How we check the law
Every duty in your compliance record comes from the published text of the law, read from the official publisher, checked twice and watched every day.
The laws we read
The record holds 116 duties drawn from 19 laws, chosen for what binds a small Irish business that holds personal data, uses technology or sells to consumers.
Personal data
- GDPR
- Data Protection Act 2018
- ePrivacy Regulations (S.I. 336/2011)
- Access to health data (S.I. 121/2022)
Technology and security
- AI Act, as amended in July 2026
- Regulation of Artificial Intelligence Act 2026
- NIS2 Directive, held as not yet in force until Ireland transposes it
- Cyber Resilience Act
Selling online and to consumers
- Consumer Rights Act 2022, with the four statutory instruments that amended it in 2026
- Consumer Protection Act 2007, where the 2022 Act and S.I. 124/2026 changed it
- General Product Safety Regulation
- Digital Services Act and the Digital Services Act 2024
- Electronic Commerce Regulations (S.I. 68/2003)
- Accessibility Act, as transposed by S.I. 636/2023
Employment law, tax law, health and safety law, company law, anti-money laundering and sector regulation such as financial services authorisation are outside it. The dates further down are the exception: we track their deadlines.
Where each law comes from
We read every text from its official publisher, keep a copy of the version we read, and record its version line.
- The EU Publications Office
- EU regulations and directives, in the consolidated version where there is one, and the EU's own record of every later correction and amending act.
- The Law Reform Commission
- Irish Acts as revised to date, where a revised version exists.
- The Irish Statute Book
- Statutory instruments as made, Acts as enacted, and the legislation directory that lists every later amendment and commencement.
- The Oireachtas
- Bills before the Dáil and Seanad that would change these laws.
How each duty was checked
- Pinned to the text. Each duty is tied to the articles or sections it comes from, with a fingerprint of their exact words, and quotes the law word for word.
- Read twice, independently. Two AI models each read the law behind every duty on their own, without seeing our rules, and listed the duties they found. Where either disagreed with a rule, we re-read the law, settled it and logged the decision.
- Nothing left out quietly. All 1,376 articles and sections of the 19 laws are either used by a duty or carry a written reason they are not, such as a definition or a duty on the State.
- Read again from a second copy. Every law we keep was compared with a second copy from its publisher, word for word and by separate software, so a passage our copy dropped or added would show.
- Tested. Fourteen sample businesses are run through the duties on every change to them, and each must get exactly the duties the checked answers give it.
These are machine cross-checks of the published text. They are not legal advice, and no lawyer has reviewed the duties yet. When a solicitor reviews them, each duty will show who reviewed it and when.
When the law changes
- Every morning the portal reads every text again, with the EU's record of corrections and amending acts, the year's new Irish statutory instruments and the bills before the Oireachtas.
- A change is recorded against the duties it touches and those duties are marked for a re-check. We re-read the law, correct the duty and record who resolved it and how.
- A source that cannot be read counts as a failed read and raises an alarm. It never counts as no change.
- Every morning the duties your record is worked out from are also compared with the checked set, and anything that differs is put back. Every change to a duty is kept, with what it said before and after, and nobody can edit that history.
- The whole set is due a fresh check every 90 days, and the portal flags it as overdue past that. Each duty in your record shows the date it was last checked.
Dates that come round again
The record also keeps your recurring deadlines, and we chase each one until it is done. Each one was read from its official page, and those pages are watched the same way.
- VAT return and payment: Revenue
- PAYE and the income tax return: Revenue's calendar
- Corporation Tax return and payment: Revenue
- CRO annual return: Companies Act 2014, section 343, as revised
- Safety statement review: Safety, Health and Welfare at Work Act 2005, section 20, as revised
- Fire alarm, extinguisher and emergency lighting servicing: Department of Housing fire safety guide
- Commercial vehicle test: CVRT
- Tachograph downloads: RSA, read by hand because it refuses automated reads
Where it is kept
The duties and every client's record are kept in a PostgreSQL database in Ireland, with Supabase in its Dublin region. The portal runs in Vercel's Dublin region, and the outside scan of a website runs from Dublin too. Each client's record is visible only to that client and to us.
Every provider that handles client data is listed in our data processing agreement.
See it on your own business
The free compliance check shows which of these duties apply to you, each with the article it comes from. Keep it, and it becomes your compliance record, where each duty links to the law itself. For the work of meeting them, see Secured and proven.