colorado-ai-act-readiness.md - Per-product roadmap :
governance/compliance/per-product-roadmap.md - Threat model :
governance/threat-model/per-product-surface.md - Council process :
governance/council/charter.md - Tiered gates :
.claude/rules/ai/tiered-gates.md - Audit reports : audit-reports.md
- Sub-processors : sub-processors.md