Know where your data goes —and which flow isn't governed.

Because one ungoverned regulated flow is dispositive. In the worked six-flow sample, four flows are DOCUMENTED — but the OpenAI API flow processes customer PII across a border with no DPA at all, so it's UNVETTED, and any personal or regulated flow that's UNVETTED forces the whole register NOT DEFENSIBLE. The documented-share percentage is shown for context only and never sets the verdict. A shadow LLM API quietly receiving PII with no agreement isn't made acceptable by everything else being in order; the gate refuses to let a comforting average bury it. Put a DPA in place for that flow and the gate releases.

It's the difference between a paperwork hole and an ungoverned relationship. UNVETTED means the load-bearing control — a Data Processing Agreement — is missing for a flow that requires one: the relationship itself isn't governed. GAP means the DPA is in place but another required control is missing (a retention period not yet defined, sub-processors not yet disclosed): a governed relationship with a hole to close. The kit keeps the serious failure separate from the to-do, because they need different responses — a GAP is housekeeping, an UNVETTED regulated flow is the thing that holds your whole register.

The required set adapts to risk rather than applying one flat checklist. A flow with no personal data just needs a recorded purpose. Low-sensitivity adds a DPA. Personal or regulated data adds a defined retention period and disclosed sub-processors. And any flow that crosses a border adds a transfer mechanism (SCCs or an adequacy basis), whatever its sensitivity. DOCUMENTED means a flow carries everything its own risk requires — so a regulated cross-border flow is held to more than an internal low-sensitivity one. The exact required set varies by your role (controller vs processor), jurisdiction, and data type; the kit's defaults are a sensible baseline, not a legal determination.

No. It's a register and a gap-finder, not a contract generator — it never drafts a DPA, creates a transfer mechanism, or certifies your processing. It records what you tell it about each flow, checks it against the controls that flow's risk requires, and tells you which flows aren't governed and what each is missing, with the flow to fix first; the included Gap Closure Runbook walks through resolving each one. It's deterministic and offline — no AI, no network, nothing uploaded — so the same register always produces the same verdict, and it governs data flows, never people.

Neither. It's a working aid for maintaining a vendor / sub-processor data-flow register (the kind GDPR Art. 28/30 contemplate) — not legal advice, not a compliance certification, and not an EU AI Act assessment: Article 50 transparency and the deferred high-risk (Annex III, 2 December 2027) regime are out of scope here. The GDPR references are concepts current as of June 2026 and may change, and which categories count as regulated and which transfer basis applies are specific to your situation, so confirm your obligations with counsel. It pairs with the EU AI Act Readiness Kit and the NIST AI RMF Readiness Kit (the broader governance programs) and the AI Agent & Connector Access Auditor (its sibling — what your AI agents and connectors can reach).