Two dense, cross-referenced rulebooks rebuilt into navigable Obsidian vaults - one note per article, recital, clause, control and definition, with every cross-reference turned into a real, clickable link:
| Vault | Source | Notes | Links | Broken | Orphans |
|---|---|---|---|---|---|
EU-AI-Act-Vault/ |
Regulation (EU) 2024/1689 | 631 | 9,103 | 0 | 0 |
GDPR-Vault/ |
Regulation (EU) 2016/679 | 446 | 5,706 | 0 | 0 |
This repository ships two things:
- the vaults themselves - open one in Obsidian and browse the rules as a connected graph;
- two reusable skill files (for Claude Code and GitHub Copilot) that document the method used to build them - so you can regenerate a vault, or build one for another dense, cross-referenced body of rules, with an AI coding assistant.
Both are free and MIT licensed. They are also the foundation of ACTLAS, a commercial compliance platform that runs fully on-premises - see Free vaults, and the product built on them.
Rules of this kind are written to be correct, which means they are written in cross-references. To answer one practical question you jump between an article, two definitions, an annex entry and three recitals. These vaults turn those jumps into links you can click - and, following the same method, into typed edges a machine can walk.
The Act in full: 113 articles and 180 recitals verbatim, 13 annexes with their nested lists preserved, and the 50 defined terms that are not folded into an actor or concept note. The decision-relevant content is lifted below article level into first-class notes - the 8 prohibited practices, the 25 Annex III high-risk use cases tagged by sector, and 42 individual obligations, each bound to one actor and one paragraph.
EU-AI-Act-Vault/
├── 00 Index/ Home, How to Use, per-layer indexes
├── 01 Articles/ 113 articles, verbatim, with paragraph block anchors
├── 02 Recitals/ 180 recitals
├── 03 Definitions/ the Article 3 defined terms
├── 04 Annexes/ 13 annexes, nested lists preserved
├── 05 Chapters/ structural spine
├── 06 Actors/ provider, deployer, importer, ...
├── 07 Concepts/ editorial theme hubs + evidence expectations
├── 08 Related EU Law/ the Union instruments the Act references
├── 09 Prohibited Practices/ the Article 5(1) bans, one note each
├── 10 High-Risk Use Cases/ the Annex III taxonomy, tagged by sector
├── 11 Obligations/ individual duties, by actor and paragraph
└── 99 Meta/ Ontology, Provenance, Build Report
Where to start: Is my system prohibited? go to 09 Prohibited Practices/. Is it
high-risk? go to 10 High-Risk Use Cases/ and filter by the sector/... tag. What must we
do, and who does it? go to 11 Obligations/.
The same treatment for data protection: 99 articles and 173 recitals verbatim, and the Article 4 definitions. What the AI Act expresses as risk tiers, the GDPR expresses as grounds, rights and situations - so the promoted notes differ. The six Article 6(1) lawful bases each get a note, as do the eight Chapter III data subject rights, alongside 14 recognisable processing contexts (special categories, DPIA triggers, third-country transfers, children's data, direct marketing and more) and 43 obligations bound to the controller, the processor or the DPO.
GDPR-Vault/
├── 00 Index/ Home, How to Use, per-layer indexes
├── 01 Articles/ 99 articles, verbatim, with paragraph block anchors
├── 02 Recitals/ 173 recitals
├── 03 Definitions/ the Article 4 defined terms
├── 04 Chapters/ structural spine
├── 05 Actors/ controller, processor, data subject, DPO, ...
├── 06 Concepts/ editorial theme hubs + evidence expectations
├── 07 Related EU Law/ the instruments the Regulation references
├── 08 Lawful Bases/ the six Article 6(1) grounds, one note each
├── 09 Data Subject Rights/ the Chapter III rights, one note each
├── 10 Processing Contexts/ classification entry points, tagged by sector
├── 11 Obligations/ individual duties, by actor and paragraph
└── 99 Meta/ Ontology, Provenance, Build Report
Where to start: Which ground can we rely on? go to 08 Lawful Bases/. Someone has made a
request - go to 09 Data Subject Rights/. Does this activity need a DPIA, or is it a
transfer? go to 10 Processing Contexts/.
Open either vault folder as a vault in Obsidian, then press
Ctrl/Cmd + G for the graph view - the colour groups you see in the images above are
preconfigured per layer. Start from 00 Index/Home, or 00 Index/How to Use This Vault. There
is no build step and there are no dependencies: the vault is the artifact.
Each vault is a deterministic projection of its source. Two design rules keep them honest:
- Authoritative and editorial are never blurred. Article, recital, annex and definition
text is reproduced verbatim where the source permits it; everything written for this project
- concept summaries, regimes, evidence expectations - carries
status: editorial, and every heuristic section carries a visible Derivation note.
- concept summaries, regimes, evidence expectations - carries
- Nothing is invented. Neither regulation publishes an official recital-to-article mapping, so neither vault draws one; recitals connect through concept hubs and the references their own text makes.
Every enumerated point also carries a block anchor derived from its citation path, so any point
is individually addressable: [[Article 14#^p4]], [[Annex III#^5-c]]. See each vault's
99 Meta/Ontology.md for the full model and 99 Meta/Provenance.md for the source record.
The method that produced these vaults - including a typed Neo4j graph projection and the pitfalls that cost real debugging time - is packaged so an AI coding assistant can apply it to another regulation or standard, or regenerate a vault from its official source:
- Claude Code -
.claude/skills/legal-text-to-obsidian-vault/SKILL.md - GitHub Copilot -
.github/prompts/legal-text-to-obsidian-vault.prompt.mdand.github/copilot-instructions.md
Everything in this repository - the two vaults and the skill files - is free and MIT licensed. Clone it, open it in Obsidian, regenerate it, build a vault for a regulation of your own. No signup, no gate, no telemetry. It stands on its own and is meant to.
ACTLAS is the commercial product built on the same method. Where a vault is something a person reads, ACTLAS is something that reasons over the same material: each regulation projected into a typed Neo4j graph, an agent that classifies a system, derives the obligations that attach and hands back the exact path it walked with citations to the paragraph, and a spec linter that overlays your own system specification on the law and shows the duties nothing in it yet covers - including against drafts that have not been voted yet.
The agent classifies a system, derives the duties that attach to each actor, and hands back the path it walked - every claim carrying its article and paragraph.
Every cross-reference in the regulation as a directed, trust-labelled edge - 620 nodes and 3,279 typed edges for the EU AI Act alone, each layer its own node type. Search it, re-layout it, expand a neighbourhood, export the sub-graph as PNG or JSON.
The same material as the vaults, projected into Neo4j. Open any node for its verbatim text, its provenance and every relation it has, each edge labelled verbatim, curated, heuristic or mechanical.
The spec linter overlays your own system on the law - the regime it lands in, the flags it trips, and the obligations nothing in the design yet answers. The base graph is never modified.
It is delivered on-premises, and that is the point. The graph store, the reasoning engine, the document vault and - if you want - the model itself all run inside your own infrastructure. It is bring-your-own-key: point it at your own account with any major provider and the credentials stay in your secret store, on your contracts and your billing. Or skip the providers entirely and serve open models fully locally through Ollama, which makes the whole deployment zero-egress. No specification, log or piece of evidence leaves your network.
Every model call the platform makes is recorded and handed back to you: comprehensive monitoring and observability - cost, tokens in and out, average and p95 latency, error rate, volume over time, a per-provider breakdown and the individual calls behind it. Compliance work has to be auditable, and that has to include the machine doing it: what was asked, of which model, at what cost, and how long it took.
Cost, latency and volume of every LLM interaction - chat loops, classification, linting, evaluation and connectivity tests - down to the individual call.
The regulation graphs are versioned and maintained by our technical and compliance team. Like the vaults, it never concludes "compliant".
Currently covering the EU AI Act and GDPR, with more regulations added on request. The remaining screens - the evaluation set and the model-provider controls - are on the site: https://actlas.adoptintelligence.com/
The EU AI Act and GDPR texts are reproduced from the official EUR-Lex renditions of Regulation
(EU) 2024/1689 and Regulation (EU) 2016/679; every note deep-links back to its source anchor.
The full provenance record for each vault is in its 99 Meta/Provenance.md.
This project reorganises rules for navigation and analysis. It is not legal advice, not an authoritative interpretation, and it produces no compliance conclusions. It is not affiliated with or endorsed by the European Union.
Editorial content and the skill files: MIT (see LICENSE). The verbatim text of
the EU regulations is © European Union, reused from EUR-Lex under the Commission's reuse policy
with source acknowledgment.
A project by Adopt Intelligence. The on-premises product built on these vaults: ACTLAS.