Jurisdictions

A finding read by jurisdiction is a reading aid drawn from draft catalogues not reviewed by counsel. It is never legal advice and never a statement that a system meets a law; the official text of each instrument governs. Declare where a system is used, and Oloproof reads it against every catalogue that covers that place, names each one it left out and why, and says when a catalogue is due to be read again.

Declaring where a system is used

A system in governance.yaml may declare jurisdictions:, a list of ISO 3166 codes: a country (CA, US), a subdivision (CA-QC, US-CO), a city after its subdivision (US-NY-NYC), EU or INT. Add sector: (public or private) and role: (provider or deployer) where an instrument's reach turns on them, and name the catalogue index:

catalogue_index: catalogues/catalogues.yaml
systems:
  - id: triage
    name: Benefits triage
    in_scope: true
    scope_reason: assesses eligibility for a provincial benefit
    aia_level: II
    jurisdictions: [CA-QC]
    sector: public

oloproof governance check then adds every indexed catalogue that applies to the system's own list and prints, per system, each catalogue selected or left out with its reason: a federal directive does not reach a provincial body, a sector or role that does not match is named, a voluntary framework is offered and never selected, and a proposed or repealed instrument is catalogued and never selected. A proposed catalogue named by hand is refused rather than assessed. A system with no jurisdictions keeps the catalogues it names itself. When every system declares jurisdictions, the file may name no catalogue at all and leave them to the index, as above; oloproof init --example governance writes such a project, with the catalogues and their index copied into catalogues/.

A code matches only downward: a catalogue indexed for CA with subdivisions covers CA-QC, but a system that declares US-NY is not covered by a catalogue for US-NY-NYC. Declare the most precise place the system is used, and every place it is used.

What the index holds

Each entry of catalogues.yaml names a catalogue file, the jurisdictions it covers, whether it covers their subdivisions, and where it applies: sector, role, voluntary, and status (in_force, proposed or repealed), with an optional note that says why a proposed instrument is not selected. It indexes Canada (the federal directive and its impact assessment, the Policy on Service and Digital and its guidance, Bill C-36, proposed), Quebec (its private and public sector privacy Acts), Ontario (its AI directive, and the Enhancing Digital Security and Trust Act, proposed until a regulation names who its AI duties bind), the United States (OMB M-25-21 for federal agencies and the NIST AI RMF, voluntary), New York City (Local Law 144 on automated hiring tools), Colorado (SB26-189, enacted and in effect from 1 January 2027, so not selected before then), the European Union (the AI Act for providers, deployers, transparency and general-purpose models; most high-risk duties apply from 2 December 2027, and findings before then describe readiness), the United Kingdom (the Algorithmic Transparency Recording Standard for central government and the UK GDPR duties the ICO's AI guidance explains, with Articles 22A to 22D on automated decisions), Singapore (AI Verify, voluntary) and ISO/IEC 42001 with its Annex A controls and ISO/IEC 23894, voluntary, by number and heading only. A system declared in an EU member state, such as FR or DE-BY, is covered by the EU catalogues. Every catalogue says on its first lines that it is a draft not reviewed by counsel.

One piece of evidence, several catalogues

A crosswalk row offers one gate rule to the measured requirements of several catalogues at once:

crosswalk:
  - id: fair
    rule: parity-gap
    targets: [DADM-6.3.3#1, EUAIA-10]

A row binds nothing until a reviewer accepts it for one system's target: oloproof governance crosswalk --row fair --system triage --target EUAIA-10 --by "A. Reviewer", logged in the review log. Only that target reads the rule, and only while the row is as it was accepted; an edited row is offered again. --withdraw with the same flags withdraws one acceptance. A crosswalk never says two requirements are the same; it says the same evidence is offered to both, and the finding names the row.

When a catalogue is due to be read again

Each catalogue records when it was read against its instrument (read_on) and how often it is due again (review_every, six months by default, three for instruments under active amendment). Past that date its findings keep their states with "catalogue not reread since" beside them, on the page, in the export and in the API. When the instrument was amended after the catalogue was read (amended_on), its findings read unable to determine until it is reread.

By jurisdiction, in the terminal and the workspace

oloproof governance check ends its selection with a block "By jurisdiction": for each system and each place it declared, the catalogues that cover it, the count of their findings in each state, and any that are stale; catalogues the file names under its own path are listed apart. The hosted Governance page shows the same grouping. The export of a seal stays the signed record alone; the grouping is drawn from it, never carried unsigned beside it.

What it cannot tell you

A catalogue paraphrases its instrument as one reader understood it on one day. Oloproof does not track legislative change; the review date and a person rereading are the mechanism. Which instruments apply to an organization, and what they require of it, is a question for counsel.