regulation-ledger

Open-source compliance management with adaptive forms, versioned regulatory templates and auditable evidence tracking.

The problem

Companies face overwhelming regulatory forms that don't match their actual profile — wrong size, risk class or sector. The result is confusion, missed obligations and wasted effort. A five-person microbusiness and a five-hundred-person construction company do not have the same compliance obligations.

How it works

Company Profile {
  risk_class: "III"
  sector: "construction"     // CIIU code
  employees: 45
  jurisdiction: "CO"
}
  → Template: "large-enterprise-construction"
  → Forms: 18 relevant forms (from ~30 total registry)
  → Menu: only what applies

Core layers

• Form Builder Engine — versioned JSON Schema registry with categories and applicability rules (risk class, sector, employee count, jurisdiction). Locked forms protect mandatory regulatory requirements.
• Template Engine — profile-driven menu generation: profile → applicable template → minimal relevant form set.
• Normative snapshots — each rule version is captured as an immutable snapshot, so a form always states which version of which rule it was built against. When a norm changes, affected forms are flagged instead of silently drifting.
• Expiration alerts — automatic notifications for documents, certifications and periodic renewals.
• Evidence chain — hash-chained, append-only trail, so an auditor can reconstruct what was filed, when, and against which normative version.
• MSP connector — REST API and MCP server for service providers managing multiple client companies.

Transparency

The technical specification and documentation were drafted with AI assistance before this project adopted a written policy on generative AI; that assistance is disclosed in the repository README. New code and documentation are written by hand.

License

MPL-2.0 — permits commercial use, modification and redistribution. Modifications to MPL-licensed files remain open.