tegwick 7f135f9e0f Legal policy set: written before needed, dormant until a context activates

Operator ruling: no external determination in build mode, but keep the
set of legal policies for reuse when a work context needs one in place.

docs/regulatory/policies/ catalogues thirteen, keyed by activation
condition rather than by regime, with a retrieval table so a context
pulls a slice: first real user account pulls six of them; a
consumer-facing product in Germany pulls those plus accessibility. Two
are already active and nobody had noticed — commercial and tax retention,
and the e-invoicing receiving obligation that has been live since 2025
with no named owner in the estate. Four written in full; the rest carry
their trigger now and get their text when a context approaches, which is
the point.

RISK-POL-0011 is the argument for the whole catalogue: accessibility
cannot be retrofitted cheaply, so a policy retrieved at launch is a
rebuild while one read at design time is just a constraint.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

2026-08-20 23:36:22 +02:00

2.4 KiB

Raw Blame History

id	type	title	regime	status	activates_when	owner	written	cadence	clean_streak	last_checked	next_check
RISK-POL-0011	legal-policy	Accessibility of digital services	BFSG (European Accessibility Act, Directive 2019/882), EN 301 549 / WCAG	dormant	a consumer-facing digital service or product is offered in Germany — e-commerce, banking, e-books, ticketing, or a consumer app	risk-nexus	2026-08-20	instant	0	2026-08-20T21:30:00Z	2026-08-20T21:30:00Z

RISK-POL-0011 — accessibility

Dormant, and the most likely of the dormant set to activate. The estate has a consumer domain and design work in it; the day any of that is offered to consumers in Germany, this applies in full and without a grace period for new services.

Why it is written before it is needed

Accessibility cannot be retrofitted cheaply. It constrains component choice, colour, focus handling, form semantics and content structure — decisions taken early and expensively reversed. A policy retrieved at launch is a rebuild; a policy read at design time is a constraint like any other.

That is the whole argument for this catalogue existing, and this is the entry that demonstrates it.

What it requires, in outline

Conformance to the harmonised standard (EN 301 549, which carries WCAG at level AA) for the service's interface, and for its documentation and support.
An accessibility statement, published, saying what conforms and what does not.
Accessibility considered in the product's own conformity assessment, with records kept.

Micro-enterprises providing services are outside scope, which is a real exemption and also a fragile one to build on — it disappears with headcount or turnover, and the product does not become accessible by growing.

What it requires of systems

Design-time, not launch-time: semantic markup, keyboard operability, contrast and focus visibility, form labelling and error identification, no information-by-colour-alone, captions and alternatives for media. Plus a way to test these that runs before release rather than at it.

Evidence that would show this is met

A conformance assessment against EN 301 549; a published accessibility statement; automated and manual test results in the release path.

Nothing here binds any repo today. whynot-design and the consumer-domain repos are where it will land, and naming the owner is theirs, not the register's.

2.4 KiB Raw Blame History