LOCUS SRL (Locus Labs)

This Regulatory Compliance Dossier documents the statutory baseline for Locus Labs Regulatory Governance Engine (locuslabs.tech), operated by LOCUS SRL (Locus Labs). Conducted pursuant to Regulation (EU) 2024/1689 (Artificial Intelligence Act), Regulation (EU) 2016/679 (GDPR), Regulation (EU) 2023/2854 (EU Data Act), and Regulation (EU) 2022/2554 (DORA), the system is classified under the EU AI Act as LIMITED_RISK_ART_50. The organization operates in the legal capacity of a DEPLOYER under Article 3 of the EU AI Act and acts as a PROCESSOR under GDPR Article 4. The system is subject to mandatory transparency obligations under Article 50(1) (human-interaction disclosures) and Article 50(2) (machine-readable marking and watermarking for synthetic media, enforceable by December 2, 2026). Under Chapter VI of the EU Data Act (applicable since September 12, 2025), customers are contractually guaranteed frictionless switching, standardized machine-readable data export, and zero switching fees prior to January 12, 2027. Declared sub-processors (Supabase EU (AWS Frankfurt eu-central-1), Cloudflare Europe (FRA/VIE Edge Network), Google Cloud EEA (Gemini 2.5 Flash Zero-Retention API)) are governed under GDPR Article 28 data processing addenda and Standard Contractual Clauses.