Reference
Regulatory toggle catalog
The 36 regulatory feature toggles, each default-off and sticky once it first produces a regulated artifact.
There are 36 regulatory toggles. Every toggle defaults to off for a new tenant. A toggle becomes sticky -- it can no longer be switched off without a dual-approval request -- the moment it first produces the regulated artifact described under Becomes sticky when.
| Key | Group | Regulation | Becomes sticky when | Owner module |
|---|---|---|---|---|
dora_major_incident_classification | DORA | DORA Art. 18 | First incident classified as DORA major. | incident |
dora_major_incident_cascade | DORA | DORA Art. 19 | First initial notification dispatched (or drafted past 4h mark). | reporting |
dora_register_of_information | DORA | DORA Art. 28(3) | First Register of Information export generated. | reporting |
dora_detection_workflow | DORA | DORA Art. 10 | First critical-CVE detection event emitted. | cmdb, reporting |
dora_testing_notes | DORA | DORA Art. 25 | First Change tagged with DORA testing implication. | change |
dora_concentration_risk | DORA | DORA Art. 29 | First concentration-risk report generated. | reporting |
nis2_significant_incident_cascade | NIS-2 | NIS-2 Art. 23 | First NIS-2 early warning dispatched. | incident, reporting |
marisk_audit_retention_extended | MaRisk | MaRisk AT 4.3.1 | Activation alone counts as artifact (changes retention rules). | audit |
bait_berechtigungskonzept_export | BAIT | BAIT 5.4 | First Berechtigungskonzept export generated. | reporting |
bait_information_classification | BAIT | BAIT 4 | First CI tagged with data_classification other than default. | cmdb |
betrvg_works_council_view | BetrVG | BetrVG §87 | First Works Council member role assignment. | identity, pseudonymization |
eol_eos_risk_register | DORA | DORA Art. 8 | First CI past EoS appears on register. | cmdb, reporting |
cve_detection_ui | DORA | DORA Art. 10 precursor | First CVE manually entered on a CI. | cmdb |
asset_lifecycle | Other | n/a | n/a | cmdb |
idv_flag_for_applications | BAIT | BAIT 6 | First Application CI flagged is_idv = true. | cmdb |
sub_outsourcing_chain | DORA | DORA Art. 30 | First sub_outsourced_to relationship created. | cmdb |
gdpr_enhanced_data_export | GDPR | GDPR Art. 20 | First GDPR Article 20 export generated. | reporting |
eu_ai_act_register | EU-AI-Act | EU AI Act (Reg. 2024/1689) Art. 26, 27, 49, 50 | First AI risk classification accepted, or first KI-Register export generated. | ai-governance, cmdb, reporting |
status_page_public | Other | n/a | n/a | status-page |
kb_public_faq | Other | n/a | n/a | knowledge |
product_analytics | GDPR | GDPR Art. 6(1)(f) (ADR-0030, ADR-0037) | None — reversible consent; never marks sticky (no regulated artifact produced). | identity |
tenant_publications | Other | n/a | n/a | announcements |
portal_quick_launch | Other | n/a | n/a | announcements |
tenant_directory | Other | n/a | n/a | identity, announcements |
tenant_directory_sync | Other | n/a | n/a | identity |
publication_acknowledgements | Other | DORA Art. 19 / NIS-2 Art. 23 / BAIT (distribution evidence) | First acknowledgement of a publication tagged to a regulated intent. | announcements |
portal_assistant | Other | n/a | n/a | announcements |
portal_intranet | Other | n/a | n/a | announcements |
portal_polls | Other | n/a | n/a | announcements |
portal_events | Other | n/a | n/a | announcements |
portal_banners | Other | DORA Art. 19 / NIS-2 Art. 23 / BAIT (distribution evidence) | First acknowledgement of a mandatory banner tagged to a regulated intent. | announcements |
portal_authoring | Other | n/a | n/a | announcements |
portal_projects | Other | n/a | n/a | projects |
sap_integration | Other | n/a | n/a | cmdb |
manual_backup | Other | n/a | n/a | audit |
technician_location_sharing | BetrVG | BetrVG §87(1)(6); GDPR Art. 5(1)(c), Art. 88 / §26 BDSG (ADR-0096) | None — reversible per-user opt-in; never marks sticky (no regulated artifact produced). | workforce |