Frequently asked questions.

Landfall reads regulatory text (the EU AI Act, the GDPR, the UK AADC, the EU DSA, COPPA and more) and translates it into structured obligations mapped to your specific product context. Those obligations then become prioritised engineering work items your team can build from — with full traceability back to the source regulation.

Compliance, policy and engineering teams who have to turn a regulation into engineering work — public bodies deploying an algorithm, financial services teams, and product teams shipping consumer software. You choose a use case when you create a project: an AI system pre-scan under the EU AI Act, a privacy or DPIA screening, child online safety, accessibility, or a NIST security and privacy framework.

A screening for a team that has to say whether the AI Act applies to a system and whether a data protection impact assessment is needed. Landfall scans the repository for AI components, asks about your role and the Annex III area, and computes a risk tier — the classification is deterministic, not written by a model, so the same answers always produce the same tier. The report carries a numbered rationale with an article citation on every step, an Article 5 prohibited-practice check, a duties table (fundamental rights impact assessment under Art. 27, EU database registration under Art. 49, GDPR Art. 35 DPIA, Art. 36 prior consultation) with the basis printed for each row, the detected AI components as file and line references, and a register-entry draft. It is a screening instrument, not legal advice, and it does not complete your DPIA or approve anything.

No. Landfall is a translation tool, not legal advice. It structures the interpretation of regulatory text so your legal and engineering teams can have productive conversations grounded in the same data. Every AI-generated suggestion is flagged for human review.

Obligation mapping is rule-based: each obligation carries trigger conditions evaluated against your questionnaire answers, so no model decides what applies to you. AI is used for interpretation text, the optional pre-scan narrative and document extraction, each labelled as AI-written and flagged for human review. No silent interpretations.

12 binding regulations and 6 technical standards, 421 obligations in total: the EU AI Act, the EU GDPR and its children's provisions, the EU DSA, UK AADC, UK Online Safety Act, US COPPA, California CAADCA, Australia Online Safety Act, Ireland Online Safety Code, Brazil LGPD and Singapore PDPA, plus NIST CSF 2.0, the NIST Privacy Framework, W3C WCAG 2.2, IEEE 2089, ISO 27566 and AIUC-1 (a certification standard for AI agents, in preview). Each obligation is traced to specific articles, with severity, trigger conditions and implementation guidance.

Yes. Landfall exports to Jira CSV, Markdown documentation, and JSON audit bundles. You can also generate compliance contracts that live in your codebase and are verified in CI with the @reg-to-backlog/verify CLI.

A machine-readable file committed to your repository that describes which regulatory obligations your product satisfies. It includes SHA-256 integrity verification and can be checked automatically in your CI/CD pipeline — so regulatory status stays in sync with your codebase.

Your project data lives in your database, and obligation mapping itself is deterministic — no model decides what applies to you. Where AI is used (interpretation, scan narrative, document extraction), the calls go to the provider you choose: Anthropic by default, or any OpenAI-compatible endpoint including EU-hosted and self-hosted models. A per-project residency policy can block non-EU or non-local providers, in which case AI features refuse to run rather than send that project's data elsewhere. Self-hosting is available for teams that want the model to run inside their own infrastructure too. The residency policy covers that AI hop; features you switch on — email notifications, Slack or generic webhooks, a Jira/Linear/GitHub push, in-app feedback — send what you configure them to send, and the trust page lists each one with how to turn it off.

Minutes. You answer a context questionnaire about your product, select the relevant regulations, and Landfall generates obligation mappings. From there you review, approve, and export — the whole workflow can be completed in a single sitting.

Continuous compliance lets you query your compliance state at any point in time. Auditors often ask 'what was your compliance posture on date X?' — Landfall can answer that instantly. Daily automated snapshots capture your coverage, and you can compare changes between any two dates.

The Evidence Collector is a CLI tool (rtb-collect) that runs in your CI/CD pipeline. It gathers evidence deterministically from your codebase — checking file presence, dependencies, code patterns, and configuration values. Evidence is bundled with SHA-256 integrity hashes and uploaded to your Landfall project automatically.

Yes. Choose an EU-hosted or self-hosted OpenAI-compatible model as the project's provider. A per-project residency policy then refuses to call any other provider, so an AI feature fails closed rather than sending data elsewhere. The AI call is the only hop the policy governs; the trust page lists every other outbound connection.

Yes. The pre-scan exports a draft entry in the Algoritmeregister publication standard, filled with the fields Landfall can derive (risk category, human oversight, impact assessments, source references). Where a human must decide, such as the legal basis, the field reads "to complete" rather than a guess.

Landfall is currently in pilot. If you deploy an AI system, process personal data, or ship a product under online-safety or accessibility rules, get in touch — we're onboarding early teams now.