Compliance
Built for the human-oversight era.
Regulators now expect a human in the loop before automated systems act — and evidence that oversight happened. Proof Holdings is designed to support both: approvals on channels people actually answer, recorded as signed, offline-verifiable tokens.
The regulatory docket
The dates your roadmap already lives under
34+ jurisdictions, one direction: people must be told, and be able to reach a human, when an automated decision affects them — and some now require a record that it happened.
- In forceEUGDPR · Art. 22
A person may not be subject to a solely automated decision with legal or similarly significant effect — where the decision rests on a contract or consent, human intervention must be available on request.
- In forceUKUK GDPR · Arts. 22A–22D
The Data (Use and Access) Act replaced Article 22 on 5 February 2026: significant automated decisions are permitted, but safeguards are mandatory — people must be able to obtain human intervention, make representations, contest the decision, and get information about it.
Source: Data (Use and Access) Act 2025, s. 80, legislation.gov.uk
- In forceUSNYC Local Law 144
Automated employment decision tools require an independent bias audit and advance notice to candidates — an automated decision alone is not enough.
Source: Automated Employment Decision Tools, NYC Department of Consumer and Worker Protection
- In forceCHSwiss FADP · Art. 21
Switzerland’s revised data protection law: automated individual decisions must be disclosed, and the person can ask for the decision to be reviewed by a human.
- In forceKRKorea PIPA · Art. 37-2
South Korea’s privacy law grants the right to refuse, or demand a human explanation of, fully automated decisions that significantly affect a person.
Source: Personal Information Protection Act, Korea Law Information Center
- In forceUSUtah AI Policy Act
Consumers must be told they are interacting with generative AI when they ask; in regulated occupations, upfront only for high-risk interactions.
- In forceJPJapan AI Promotion Act
Japan’s first AI law sets a light-touch national governance baseline — a duty for businesses to cooperate with national measures, and transparency expectations, with no penalties.
Source: Act No. 53 of 2025, Japanese Law Translation (Ministry of Justice)
- GuidanceSGSingapore Model AI Framework
Singapore’s PDPC framework recommends choosing how far a human stays involved (in, over or out of the loop) by the likelihood and severity of harm. Not binding — but the governance reference point for the region.
- In forceKRKorea AI Basic Act
Korea’s AI Basic Act (in force 22 January 2026) imposes duties on high-impact AI — employment, loans, healthcare and more — including risk management, explainability, and human-oversight mechanisms.
Source: Framework Act on Artificial Intelligence (Act No. 20676), Korea Law Information Center
- In forceEUEU AI Act · Art. 50
Transparency obligations apply: people must be told when they interact with an AI system, and AI-generated content must be disclosed (systems already on the market before 2 August 2026 have until 2 December 2026 for the marking).
Source: Regulation (EU) 2026/1744 amending Regulation (EU) 2024/1689, EUR-Lex
- Dec 2026AUAustralia Privacy Amendment
Australia’s Privacy Act amendments require privacy policies to disclose automated decisions that significantly affect individuals — transparency first, with broader reform still moving.
Source: APP 1.7–1.9 transparency obligation fact sheet, OAIC
- Jan 2027USColorado AI Act · revised
Colorado repealed and replaced its 2024 act (SB 26-189, May 2026): deployers of automated decision-making technology must give clear notice, explain adverse outcomes, and offer meaningful human reconsideration of consequential decisions.
- Dec 2027EUEU AI Act · Art. 14
Human oversight becomes mandatory for high-risk AI systems: humans must be able to understand, intervene in, and override the system (Annex III systems; Annex I systems from 2 August 2028 — deferred from 2026 by the Digital Omnibus, Regulation (EU) 2026/1744).
Source: Regulation (EU) 2026/1744 (Digital Omnibus on AI), EUR-Lex
Sources, checked 25 October 2026: the law text or the regulator’s or legislature’s own page for each row.
Why this matters now
The strictest texts ask for two things
A human able to intervene before the system acts.
Proof of Action delivers the approval on the channels people already answer — Telegram or WhatsApp — so the checkpoint happens in seconds, not in the next sprint. A queue nobody opens is oversight on paper only.
Evidence that the oversight actually happened.
Every decision mints a signed ES256 token: approve or deny, and when, bound to the encrypted request. Who answered is kept on the record beside it. An auditor verifies the token offline against our published JWKS: no Proof Holdings account, no API key, no trust in screenshots.
How Proof Holdings maps to the obligations
Every obligation, an instrument you can hand an auditor
No vendor hands you compliance. What we issue is the oversight mechanic and the signed evidence trail the rules keep asking for.
Human oversight & intervention
EU AI Act Art. 14 · GDPR Art. 22 · Colorado
Human-in-the-loop approval gates before irreversible actions, on channels people answer.
Supply-chain & agent authority
NIS2 Art. 21(2)(d) supply chain · agent authority
Signed, scoped, revocable statements of which agents, packages and endpoints a domain you control authorized.
Demonstrable audit trail
EU AI Act Art. 12 record-keeping · accountability
Signed ES256 tokens for every decision — verifiable offline via the public JWKS, holdable for years.
Put a human in the loop this week
Your first approval gate is one API call — and every decision after it leaves a signed token you can show an auditor.
Product positioning, not legal advice. Consult your counsel on how these rules apply to you.