V4 · Governance

EU AI Act & Governance

A technical-control map for EU AI Act and GDPR obligations — not legal advice or a certification. Applicability depends on your deployed use case, data, operator role, and surrounding system.

V4 AGPL v3 GDPR EU AI Act self-assessment
Self-Assessment · Per Mode

Three modes, three postures.

SuperLocalMemory ships a per-mode EU AI Act self-assessment. It is a technical-control map, not a legal certification — applicability depends on deployment, data, operator role, and surrounding system.

Mode A · Local core
Memory processing stays local with no generative AI in the core memory-content path. Per the built-in self-assessment checker: assessed as fitting EU data-residency obligations — no external provider in the core path.
data-stays-local: yes generative-AI: none in core path risk-category: assessed
Mode B · Local model (Ollama)
Local Ollama enrichment keeps processing on the machine with no external provider in the core path. Per the built-in self-assessment checker: assessed as meeting requirements. Model acquisition and any non-local Ollama endpoint must be assessed as separate network paths.
data-stays-local: yes provider-in-core: none risk-category: assessed
Mode C · Provider-assisted
Sends configured content to an external provider. Per the built-in self-assessment checker: flagged. Assess provider terms, international transfers, legal basis, logging, and retention for the complete deployment before any compliance claim.
data-stays-local: no generative-AI: provider-assisted risk-category: flagged

Self-assessment tooling, not a certification. Checker results cover the core memory-content path only. Optional connectors, backups, client applications, and model downloads retain their own network behavior and must be assessed separately.

GDPR Controls

Subject rights and data controls.

Technical controls that can support GDPR subject-rights procedures. The operator must validate completeness against the full deployment, including derived stores, backups, clients, and logs.

Art. 15 — Right of Access
Full profile data export via slm export. Supplies all stored memory records for a workspace. Verify completeness across indexes, logs, backups, and surrounding systems.
Art. 17 — Right to Erasure
Hard delete with verification. Operations are logged before execution. Verify that derived state, backups, projection indexes, and any surrounding systems are also cleared.
Art. 20 — Right to Portability
Structured, machine-readable export. SLM export produces JSON-structured output suitable for data portability requests. Verify completeness against all local data stores in the deployment.
Hash-chained Audit Trail
Tamper-evident log of write, update, and delete operations. Each entry is hash-chained to the previous entry, making the log inspectable and providing an ordered record of the complete operation sequence.
Opt-in PII Redaction on Save
When enabled, SLM strips recognized PII patterns before storage: email addresses, phone numbers, national ID numbers, payment card patterns, and IP addresses. Off by default — configure per workspace.
Access Control

Role-based access and workspace isolation.

Three roles per workspace. Workspaces are isolated — one workspace cannot read another workspace's memories. Single-user installs require no login.

Admin
Manage workspace users, settings, and configuration. Trigger export and erasure procedures. First-run setup creates an admin account; no default credentials are shipped.
Member
Read and write memories within the workspace. Cannot access another workspace's memory or alter access settings.
Viewer
Read-only access to workspace memories. Cannot write, modify, or trigger exports.
Workspace Isolation & Memory Scopes
Per-workspace isolation — workspaces are independent memory containers; a user in workspace A cannot read workspace B's personal memories.
Optional login gate — the require_login setting activates authentication; first-run admin account creation is required; no default credentials shipped.
Single-user installs — no login gate required; all local, no multi-tenant surface.
Memory scopes — personal (default, private to the user), shared (named profiles), global; recall is default-deny across scope boundaries.
Auditability

Bounded loops and durable ledgers.

Bounded-loop runs write a durable, auditable ledger. Each iteration is tagged and reviewable — relevant for human-oversight and traceability obligations under EU AI Act Art. 14.

bounded loop — audit ledger
# Run a bounded loop — each iteration is tagged and logged durably $ slm loop run review-cycle --max-iterations 5
✓ Loop started · tag: loop:review-cycle · ledger: durable iter 1/5 · op_id: <opaque-id> · state: complete iter 2/5 · op_id: <opaque-id> · state: complete ✓ Bounded loop complete · 5/5 iterations logged to audit ledger
# Inspect the loop audit history $ slm loop history review-cycle --json "iterations": 5 · "all_logged": true · "ledger_hash": "sha256:..."
Mapping

Article-by-article self-assessment.

How each relevant EU AI Act and GDPR requirement maps to Mode A and Mode C in the built-in checker. Self-assessment posture only — not a legal compliance determination.

Article Scope Mode A self-assessment posture Mode C self-assessment posture
Art. 10 — Data Governance Data quality, relevance, and representativeness requirements may apply to the complete system. ✓ local path Local controls and export tools provide evidence; the operator verifies data quality and governance. ⚑ provider-flagged Provider processing and terms become part of the assessment.
Art. 13 — Transparency Applicable systems may need information that lets deployers interpret outputs. ✓ local path Candidate, fusion, and reranker diagnostics provide retrieval evidence. ⚑ provider-flagged Model synthesis adds another component to document.
Art. 14 — Human Oversight Humans must be able to understand, intervene, and override AI decisions. ✓ local path Full dashboard visibility. Trust gates. Manual memory management. ✓ local path Same oversight tools available. Cloud LLM output can be reviewed before use.
GDPR Art. 15 — Right of Access Applicable deployments may need a complete subject-access procedure. ✓ local path SLM export tools supply part of the evidence; indexes, logs, backups, clients, and surrounding systems remain in scope. ⚑ provider-flagged Include provider-held data and logs in the complete procedure.
GDPR Art. 17 — Right to Erasure Applicable deployments may need verified erasure across every copy and processor. ✓ local path Hard delete with verification; operation logged before execution. Verify derived state, backups, and surrounding systems separately. ⚑ provider-flagged Verify local deletion and the provider's deletion and retention process.
GDPR Art. 20 — Right to Portability Applicable deployments may need structured, machine-readable export for portability. ✓ local path SLM export produces structured, machine-readable JSON output. Verify completeness against all local data stores. ⚑ provider-flagged Include provider-held data representations in the portability scope.

"Local path" and "provider-flagged" are outputs of the built-in checker — not legal determinations. Mode B follows the same local-path assessment as Mode A. Engage qualified legal counsel for the complete compliance evaluation of your deployed system.

Common Questions

Questions about governance.

Technical Controls

Start with Mode A when a local core path fits.
Validate before any compliance claim.

Validate optional network features, provider terms, operator duties, and the surrounding AI system before making any compliance or data-residency claim. Qualified legal advice is required for the complete assessment.

Install V4.0 Compare Modes