> ## Documentation Index
> Fetch the complete documentation index at: https://docs.responsibleailabs.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance

> Check AI content against GDPR, HIPAA, EU AI Act, CCPA, India DPDP, and more.

The Compliance endpoint checks whether AI-generated content and its surrounding context satisfy the requirements of major regulatory frameworks. It returns a pass/fail verdict per framework, flagged clauses, and remediation guidance.

Compliance is a separate check from [Evaluation](/concepts/evaluation): evaluation scores quality across the 8 RAIL dimensions, while compliance assesses content against specific regulations. They are independent calls — use evaluation for everyday quality scoring, and compliance when you need a regulatory verdict.

<Info>
  **API endpoint:** `POST /railscore/v1/compliance/check` | **Python:** `client.compliance_check()`
</Info>

## Supported frameworks

| Code           | Framework                                           | Region          |
| -------------- | --------------------------------------------------- | --------------- |
| `gdpr`         | General Data Protection Regulation                  | EU              |
| `ccpa`         | California Consumer Privacy Act                     | US (California) |
| `hipaa`        | Health Insurance Portability and Accountability Act | US              |
| `eu_ai_act`    | EU Artificial Intelligence Act                      | EU              |
| `india_dpdp`   | India Digital Personal Data Protection Act          | India           |
| `india_ai_gov` | India AI Governance Guidelines                      | India           |

## Basic usage

<CodeGroup>
  ```python Python theme={null}
  from rail_score_sdk import RailScoreClient

  client = RailScoreClient(api_key="YOUR_RAIL_API_KEY")

  result = client.compliance_check(
      content="Your AI system collects user behavior data to personalize responses.",
      frameworks=["gdpr", "eu_ai_act"],
      context="B2C SaaS chatbot processing EU user data",
  )

  for framework, check in result.frameworks.items():
      print(f"{framework}: {'PASS' if check.compliant else 'FAIL'}")
      for issue in check.issues:
          print(f"  - {issue.description}")
          print(f"    Remedy: {issue.remediation}")
  ```

  ```typescript JavaScript theme={null}
  import { RailScoreClient } from "@responsible-ai-labs/rail-score";

  const client = new RailScoreClient({ apiKey: "YOUR_RAIL_API_KEY" });

  const result = await client.complianceCheck({
    content: "Your AI system collects user behavior data to personalize responses.",
    frameworks: ["gdpr", "eu_ai_act"],
    context: "B2C SaaS chatbot processing EU user data",
  });

  for (const [framework, check] of Object.entries(result.frameworks)) {
    console.log(`${framework}: ${check.compliant ? "PASS" : "FAIL"}`);
  }
  ```

  ```bash cURL theme={null}
  curl -X POST https://api.responsibleailabs.ai/railscore/v1/compliance/check \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer YOUR_RAIL_API_KEY" \
    -d '{
      "content": "Your AI system collects user behavior data to personalize responses.",
      "frameworks": ["gdpr", "eu_ai_act"],
      "context": "B2C SaaS chatbot processing EU user data"
    }'
  ```
</CodeGroup>

## India DPDP: dedicated API

`POST /compliance/check` gives you a point-in-time verdict for any framework, including India DPDP. India DPDP additionally has a suite of 7 dedicated endpoints for teams that need stateful, lifecycle compliance rather than a single check — use these when you must track consent, deadlines, and audit evidence across a user journey:

* **Scan** content for Indian PII (Aadhaar, PAN, mobile, UPI, passport, and 5 more types), child signals, and purpose drift
* **Evaluate** actions against DPDP rules with allow/block/require\_action verdicts
* **Emit** compliance events (consent, DSR, breach, retention) with automatic timer creation
* **Require** proactive guidance for what the application must do at each workflow step
* **Evidence** generation for audit-grade packets (DSR responses, breach notifications, annual reports)
* **Session** management for stateful tracking across a user journey
* **Timers** for monitoring DSR SLAs, breach notification deadlines, and retention windows

<Card title="India DPDP API Reference" icon="shield-halved" href="/api-reference/compliance-overview#india-dpdp-dedicated-endpoints">
  Full endpoint reference with request/response examples.
</Card>

## What's next

<CardGroup cols={2}>
  <Card title="Compliance API Overview" icon="shield-halved" href="/api-reference/compliance-overview">
    All compliance frameworks and dedicated endpoints.
  </Card>

  <Card title="API Reference: Compliance Check" icon="code" href="/api-reference/compliance">
    General compliance check parameter reference.
  </Card>

  <Card title="Python SDK: Compliance" icon="python" href="/sdk/python/compliance">
    Python SDK examples.
  </Card>

  <Card title="DPDP: Content Scan" icon="magnifying-glass-chart" href="/api-reference/dpdp-scan">
    Indian PII detection and masking.
  </Card>
</CardGroup>