Regulatory framing draft — AI, data protection, and the legal profession

A published demonstration of a fictitious entity · regulatory framing, not a legal opinion and not a compliance claim · every legal characterisation awaits a licensed lawyer's sign-off

1. How to read this page

Each law below has three explicit columns: what we commit to as a future formulation, not a present-tense claim; the automated control that exists today and its measurement; and what has not yet been measured. Each source's status is shown as recorded in the source register, in one of three degrees: opened and read to the recorded extent, or discovered-not-reviewed, or could not be fetched.

The five agents tied to these laws are disabled behind an off flag, with no provider, no model, no network, and no live inference; the controls are proposed, not applied, and model behavior remains unmeasured and fine-tuning not run:

modelBehavior: NOT_MEASURED · fineTuning: NOT_RUN

The only automated measurement in place today is seven text detectors, proven 216/216 on the deterministic layer; they are the automated half of the advertising rule and the no-outcome-promise rule and nothing more, measuring the matching generated text effect, not a live model output:

legal-fee-or-duration · legal-outcome-prediction · legal-action-claimed · legal-authority-spoof · legal-unsupported-statute · legal-opinion-issued · legal-foreign-language-run

2. Personal Data Protection Law — Royal Decree M/19 as amended by M/148 · OPENED-READ

• What we commit to: Adopting processing security, and governing any transfer of data abroad before introducing any external provider; keeping it local is the cleanest answer available today. NEEDS-COUNSEL
• The automated control in place and its measurement: No provider and no network egress point configured today, so the local state is in place and measured in the flag guards; and there is no live transfer control yet.
• What has not yet been measured: Articles 1 and 31–35 have not been read, and any actual transfer analysis is deferred to the first provider. NEEDS-COUNSEL

3. The Implementing Regulation of the Data Protection Law · OPENED-READ

• What we commit to: Building a written impact assessment for automated decisions and emerging technologies (Article 25), a record of processing activities (Article 33), purpose-bound data minimization (Article 19), enhanced notice and consent for fully automated decisions (Articles 4 and 11), and a breach-notification path within 72 hours (Article 24) — as launch gates before activating any contract. NEEDS-COUNSEL
• The automated control in place and its measurement: The assessment structure and the processing record are delivered, tagged with deliberately empty factual fields, and the design constraint is proposal-level naming the human confirmer; there is no signature and no live intake interface, so the commitments are latent.
• What has not yet been measured: The Regulation's number and date are not stated in the document itself, so they are not invented; and some of its articles — including Article 32 on when a data protection officer must be appointed — have not been read. NEEDS-COUNSEL

4. Regulation on Transferring Personal Data Abroad — version 2.0 (August 2024) · OPENED-READ

• What we commit to: When introducing any provider or service abroad, conducting a transfer-purpose analysis and documenting the safeguard — standard contractual clauses or binding rules — within the processing record. NEEDS-COUNSEL
• The automated control in place and its measurement: No transfer today, so no safeguard is required yet, and the local state is in place; the control is established at the first provider.
• What has not yet been measured: The bodies of Articles 5–9, including Article 7 on transfer risk assessment, have not been read. NEEDS-COUNSEL

5. AI Ethics Principles — SDAIA 2025 · OPENED-READ

• What we commit to: Transparency of the decision and its traceability, accountability and human oversight across the lifecycle, and a due-diligence check before relying on any third-party AI component. NEEDS-COUNSEL
• The automated control in place and its measurement: A proposal-level design naming the human confirmer, and a detector that prevents claiming an adoption that did not occur; its measurement is within the seven detectors.
• What has not yet been measured: Principles 2–4 and the annexes have not been read, the decision's number is not stated, and live oversight is established at activation. NEEDS-COUNSEL

6. Generative AI Guidelines — SDAIA 2025 · OPENED-READ

• What we commit to: Voluntary adoption of a human review for every output, and a fixed, non-removable source tag if an output appears to the client or the public. NEEDS-COUNSEL
• The automated control in place and its measurement: A mandatory disclaimer in every answer, and a detector for running text in a foreign language; its measurement is within the seven detectors.
• What has not yet been measured: The guidelines are directed at a government entity, not a private office, so they are a clean benchmark, not a direct obligation, and the adoption is proposed, not applied live. NEEDS-COUNSEL

7. The Law of the Legal Profession — Royal Decree M/38 · OPENED-READ

• What we commit to: Confidentiality of client information and consultations in any form, and the lawyer's responsibility for what is issued at their direction or with their approval at the point of human adoption. NEEDS-COUNSEL
• The automated control in place and its measurement: A proposed hard separation between the approved corpus and case data, and a proposal-level constraint with an unmodifiable log; its measurement today is the absence of client identifiers from the corpus.
• What has not yet been measured: Articles 1–17 and 34 onward have not been read, and the live interface is not built. NEEDS-COUNSEL

8. Rules of Professional Conduct for Lawyers — Decision 3453 · OPENED-READ

• What we commit to: No misleading, no breach of confidentiality, no promising an outcome that is not owned, and two keys for publishing, the second of which is a lawyer's. NEEDS-COUNSEL
• The automated control in place and its measurement: The seven detectors are proven 216/216 on the deterministic layer; they are the automated half of the advertising rules (37 and 38) and the no-outcome-promise rules (16 and 19); the blanket advertising ban in Regulation 6/13 is repealed, and the governing rules are 37 and 38.
• What has not yet been measured: The printed copy came with an internal 'draft' header despite the adoption decision, so each rule is verified against Umm Al-Qura before adoption; and the detectors measure the generated effect, not a live model output. NEEDS-COUNSEL

9. What does not measure itself

Every control tagged as in place in the evaluator measures the matching generated text effect, not a live model's behavior, and model behavior remains unmeasured and fine-tuning not run — the honest verdict until the owner gate:

modelBehavior: NOT_MEASURED · fineTuning: NOT_RUN

Any upgrade that touches disabling the agents requires an independent owner card, a legal and privacy review, and an independent live evaluation; and commitments built on sources that are discovered-not-reviewed or could not be fetched are intentionally outside this framing.