What each Regulation10 module actually does

/platform lists eight modules at a glance. This entry covers what each one is for and exactly what it produces.

1.1 Risk classification. Run this to place a system on the DIFC risk ladder. It produces a written classification, cited to Schedule 1, Article 3 of the DPL.

1.1b Article 5 screen. Run this to check nothing you run is prohibited. It produces a pass or flag result, cited to EU AI Act Article 5.

1.2 DPIA. Run this to meet DPL Article 20(1) before high-risk processing. It produces a Data Protection Impact Assessment with risks, mitigations and an Article 27 fundamental-rights overlay.

1.3 Transparency notice. Run this to tell people when AI decides about them. It produces a notice covering Reg 10.2.2(b).

2.1 Bias and fairness. Run this to test for unfair outcomes by group. It produces a bias report using the four-fifths rule and standard floors.

2.2 Threat model. Run this to show you thought about attack. It produces a STRIDE model mapped to ISO/IEC 27001 and MITRE ATLAS.

3.3 Audit trail. Run this to prove what the system did and when. It produces an append-only log that is sealed and tamper-evident: each record is fingerprinted when it is saved, so any later change would be detected. The log exports as CSV and JSON.

4.1 Evidence pack. Run this to hand an Accredited Certification Body one file. It produces a signed ZIP with a manifest listing every sha256.

Every artefact above is citation-pinned and sealed by a deliberate Approve and Lock; the seal records the hash, it does not certify. See the platform for how registering a system and running the gateway fit around these eight modules.