Advisory · Training · Formal rules

KROG RULES

Make legal requirements explicit, traceable and testable.

We help organisations model obligations, exceptions and deadlines, connect them to evidence, and document how conclusions were reached. Then we teach your people to do it themselves.

Explore the AI Act, article by article See the courses See the engagements

01 · The fundamental problem

Compliance you can assert, or compliance you can prove

Regulation is written as rules. Organisations answer with narrative. The gap between the two is where fines, failed audits and unenforceable contracts live.

Where it breaks today

· Nobody can say which obligation a given control actually satisfies.
· Exceptions and derogations are claimed, never reasoned through.
· Documentation is written once, then silently goes out of date as the law changes.
· Contracts and policies use the same words to mean different things.
· No record of which version of the law a decision was made against.

What we deliver instead

· Every rule formalised as a position: who must do what, when, and under which exception.
· Documentation generated from facts, with its own derivation attached.
· A shared vocabulary so systems, contracts and records agree on meaning.
· The exact article, paragraph and point behind every claim.
· Your team trained to run it without us.

02 · Services

What you can buy

Advisory engagements and courses across data, technology, AI, security and governance. All areas are open for new engagements.

Data Governance

Advisory and courses on GDPR accountability, certification under GDPR-CARPA, processor arrangements, transfers, and the documentation that has to hold up under audit.

AI Governance

Governance of AI systems: conformity under the AI Act, risk classification, documentation, human oversight, and the evidence trail behind automated decisions. Article 17 quality management support, EN 18286 gap analysis, and structured modelling of requirements, responsibilities, controls and evidence.

Agentic Governance

Authorisation for autonomous agents: what an agent may do, on whose behalf, under which mandate, and how each action is bound to a rule that can be checked afterwards.

Security

Security as a governance question — risk analysis, treatment, audit and follow-up — expressed so that controls can be tied to the obligations they satisfy.

Standard, machine-readable and interoperable vocabularies and artifacts

Shared vocabularies, taxonomies and artifacts so that policies, records and contracts mean the same thing across systems and organisations — and can be exchanged without translation loss.

Contract Formalization, Analysis and Engineering

Turning contract text into precise structure: rights, obligations, prohibitions and deadlines made explicit, analysed for gaps and asymmetry, and engineered rather than copy-pasted.

Discuss an engagement

03 · Courses

Legal engineering courses

Featured · On request

EN 18286: AI quality management

Connect Article 17 quality management with explicit responsibilities, processes, controls and evidence. In-house training and workshops using structured information modelling and KROG rule logic.

View course topics Explore the standard

Programmes

Available now · 6 courses

Structured Consent

Modelling consent records, receipts, and notices to ISO/IEC TS 27560 and ISO/IEC 29184 — mapped to the GDPR.

Coming soon · 4 courses

GDPR & AI Act Operations

Records of Processing Activities · Personal Data Breach · Data Protection Impact Assessment · AI Act Compliance

Planned · 5 courses

Accountability & Certification

Governance · Lawfulness, transparency and rights · Data quality, storage and security · The processor's obligations · The certification mechanism

GDPR-CARPA course topics

GDPR-CARPA is the certification scheme under GDPR Article 42 approved by the CNPD in Luxembourg — 70 criteria across 30 subjects. The teaching follows the criteria set section by section, and can be run in-house for your team.

Explore all courses Criteria index

SECTION I

Accountability and governance

·The target of evaluation
·Policies and procedures
·The record of processing activities
·Facilitating data subjects' rights
·The data protection officer
·Data breaches
·Awareness and competencies

SECTION II-a

Lawfulness, transparency and rights

·Identifying and reviewing a legal basis
·The five bases other than consent
·Consent
·Special categories
·Objection, restriction, automated decisions
·Transparency
·Access, portability and transfers

SECTION II-b–f

Data quality, storage and security

·Purpose limitation and minimisation
·Accuracy and rectification
·Storage limitation and erasure
·Security: risk analysis and treatment
·Audit and follow-up
·DPIA and prior consultation
·Outsourcing

SECTION III

The processor's obligations

·The contract and documented instructions
·Security
·Audit and follow-up
·Subcontracting
·Transfers and the end of service

THE MECHANISM

How certification is examined

·Eligibility and the target of evaluation
·ISAE 3000 and what the auditor tests
·Nonconformities and the decision
·The certificate

BEYOND THE CRITERIA

What CARPA does not reach

·AI Act conformity
·Machine-readable documentation

04 · The engine

KROG data model and rule logic

Structure the information, state the rules, and trace the result. The KROG data model connects facts, sources and evidence; KROG rule logic expresses the conditions under which conclusions follow.

Explore the KROG data model Explore the KROG framework Request specification access

(K ∩ R ∩ O) ⊆ G

05 · Contact

Start with one article, one contract, one audit

For advisory engagements, in-house training or course enrolment, write to hello@signatu.com. Curious who is behind this? About Georg Philip Krog.