From 5a7e4ac2d412754e07be2780686a5ae394697bd6 Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 22 Sep 2026 08:26:43 +0200 Subject: [PATCH] Review the overdue regulatory records MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit RISK-REG-0001: eight-year voucher period (BEG IV) confirmed against secondary sources and §147 AO. RISK-POL-0009/0002: positions unchanged; new restore evidence noted as partial. RISK-POL-0012: receiving duty still unowned; issuing phase-in dates added, flagged for confirmation. RISK-POL-0011: stays dormant. Co-Authored-By: Claude Opus 5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 6903@bnt-lap001 Assistant-Session: 8319e8a8-ffa6-4eb3-b8bf-b29945628f89 --- docs/regulatory/audit-retention-basis.md | 17 +++++------ .../RISK-POL-0002-retention-and-erasure.md | 25 +++++++++++++--- ...K-POL-0009-commercial-and-tax-retention.md | 30 ++++++++++++++----- .../policies/RISK-POL-0011-accessibility.md | 17 ++++++++--- .../policies/RISK-POL-0012-e-invoicing.md | 24 ++++++++++++--- 5 files changed, 85 insertions(+), 28 deletions(-) diff --git a/docs/regulatory/audit-retention-basis.md b/docs/regulatory/audit-retention-basis.md index 8bb4480..ec07a28 100644 --- a/docs/regulatory/audit-retention-basis.md +++ b/docs/regulatory/audit-retention-basis.md @@ -6,13 +6,13 @@ status: determined-internally owner: risk-nexus determined: "2026-08-20" finding: RISK-F-0008 -sources_read: "GDPR Arts 5, 6, 17, 21, 32; Recitals 49, 65; HGB §257; AO §147" +sources_read: "GDPR Arts 5, 6, 17, 21, 32; Recitals 49, 65; HGB §257; AO §147; BEG IV (BGBl. 2024 I Nr. 323) secondary summaries" external_review: none -last_checked: "2026-09-02T08:11:18Z" -next_check: "2026-09-02T09:11:18Z" -cadence: 1h -clean_streak: 1 -checked_by: "grok/risk-nexus" +last_checked: "2026-09-22T06:25:39Z" +next_check: "2026-09-22T14:25:39Z" +cadence: 8h +clean_streak: 2 +checked_by: "worsch" --- # RISK-REG-0001 — the retention basis, written down @@ -138,7 +138,7 @@ can argue with is stronger than an honest blank. | --- | --- | --- | | Operator and agent security audit records | **12 months** | Art 6(1)(f) with Art 32. Twelve months covers an annual review cycle and the ordinary lag between an incident happening and being discovered. Longer needs a specific reason, per record class, not a habit. | | Counterparty transaction evidence | **3 years, running to the end of the third calendar year** | Art 17(3)(e), defence of legal claims, tracking the general German limitation period (§195, §199 BGB — three years from the end of the year in which the claim arose). Evidence outliving the claim it could defend has no ground. | -| Accounting vouchers (*Buchungsbelege*) | **8 years** | §147 AO / §257 HGB. Shortened from ten years by the Fourth Bureaucracy Relief Act with effect from 2025. **Worth confirming before relied on** — it is recent and this repo has not verified it against the current text. | +| Accounting vouchers (*Buchungsbelege*) | **8 years** | §147 AO / §257 HGB. Shortened from ten years by the Fourth Bureaucracy Relief Act (BEG IV, promulgated 2024-10-29) with effect from 2025-01-01, including vouchers whose period had not expired by then. Confirmed 2026-09-22 against secondary sources (Haufe, datenschutz-notizen) and the `gesetze-im-internet.de` text of §147 AO. This is not a qualified review. | | Books, inventories, annual accounts | **10 years** | §257 HGB, unchanged by that reform. | | Commercial and business letters | **6 years** | §257 HGB. | | Personal data in audit records falling in none of the above | **delete** | No ground identified means no retention. The operator's minimisation ruling of 2026-08-20 should mean this category is close to empty by construction. | @@ -169,8 +169,6 @@ table as a compliance claim. - **A keyed commitment working** (`RISK-F-0008`). Then erasure becomes available and the retention argument narrows to the retained-by-obligation rows only, which are the strong ones. -- **Confirmation of the eight-year voucher period.** Flagged above; the rest of - the table does not depend on it. - **Any of the three triggers** for buying an external determination, which remain unruled. @@ -180,3 +178,4 @@ unresolved. - **2026-09-01** — not clean: the dated review found that the 2026-08-20 target-period amendment had never advanced this record's check state. The targets now stand explicitly; achievement under the shared backup horizon and keyed-commitment feasibility remain open. Cadence 1h → instant; checked again immediately. - **2026-09-02** — clean check: grounds and target periods unchanged; still waiting on the platform-pg co-residency horizon. Cadence instant → 1h (1 clean in a row); next check 2026-09-02 09:11Z. +- **2026-09-22** — clean check: Grounds and target periods unchanged; eight-year voucher period (BEG IV, from 2025-01-01) confirmed against secondary sources and AO §147; audit-core co-residency horizon and keyed commitment unchanged since 2026-09-02. Cadence 1h → 8h (2 clean in a row); next check 2026-09-22 14:25Z. diff --git a/docs/regulatory/policies/RISK-POL-0002-retention-and-erasure.md b/docs/regulatory/policies/RISK-POL-0002-retention-and-erasure.md index 2d3cb82..eb4dfda 100644 --- a/docs/regulatory/policies/RISK-POL-0002-retention-and-erasure.md +++ b/docs/regulatory/policies/RISK-POL-0002-retention-and-erasure.md @@ -8,10 +8,11 @@ activates_when: "any personal data is held — the commercial half (RISK-POL-000 owner: risk-nexus written: "2026-08-20" related: [RISK-POL-0009, RISK-REG-0001, RISK-F-0008] -cadence: instant -clean_streak: 0 -last_checked: "2026-08-20T21:30:00Z" -next_check: "2026-08-20T21:30:00Z" +cadence: 1h +clean_streak: 1 +last_checked: "2026-09-22T06:26:12Z" +next_check: "2026-09-22T07:26:12Z" +checked_by: "worsch" --- # RISK-POL-0002 — retention and erasure @@ -61,3 +62,19 @@ and verified co-residency horizon; a demonstrated restore proving the retained side works too. None of those exist yet, and `RISK-F-0008` carries the gap. + +**2026-09-22 review.** The position is unchanged and `RISK-F-0008` still +carries the gap. Two partial inputs have arrived since 2026-08-20: + +- `audit-core` (AUDIT-WP-0008) states it declares nothing above the 30-day + `platform-pg` default and will not extend any co-resident's horizon. That is + a *stated* contribution to the co-residency horizon. It does not verify the + instance maximum, which also depends on the other co-residents and on backup + retention. +- Restores from the retained side are demonstrated for `apps-pg` and Forgejo + (RPF-WP-0029, RPF-WP-0038). That shows the retained side works, but it + proves no deletion at expiry. + +## Reviews + +- **2026-09-22** — clean check: Position unchanged; audit-core states a 30-day contribution (unverified instance maximum); restore evidence exists, no deletion evidence; F-0008 carries the gap. Cadence instant → 1h (1 clean in a row); next check 2026-09-22 07:26Z. diff --git a/docs/regulatory/policies/RISK-POL-0009-commercial-and-tax-retention.md b/docs/regulatory/policies/RISK-POL-0009-commercial-and-tax-retention.md index 1439654..f9b0eaf 100644 --- a/docs/regulatory/policies/RISK-POL-0009-commercial-and-tax-retention.md +++ b/docs/regulatory/policies/RISK-POL-0009-commercial-and-tax-retention.md @@ -7,10 +7,11 @@ status: active activates_when: "the estate keeps commercial books or issues and receives invoices — already true" owner: risk-nexus written: "2026-08-20" -cadence: instant -clean_streak: 0 -last_checked: "2026-08-20T21:30:00Z" -next_check: "2026-08-20T21:30:00Z" +cadence: 1h +clean_streak: 1 +last_checked: "2026-09-22T06:26:01Z" +next_check: "2026-09-22T07:26:01Z" +checked_by: "worsch" --- # RISK-POL-0009 — commercial and tax retention @@ -31,9 +32,11 @@ made or the document created — not from the document's own date. That detail is the one most often got wrong, and it always extends the period rather than shortening it. -**The eight-year figure is recent and this repo has not verified it against the -current text.** Confirm before relying on it for a deletion decision; ten years -is the safe reading if nobody has. +**The eight-year figure was confirmed on 2026-09-22** (see `RISK-REG-0001`). It +comes from BEG IV, promulgated 2024-10-29, and has applied since 2025-01-01, +including to vouchers whose period had not run out by then. This rests on +secondary sources and the published §147 AO text, not on a qualified review. +Books and annual accounts stay at ten years. ## What it requires of systems @@ -64,3 +67,16 @@ retained period; a deletion routine that actually runs at expiry. None of those exist yet. This policy is `active` in the sense that the duty applies, not in the sense that it is demonstrably satisfied — and the register says which. + +**2026-09-22 review.** Some new evidence exists but it does not satisfy the +duty. Restores are now proven for `apps-pg` from the Scaleway primary and for +Forgejo from the Nextcloud secondary (RPF-WP-0029, RPF-WP-0038). Neither is a +restore from the oldest retained period, and neither lane holds books or +vouchers as a named record class. The secondary lane's 10 GiB quota holds about +two archives, which is far short of an eight-year horizon. There is still no +retention schedule and no expiry deletion routine, so the position above is +unchanged. + +## Reviews + +- **2026-09-22** — clean check: Position unchanged: duty applies, not demonstrably met; eight-year voucher period confirmed; new restore evidence (apps-pg, Forgejo) does not cover book/voucher classes or the oldest period. Cadence instant → 1h (1 clean in a row); next check 2026-09-22 07:26Z. diff --git a/docs/regulatory/policies/RISK-POL-0011-accessibility.md b/docs/regulatory/policies/RISK-POL-0011-accessibility.md index 1929a42..51af47d 100644 --- a/docs/regulatory/policies/RISK-POL-0011-accessibility.md +++ b/docs/regulatory/policies/RISK-POL-0011-accessibility.md @@ -7,10 +7,11 @@ status: dormant activates_when: "a consumer-facing digital service or product is offered in Germany — e-commerce, banking, e-books, ticketing, or a consumer app" owner: risk-nexus written: "2026-08-20" -cadence: instant -clean_streak: 0 -last_checked: "2026-08-20T21:30:00Z" -next_check: "2026-08-20T21:30:00Z" +cadence: 1h +clean_streak: 1 +last_checked: "2026-09-22T06:26:29Z" +next_check: "2026-09-22T07:26:29Z" +checked_by: "worsch" --- # RISK-POL-0011 — accessibility @@ -58,3 +59,11 @@ statement; automated and manual test results in the release path. Nothing here binds any repo today. `whynot-design` and the consumer-domain repos are where it will land, and naming the owner is theirs, not the register's. + +**2026-09-22 review.** The policy stays dormant. No consumer-facing digital +service offered in Germany is on record. The micro-enterprise exemption for +services is still the fragile basis described above. + +## Reviews + +- **2026-09-22** — clean check: Dormant: no consumer-facing service on record. Cadence instant → 1h (1 clean in a row); next check 2026-09-22 07:26Z. diff --git a/docs/regulatory/policies/RISK-POL-0012-e-invoicing.md b/docs/regulatory/policies/RISK-POL-0012-e-invoicing.md index f126fea..039d92d 100644 --- a/docs/regulatory/policies/RISK-POL-0012-e-invoicing.md +++ b/docs/regulatory/policies/RISK-POL-0012-e-invoicing.md @@ -7,10 +7,11 @@ status: active activates_when: "the estate is a German business receiving B2B invoices — already true" owner: risk-nexus written: "2026-08-20" -cadence: instant -clean_streak: 0 -last_checked: "2026-08-20T21:30:00Z" -next_check: "2026-08-20T21:30:00Z" +cadence: 1h +clean_streak: 1 +last_checked: "2026-09-22T06:26:29Z" +next_check: "2026-09-22T07:26:29Z" +checked_by: "worsch" --- # RISK-POL-0012 — e-invoicing @@ -53,3 +54,18 @@ structured form, retrievable at eight years. Not established. If a supplier sends one tomorrow, nobody here can say what happens to it — which is a small, ordinary, entirely fixable gap, and exactly the kind that only becomes visible when it is written down. + +**2026-09-22 review.** The position is unchanged. The receiving duty is live +and still has no named owner in the estate, five weeks after this record was +written. The issuing dates under §27(38) UStG are: + +- **2027-01-01** for businesses with prior-year turnover above EUR 800,000; +- **2028-01-01** for everyone else. + +A turnover below the threshold therefore leaves about fifteen months, not +three. This is from general knowledge of the Wachstumschancengesetz and has +not been re-read against the current text. Confirm it before planning to it. + +## Reviews + +- **2026-09-22** — clean check: Receiving duty live, still no named owner; issuing phase-in dates noted (2027/2028), to be confirmed. Cadence instant → 1h (1 clean in a row); next check 2026-09-22 07:26Z.