> For the complete documentation index, see [llms.txt](https://docs.ruler.nl/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ruler.nl/about-ruler/faq.md).

# Frequently asked questions

Short answers to the questions compliance, legal and security teams ask most often about Ruler.

Short answers, with links to the page that has the detail. If your question is not here, e-mail Ruler support at <info@ruler.nl> or get in touch with your Ruler contact.

## Sources and regulation

<details>

<summary>Which sources of law and regulation does Ruler use?</summary>

Dutch, Belgian and European sources, including the AFM, DNB, ECB and the European Commission. The full list of sources and publication types is in the [Ruler alerting policy](https://ruler.nl/app/uploads/2026/08/20260615-Alerteringsbeleid-Ruler-NLBEEU.pdf). See [How Ruler's content is produced](/about-ruler/editorial-process.md).

</details>

<details>

<summary>Only primary sources, or also secondary sources and guidance?</summary>

Also secondary sources, guidance documents and publications by supervisors. The alerting policy explains which sources Ruler does and does not alert on, and why.

</details>

<details>

<summary>How does Ruler make sure changes are processed in time?</summary>

Scrapers for laws and regulations run every six hours. News scrapers run every two hours between 07:00 and 19:00. The editorial team assesses the collected content daily and publishes what is relevant.

</details>

## Explainability and transparency

<details>

<summary>Is every obligation traceable to a source?</summary>

Yes. Every alert, radar item, consultation and Signalling item is linked to the original source publication.

</details>

<details>

<summary>Can a user see how an obligation or change was identified?</summary>

Yes. The editors announce every new obligation or change in an alert and explain it there. The alert states which source published it and when. See [Reading an alert](/inbox/reading-an-alert.md).

</details>

<details>

<summary>Does Ruler distinguish between legislation, interpretation, guidance and recommendations?</summary>

There is no separate field or label for this. The distinction is clear from the title, the summary and the editor's note, which together show whether an alert concerns legislation, guidance or recommendations, or informative content without new standards or interpretations.

</details>

## Quality assurance

<details>

<summary>How is the quality of Ruler's content monitored?</summary>

An editor checks all content before it is published in Ruler. In addition, Ruler tests source links periodically, measures source completeness every quarter against its SLA commitments, and shows customers which sources it consults. See [How quality is safeguarded](/about-ruler/editorial-process.md#how-quality-is-safeguarded).

</details>

<details>

<summary>What if a relevant source is missing?</summary>

Report it. The editorial team assesses every request. If the source is within the agreed scope, it is added, monitored through a new scraper and included in the alerting policy. The requesting customer is informed, and where relevant the users of the profiles concerned.

</details>

## Human in the loop

<details>

<summary>Does Ruler apply changes automatically, or present them as proposals?</summary>

Neither. Ruler makes no automatic changes and does not generate proposals. The user decides whether a new obligation or change affects their compliance and control framework, archives alerts that are not relevant, and links actions or updates control measures for those that are.

</details>

<details>

<summary>What validation is expected from users?</summary>

Assess in the alert whether the obligation is relevant. If not, archive the alert; if the topic or radar item as a whole does not apply, unfollow it. If it is relevant, upload or update the linked control measures (policies, procedures, controls) and rescore the risks. See [Your role: the human in the loop](/about-ruler/editorial-process.md#your-role-the-human-in-the-loop).

</details>

## AI

<details>

<summary>Which AI technology and model providers does Ruler use?</summary>

None in production. Ruler currently has no AI functionality. The AI feature in development uses OpenAI GPT foundation models via Microsoft Foundry. See [AI at Ruler](/about-ruler/ai.md).

</details>

<details>

<summary>Is customer data used to train models?</summary>

No. Customer data and user interactions are never used to train or improve models.

</details>

<details>

<summary>Where does processing take place?</summary>

Within the EU.

</details>

<details>

<summary>How does Ruler deal with the EU AI Act?</summary>

With no AI in production, no AI Act obligations currently rest on the product. The feature in development has been classified in advance as limited risk, not high risk, and meets the transparency obligation: AI output is recognisable and traceable to its source, with no automatic effect without human intervention. See [EU AI Act](/about-ruler/ai.md#eu-ai-act).

</details>

<details>

<summary>How are model changes managed and communicated?</summary>

Model versions are pinned in Microsoft Foundry; there is no automatic upgrade. Changes to the model, model version or prompt logic go through change management with review, acceptance testing and formal approval. Functional changes are communicated via release notes; material changes and a change of provider are announced in advance. See [How model changes are managed](/about-ruler/ai.md#how-model-changes-are-managed).

</details>

## Assurance

<details>

<summary>Which assurance reports or certifications are available?</summary>

Ruler B.V. has a SOC 2 Type II report. CERRIX B.V. is ISO/IEC 27001:2022 certified and has an ISAE 3402 Type II report, which is being converted to SOC 2 Type II. See [Trust and compliance](/about-ruler/trust-and-compliance.md).

</details>