complyDNA · classification + oversight
How human oversight becomes software.
complyDNA is the compliance layer of ozDNA. DT 5.0 classifies each workload onto a risk tier; the Council puts a multi-model vote, a veto and a fail-closed judge in front of every high-risk decision. Article 9 and Article 14 — not as a policy PDF, but as runtime.
DT 5.0 · Art. 9 — risk management
Classification: workload → risk tier
Risk management under Article 9 is continuous and lifecycle-wide. DT 5.0 places each workload on a tier and makes the routing decision that follows from it — so the risk posture is computed, not assumed.
TIER · LOW
Cheapest sufficient model
Routine work clears on the most economical model that meets the bar. No premium paid for risk that isn't there.
TIER · ELEVATED
Stronger model, logged
Higher-stakes work takes a stronger model and is recorded for traceability.
TIER · HIGH
Escalated to the Council
Decisions that carry regulatory weight are routed to multi-model oversight before they stand.
Council · Art. 14 — human oversight
A veto, in software
Article 14 asks for oversight that can stop a system and that guards against over-reliance on automation. The Council implements exactly that: several models vote, any one can veto, and a fail-closed judge holds the decision when the vote is unsafe.
Vote
Independent models assess the high-risk decision in parallel.
Veto
A single well-founded objection is enough to hold the decision.
Fail closed
When the vote is unsafe or unresolved, the default is to stop — not to proceed.
Escalate
Held decisions surface to a human owner with the full rationale attached.
Over-reliance on automation is designed out: the safe default is a stop, and a human always has the last word on a held decision.
Mapping
complyDNA ↔ the Act
| Component | What it implements | Article |
|---|---|---|
| DT 5.0 | Continuous, lifecycle-wide risk classification of each workload | Art. 9 |
| Council | Stop/veto authority and a guard against automation over-reliance | Art. 14 |
complyDNA implements and operationalises these obligations; it makes no absolute compliance claim. The record it produces is proven by originDNA.
See it on your own systems
An audit turns your workloads into a classification report — complyDNA, demonstrating itself.
Request a compliance audit