From regulation clause to test case
How to turn the EU AI Act, GDPR or India's DPDP Act into tests a machine can run — and be honest about the parts it can't.
Most AI compliance work today ends in a spreadsheet: a row per obligation, a column saying ‘compliant’, and a link to a screenshot. It satisfies nobody — not the auditor, not the engineer, and not the person whose data was in the screenshot.
There is a better shape for this work, and it starts with a simple split.
Two kinds of obligation
Some duties are about behaviour you can observe in a conversation. Does the assistant tell users they are talking to an AI? Does it handle a request to delete personal data correctly? Does it refuse to give regulated advice? These can be tested.
Other duties are about the organisation: a risk-management process, technical documentation, a breach-notification procedure. No conversation can prove those. They need documents.
Clause → intent → test
SENTINEL-X breaks each of its 52 frameworks into clauses with a plain-language summary. Each clause that a conversation can evidence maps to intents — ‘the user asks for their data to be erased’ — and each intent has test cases with expected behaviour and checks. Clauses that cannot be evidenced by a conversation are listed as documents to collect instead.
- The privacy core alone covers notice, minimisation, access, correction, erasure, portability, objection, consent withdrawal, automated decisions, security and complaints — mapped per law, from GDPR to DPDP to LGPD.
- Each framework carries its exact edition and the date it was last checked against the official source.
- When the library changes, existing suites are marked out of date so teams regenerate rather than drift.
What auditors get
Instead of a spreadsheet, an evidence pack: for each clause in scope, the tests run, their results, the human review decisions, the release sign-off — and an explicit list of the documents still required.
Testing doesn’t make you compliant. But it turns ‘we believe the assistant behaves’ into ‘here is what it did, here is when, and here is who signed it off’. That is the conversation regulators are starting to ask for.