Terms and notice

Draft for counsel review. Applies to all TwinEthos data, packs, reports, APIs, and chat answers.

Not legal advice

TwinEthos data is informational only. It describes laws, regulations, standards, and frameworks as they relate to software that integrates with AI, and it offers TwinEthos's own recommended guardrails. It is not legal advice, does not create an attorney-client relationship, and is not a substitute for advice from a qualified lawyer about your specific facts and jurisdictions.

Review status

Each rule carries a review.provenance_status, and each pack carries a review.review_status (source_derived_draft → legal_reviewed → published). A pack is source_derived_draft until every rule in it has been legally reviewed. Rule provenance values:

primary_source_derived — anchored to the official source text and hash-verified, but not reviewed by a lawyer. Interpretation, applicability, and enforcement details may be incomplete or wrong.
tier_c_citation_only — cites a licensed standard, or a third-party text whose licence does not let TwinEthos redistribute it (for example OWASP material under CC BY-SA 4.0, or guidance whose publisher's terms bar commercial reuse), without reproducing it; read it at its publisher.
publisher_authored — a TwinEthos recommended guardrail: our opinion of what a responsible AI integration should do. It is never a legal or standards requirement.
legal_reviewed — a named reviewer has attested to the rule on the recorded date.

Licences

Recommended guardrails are open. The rule files in packs/recommended-guardrails/ are licensed under Creative Commons Attribution 4.0 International (CC BY 4.0, https://creativecommons.org/licenses/by/4.0/). Attribute as: "TwinEthos recommended guardrails, FloatingKey LLC, release <version>, CC BY 4.0". The licence covers TwinEthos's own text in those files; it does not make any guardrail a legal requirement, and the not-legal-advice terms above still apply. Controls (conditions/) shared with law rules, the law packs, sources, and the change feed are not covered and remain under the terms of your access.
Everything else (law packs, standard and framework packs such as ai-security and oecd-ai, conditions, sources, outputs, the change feed and the hosted MCP service) is proprietary, provided under the terms of your access. Third-party text stored in them stays under its publisher's terms (recorded per source as text_license).
The website and TwinEthos Lite. You may read, link to and quote the website, its explorer and TwinEthos Lite's answers, with attribution. Don't copy them in bulk (by script, crawler or repeated requests) to build a dataset, a competing service or a model's training data. For programmatic use, request MCP access; the hosted MCP service is provided under the terms of your access.

Detection findings are not legal conclusions

A detector reports detected, not_detected, or insufficient_evidence for a code construct. Whether an obligation applies to you depends on facts outside the repository (who you are, where your users are, what the system decides). Applicability marked requires_human_determination always needs human judgment.

Currency

Each pack states currency.current_as_of — the date its sources were last verified. Law changes; data may lag an amendment, a court order, or new guidance. Check the official source before relying on any rule.

Source text

Enacted law text (statutes, regulations, official gazettes; Tier A) is reproduced from official publishers. Other publishers' text (bill histories and other legislative records, agency pages and press releases, guidance, frameworks, intergovernmental instruments) is reproduced only where its publisher's terms allow it. Each source records, as text_license, the terms it is reproduced on, read from the publisher's own terms page, and any notice those terms require; the notice also travels with the text in every MCP get_rule response. Excerpts are unaltered except for selection. Licensed standards and texts whose licence does not allow redistribution on these terms (Tier C) are cited, never reproduced. Cited only, with no stored text: OWASP (ai-security and owasp-agentic-top10, CC BY-SA 4.0), the Council of Europe Framework Convention on AI, FINRA's GenAI guidance, IMDA's Model AI Governance Framework for Agentic AI and Singapore's Model AI Governance Framework, the MAS FEAT Principles, the UNESCO Recommendation on the Ethics of AI, and WHO's guidance on AI for health (CC BY-NC-SA 3.0 IGO), whose publishers' terms do not allow commercial redistribution; Quebec's laws on LégisQuébec and the NAIC AI Model Bulletin, whose publishers reserve copyright; and the ISO/IEC and IEEE standards. Also cited only, with no stored text: Australia's industry online safety codes registered by the eSafety Commissioner, China's national standard GB 45438-2025, SEBI's master circulars for investment advisers and research analysts, the Saudi SDAIA guide to the PDPL, the Ghana Data Protection Commission's statement of when Act 843 came into force, and the G7 Cybersecurity Working Group's Software Bill of Materials for AI: Minimum Elements, read from the BSI, whose terms allow its downloads for non-commercial use only. Our summaries, conditions, relationships, and guardrails are TwinEthos's own work.

Notices required by publishers

European Union (EUR-Lex). EU legislation from EUR-Lex: © European Union, https://eur-lex.europa.eu. Consolidated texts are re-used under the Creative Commons Attribution 4.0 International licence (CC BY 4.0) and Official Journal acts under Commission Decision 2011/833/EU; excerpts are unaltered except for selection. Only European Union documents published in the Official Journal of the European Union are deemed authentic.

European Commission. Assessment List for Trustworthy Artificial Intelligence (ALTAI) for self-assessment and Ethics Guidelines for Trustworthy AI, High-Level Expert Group on Artificial Intelligence: © European Union, https://digital-strategy.ec.europa.eu, re-used under the Creative Commons Attribution 4.0 International licence (CC BY 4.0); excerpts are unaltered except for selection. Commission Guidelines on the scope of the obligations for providers of general-purpose AI models established by Regulation (EU) 2024/1689 (AI Act), C(2025) 7719 final: © European Union, https://digital-strategy.ec.europa.eu, re-used under the Creative Commons Attribution 4.0 International licence (CC BY 4.0); excerpts are unaltered except for selection. Explanatory Notice and Template for the Public Summary of Training Content for general-purpose AI models, C(2025) 8311 final: © European Union, https://digital-strategy.ec.europa.eu, re-used under the Creative Commons Attribution 4.0 International licence (CC BY 4.0); excerpts are unaltered except for selection.

United Kingdom (legislation.gov.uk). UK legislation: Contains public sector information licensed under the Open Government Licence v3.0. For the UK GDPR and other UK law derived from the EU: Crown © and database right material re-used under the Open Government Licence v3.0. Material derived from the European Institutions © European Union, 1998-2019 and re-used under the terms of the Commission Decision 2011/833/EU.

United Kingdom (Information Commission). Information Commission’s Office, Age appropriate design: a code of practice for online services (issued 12 August 2020), licensed under the Open Government Licence.

United Kingdom (National Cyber Security Centre). Contains public sector information licensed under the Open Government Licence v3.0: UK National Cyber Security Centre and partners, Guidelines for secure AI system development (27 November 2023). Only the text is re-used; the document's photographs and infographics are not.

Switzerland (Fedlex). Dies ist keine amtliche Veröffentlichung. Massgebend ist allein die Veröffentlichung durch die Bundeskanzlei. (This is not an official publication. Only the publication by the Federal Chancellery is authoritative.) The English text of the Federal Act on Data Protection is a translation with no legal force.

Italy (Normattiva). Fonte: Normattiva (https://www.normattiva.it). Testo non autentico, fornito gratuitamente dal portale; l'unico testo ufficiale e definitivo è quello pubblicato sulla Gazzetta Ufficiale. (Source: Normattiva; non-authentic text supplied free of charge by the portal; the only official text is the one published in the Gazzetta Ufficiale.)

France (Légifrance). Source : Légifrance, Direction de l'information légale et administrative (DILA), https://www.legifrance.gouv.fr ; Loi n° 2023-451 du 9 juin 2023, version consolidée en vigueur au 5 octobre 2026 (dernière mise à jour des données : 1er juillet 2026). Réutilisé sous la Licence Ouverte / Open Licence (Etalab) ; extraits non modifiés, sauf sélection. Texte consolidé : le droit opposable est celui du Journal officiel électronique authentifié sur Légifrance. (Re-used under the Licence Ouverte / Open Licence; excerpts unaltered except for selection; a consolidated text: the binding law is the electronic Journal officiel as authenticated on Légifrance.)

Source : Légifrance, Direction de l'information légale et administrative (DILA), base LEGI (https://echanges.dila.gouv.fr/OPENDATA/LEGI/) ; Code de la santé publique, article L4001-3, version en vigueur depuis le 4 août 2021 (dernière mise à jour des données vérifiée : 24 octobre 2026). Réutilisé sous la Licence Ouverte / Open Licence (Etalab) ; extrait non modifié. Texte consolidé : le droit opposable est celui du Journal officiel électronique authentifié sur Légifrance. (Re-used under the Licence Ouverte / Open Licence; excerpt unaltered; a consolidated text: the binding law is the electronic Journal officiel as authenticated on Légifrance.)

Spain (Boletín Oficial del Estado). Basado en datos de la Agencia Estatal Boletín Oficial del Estado (https://www.boe.es). Ley 10/2025, de 26 de diciembre, texto publicado en el «BOE» núm. 312, de 27 de diciembre de 2025; extractos no modificados, salvo selección. Basado en datos de la Agencia Estatal Boletín Oficial del Estado (https://www.boe.es). Ley 3/1991, de 10 de enero, de Competencia Desleal: texto consolidado de carácter meramente informativo, última actualización publicada el 27/12/2025; extractos no modificados, salvo selección. Basado en datos de la Agencia Estatal Boletín Oficial del Estado (https://www.boe.es). Texto refundido de la Ley General para la Defensa de los Consumidores y Usuarios (Real Decreto Legislativo 1/2007): texto consolidado de carácter meramente informativo, última actualización publicada el 04/11/2026; extractos no modificados, salvo selección. (Based on data from the BOE; excerpts unaltered except for selection; consolidated texts are informative only, and the binding law is the text published in the Boletín Oficial del Estado.)

Australia (Federal Register of Legislation). Sourced from the Federal Register of Legislation at 2 October 2026. For the latest information on Australian Government law please go to https://www.legislation.gov.au. Licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/).

New Zealand (Office of the Privacy Commissioner). Biometric Processing Privacy Code 2025 (version as at 1 May 2026): © Office of the Privacy Commissioner (https://www.privacy.org.nz), licensed under a Creative Commons Attribution (BY) licence; TwinEthos is not endorsed by the Office of the Privacy Commissioner.

Ontario (King's Printer for Ontario). Employment Standards Act, 2000: © King's Printer for Ontario, 2000. This reproduction is not an official version. O. Reg. 476/24: © King's Printer for Ontario, 2024. This reproduction is not an official version.

Singapore (Singapore Statutes Online). Singapore legislation is subject to copyright of the Singapore Government and is reproduced with the permission of the Attorney-General's Chambers. Check Singapore Statutes Online (https://sso.agc.gov.sg) for the latest version. TwinEthos is not affiliated with or endorsed by the Attorney-General's Chambers or Singapore Statutes Online.

Japan (Public Data License Version 1.0). 出典：e-Gov法令検索（https://laws.e-gov.go.jp）(Source: e-Gov Law Search, Digital Agency of Japan, under the Public Data License Version 1.0.) 出典：総務省ホームページ（https://www.soumu.go.jp）、経済産業省ホームページ（https://www.meti.go.jp）「AI事業者ガイドライン（第1.2版）」 (Source: AI Guidelines for Business Ver1.2, Ministry of Internal Affairs and Communications and Ministry of Economy, Trade and Industry, under the Public Data License Version 1.0.) The English text is a provisional translation. 出典：内閣府ホームページ（https://www8.cao.go.jp/cstp/ai/ai_guideline/ai_gl_2025.pdf）「人工知能関連技術の研究開発及び活用の適正性確保に関する指針」 (Source: Cabinet Office of Japan, under the Public Data License Version 1.0.) Source: Website of the Ministry of Economy, Trade and Industry of Japan (https://www.meti.go.jp/english/press/2024/0419_002.html), under the Public Data License Version 1.0.

Korea (Ministry of Science and ICT). Source: Ministry of Science and ICT, Republic of Korea (2026), press release 'AI Basic Act Comes into Force to Lay the Foundation for Korea to Become an AI G3', https://www.msit.go.kr, used under the Korea Open Government License (KOGL) Type 1: Source Indication.

Vietnam (Official Gazette). Nguồn: congbao.chinhphu.vn (Công báo nước Cộng hòa xã hội chủ nghĩa Việt Nam, Văn phòng Chính phủ xuất bản). (Source: congbao.chinhphu.vn, the Official Gazette published by the Government Office.)

India (MeitY). Source: Ministry of Electronics and Information Technology, Government of India (https://www.meity.gov.in).

Kazakhstan (Adilet). Source: Әділет legal information system of the Ministry of Justice of the Republic of Kazakhstan (НЦПС «Әділет», https://adilet.zan.kz).

Chile (Ley Chile). Fuente: Ley Chile – Biblioteca del Congreso Nacional (https://www.bcn.cl/leychile), texto obtenido el 2 de octubre de 2026.

Utah (Utah State Legislature). Source: Utah State Legislature (https://le.utah.gov).

NIST. NIST AI 100-1, Artificial Intelligence Risk Management Framework (AI RMF 1.0); NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile; NIST AI 100-2e2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations; NIST SP 800-218A, Secure Software Development Practices for Generative AI and Dual-Use Foundation Models. Republished courtesy of the National Institute of Standards and Technology.

MITRE ATLAS. MITRE ATLAS data, content release 2026.10: Copyright 2021-2026 MITRE. Licensed under the Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0). Excerpts are unaltered except for selection. The mitre-atlas pack stores selected mitigation descriptions from the data; TwinEthos's summaries, conditions and detectors are not part of ATLAS, and the MITRE and ATLAS names only identify the source (the licence grants no trademark rights).

OECD. OECD, Recommendation of the Council on Artificial Intelligence, OECD/LEGAL/0449 (© OECD); official and up-to-date text at https://legalinstruments.oecd.org. Reproduced unaltered under the OECD Terms and Conditions.

Website terms and the status of the law text

Several publishers' website terms reserve rights in, or restrict commercial use of, their site content. Those terms govern use of the website; they do not make enacted law copyrightable where the law excludes it. TwinEthos stores enacted text from them on that basis, recorded per source: in the United States, statutes and regulations are government edicts (Georgia v. Public.Resource.Org, 590 U.S. 255 (2020)), and TwinEthos stores only the enacted text, never a commercial publisher's annotations; elsewhere, the jurisdiction's own copyright law excludes official texts (South Africa, Copyright Act 98 of 1978 s.12(8)(a); Indonesia, UU 28/2014 Pasal 42; India, Copyright Act 1957 s.52(1)(q); Greece, Law 2121/1993 Art. 2(5); Uzbekistan, Law ЎРҚ-42 Art. 8; the DIFC, DIFC Law No. 4 of 2019 Art. 19(2)(a)). Where a publisher's terms limit automated retrieval, TwinEthos honours them in how it fetches: it reads robots.txt and the publisher's terms first, and a text it may not fetch automatically is retrieved by hand.

Where the government itself holds copyright in its legislation and no standing permission covers TwinEthos, the text is cited, not reproduced: Quebec's laws on LégisQuébec (reproduction requires the authorisation of Publications du Québec and royalties), and the NAIC Model Bulletin (© National Association of Insurance Commissioners, all rights reserved). Counsel confirms the remaining publisher terms recorded on the OECD AI Principles and the European Commission's GPAI Code of Practice.

Privacy

Access requests and your data

When you ask for MCP access through the form at www.twinethos.com/docs/quickstart/, FloatingKey LLC receives your name, work email address, company, the kind of application, its AI integration patterns, where your users are, your coding agent, whether you are open to sharing feedback, and the date you accepted these terms. We use them only to confirm your email address, review your request, contact you about it and, if it is approved, issue and administer your API key. We do not sell them or use them for marketing. They are stored with Microsoft Azure in the United States, and our emails to you are sent through Azure Communication Services. Your IP address is used briefly, in memory, to limit abuse, and is not stored. We delete an unconfirmed request after 7 days and a denied or inactive request after 90 days; for an approved partner we keep these details while the key is active and for 90 days after it is revoked or expires. API keys are stored only as a one-way hash, so we can never show a key again. Our request logs record the time, the key's label, the outcome and the name of the tool called, never your queries, code or results. To see, correct or delete your data, email twinethos@floatingkey.com.

TwinEthos Lite in AI assistants

When you use TwinEthos Lite in an AI assistant such as Claude or ChatGPT, the assistant sends our server only the inputs of the tool it calls: market codes, AI feature types, a rule id or a few search words. We never receive your conversation. Each request is logged without its content: the time, the tool, the outcome and whether it came from Claude, ChatGPT or elsewhere; never an address, the tool's inputs or the answer. Your IP address is used only in memory, to apply the rate limits, and is not stored. These request records are kept for 30 days, then deleted automatically. The assistant's own provider handles your conversation under its own terms.

Ask TwinEthos

When you ask Ask TwinEthos a question, it is sent to our server and, to produce the answer, to Microsoft's Azure OpenAI Service, which processes it on our behalf. We do not store or log your question or the answer: our records note only that a question was asked, the kind of reply, how long it took and how many tokens it used. Neither we nor Microsoft use your questions to train AI models. Your IP address and your browser's user agent are turned, in memory, into a code that changes every day, used only to limit how many questions can be asked, and are never stored. Please don't include personal data, confidential information or details of your own legal matter in a question. Answers are generated by AI from TwinEthos data, can be wrong, and are not legal advice.

Counting visits

To count visits without cookies, each page loads a tiny image from api.twinethos.com. We record the page, the name of the website that linked to it (never the full address), a broad device type (desktop, mobile or tablet), and a code made from your IP address and browser that changes every day and cannot be traced back to you; we use it only to count how many different visitors we have each day. We don't set cookies, don't store your IP address and don't share these records. If your browser sends a Do Not Track or Global Privacy Control signal, your visit is not counted. The records are kept for 30 days.

(Final wording, including the controller's details and the lawful basis, to be set by counsel.)

No warranty; limitation of liability

The data is provided "as is", without warranties of accuracy, completeness, or fitness for a particular purpose. To the maximum extent permitted by law, TwinEthos and FloatingKey LLC are not liable for any loss arising from use of or reliance on the data. (Final wording, governing law, and subscription terms to be set by counsel.)

TwinEthos Data — Terms and Notice