# Landfall

> Turn regulation into engineering work you can ship and audit.

Landfall is a compliance-to-engineering tool for public bodies, banks and product teams: it reads regulatory text — the EU AI Act, the GDPR, child-safety law, NIST and ISO standards — and turns the obligations that apply to your product into prioritised, citation-backed engineering work items.

Landfall maps the text of a regulation to the specific engineering work a
product team has to do, and keeps the citation attached to every item. The
pages below are public and free to read; the obligation summaries are
plain-language restatements, not the source legal text, and none of it is
legal advice.

## Frameworks

One page per regulation or standard, listing its obligations with article
citation, category, severity and obligation type.

- [UK Online Safety Act 2023](https://landfalltech.io/explore/uk-osa): 23 public obligations. Ofcom-enforced duties of care for user-to-user and search services accessible in the UK.
- [Children's Online Privacy Protection Act](https://landfalltech.io/explore/coppa): 24 public obligations. FTC rules governing the collection of personal information from children under 13.
- [California Consumer Privacy Act (as amended by the CPRA)](https://landfalltech.io/explore/ccpa): 38 public obligations. Californians' rights to know, delete, correct and opt out of the sale or sharing of their personal information, and the duties of the businesses that hold it.
- [UK Age Appropriate Design Code](https://landfalltech.io/explore/uk-aadc): 27 public obligations. The ICO's Children's Code — data-protection-by-design standards for likely-child users.
- [California Age-Appropriate Design Code Act](https://landfalltech.io/explore/caadca): 27 public obligations. California's design-code duties for online services likely to be accessed by children.
- [EU Digital Services Act](https://landfalltech.io/explore/eu-dsa): 30 public obligations. Union-wide obligations for intermediary and platform services, with extra duties for VLOPs.
- [EU GDPR Children's Provisions (Article 8)](https://landfalltech.io/explore/eu-gdpr-k): 18 public obligations. The GDPR provisions specific to children's data and information-society-service consent.
- [EU General Data Protection Regulation](https://landfalltech.io/explore/eu-gdpr): 5 public obligations. The GDPR duties that drive a data protection impact assessment and limit solely automated decisions.
- [EU Artificial Intelligence Act](https://landfalltech.io/explore/eu-ai-act): 42 public obligations. Risk-tiered obligations for providers and deployers of AI systems in the Union.
- [Brazil LGPD — Children's Provisions](https://landfalltech.io/explore/br-lgpd): 31 public obligations. Brazil's general data-protection law, with the best-interest-of-the-child provisions.
- [Singapore PDPA — Children's Guidelines](https://landfalltech.io/explore/sg-pdpa): 18 public obligations. Singapore's data-protection regime and the PDPC guidance on children's personal data.
- [Australia Online Safety Act 2021](https://landfalltech.io/explore/au-osa): 20 public obligations. eSafety Commissioner duties, including the 2024 amendments and Basic Online Safety Expectations.
- [Ireland Online Safety Code](https://landfalltech.io/explore/ie-osc): 20 public obligations. Coimisiún na Meán's binding code for designated video-sharing platform services.
- [NIST Cybersecurity Framework](https://landfalltech.io/explore/nist-csf): 25 public obligations. The NIST framework for identifying, protecting, detecting, responding, and recovering.
- [NIST Privacy Framework](https://landfalltech.io/explore/nist-pf): 23 public obligations. The NIST companion framework for managing privacy risk across the data lifecycle.
- [W3C Web Content Accessibility Guidelines](https://landfalltech.io/explore/w3c-wcag): 24 public obligations. The W3C accessibility guidelines, in their child-relevant application.

## Guides

Long-form writing on how these rules land in a product, each grounded in the
obligations above.

- [AADC vs COPPA: why 'under 18' and 'under 13' are different compliance universes](https://landfalltech.io/guides/aadc-vs-coppa-age-thresholds): COPPA is a data-privacy statute that gates collection from under-13s behind parental consent; the UK AADC is a design code protecting every under-18 through age-appropriate defaults. The gap is where teams get caught.
- [EU AI Act Risk Tiers Explained for Deployers](https://landfalltech.io/guides/eu-ai-act-risk-tiers-for-deployers): What high-risk means under Regulation (EU) 2024/1689, the Annex III areas, how provider and deployer duties differ, and the Art. 2(3) and 2(6) exclusions.
- [Does the EU AI Act Apply to My Project?](https://landfalltech.io/guides/does-the-ai-act-apply-to-my-project): A scoping walk-through: AI system or not, provider or deployer, Annex III areas, exclusions, body type, Art. 50 features, and what out of scope means.
- [FRIA Under Article 27 for Public Bodies](https://landfalltech.io/guides/fria-article-27-public-bodies): Who must perform a fundamental rights impact assessment, the six elements it contains, how it relates to a GDPR DPIA, and how the Dutch IAMA fits.
- [Registering High-Risk AI as a Public Authority Deployer](https://landfalltech.io/guides/high-risk-ai-registration-public-deployer): The Art. 49(3) EU database duty for public authorities, the Dutch Algoritmeregister entry, what a tool can pre-fill, and which fields always need a human.
- [DPIA Screening Criteria for AI Systems](https://landfalltech.io/guides/dpia-screening-criteria-ai-systems): The nine WP248 criteria for a GDPR Art. 35 DPIA, how they behave when an AI system is involved, and when Art. 36 prior consultation is possible.
- [Prohibited AI Practices Under Article 5](https://landfalltech.io/guides/prohibited-ai-practices-article-5): The eight practices Regulation (EU) 2024/1689 bans outright, in force since 2 February 2025, and why a screening tool should say review rather than pass.
- [Transparency Duties Under Article 50](https://landfalltech.io/guides/ai-act-article-50-transparency-duties): Art. 50 disclosure duties for chatbots, emotion recognition, biometric categorisation, deep fakes and AI-generated public text, and how to evidence them.
- [Finding AI in a Codebase](https://landfalltech.io/guides/finding-ai-in-a-codebase): What static detection of ML frameworks, LLM SDKs, model artifacts, scoring logic and agent frameworks can and cannot tell you about AI Act scope.
- [Keeping PII Out of US-Hosted Models](https://landfalltech.io/guides/keeping-pii-out-of-us-hosted-models): EU-hosted and local model options, a per-project residency policy that fails closed, and the questions to put in an AI provider procurement checklist.
- [The UK Children's Code: Fifteen Standards as a Checklist](https://landfalltech.io/guides/uk-aadc-fifteen-standards-checklist): The ICO's Age Appropriate Design Code, in force since September 2021, turned standard by standard into the product decision each one asks for.
- [COPPA Verifiable Parental Consent Methods](https://landfalltech.io/guides/coppa-verifiable-parental-consent-methods): COPPA parental-verification methods, their notice and disclosure conditions, the 2025 dates, and the distinction between voice recordings and biometric identifiers.
- [California's Age-Appropriate Design Code: What Still Applies](https://landfalltech.io/guides/california-aadc-what-still-applies): AB 2273, the NetChoice v. Bonta injunctions, which provisions have been enjoined, and what a product team should still build while the litigation runs.
- [UK Online Safety Act Duties for Children's Services](https://landfalltech.io/guides/uk-online-safety-act-children-duties): Children's access assessment, children's risk assessment, the Protection of Children Codes and highly effective age assurance, with Ofcom's 2025 deadlines.
- [DSA Article 28: Protecting Minors on Online Platforms](https://landfalltech.io/guides/eu-dsa-article-28-minors): The four paragraphs of Art. 28, who counts as accessible to minors, and the Commission's July 2025 guidelines on age assurance, defaults and recommenders.
- [Age Assurance Methods Compared](https://landfalltech.io/guides/age-assurance-methods-compared): Self-declaration, age estimation, age verification and parental attestation: what the UK AADC, UK OSA and EU DSA expect, and how to keep the data minimal.
- [High-Privacy Defaults for Child Accounts](https://landfalltech.io/guides/high-privacy-defaults-for-child-accounts): Visibility, contact, geolocation, profiling, nudge techniques and parental controls, set feature by feature under AADC standards 7 to 13 and DSA Art. 28.
- [Australia's Under-16 Social Media Minimum Age](https://landfalltech.io/guides/australia-under-16-social-media-minimum-age): The Social Media Minimum Age Act 2024, in effect from 10 December 2025: reasonable steps, which services are in scope, and the eSafety Commissioner's role.

## Help guides (EN/NL)

How to run an EU AI Act and DPIA pre-scan in Landfall and how to read the
report. Every guide is published in English and Dutch at the same URL; the
language toggle on the page switches between them.

- [What the AI Act pre-scan is](https://landfalltech.io/help/guides/what-the-prescan-is): One page for a first-time reader: who the pre-scan is for, what it produces, what it deliberately does not decide, who signs off, and how it sits beside the IAMA, the DPIA and the Algoritmeregister. (NL: Wat de AI-pre-scan is)
- [Questionnaire field guide](https://landfalltech.io/help/guides/questionnaire-field-guide): Every question the pre-scan asks, in plain language, with the provision it feeds and where the answer normally lives in a Dutch public body. (NL: Veldgids bij de vragenlijst)
- [Reading the pre-scan report](https://landfalltech.io/help/guides/reading-the-report): What each risk tier means, why an applicable prohibition is not automatically a finding, what the six duty flags are based on, and why the register draft is deliberately incomplete. (NL: Het pre-scanrapport lezen)
- [Engineer setup: code sources, the scanner and the CI gate](https://landfalltech.io/help/guides/engineer-setup): How to connect a repository, exactly what the scanner reads and never reads, what does and does not leave the server, how the residency policy fails closed, and how to wire the decision check into the pipeline. (NL: Inrichting voor ontwikkelaars: codebronnen, de scanner en de CI-poort)

## Product

- [Features](https://landfalltech.io/features): what Landfall does — obligation mapping, a planned backlog engineers can run, behaviour checks of the running product (including signed-in child accounts), evidence ranked by how much it proves, and the audit trail.
- [Pricing](https://landfalltech.io/pricing): free for pilot partners, self-hosting for public bodies; commercial tiers are published at general availability.
- [Trust and security](https://landfalltech.io/trust): data handling, AI-provider residency policy, and the integrations that send data out.
- [How it works](https://landfalltech.io/how-it-works): the questionnaire, the mapping step, the review gate and the export.
- [FAQ](https://landfalltech.io/faq): common questions about scope, AI use and data.
- [Changelog](https://landfalltech.io/changelog): what shipped, most recent first.

Full obligation text index: https://landfalltech.io/llms-full.txt