Advanced: the rule library of legal requirements and recommendations
Short answer
The rule library is under Settings > Advanced and has two kinds of rules. Legal requirements – for example that a person decides cases about people – are always on and cannot be changed. Recommendations – for example automatic approval of low risk and a passkey for decisions – are on from the start and can be turned off or on with your initials and a reason. Every change is saved in the audit log.
All the rules
Open Settings > Advanced. GoalCube is set up with good practice from the start, so leave the rules as they are unless you have a good reason. This is also where you find the Monday email.
This is the real system with fictitious data. Try the walkthroughs in the articles to click through.
The list comes straight from the system.
Legal requirements (always on)
| Requirement | Legal basis |
|---|---|
| Decisions about people are made by a person, not by the AI. The AI may only recommend. | Art. 22 GDPR; Art. 14 and 26(2) AI Act |
| If the person makes a different decision from the AI's recommendation, it must be explained in at least one full sentence that can be shown to the person concerned. | Art. 22(3) GDPR; Art. 86 AI Act |
| A decision cannot be changed afterwards. It is logged with a checksum in a hash chain. | Art. 12 and 26(6) AI Act |
| The audit log contains only IDs and codes – no names (older entries from before 18 Oct 2026 may contain names) – and is kept for at least 6 months. | Art. 26(6) AI Act; Art. 5(1)(c) GDPR |
| The AI gets pseudonyms instead of names and numbers (see Annex C.2 of the data processing agreement). The real values are only shown at GoalCube in the EU. | Art. 5, 25, 32 and 44 GDPR |
| Prohibited use of AI is stopped: emotion recognition in the workplace or in education; social scoring of people; biometric categorisation by, for example, race, political opinion, religion or sexuality; manipulation or exploitation of vulnerabilities that can harm people. | Art. 5 AI Act |
| High-risk areas: recruitment and selection of people; decisions on employment (e.g. promotion, terms, termination, task allocation, evaluation); education (access, assessment, monitoring of exams); credit scoring or pricing of life and health insurance; access to public benefits; biometric identification or categorisation; safety in critical infrastructure. Exception for narrow, preparatory tasks without profiling. | Art. 6 and Annex III AI Act |
| Staff who use AI must have sufficient AI literacy. | Art. 4 AI Act |
Recommendations (can be switched off with a reason)
| Recommendation | Why |
|---|---|
| Use of AI with minimal or limited risk is approved automatically under GoalCube's fixed rules, as long as it is not about decisions on people. The person responsible sees it on the task list. | Employees can keep working without waiting; a person only confirms high-risk use and decisions about people (Art. 26 AI Act and Art. 22 GDPR). |
| The AI only gets data once the use has been recorded and confirmed in the AI inventory. | All use of AI on the company's data is known and assessed under the AI Act and GDPR before it happens, and the user takes one step at a time. (The law does not require an inventory as such; the inventory shows which requirements apply.) |
| Require a passkey (Face ID, fingerprint or security key) for decisions once users with a passkey have been created. | Shows unambiguously who decided the case, and that the person had the role to do so. |
| Only users with the right role may decide cases in an area (e.g. HR cases only by HR or an administrator). | Art. 26(2) AI Act requires oversight by people with competence and authority. |
| Flag decisions made in under 15 seconds per case as "short review time". | Helps spot when the person simply follows the AI (automation bias, Art. 14(4)(b) AI Act). |
| Show the AI's uncertainty for each case. | Makes it easier to assess the AI's recommendation critically (Art. 14(4) AI Act). |
| Show only the facts relevant to the decision (not email, phone and numbers). | Data minimisation (Art. 5(1)(c) GDPR). |
| Timestamp the audit log with an independent timestamp service after every decision. | Proves to third parties that the log existed at a specific time (in the product, a qualified service under eIDAS). |
Turn off a recommendation
Tap the highlighted field or use Next.
Legal requirements are locked. Recommendations can be switched off. Press "Why · Turn off" under the recommendation you want to switch off.
All steps (5)
- Legal requirements are locked. Recommendations can be switched off. Press "Why · Turn off" under the recommendation you want to switch off.
- Enter your initials.
- Write why you are switching it off. The reason is saved in the audit log.
- Press "Turn off the recommendation".
- The recommendation is switched off, and the change is in the audit log. It can be switched on again.
If you turn off a recommendation, think about what you will do instead. Auditors and regulators can see the change and the reason in the audit log and the report for the regulator.
Screens recorded from GoalCube 0.26.0 on 22 October 2026 with fictitious data.