Regulations & use cases

One evidence chain. Many people asking for it.

Each guide explains one regulation or one use case for a technical decision-maker: what it is, who it applies to and when, what it asks of your development process — and, honestly, what recorded evidence supports. Evidence, not a legal opinion.

Regulations

Customer and tender requirements: answering "how much of your code is AI-generated, and how is it quality-assured?" with evidenceWhy procurement and tenders ask how AI-written code is reviewed, what a defensible vendor answer contains, and what a recorded evidence chain supports.Last reviewed 2026-08-21 · 8 min read
EU AI Act and AI-assisted development: what Article 50, human oversight and technical documentation ask of your recordsWhat the AI Act asks when AI writes your code: Article 50 since 2 August 2026, deferred high-risk duties, and what recorded development evidence supports.Last reviewed 2026-08-21 · 9 min read
EU Cyber Resilience Act: what software vendors must document about secure development — and how to evidence itWhat the Cyber Resilience Act asks of software vendors: secure-development documentation, reporting from 11 September 2026, full application 11 December 2027.Last reviewed 2026-08-21 · 9 min read
EU Product Liability Directive (2024/2853): what software makers must be able to show — and how to evidence itSoftware is a product from 9 December 2026: what the recast Product Liability Directive asks of your development records, and what recorded evidence supports.Last reviewed 2026-08-21 · 9 min read
ISO/IEC 27001 and SOC 2 audits: the change-management evidence auditors sample — and how to have it readyWhat ISO/IEC 27001 and SOC 2 audits ask of change-management and review controls, why sampled evidence beats policy text, and what a recorded chain supports.Last reviewed 2026-08-21 · 8 min read
NIS2 and DORA for software vendors: what supply-chain and ICT-risk rules push down to you — and what evidence supportsHow NIS2 and DORA reach software vendors via customers' supply-chain and ICT-risk duties, what documentation they ask for, and what recorded evidence supports.Last reviewed 2026-08-21 · 9 min read

Use cases

A necessary honesty: OLOBOLO is evidence, not a legal opinion. Mapping notes show where the chain supports each framework; your counsel decides what compliance requires. No tool can promise the latter — be wary of any that does.