diff --git a/admin-compliance/app/api/sdk/v1/ai-registration/[id]/route.ts b/admin-compliance/app/api/sdk/v1/ai-registration/[id]/route.ts
new file mode 100644
index 0000000..cc82c76
--- /dev/null
+++ b/admin-compliance/app/api/sdk/v1/ai-registration/[id]/route.ts
@@ -0,0 +1,47 @@
+import { NextRequest, NextResponse } from 'next/server'
+
+const SDK_URL = process.env.SDK_URL || 'http://ai-compliance-sdk:8090'
+
+export async function GET(request: NextRequest, { params }: { params: Promise<{ id: string }> }) {
+  try {
+    const { id } = await params
+    const resp = await fetch(`${SDK_URL}/sdk/v1/ai-registration/${id}`)
+    const data = await resp.json()
+    return NextResponse.json(data)
+  } catch (err) {
+    return NextResponse.json({ error: 'Failed to fetch registration' }, { status: 500 })
+  }
+}
+
+export async function PUT(request: NextRequest, { params }: { params: Promise<{ id: string }> }) {
+  try {
+    const { id } = await params
+    const tenantId = request.headers.get('x-tenant-id') || '9282a473-5c95-4b3a-bf78-0ecc0ec71d3e'
+    const body = await request.json()
+    const resp = await fetch(`${SDK_URL}/sdk/v1/ai-registration/${id}`, {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json', 'X-Tenant-ID': tenantId },
+      body: JSON.stringify(body),
+    })
+    const data = await resp.json()
+    return NextResponse.json(data, { status: resp.status })
+  } catch (err) {
+    return NextResponse.json({ error: 'Failed to update registration' }, { status: 500 })
+  }
+}
+
+export async function PATCH(request: NextRequest, { params }: { params: Promise<{ id: string }> }) {
+  try {
+    const { id } = await params
+    const body = await request.json()
+    const resp = await fetch(`${SDK_URL}/sdk/v1/ai-registration/${id}/status`, {
+      method: 'PATCH',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(body),
+    })
+    const data = await resp.json()
+    return NextResponse.json(data, { status: resp.status })
+  } catch (err) {
+    return NextResponse.json({ error: 'Failed to update status' }, { status: 500 })
+  }
+}
diff --git a/admin-compliance/app/api/sdk/v1/ai-registration/route.ts b/admin-compliance/app/api/sdk/v1/ai-registration/route.ts
new file mode 100644
index 0000000..785cff3
--- /dev/null
+++ b/admin-compliance/app/api/sdk/v1/ai-registration/route.ts
@@ -0,0 +1,32 @@
+import { NextRequest, NextResponse } from 'next/server'
+
+const SDK_URL = process.env.SDK_URL || 'http://ai-compliance-sdk:8090'
+
+export async function GET(request: NextRequest) {
+  try {
+    const tenantId = request.headers.get('x-tenant-id') || '9282a473-5c95-4b3a-bf78-0ecc0ec71d3e'
+    const resp = await fetch(`${SDK_URL}/sdk/v1/ai-registration`, {
+      headers: { 'X-Tenant-ID': tenantId },
+    })
+    const data = await resp.json()
+    return NextResponse.json(data)
+  } catch (err) {
+    return NextResponse.json({ error: 'Failed to fetch registrations' }, { status: 500 })
+  }
+}
+
+export async function POST(request: NextRequest) {
+  try {
+    const tenantId = request.headers.get('x-tenant-id') || '9282a473-5c95-4b3a-bf78-0ecc0ec71d3e'
+    const body = await request.json()
+    const resp = await fetch(`${SDK_URL}/sdk/v1/ai-registration`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', 'X-Tenant-ID': tenantId },
+      body: JSON.stringify(body),
+    })
+    const data = await resp.json()
+    return NextResponse.json(data, { status: resp.status })
+  } catch (err) {
+    return NextResponse.json({ error: 'Failed to create registration' }, { status: 500 })
+  }
+}
diff --git a/admin-compliance/app/api/sdk/v1/payment-compliance/route.ts b/admin-compliance/app/api/sdk/v1/payment-compliance/route.ts
new file mode 100644
index 0000000..872bd93
--- /dev/null
+++ b/admin-compliance/app/api/sdk/v1/payment-compliance/route.ts
@@ -0,0 +1,48 @@
+import { NextRequest, NextResponse } from 'next/server'
+
+const SDK_URL = process.env.SDK_URL || 'http://ai-compliance-sdk:8090'
+
+export async function GET(request: NextRequest) {
+  try {
+    const { searchParams } = new URL(request.url)
+    const endpoint = searchParams.get('endpoint') || 'controls'
+    const tenantId = request.headers.get('x-tenant-id') || '9282a473-5c95-4b3a-bf78-0ecc0ec71d3e'
+
+    let path: string
+    switch (endpoint) {
+      case 'controls':
+        const domain = searchParams.get('domain') || ''
+        path = `/sdk/v1/payment-compliance/controls${domain ? `?domain=${domain}` : ''}`
+        break
+      case 'assessments':
+        path = '/sdk/v1/payment-compliance/assessments'
+        break
+      default:
+        path = '/sdk/v1/payment-compliance/controls'
+    }
+
+    const resp = await fetch(`${SDK_URL}${path}`, {
+      headers: { 'X-Tenant-ID': tenantId },
+    })
+    const data = await resp.json()
+    return NextResponse.json(data)
+  } catch (err) {
+    return NextResponse.json({ error: 'Failed to fetch' }, { status: 500 })
+  }
+}
+
+export async function POST(request: NextRequest) {
+  try {
+    const tenantId = request.headers.get('x-tenant-id') || '9282a473-5c95-4b3a-bf78-0ecc0ec71d3e'
+    const body = await request.json()
+    const resp = await fetch(`${SDK_URL}/sdk/v1/payment-compliance/assessments`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', 'X-Tenant-ID': tenantId },
+      body: JSON.stringify(body),
+    })
+    const data = await resp.json()
+    return NextResponse.json(data, { status: resp.status })
+  } catch (err) {
+    return NextResponse.json({ error: 'Failed to create' }, { status: 500 })
+  }
+}
diff --git a/admin-compliance/app/api/sdk/v1/payment-compliance/tender/[id]/route.ts b/admin-compliance/app/api/sdk/v1/payment-compliance/tender/[id]/route.ts
new file mode 100644
index 0000000..34562ad
--- /dev/null
+++ b/admin-compliance/app/api/sdk/v1/payment-compliance/tender/[id]/route.ts
@@ -0,0 +1,28 @@
+import { NextRequest, NextResponse } from 'next/server'
+
+const SDK_URL = process.env.SDK_URL || 'http://ai-compliance-sdk:8090'
+
+export async function GET(request: NextRequest, { params }: { params: Promise<{ id: string }> }) {
+  try {
+    const { id } = await params
+    const resp = await fetch(`${SDK_URL}/sdk/v1/payment-compliance/tender/${id}`)
+    return NextResponse.json(await resp.json())
+  } catch {
+    return NextResponse.json({ error: 'Failed' }, { status: 500 })
+  }
+}
+
+export async function POST(request: NextRequest, { params }: { params: Promise<{ id: string }> }) {
+  try {
+    const { id } = await params
+    const { searchParams } = new URL(request.url)
+    const action = searchParams.get('action') || 'extract'
+    const resp = await fetch(`${SDK_URL}/sdk/v1/payment-compliance/tender/${id}/${action}`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+    })
+    return NextResponse.json(await resp.json(), { status: resp.status })
+  } catch {
+    return NextResponse.json({ error: 'Failed' }, { status: 500 })
+  }
+}
diff --git a/admin-compliance/app/api/sdk/v1/payment-compliance/tender/route.ts b/admin-compliance/app/api/sdk/v1/payment-compliance/tender/route.ts
new file mode 100644
index 0000000..c62f417
--- /dev/null
+++ b/admin-compliance/app/api/sdk/v1/payment-compliance/tender/route.ts
@@ -0,0 +1,30 @@
+import { NextRequest, NextResponse } from 'next/server'
+
+const SDK_URL = process.env.SDK_URL || 'http://ai-compliance-sdk:8090'
+
+export async function GET(request: NextRequest) {
+  try {
+    const tenantId = request.headers.get('x-tenant-id') || '9282a473-5c95-4b3a-bf78-0ecc0ec71d3e'
+    const resp = await fetch(`${SDK_URL}/sdk/v1/payment-compliance/tender`, {
+      headers: { 'X-Tenant-ID': tenantId },
+    })
+    return NextResponse.json(await resp.json())
+  } catch {
+    return NextResponse.json({ error: 'Failed' }, { status: 500 })
+  }
+}
+
+export async function POST(request: NextRequest) {
+  try {
+    const tenantId = request.headers.get('x-tenant-id') || '9282a473-5c95-4b3a-bf78-0ecc0ec71d3e'
+    const formData = await request.formData()
+    const resp = await fetch(`${SDK_URL}/sdk/v1/payment-compliance/tender/upload`, {
+      method: 'POST',
+      headers: { 'X-Tenant-ID': tenantId },
+      body: formData,
+    })
+    return NextResponse.json(await resp.json(), { status: resp.status })
+  } catch {
+    return NextResponse.json({ error: 'Upload failed' }, { status: 500 })
+  }
+}
diff --git a/admin-compliance/app/api/sdk/v1/ucca/decision-tree/[[...path]]/route.ts b/admin-compliance/app/api/sdk/v1/ucca/decision-tree/[[...path]]/route.ts
new file mode 100644
index 0000000..ddbb733
--- /dev/null
+++ b/admin-compliance/app/api/sdk/v1/ucca/decision-tree/[[...path]]/route.ts
@@ -0,0 +1,57 @@
+import { NextRequest, NextResponse } from 'next/server'
+
+const SDK_URL = process.env.SDK_URL || 'http://ai-compliance-sdk:8090'
+const DEFAULT_TENANT = process.env.DEFAULT_TENANT_ID || '9282a473-5c95-4b3a-bf78-0ecc0ec71d3e'
+
+/**
+ * Proxy: /api/sdk/v1/ucca/decision-tree/... → Go Backend /sdk/v1/ucca/decision-tree/...
+ */
+async function proxyRequest(request: NextRequest, { params }: { params: Promise<{ path: string[] }> }) {
+  const { path } = await params
+  const subPath = path ? path.join('/') : ''
+  const search = request.nextUrl.search || ''
+  const targetUrl = `${SDK_URL}/sdk/v1/ucca/decision-tree/${subPath}${search}`
+
+  const tenantID = request.headers.get('X-Tenant-ID') || DEFAULT_TENANT
+
+  try {
+    const headers: Record<string, string> = {
+      'X-Tenant-ID': tenantID,
+    }
+
+    const fetchOptions: RequestInit = {
+      method: request.method,
+      headers,
+    }
+
+    if (request.method === 'POST' || request.method === 'PUT' || request.method === 'PATCH') {
+      const body = await request.json()
+      headers['Content-Type'] = 'application/json'
+      fetchOptions.body = JSON.stringify(body)
+    }
+
+    const response = await fetch(targetUrl, fetchOptions)
+
+    if (!response.ok) {
+      const errorText = await response.text()
+      console.error(`Decision tree proxy error [${request.method} ${subPath}]:`, errorText)
+      return NextResponse.json(
+        { error: 'Backend error', details: errorText },
+        { status: response.status }
+      )
+    }
+
+    const data = await response.json()
+    return NextResponse.json(data, { status: response.status })
+  } catch (error) {
+    console.error('Decision tree proxy connection error:', error)
+    return NextResponse.json(
+      { error: 'Failed to connect to AI compliance backend' },
+      { status: 503 }
+    )
+  }
+}
+
+export const GET = proxyRequest
+export const POST = proxyRequest
+export const DELETE = proxyRequest
diff --git a/admin-compliance/app/api/sdk/v1/ucca/decision-tree/route.ts b/admin-compliance/app/api/sdk/v1/ucca/decision-tree/route.ts
new file mode 100644
index 0000000..d8b1c33
--- /dev/null
+++ b/admin-compliance/app/api/sdk/v1/ucca/decision-tree/route.ts
@@ -0,0 +1,36 @@
+import { NextRequest, NextResponse } from 'next/server'
+
+const SDK_URL = process.env.SDK_URL || 'http://ai-compliance-sdk:8090'
+const DEFAULT_TENANT = process.env.DEFAULT_TENANT_ID || '9282a473-5c95-4b3a-bf78-0ecc0ec71d3e'
+
+/**
+ * Proxy: GET /api/sdk/v1/ucca/decision-tree → Go Backend GET /sdk/v1/ucca/decision-tree
+ * Returns the decision tree definition (questions, structure)
+ */
+export async function GET(request: NextRequest) {
+  const tenantID = request.headers.get('X-Tenant-ID') || DEFAULT_TENANT
+
+  try {
+    const response = await fetch(`${SDK_URL}/sdk/v1/ucca/decision-tree`, {
+      headers: { 'X-Tenant-ID': tenantID },
+    })
+
+    if (!response.ok) {
+      const errorText = await response.text()
+      console.error('Decision tree GET error:', errorText)
+      return NextResponse.json(
+        { error: 'Backend error', details: errorText },
+        { status: response.status }
+      )
+    }
+
+    const data = await response.json()
+    return NextResponse.json(data)
+  } catch (error) {
+    console.error('Decision tree proxy error:', error)
+    return NextResponse.json(
+      { error: 'Failed to connect to AI compliance backend' },
+      { status: 503 }
+    )
+  }
+}
diff --git a/admin-compliance/app/sdk/advisory-board/_types.ts b/admin-compliance/app/sdk/advisory-board/_types.ts
index 0d037ed..3a24935 100644
--- a/admin-compliance/app/sdk/advisory-board/_types.ts
+++ b/admin-compliance/app/sdk/advisory-board/_types.ts
@@ -7,6 +7,116 @@ export interface AdvisoryForm {
   custom_data_types: string[]
   purposes: string[]
   automation: string
+  // BetrVG / works council
+  employee_monitoring: boolean
+  hr_decision_support: boolean
+  works_council_consulted: boolean
+  // Domain-specific contexts (Annex III)
+  hr_automated_screening: boolean
+  hr_automated_rejection: boolean
+  hr_candidate_ranking: boolean
+  hr_bias_audits: boolean
+  hr_agg_visible: boolean
+  hr_human_review: boolean
+  hr_performance_eval: boolean
+  edu_grade_influence: boolean
+  edu_exam_evaluation: boolean
+  edu_student_selection: boolean
+  edu_minors: boolean
+  edu_teacher_review: boolean
+  hc_diagnosis: boolean
+  hc_treatment: boolean
+  hc_triage: boolean
+  hc_patient_data: boolean
+  hc_medical_device: boolean
+  hc_clinical_validation: boolean
+  // Legal
+  leg_legal_advice: boolean
+  leg_court_prediction: boolean
+  leg_client_confidential: boolean
+  // Public Sector
+  pub_admin_decision: boolean
+  pub_benefit_allocation: boolean
+  pub_transparency: boolean
+  // Critical Infrastructure
+  crit_grid_control: boolean
+  crit_safety_critical: boolean
+  crit_redundancy: boolean
+  // Automotive
+  auto_autonomous: boolean
+  auto_safety: boolean
+  auto_functional_safety: boolean
+  // Retail
+  ret_pricing: boolean
+  ret_profiling: boolean
+  ret_credit_scoring: boolean
+  ret_dark_patterns: boolean
+  // IT Security
+  its_surveillance: boolean
+  its_threat_detection: boolean
+  its_data_retention: boolean
+  // Logistics
+  log_driver_tracking: boolean
+  log_workload_scoring: boolean
+  // Construction
+  con_tenant_screening: boolean
+  con_worker_safety: boolean
+  // Marketing
+  mkt_deepfake: boolean
+  mkt_minors: boolean
+  mkt_targeting: boolean
+  mkt_labeled: boolean
+  // Manufacturing
+  mfg_machine_safety: boolean
+  mfg_ce_required: boolean
+  mfg_validated: boolean
+  // Agriculture
+  agr_pesticide: boolean
+  agr_animal_welfare: boolean
+  agr_environmental: boolean
+  // Social Services
+  soc_vulnerable: boolean
+  soc_benefit: boolean
+  soc_case_mgmt: boolean
+  // Hospitality
+  hos_guest_profiling: boolean
+  hos_dynamic_pricing: boolean
+  hos_review_manipulation: boolean
+  // Insurance
+  ins_risk_class: boolean
+  ins_claims: boolean
+  ins_premium: boolean
+  ins_fraud: boolean
+  // Investment
+  inv_algo_trading: boolean
+  inv_advice: boolean
+  inv_robo: boolean
+  // Defense
+  def_dual_use: boolean
+  def_export: boolean
+  def_classified: boolean
+  // Supply Chain
+  sch_supplier: boolean
+  sch_human_rights: boolean
+  sch_environmental: boolean
+  // Facility
+  fac_access: boolean
+  fac_occupancy: boolean
+  fac_energy: boolean
+  // Sports
+  spo_athlete: boolean
+  spo_fan: boolean
+  spo_doping: boolean
+  // Finance / Banking
+  fin_credit_scoring: boolean
+  fin_aml_kyc: boolean
+  fin_algo_decisions: boolean
+  fin_customer_profiling: boolean
+  // General
+  gen_affects_people: boolean
+  gen_automated_decisions: boolean
+  gen_sensitive_data: boolean
+  // Hosting
   hosting_provider: string
   hosting_region: string
   model_usage: string[]
diff --git a/admin-compliance/app/sdk/advisory-board/page.tsx b/admin-compliance/app/sdk/advisory-board/page.tsx
index a6359ee..0ee1cdd 100644
--- a/admin-compliance/app/sdk/advisory-board/page.tsx
+++ b/admin-compliance/app/sdk/advisory-board/page.tsx
@@ -51,6 +51,71 @@ function AdvisoryBoardPageInner() {
     custom_data_types: [],
     purposes: [],
     automation: '',
+    // BetrVG / works council
+    employee_monitoring: false,
+    hr_decision_support: false,
+    works_council_consulted: false,
+    // Domain-specific contexts (Annex III)
+    hr_automated_screening: false,
+    hr_automated_rejection: false,
+    hr_candidate_ranking: false,
+    hr_bias_audits: false,
+    hr_agg_visible: false,
+    hr_human_review: false,
+    hr_performance_eval: false,
+    edu_grade_influence: false,
+    edu_exam_evaluation: false,
+    edu_student_selection: false,
+    edu_minors: false,
+    edu_teacher_review: false,
+    hc_diagnosis: false,
+    hc_treatment: false,
+    hc_triage: false,
+    hc_patient_data: false,
+    hc_medical_device: false,
+    hc_clinical_validation: false,
+    // Legal
+    leg_legal_advice: false, leg_court_prediction: false, leg_client_confidential: false,
+    // Public Sector
+    pub_admin_decision: false, pub_benefit_allocation: false, pub_transparency: false,
+    // Critical Infrastructure
+    crit_grid_control: false, crit_safety_critical: false, crit_redundancy: false,
+    // Automotive
+    auto_autonomous: false, auto_safety: false, auto_functional_safety: false,
+    // Retail
+    ret_pricing: false, ret_profiling: false, ret_credit_scoring: false, ret_dark_patterns: false,
+    // IT Security
+    its_surveillance: false, its_threat_detection: false, its_data_retention: false,
+    // Logistics
+    log_driver_tracking: false, log_workload_scoring: false,
+    // Construction
+    con_tenant_screening: false, con_worker_safety: false,
+    // Marketing
+    mkt_deepfake: false, mkt_minors: false, mkt_targeting: false, mkt_labeled: false,
+    // Manufacturing
+    mfg_machine_safety: false, mfg_ce_required: false, mfg_validated: false,
+    // Agriculture
+    agr_pesticide: false, agr_animal_welfare: false, agr_environmental: false,
+    // Social Services
+    soc_vulnerable: false, soc_benefit: false, soc_case_mgmt: false,
+    // Hospitality
+    hos_guest_profiling: false, hos_dynamic_pricing: false, hos_review_manipulation: false,
+    // Insurance
+    ins_risk_class: false, ins_claims: false, ins_premium: false, ins_fraud: false,
+    // Investment
+    inv_algo_trading: false, inv_advice: false, inv_robo: false,
+    // Defense
+    def_dual_use: false, def_export: false, def_classified: false,
+    // Supply Chain
+    sch_supplier: false, sch_human_rights: false, sch_environmental: false,
+    // Facility
+    fac_access: false, fac_occupancy: false, fac_energy: false,
+    // Sports
+    spo_athlete: false, spo_fan: false, spo_doping: false,
+    // Finance / Banking
+    fin_credit_scoring: false, fin_aml_kyc: false, fin_algo_decisions: false, fin_customer_profiling: false,
+    // General
+    gen_affects_people: false, gen_automated_decisions: false, gen_sensitive_data: false,
     hosting_provider: '',
     hosting_region: '',
     model_usage: [],
@@ -133,7 +198,131 @@ function AdvisoryBoardPageInner() {
         retention_purpose: form.retention_purpose,
         contracts_list: form.contracts,
         subprocessors: form.subprocessors,
+        employee_monitoring: form.employee_monitoring,
+        hr_decision_support: form.hr_decision_support,
+        works_council_consulted: form.works_council_consulted,
+        // Domain-specific contexts
+        hr_context: ['hr', 'recruiting'].includes(form.domain) ? {
+          automated_screening: form.hr_automated_screening,
+          automated_rejection: form.hr_automated_rejection,
+          candidate_ranking: form.hr_candidate_ranking,
+          bias_audits_done: form.hr_bias_audits,
+          agg_categories_visible: form.hr_agg_visible,
+          human_review_enforced: form.hr_human_review,
+          performance_evaluation: form.hr_performance_eval,
+        } : undefined,
+        education_context: ['education', 'higher_education', 'vocational_training', 'research'].includes(form.domain) ? {
+          grade_influence: form.edu_grade_influence,
+          exam_evaluation: form.edu_exam_evaluation,
+          student_selection: form.edu_student_selection,
+          minors_involved: form.edu_minors,
+          teacher_review_required: form.edu_teacher_review,
+        } : undefined,
+        healthcare_context: ['healthcare', 'medical_devices', 'pharma', 'elderly_care'].includes(form.domain) ? {
+          diagnosis_support: form.hc_diagnosis,
+          treatment_recommendation: form.hc_treatment,
+          triage_decision: form.hc_triage,
+          patient_data_processed: form.hc_patient_data,
+          medical_device: form.hc_medical_device,
+          clinical_validation: form.hc_clinical_validation,
+        } : undefined,
+        legal_context: ['legal', 'consulting', 'tax_advisory'].includes(form.domain) ? {
+          legal_advice: form.leg_legal_advice,
+          court_prediction: form.leg_court_prediction,
+          client_confidential: form.leg_client_confidential,
+        } : undefined,
+        public_sector_context: ['public_sector', 'defense', 'justice'].includes(form.domain) ? {
+          admin_decision: form.pub_admin_decision,
+          benefit_allocation: form.pub_benefit_allocation,
+          transparency_ensured: form.pub_transparency,
+        } : undefined,
+        critical_infra_context: ['energy', 'utilities', 'oil_gas'].includes(form.domain) ? {
+          grid_control: form.crit_grid_control,
+          safety_critical: form.crit_safety_critical,
+          redundancy_exists: form.crit_redundancy,
+        } : undefined,
+        automotive_context: ['automotive', 'aerospace'].includes(form.domain) ? {
+          autonomous_driving: form.auto_autonomous,
+          safety_relevant: form.auto_safety,
+          functional_safety: form.auto_functional_safety,
+        } : undefined,
+        retail_context: ['retail', 'ecommerce', 'wholesale'].includes(form.domain) ? {
+          pricing_personalized: form.ret_pricing,
+          credit_scoring: form.ret_credit_scoring,
+          dark_patterns: form.ret_dark_patterns,
+        } : undefined,
+        it_security_context: ['it_services', 'cybersecurity', 'telecom'].includes(form.domain) ? {
+          employee_surveillance: form.its_surveillance,
+          threat_detection: form.its_threat_detection,
+          data_retention_logs: form.its_data_retention,
+        } : undefined,
+        logistics_context: ['logistics'].includes(form.domain) ? {
+          driver_tracking: form.log_driver_tracking,
+          workload_scoring: form.log_workload_scoring,
+        } : undefined,
+        construction_context: ['construction', 'real_estate', 'facility_management'].includes(form.domain) ? {
+          tenant_screening: form.con_tenant_screening,
+          worker_safety: form.con_worker_safety,
+        } : undefined,
+        marketing_context: ['marketing', 'media', 'entertainment'].includes(form.domain) ? {
+          deepfake_content: form.mkt_deepfake,
+          behavioral_targeting: form.mkt_targeting,
+          minors_targeted: form.mkt_minors,
+          ai_content_labeled: form.mkt_labeled,
+        } : undefined,
+        manufacturing_context: ['mechanical_engineering', 'electrical_engineering', 'plant_engineering', 'chemicals', 'food_beverage'].includes(form.domain) ? {
+          machine_safety: form.mfg_machine_safety,
+          ce_marking_required: form.mfg_ce_required,
+          safety_validated: form.mfg_validated,
+        } : undefined,
+        agriculture_context: ['agriculture', 'forestry', 'fishing'].includes(form.domain) ? {
+          pesticide_ai: form.agr_pesticide,
+          animal_welfare: form.agr_animal_welfare,
+          environmental_data: form.agr_environmental,
+        } : undefined,
+        social_services_context: ['social_services', 'nonprofit'].includes(form.domain) ? {
+          vulnerable_groups: form.soc_vulnerable,
+          benefit_decision: form.soc_benefit,
+          case_management: form.soc_case_mgmt,
+        } : undefined,
+        hospitality_context: ['hospitality', 'tourism'].includes(form.domain) ? {
+          guest_profiling: form.hos_guest_profiling,
+          dynamic_pricing: form.hos_dynamic_pricing,
+          review_manipulation: form.hos_review_manipulation,
+        } : undefined,
+        insurance_context: ['insurance'].includes(form.domain) ? {
+          risk_classification: form.ins_risk_class,
+          claims_automation: form.ins_claims,
+          premium_calculation: form.ins_premium,
+          fraud_detection: form.ins_fraud,
+        } : undefined,
+        investment_context: ['investment'].includes(form.domain) ? {
+          algo_trading: form.inv_algo_trading,
+          investment_advice: form.inv_advice,
+          robo_advisor: form.inv_robo,
+        } : undefined,
+        defense_context: ['defense'].includes(form.domain) ? {
+          dual_use: form.def_dual_use,
+          export_controlled: form.def_export,
+          classified_data: form.def_classified,
+        } : undefined,
+        supply_chain_context: ['textiles', 'packaging'].includes(form.domain) ? {
+          supplier_monitoring: form.sch_supplier,
+          human_rights_check: form.sch_human_rights,
+          environmental_impact: form.sch_environmental,
+        } : undefined,
+        facility_context: ['facility_management'].includes(form.domain) ? {
+          access_control_ai: form.fac_access,
+          occupancy_tracking: form.fac_occupancy,
+          energy_optimization: form.fac_energy,
+        } : undefined,
+        sports_context: ['sports'].includes(form.domain) ? {
+          athlete_tracking: form.spo_athlete,
+          fan_profiling: form.spo_fan,
+        } : undefined,
         store_raw_text: true,
+        // Finance/Banking and General don't need separate context structs —
+        // their fields are evaluated via existing FinancialContext or generic rules
       }
 
       const url = isEditMode
diff --git a/admin-compliance/app/sdk/ai-act/page.tsx b/admin-compliance/app/sdk/ai-act/page.tsx
index 1243c12..96522f9 100644
--- a/admin-compliance/app/sdk/ai-act/page.tsx
+++ b/admin-compliance/app/sdk/ai-act/page.tsx
@@ -8,9 +8,178 @@ import { LoadingSkeleton } from './_components/LoadingSkeleton'
 import { RiskPyramid } from './_components/RiskPyramid'
 import { AddSystemForm } from './_components/AddSystemForm'
 import { AISystemCard } from './_components/AISystemCard'
+import DecisionTreeWizard from '@/components/sdk/ai-act/DecisionTreeWizard'
+
+type TabId = 'overview' | 'decision-tree' | 'results'
+
+// SAVED RESULTS TAB
+// =============================================================================
+
+interface SavedResult {
+  id: string
+  system_name: string
+  system_description?: string
+  high_risk_result: string
+  gpai_result: { gpai_category: string; is_systemic_risk: boolean }
+  combined_obligations: string[]
+  created_at: string
+}
+
+function SavedResultsTab() {
+  const [results, setResults] = useState<SavedResult[]>([])
+  const [loading, setLoading] = useState(true)
+
+  useEffect(() => {
+    const load = async () => {
+      try {
+        const res = await fetch('/api/sdk/v1/ucca/decision-tree/results')
+        if (res.ok) {
+          const data = await res.json()
+          setResults(data.results || [])
+        }
+      } catch {
+        // Ignore
+      } finally {
+        setLoading(false)
+      }
+    }
+    load()
+  }, [])
+
+  const handleDelete = async (id: string) => {
+    if (!confirm('Ergebnis wirklich löschen?')) return
+    try {
+      const res = await fetch(`/api/sdk/v1/ucca/decision-tree/results/${id}`, { method: 'DELETE' })
+      if (res.ok) {
+        setResults(prev => prev.filter(r => r.id !== id))
+      }
+    } catch {
+      // Ignore
+    }
+  }
+
+  const riskLabels: Record<string, string> = {
+    unacceptable: 'Unzulässig',
+    high_risk: 'Hochrisiko',
+    limited_risk: 'Begrenztes Risiko',
+    minimal_risk: 'Minimales Risiko',
+    not_applicable: 'Nicht anwendbar',
+  }
+
+  const riskColors: Record<string, string> = {
+    unacceptable: 'bg-red-100 text-red-700',
+    high_risk: 'bg-orange-100 text-orange-700',
+    limited_risk: 'bg-yellow-100 text-yellow-700',
+    minimal_risk: 'bg-green-100 text-green-700',
+    not_applicable: 'bg-gray-100 text-gray-500',
+  }
+
+  const gpaiLabels: Record<string, string> = {
+    none: 'Kein GPAI',
+    standard: 'GPAI Standard',
+    systemic: 'GPAI Systemisch',
+  }
+
+  const gpaiColors: Record<string, string> = {
+    none: 'bg-gray-100 text-gray-500',
+    standard: 'bg-blue-100 text-blue-700',
+    systemic: 'bg-purple-100 text-purple-700',
+  }
+
+  if (loading) {
+    return <LoadingSkeleton />
+  }
+
+  if (results.length === 0) {
+    return (
+      <div className="bg-white rounded-xl border border-gray-200 p-12 text-center">
+        <div className="w-16 h-16 mx-auto bg-purple-100 rounded-full flex items-center justify-center mb-4">
+          <svg className="w-8 h-8 text-purple-600" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+            <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2" />
+          </svg>
+        </div>
+        <h3 className="text-lg font-semibold text-gray-900">Keine Ergebnisse vorhanden</h3>
+        <p className="mt-2 text-gray-500">Nutzen Sie den Entscheidungsbaum, um KI-Systeme zu klassifizieren.</p>
+      </div>
+    )
+  }
+
+  return (
+    <div className="space-y-4">
+      {results.map(r => (
+        <div key={r.id} className="bg-white rounded-xl border border-gray-200 p-5">
+          <div className="flex items-start justify-between">
+            <div>
+              <h4 className="font-semibold text-gray-900">{r.system_name}</h4>
+              {r.system_description && (
+                <p className="text-sm text-gray-500 mt-0.5">{r.system_description}</p>
+              )}
+              <div className="flex items-center gap-2 mt-2">
+                <span className={`px-2 py-1 text-xs rounded-full ${riskColors[r.high_risk_result] || 'bg-gray-100 text-gray-500'}`}>
+                  {riskLabels[r.high_risk_result] || r.high_risk_result}
+                </span>
+                <span className={`px-2 py-1 text-xs rounded-full ${gpaiColors[r.gpai_result?.gpai_category] || 'bg-gray-100 text-gray-500'}`}>
+                  {gpaiLabels[r.gpai_result?.gpai_category] || 'Kein GPAI'}
+                </span>
+                {r.gpai_result?.is_systemic_risk && (
+                  <span className="px-2 py-1 text-xs rounded-full bg-red-100 text-red-700">Systemisch</span>
+                )}
+              </div>
+              <div className="text-xs text-gray-400 mt-2">
+                {r.combined_obligations?.length || 0} Pflichten &middot; {new Date(r.created_at).toLocaleDateString('de-DE')}
+              </div>
+            </div>
+            <button
+              onClick={() => handleDelete(r.id)}
+              className="px-3 py-1 text-xs text-red-600 hover:bg-red-50 rounded transition-colors"
+            >
+              Löschen
+            </button>
+          </div>
+        </div>
+      ))}
+    </div>
+  )
+}
+
+// TABS
+// =============================================================================
+
+const TABS: { id: TabId; label: string; icon: React.ReactNode }[] = [
+  {
+    id: 'overview',
+    label: 'Übersicht',
+    icon: (
+      <svg className="w-4 h-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={2}>
+        <path strokeLinecap="round" strokeLinejoin="round" d="M3.75 6A2.25 2.25 0 016 3.75h2.25A2.25 2.25 0 0110.5 6v2.25a2.25 2.25 0 01-2.25 2.25H6a2.25 2.25 0 01-2.25-2.25V6zM3.75 15.75A2.25 2.25 0 016 13.5h2.25a2.25 2.25 0 012.25 2.25V18a2.25 2.25 0 01-2.25 2.25H6A2.25 2.25 0 013.75 18v-2.25zM13.5 6a2.25 2.25 0 012.25-2.25H18A2.25 2.25 0 0120.25 6v2.25A2.25 2.25 0 0118 10.5h-2.25a2.25 2.25 0 01-2.25-2.25V6zM13.5 15.75a2.25 2.25 0 012.25-2.25H18a2.25 2.25 0 012.25 2.25V18A2.25 2.25 0 0118 20.25h-2.25A2.25 2.25 0 0113.5 18v-2.25z" />
+      </svg>
+    ),
+  },
+  {
+    id: 'decision-tree',
+    label: 'Entscheidungsbaum',
+    icon: (
+      <svg className="w-4 h-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={2}>
+        <path strokeLinecap="round" strokeLinejoin="round" d="M3.75 12h16.5m-16.5 3.75h16.5M3.75 19.5h16.5M5.625 4.5h12.75a1.875 1.875 0 010 3.75H5.625a1.875 1.875 0 010-3.75z" />
+      </svg>
+    ),
+  },
+  {
+    id: 'results',
+    label: 'Ergebnisse',
+    icon: (
+      <svg className="w-4 h-4" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={2}>
+        <path strokeLinecap="round" strokeLinejoin="round" d="M9 12h3.75M9 15h3.75M9 18h3.75m3 .75H18a2.25 2.25 0 002.25-2.25V6.108c0-1.135-.845-2.098-1.976-2.192a48.424 48.424 0 00-1.123-.08m-5.801 0c-.065.21-.1.433-.1.664 0 .414.336.75.75.75h4.5a.75.75 0 00.75-.75 2.25 2.25 0 00-.1-.664m-5.8 0A2.251 2.251 0 0113.5 2.25H15c1.012 0 1.867.668 2.15 1.586m-5.8 0c-.376.023-.75.05-1.124.08C9.095 4.01 8.25 4.973 8.25 6.108V8.25m0 0H4.875c-.621 0-1.125.504-1.125 1.125v11.25c0 .621.504 1.125 1.125 1.125h9.75c.621 0 1.125-.504 1.125-1.125V9.375c0-.621-.504-1.125-1.125-1.125H8.25z" />
+      </svg>
+    ),
+  },
+]
+
+// MAIN PAGE
 
 export default function AIActPage() {
   const { state } = useSDK()
+  const [activeTab, setActiveTab] = useState<TabId>('overview')
   const [systems, setSystems] = useState<AISystem[]>([])
   const [filter, setFilter] = useState<string>('all')
   const [showAddForm, setShowAddForm] = useState(false)
@@ -178,17 +347,38 @@ export default function AIActPage() {
         explanation={stepInfo.explanation}
         tips={stepInfo.tips}
       >
-        <button
-          onClick={() => setShowAddForm(true)}
-          className="flex items-center gap-2 px-4 py-2 bg-purple-600 text-white rounded-lg hover:bg-purple-700 transition-colors"
-        >
-          <svg className="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-            <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M12 6v6m0 0v6m0-6h6m-6 0H6" />
-          </svg>
-          KI-System registrieren
-        </button>
+        {activeTab === 'overview' && (
+          <button
+            onClick={() => setShowAddForm(true)}
+            className="flex items-center gap-2 px-4 py-2 bg-purple-600 text-white rounded-lg hover:bg-purple-700 transition-colors"
+          >
+            <svg className="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+              <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M12 6v6m0 0v6m0-6h6m-6 0H6" />
+            </svg>
+            KI-System registrieren
+          </button>
+        )}
       </StepHeader>
 
+      {/* Tabs */}
+      <div className="flex items-center gap-1 bg-gray-100 p-1 rounded-lg w-fit">
+        {TABS.map(tab => (
+          <button
+            key={tab.id}
+            onClick={() => setActiveTab(tab.id)}
+            className={`flex items-center gap-2 px-4 py-2 text-sm font-medium rounded-md transition-colors ${
+              activeTab === tab.id
+                ? 'bg-white text-purple-700 shadow-sm'
+                : 'text-gray-600 hover:text-gray-900'
+            }`}
+          >
+            {tab.icon}
+            {tab.label}
+          </button>
+        ))}
+      </div>
+
+      {/* Error Banner */}
       {error && (
         <div className="p-4 bg-red-50 border border-red-200 rounded-lg text-red-700 flex items-center justify-between">
           <span>{error}</span>
@@ -196,82 +386,105 @@ export default function AIActPage() {
         </div>
       )}
 
-      {showAddForm && (
-        <AddSystemForm
-          onSubmit={handleAddSystem}
-          onCancel={() => { setShowAddForm(false); setEditingSystem(null) }}
-          initialData={editingSystem}
-        />
-      )}
-
-      <div className="grid grid-cols-1 md:grid-cols-4 gap-4">
-        <div className="bg-white rounded-xl border border-gray-200 p-6">
-          <div className="text-sm text-gray-500">KI-Systeme gesamt</div>
-          <div className="text-3xl font-bold text-gray-900">{systems.length}</div>
-        </div>
-        <div className="bg-white rounded-xl border border-orange-200 p-6">
-          <div className="text-sm text-orange-600">Hochrisiko</div>
-          <div className="text-3xl font-bold text-orange-600">{highRiskCount}</div>
-        </div>
-        <div className="bg-white rounded-xl border border-green-200 p-6">
-          <div className="text-sm text-green-600">Konform</div>
-          <div className="text-3xl font-bold text-green-600">{compliantCount}</div>
-        </div>
-        <div className="bg-white rounded-xl border border-gray-200 p-6">
-          <div className="text-sm text-gray-500">Nicht klassifiziert</div>
-          <div className="text-3xl font-bold text-gray-500">{unclassifiedCount}</div>
-        </div>
-      </div>
-
-      <RiskPyramid systems={systems} />
-
-      <div className="flex items-center gap-2 flex-wrap">
-        <span className="text-sm text-gray-500">Filter:</span>
-        {['all', 'high-risk', 'limited-risk', 'minimal-risk', 'unclassified', 'compliant', 'non-compliant'].map(f => (
-          <button
-            key={f}
-            onClick={() => setFilter(f)}
-            className={`px-3 py-1 text-sm rounded-full transition-colors ${
-              filter === f ? 'bg-purple-600 text-white' : 'bg-gray-100 text-gray-600 hover:bg-gray-200'
-            }`}
-          >
-            {f === 'all' ? 'Alle' :
-             f === 'high-risk' ? 'Hochrisiko' :
-             f === 'limited-risk' ? 'Begrenztes Risiko' :
-             f === 'minimal-risk' ? 'Minimales Risiko' :
-             f === 'unclassified' ? 'Nicht klassifiziert' :
-             f === 'compliant' ? 'Konform' : 'Nicht konform'}
-          </button>
-        ))}
-      </div>
-
-      {loading && <LoadingSkeleton />}
-
-      {!loading && (
-        <div className="grid grid-cols-1 md:grid-cols-2 gap-6">
-          {filteredSystems.map(system => (
-            <AISystemCard
-              key={system.id}
-              system={system}
-              onAssess={() => handleAssess(system.id)}
-              onEdit={() => handleEdit(system)}
-              onDelete={() => handleDelete(system.id)}
-              assessing={assessingId === system.id}
+      {/* Tab: Overview */}
+      {activeTab === 'overview' && (
+        <>
+          {/* Add/Edit System Form */}
+          {showAddForm && (
+            <AddSystemForm
+              onSubmit={handleAddSystem}
+              onCancel={() => { setShowAddForm(false); setEditingSystem(null) }}
+              initialData={editingSystem}
             />
-          ))}
-        </div>
+          )}
+
+          {/* Stats */}
+          <div className="grid grid-cols-1 md:grid-cols-4 gap-4">
+            <div className="bg-white rounded-xl border border-gray-200 p-6">
+              <div className="text-sm text-gray-500">KI-Systeme gesamt</div>
+              <div className="text-3xl font-bold text-gray-900">{systems.length}</div>
+            </div>
+            <div className="bg-white rounded-xl border border-orange-200 p-6">
+              <div className="text-sm text-orange-600">Hochrisiko</div>
+              <div className="text-3xl font-bold text-orange-600">{highRiskCount}</div>
+            </div>
+            <div className="bg-white rounded-xl border border-green-200 p-6">
+              <div className="text-sm text-green-600">Konform</div>
+              <div className="text-3xl font-bold text-green-600">{compliantCount}</div>
+            </div>
+            <div className="bg-white rounded-xl border border-gray-200 p-6">
+              <div className="text-sm text-gray-500">Nicht klassifiziert</div>
+              <div className="text-3xl font-bold text-gray-500">{unclassifiedCount}</div>
+            </div>
+          </div>
+
+          {/* Risk Pyramid */}
+          <RiskPyramid systems={systems} />
+
+          {/* Filter */}
+          <div className="flex items-center gap-2 flex-wrap">
+            <span className="text-sm text-gray-500">Filter:</span>
+            {['all', 'high-risk', 'limited-risk', 'minimal-risk', 'unclassified', 'compliant', 'non-compliant'].map(f => (
+              <button
+                key={f}
+                onClick={() => setFilter(f)}
+                className={`px-3 py-1 text-sm rounded-full transition-colors ${
+                  filter === f
+                    ? 'bg-purple-600 text-white'
+                    : 'bg-gray-100 text-gray-600 hover:bg-gray-200'
+                }`}
+              >
+                {f === 'all' ? 'Alle' :
+                 f === 'high-risk' ? 'Hochrisiko' :
+                 f === 'limited-risk' ? 'Begrenztes Risiko' :
+                 f === 'minimal-risk' ? 'Minimales Risiko' :
+                 f === 'unclassified' ? 'Nicht klassifiziert' :
+                 f === 'compliant' ? 'Konform' : 'Nicht konform'}
+              </button>
+            ))}
+          </div>
+
+          {/* Loading */}
+          {loading && <LoadingSkeleton />}
+
+          {/* AI Systems List */}
+          {!loading && (
+            <div className="grid grid-cols-1 md:grid-cols-2 gap-6">
+              {filteredSystems.map(system => (
+                <AISystemCard
+                  key={system.id}
+                  system={system}
+                  onAssess={() => handleAssess(system.id)}
+                  onEdit={() => handleEdit(system)}
+                  onDelete={() => handleDelete(system.id)}
+                  assessing={assessingId === system.id}
+                />
+              ))}
+            </div>
+          )}
+
+          {!loading && filteredSystems.length === 0 && (
+            <div className="bg-white rounded-xl border border-gray-200 p-12 text-center">
+              <div className="w-16 h-16 mx-auto bg-purple-100 rounded-full flex items-center justify-center mb-4">
+                <svg className="w-8 h-8 text-purple-600" fill="none" stroke="currentColor" viewBox="0 0 24 24">
+                  <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M9.75 17L9 20l-1 1h8l-1-1-.75-3M3 13h18M5 17h14a2 2 0 002-2V5a2 2 0 00-2-2H5a2 2 0 00-2 2v10a2 2 0 002 2z" />
+                </svg>
+              </div>
+              <h3 className="text-lg font-semibold text-gray-900">Keine KI-Systeme gefunden</h3>
+              <p className="mt-2 text-gray-500">Passen Sie den Filter an oder registrieren Sie ein neues KI-System.</p>
+            </div>
+          )}
+        </>
       )}
 
-      {!loading && filteredSystems.length === 0 && (
-        <div className="bg-white rounded-xl border border-gray-200 p-12 text-center">
-          <div className="w-16 h-16 mx-auto bg-purple-100 rounded-full flex items-center justify-center mb-4">
-            <svg className="w-8 h-8 text-purple-600" fill="none" stroke="currentColor" viewBox="0 0 24 24">
-              <path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M9.75 17L9 20l-1 1h8l-1-1-.75-3M3 13h18M5 17h14a2 2 0 002-2V5a2 2 0 00-2-2H5a2 2 0 00-2 2v10a2 2 0 002 2z" />
-            </svg>
-          </div>
-          <h3 className="text-lg font-semibold text-gray-900">Keine KI-Systeme gefunden</h3>
-          <p className="mt-2 text-gray-500">Passen Sie den Filter an oder registrieren Sie ein neues KI-System.</p>
-        </div>
+      {/* Tab: Decision Tree */}
+      {activeTab === 'decision-tree' && (
+        <DecisionTreeWizard />
+      )}
+
+      {/* Tab: Results */}
+      {activeTab === 'results' && (
+        <SavedResultsTab />
       )}
     </div>
   )
diff --git a/admin-compliance/app/sdk/ai-registration/page.tsx b/admin-compliance/app/sdk/ai-registration/page.tsx
new file mode 100644
index 0000000..19c4971
--- /dev/null
+++ b/admin-compliance/app/sdk/ai-registration/page.tsx
@@ -0,0 +1,491 @@
+'use client'
+
+import React, { useState, useEffect } from 'react'
+
+interface Registration {
+  id: string
+  system_name: string
+  system_version: string
+  risk_classification: string
+  gpai_classification: string
+  registration_status: string
+  eu_database_id: string
+  provider_name: string
+  created_at: string
+}
+
+const STATUS_STYLES: Record<string, { bg: string; text: string; label: string }> = {
+  draft: { bg: 'bg-gray-100', text: 'text-gray-700', label: 'Entwurf' },
+  ready: { bg: 'bg-blue-100', text: 'text-blue-700', label: 'Bereit' },
+  submitted: { bg: 'bg-yellow-100', text: 'text-yellow-700', label: 'Eingereicht' },
+  registered: { bg: 'bg-green-100', text: 'text-green-700', label: 'Registriert' },
+  update_required: { bg: 'bg-orange-100', text: 'text-orange-700', label: 'Update noetig' },
+  withdrawn: { bg: 'bg-red-100', text: 'text-red-700', label: 'Zurueckgezogen' },
+}
+
+const RISK_STYLES: Record<string, { bg: string; text: string }> = {
+  high_risk: { bg: 'bg-red-100', text: 'text-red-700' },
+  limited_risk: { bg: 'bg-yellow-100', text: 'text-yellow-700' },
+  minimal_risk: { bg: 'bg-green-100', text: 'text-green-700' },
+  not_classified: { bg: 'bg-gray-100', text: 'text-gray-500' },
+}
+
+const INITIAL_FORM = {
+  system_name: '',
+  system_version: '1.0',
+  system_description: '',
+  intended_purpose: '',
+  provider_name: '',
+  provider_legal_form: '',
+  provider_address: '',
+  provider_country: 'DE',
+  eu_representative_name: '',
+  eu_representative_contact: '',
+  risk_classification: 'not_classified',
+  annex_iii_category: '',
+  gpai_classification: 'none',
+  conformity_assessment_type: 'internal',
+  notified_body_name: '',
+  notified_body_id: '',
+  ce_marking: false,
+  training_data_summary: '',
+}
+
+export default function AIRegistrationPage() {
+  const [registrations, setRegistrations] = useState<Registration[]>([])
+  const [loading, setLoading] = useState(true)
+  const [showWizard, setShowWizard] = useState(false)
+  const [wizardStep, setWizardStep] = useState(1)
+  const [form, setForm] = useState({ ...INITIAL_FORM })
+  const [submitting, setSubmitting] = useState(false)
+  const [error, setError] = useState<string | null>(null)
+
+  useEffect(() => { loadRegistrations() }, [])
+
+  async function loadRegistrations() {
+    try {
+      setLoading(true)
+      const resp = await fetch('/api/sdk/v1/ai-registration')
+      if (resp.ok) {
+        const data = await resp.json()
+        setRegistrations(data.registrations || [])
+      }
+    } catch {
+      setError('Fehler beim Laden')
+    } finally {
+      setLoading(false)
+    }
+  }
+
+  async function handleSubmit() {
+    setSubmitting(true)
+    try {
+      const resp = await fetch('/api/sdk/v1/ai-registration', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify(form),
+      })
+      if (resp.ok) {
+        setShowWizard(false)
+        setForm({ ...INITIAL_FORM })
+        setWizardStep(1)
+        loadRegistrations()
+      } else {
+        const data = await resp.json()
+        setError(data.error || 'Fehler beim Erstellen')
+      }
+    } catch {
+      setError('Netzwerkfehler')
+    } finally {
+      setSubmitting(false)
+    }
+  }
+
+  async function handleExport(id: string) {
+    try {
+      const resp = await fetch(`/api/sdk/v1/ai-registration/${id}`)
+      if (resp.ok) {
+        const reg = await resp.json()
+        // Build export JSON client-side
+        const exportData = {
+          schema_version: '1.0',
+          submission_type: 'ai_system_registration',
+          regulation: 'EU AI Act (EU) 2024/1689',
+          article: 'Art. 49',
+          provider: { name: reg.provider_name, address: reg.provider_address, country: reg.provider_country },
+          system: { name: reg.system_name, version: reg.system_version, description: reg.system_description, purpose: reg.intended_purpose },
+          classification: { risk_level: reg.risk_classification, annex_iii: reg.annex_iii_category, gpai: reg.gpai_classification },
+          conformity: { type: reg.conformity_assessment_type, ce_marking: reg.ce_marking },
+        }
+        const blob = new Blob([JSON.stringify(exportData, null, 2)], { type: 'application/json' })
+        const url = URL.createObjectURL(blob)
+        const a = document.createElement('a')
+        a.href = url
+        a.download = `eu_ai_registration_${reg.system_name.replace(/\s+/g, '_')}.json`
+        a.click()
+        URL.revokeObjectURL(url)
+      }
+    } catch {
+      setError('Export fehlgeschlagen')
+    }
+  }
+
+  async function handleStatusChange(id: string, status: string) {
+    try {
+      await fetch(`/api/sdk/v1/ai-registration/${id}`, {
+        method: 'PATCH',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ status }),
+      })
+      loadRegistrations()
+    } catch {
+      setError('Status-Aenderung fehlgeschlagen')
+    }
+  }
+
+  const updateForm = (updates: Partial<typeof form>) => setForm(prev => ({ ...prev, ...updates }))
+
+  const STEPS = [
+    { id: 1, title: 'Anbieter', desc: 'Unternehmensangaben' },
+    { id: 2, title: 'System', desc: 'KI-System Details' },
+    { id: 3, title: 'Klassifikation', desc: 'Risikoeinstufung' },
+    { id: 4, title: 'Konformitaet', desc: 'CE & Notified Body' },
+    { id: 5, title: 'Trainingsdaten', desc: 'Datenzusammenfassung' },
+    { id: 6, title: 'Pruefung', desc: 'Zusammenfassung & Export' },
+  ]
+
+  return (
+    <div className="max-w-5xl mx-auto p-6">
+      {/* Header */}
+      <div className="flex items-center justify-between mb-8">
+        <div>
+          <h1 className="text-2xl font-bold text-gray-900">EU AI Database Registrierung</h1>
+          <p className="text-sm text-gray-500 mt-1">Art. 49 KI-Verordnung (EU) 2024/1689 — Registrierung von Hochrisiko-KI-Systemen</p>
+        </div>
+        <button
+          onClick={() => setShowWizard(true)}
+          className="px-4 py-2 bg-purple-600 text-white rounded-lg hover:bg-purple-700 transition-colors"
+        >
+          + Neue Registrierung
+        </button>
+      </div>
+
+      {error && (
+        <div className="mb-4 p-3 bg-red-50 border border-red-200 rounded-lg text-sm text-red-700">
+          {error}
+          <button onClick={() => setError(null)} className="ml-2 underline">Schliessen</button>
+        </div>
+      )}
+
+      {/* Stats */}
+      <div className="grid grid-cols-4 gap-4 mb-8">
+        {['draft', 'ready', 'submitted', 'registered'].map(status => {
+          const count = registrations.filter(r => r.registration_status === status).length
+          const style = STATUS_STYLES[status]
+          return (
+            <div key={status} className={`p-4 rounded-xl border ${style.bg}`}>
+              <div className={`text-2xl font-bold ${style.text}`}>{count}</div>
+              <div className="text-sm text-gray-600">{style.label}</div>
+            </div>
+          )
+        })}
+      </div>
+
+      {/* Registrations List */}
+      {loading ? (
+        <div className="text-center py-12 text-gray-500">Lade...</div>
+      ) : registrations.length === 0 ? (
+        <div className="text-center py-12 text-gray-400">
+          <p className="text-lg mb-2">Noch keine Registrierungen</p>
+          <p className="text-sm">Erstelle eine neue Registrierung fuer dein Hochrisiko-KI-System.</p>
+        </div>
+      ) : (
+        <div className="space-y-4">
+          {registrations.map(reg => {
+            const status = STATUS_STYLES[reg.registration_status] || STATUS_STYLES.draft
+            const risk = RISK_STYLES[reg.risk_classification] || RISK_STYLES.not_classified
+            return (
+              <div key={reg.id} className="bg-white rounded-xl border border-gray-200 p-6 hover:border-purple-300 transition-all">
+                <div className="flex items-center justify-between">
+                  <div>
+                    <div className="flex items-center gap-2 mb-1">
+                      <h3 className="text-lg font-semibold text-gray-900">{reg.system_name}</h3>
+                      <span className="text-sm text-gray-400">v{reg.system_version}</span>
+                      <span className={`px-2 py-0.5 text-xs rounded-full ${status.bg} ${status.text}`}>{status.label}</span>
+                      <span className={`px-2 py-0.5 text-xs rounded-full ${risk.bg} ${risk.text}`}>{reg.risk_classification.replace('_', ' ')}</span>
+                      {reg.gpai_classification !== 'none' && (
+                        <span className="px-2 py-0.5 text-xs rounded-full bg-blue-100 text-blue-700">GPAI: {reg.gpai_classification}</span>
+                      )}
+                    </div>
+                    <div className="text-sm text-gray-500">
+                      {reg.provider_name && <span>{reg.provider_name} · </span>}
+                      {reg.eu_database_id && <span>EU-ID: {reg.eu_database_id} · </span>}
+                      <span>{new Date(reg.created_at).toLocaleDateString('de-DE')}</span>
+                    </div>
+                  </div>
+                  <div className="flex gap-2">
+                    <button onClick={() => handleExport(reg.id)} className="px-3 py-1.5 text-sm border border-gray-300 rounded-lg hover:bg-gray-50">
+                      JSON Export
+                    </button>
+                    {reg.registration_status === 'draft' && (
+                      <button onClick={() => handleStatusChange(reg.id, 'ready')} className="px-3 py-1.5 text-sm bg-blue-600 text-white rounded-lg hover:bg-blue-700">
+                        Bereit markieren
+                      </button>
+                    )}
+                    {reg.registration_status === 'ready' && (
+                      <button onClick={() => handleStatusChange(reg.id, 'submitted')} className="px-3 py-1.5 text-sm bg-green-600 text-white rounded-lg hover:bg-green-700">
+                        Als eingereicht markieren
+                      </button>
+                    )}
+                  </div>
+                </div>
+              </div>
+            )
+          })}
+        </div>
+      )}
+
+      {/* Wizard Modal */}
+      {showWizard && (
+        <div className="fixed inset-0 bg-black/50 flex items-center justify-center z-50 p-4">
+          <div className="bg-white rounded-2xl shadow-2xl w-full max-w-3xl max-h-[90vh] overflow-y-auto">
+            <div className="p-6 border-b">
+              <div className="flex items-center justify-between mb-4">
+                <h2 className="text-xl font-bold text-gray-900">Neue EU AI Registrierung</h2>
+                <button onClick={() => { setShowWizard(false); setWizardStep(1) }} className="text-gray-400 hover:text-gray-600 text-2xl">&times;</button>
+              </div>
+              {/* Step Indicator */}
+              <div className="flex gap-1">
+                {STEPS.map(step => (
+                  <button key={step.id} onClick={() => setWizardStep(step.id)}
+                    className={`flex-1 py-2 text-xs rounded-lg transition-all ${
+                      wizardStep === step.id ? 'bg-purple-100 text-purple-700 font-medium' :
+                      wizardStep > step.id ? 'bg-green-50 text-green-700' : 'bg-gray-50 text-gray-400'
+                    }`}>
+                    {wizardStep > step.id ? '✓ ' : ''}{step.title}
+                  </button>
+                ))}
+              </div>
+            </div>
+
+            <div className="p-6 space-y-4">
+              {/* Step 1: Provider */}
+              {wizardStep === 1 && (
+                <>
+                  <h3 className="font-semibold text-gray-900">Anbieter-Informationen</h3>
+                  <p className="text-sm text-gray-500">Angaben zum Anbieter des KI-Systems gemaess Art. 49 KI-VO.</p>
+                  <div className="grid grid-cols-2 gap-4">
+                    <div>
+                      <label className="block text-sm font-medium text-gray-700 mb-1">Firmenname *</label>
+                      <input value={form.provider_name} onChange={e => updateForm({ provider_name: e.target.value })}
+                        className="w-full px-3 py-2 border rounded-lg focus:ring-2 focus:ring-purple-500 focus:border-transparent" placeholder="Acme GmbH" />
+                    </div>
+                    <div>
+                      <label className="block text-sm font-medium text-gray-700 mb-1">Rechtsform</label>
+                      <input value={form.provider_legal_form} onChange={e => updateForm({ provider_legal_form: e.target.value })}
+                        className="w-full px-3 py-2 border rounded-lg focus:ring-2 focus:ring-purple-500 focus:border-transparent" placeholder="GmbH" />
+                    </div>
+                  </div>
+                  <div>
+                    <label className="block text-sm font-medium text-gray-700 mb-1">Adresse</label>
+                    <input value={form.provider_address} onChange={e => updateForm({ provider_address: e.target.value })}
+                      className="w-full px-3 py-2 border rounded-lg focus:ring-2 focus:ring-purple-500 focus:border-transparent" placeholder="Musterstr. 1, 20095 Hamburg" />
+                  </div>
+                  <div className="grid grid-cols-2 gap-4">
+                    <div>
+                      <label className="block text-sm font-medium text-gray-700 mb-1">Land</label>
+                      <select value={form.provider_country} onChange={e => updateForm({ provider_country: e.target.value })}
+                        className="w-full px-3 py-2 border rounded-lg focus:ring-2 focus:ring-purple-500 focus:border-transparent">
+                        <option value="DE">Deutschland</option>
+                        <option value="AT">Oesterreich</option>
+                        <option value="CH">Schweiz</option>
+                        <option value="OTHER">Anderes Land</option>
+                      </select>
+                    </div>
+                    <div>
+                      <label className="block text-sm font-medium text-gray-700 mb-1">EU-Repraesentant (falls Non-EU)</label>
+                      <input value={form.eu_representative_name} onChange={e => updateForm({ eu_representative_name: e.target.value })}
+                        className="w-full px-3 py-2 border rounded-lg focus:ring-2 focus:ring-purple-500 focus:border-transparent" placeholder="Optional" />
+                    </div>
+                  </div>
+                </>
+              )}
+
+              {/* Step 2: System */}
+              {wizardStep === 2 && (
+                <>
+                  <h3 className="font-semibold text-gray-900">KI-System Details</h3>
+                  <div className="grid grid-cols-2 gap-4">
+                    <div>
+                      <label className="block text-sm font-medium text-gray-700 mb-1">Systemname *</label>
+                      <input value={form.system_name} onChange={e => updateForm({ system_name: e.target.value })}
+                        className="w-full px-3 py-2 border rounded-lg focus:ring-2 focus:ring-purple-500 focus:border-transparent" placeholder="z.B. HR Copilot" />
+                    </div>
+                    <div>
+                      <label className="block text-sm font-medium text-gray-700 mb-1">Version</label>
+                      <input value={form.system_version} onChange={e => updateForm({ system_version: e.target.value })}
+                        className="w-full px-3 py-2 border rounded-lg focus:ring-2 focus:ring-purple-500 focus:border-transparent" placeholder="1.0" />
+                    </div>
+                  </div>
+                  <div>
+                    <label className="block text-sm font-medium text-gray-700 mb-1">Systembeschreibung</label>
+                    <textarea value={form.system_description} onChange={e => updateForm({ system_description: e.target.value })} rows={3}
+                      className="w-full px-3 py-2 border rounded-lg focus:ring-2 focus:ring-purple-500 focus:border-transparent" placeholder="Beschreibe was das KI-System tut..." />
+                  </div>
+                  <div>
+                    <label className="block text-sm font-medium text-gray-700 mb-1">Einsatzzweck (Intended Purpose)</label>
+                    <textarea value={form.intended_purpose} onChange={e => updateForm({ intended_purpose: e.target.value })} rows={2}
+                      className="w-full px-3 py-2 border rounded-lg focus:ring-2 focus:ring-purple-500 focus:border-transparent" placeholder="Wofuer wird das System eingesetzt?" />
+                  </div>
+                </>
+              )}
+
+              {/* Step 3: Classification */}
+              {wizardStep === 3 && (
+                <>
+                  <h3 className="font-semibold text-gray-900">Risiko-Klassifikation</h3>
+                  <p className="text-sm text-gray-500">Basierend auf dem AI Act Decision Tree oder manueller Einstufung.</p>
+                  <div>
+                    <label className="block text-sm font-medium text-gray-700 mb-1">Risikoklasse</label>
+                    <select value={form.risk_classification} onChange={e => updateForm({ risk_classification: e.target.value })}
+                      className="w-full px-3 py-2 border rounded-lg focus:ring-2 focus:ring-purple-500 focus:border-transparent">
+                      <option value="not_classified">Noch nicht klassifiziert</option>
+                      <option value="minimal_risk">Minimal Risk</option>
+                      <option value="limited_risk">Limited Risk</option>
+                      <option value="high_risk">High Risk</option>
+                    </select>
+                  </div>
+                  {form.risk_classification === 'high_risk' && (
+                    <div>
+                      <label className="block text-sm font-medium text-gray-700 mb-1">Annex III Kategorie</label>
+                      <select value={form.annex_iii_category} onChange={e => updateForm({ annex_iii_category: e.target.value })}
+                        className="w-full px-3 py-2 border rounded-lg focus:ring-2 focus:ring-purple-500 focus:border-transparent">
+                        <option value="">Bitte waehlen...</option>
+                        <option value="biometric">1. Biometrische Identifizierung</option>
+                        <option value="critical_infrastructure">2. Kritische Infrastruktur</option>
+                        <option value="education">3. Bildung und Berufsausbildung</option>
+                        <option value="employment">4. Beschaeftigung und Arbeitnehmerverwaltung</option>
+                        <option value="essential_services">5. Zugang zu wesentlichen Diensten</option>
+                        <option value="law_enforcement">6. Strafverfolgung</option>
+                        <option value="migration">7. Migration und Grenzkontrolle</option>
+                        <option value="justice">8. Rechtspflege und Demokratie</option>
+                      </select>
+                    </div>
+                  )}
+                  <div>
+                    <label className="block text-sm font-medium text-gray-700 mb-1">GPAI Klassifikation</label>
+                    <select value={form.gpai_classification} onChange={e => updateForm({ gpai_classification: e.target.value })}
+                      className="w-full px-3 py-2 border rounded-lg focus:ring-2 focus:ring-purple-500 focus:border-transparent">
+                      <option value="none">Kein GPAI</option>
+                      <option value="standard">GPAI (Standard)</option>
+                      <option value="systemic">GPAI mit systemischem Risiko</option>
+                    </select>
+                  </div>
+                  <div className="bg-blue-50 border border-blue-200 rounded-lg p-4 text-sm text-blue-800">
+                    <strong>Tipp:</strong> Nutze den <a href="/sdk/ai-act" className="underline">AI Act Decision Tree</a> fuer eine strukturierte Klassifikation.
+                  </div>
+                </>
+              )}
+
+              {/* Step 4: Conformity */}
+              {wizardStep === 4 && (
+                <>
+                  <h3 className="font-semibold text-gray-900">Konformitaetsbewertung</h3>
+                  <div>
+                    <label className="block text-sm font-medium text-gray-700 mb-1">Art der Konformitaetsbewertung</label>
+                    <select value={form.conformity_assessment_type} onChange={e => updateForm({ conformity_assessment_type: e.target.value })}
+                      className="w-full px-3 py-2 border rounded-lg focus:ring-2 focus:ring-purple-500 focus:border-transparent">
+                      <option value="not_required">Nicht erforderlich</option>
+                      <option value="internal">Interne Konformitaetsbewertung</option>
+                      <option value="third_party">Drittpartei-Bewertung (Notified Body)</option>
+                    </select>
+                  </div>
+                  {form.conformity_assessment_type === 'third_party' && (
+                    <div className="grid grid-cols-2 gap-4">
+                      <div>
+                        <label className="block text-sm font-medium text-gray-700 mb-1">Notified Body Name</label>
+                        <input value={form.notified_body_name} onChange={e => updateForm({ notified_body_name: e.target.value })}
+                          className="w-full px-3 py-2 border rounded-lg focus:ring-2 focus:ring-purple-500 focus:border-transparent" />
+                      </div>
+                      <div>
+                        <label className="block text-sm font-medium text-gray-700 mb-1">Notified Body ID</label>
+                        <input value={form.notified_body_id} onChange={e => updateForm({ notified_body_id: e.target.value })}
+                          className="w-full px-3 py-2 border rounded-lg focus:ring-2 focus:ring-purple-500 focus:border-transparent" />
+                      </div>
+                    </div>
+                  )}
+                  <label className="flex items-center gap-3 p-3 rounded-lg border hover:bg-gray-50 cursor-pointer">
+                    <input type="checkbox" checked={form.ce_marking} onChange={e => updateForm({ ce_marking: e.target.checked })}
+                      className="w-4 h-4 rounded border-gray-300 text-purple-600" />
+                    <span className="text-sm font-medium text-gray-900">CE-Kennzeichnung angebracht</span>
+                  </label>
+                </>
+              )}
+
+              {/* Step 5: Training Data */}
+              {wizardStep === 5 && (
+                <>
+                  <h3 className="font-semibold text-gray-900">Trainingsdaten-Zusammenfassung</h3>
+                  <p className="text-sm text-gray-500">Art. 10 KI-VO — Keine vollstaendige Offenlegung, sondern Kategorien und Herkunft.</p>
+                  <div>
+                    <label className="block text-sm font-medium text-gray-700 mb-1">Zusammenfassung der Trainingsdaten</label>
+                    <textarea value={form.training_data_summary} onChange={e => updateForm({ training_data_summary: e.target.value })} rows={5}
+                      className="w-full px-3 py-2 border rounded-lg focus:ring-2 focus:ring-purple-500 focus:border-transparent"
+                      placeholder="Beschreibe die verwendeten Datenquellen:&#10;- Oeffentliche Daten (z.B. Wikipedia, Common Crawl)&#10;- Lizenzierte Daten (z.B. Fachpublikationen)&#10;- Synthetische Daten&#10;- Unternehmensinterne Daten" />
+                  </div>
+                </>
+              )}
+
+              {/* Step 6: Review */}
+              {wizardStep === 6 && (
+                <>
+                  <h3 className="font-semibold text-gray-900">Zusammenfassung</h3>
+                  <div className="space-y-3 text-sm">
+                    <div className="grid grid-cols-2 gap-4 p-4 bg-gray-50 rounded-lg">
+                      <div><span className="text-gray-500">Anbieter:</span> <strong>{form.provider_name || '–'}</strong></div>
+                      <div><span className="text-gray-500">Land:</span> <strong>{form.provider_country}</strong></div>
+                      <div><span className="text-gray-500">System:</span> <strong>{form.system_name || '–'}</strong></div>
+                      <div><span className="text-gray-500">Version:</span> <strong>{form.system_version}</strong></div>
+                      <div><span className="text-gray-500">Risiko:</span> <strong>{form.risk_classification}</strong></div>
+                      <div><span className="text-gray-500">GPAI:</span> <strong>{form.gpai_classification}</strong></div>
+                      <div><span className="text-gray-500">Konformitaet:</span> <strong>{form.conformity_assessment_type}</strong></div>
+                      <div><span className="text-gray-500">CE:</span> <strong>{form.ce_marking ? 'Ja' : 'Nein'}</strong></div>
+                    </div>
+                    {form.intended_purpose && (
+                      <div className="p-4 bg-gray-50 rounded-lg">
+                        <span className="text-gray-500">Zweck:</span> {form.intended_purpose}
+                      </div>
+                    )}
+                  </div>
+                  <div className="bg-yellow-50 border border-yellow-200 rounded-lg p-4 text-sm text-yellow-800">
+                    <strong>Hinweis:</strong> Die EU AI Datenbank befindet sich noch im Aufbau. Die Registrierung wird lokal gespeichert und kann spaeter uebermittelt werden.
+                  </div>
+                </>
+              )}
+            </div>
+
+            {/* Navigation */}
+            <div className="p-6 border-t flex justify-between">
+              <button onClick={() => wizardStep > 1 ? setWizardStep(wizardStep - 1) : setShowWizard(false)}
+                className="px-4 py-2 text-gray-700 border rounded-lg hover:bg-gray-50">
+                {wizardStep === 1 ? 'Abbrechen' : 'Zurueck'}
+              </button>
+              {wizardStep < 6 ? (
+                <button onClick={() => setWizardStep(wizardStep + 1)}
+                  disabled={wizardStep === 2 && !form.system_name}
+                  className="px-4 py-2 bg-purple-600 text-white rounded-lg hover:bg-purple-700 disabled:opacity-50">
+                  Weiter
+                </button>
+              ) : (
+                <button onClick={handleSubmit} disabled={submitting || !form.system_name}
+                  className="px-4 py-2 bg-green-600 text-white rounded-lg hover:bg-green-700 disabled:opacity-50">
+                  {submitting ? 'Speichere...' : 'Registrierung erstellen'}
+                </button>
+              )}
+            </div>
+          </div>
+        </div>
+      )}
+    </div>
+  )
+}
diff --git a/admin-compliance/app/sdk/payment-compliance/page.tsx b/admin-compliance/app/sdk/payment-compliance/page.tsx
new file mode 100644
index 0000000..29cdc71
--- /dev/null
+++ b/admin-compliance/app/sdk/payment-compliance/page.tsx
@@ -0,0 +1,496 @@
+'use client'
+
+import React, { useState, useEffect } from 'react'
+
+interface PaymentControl {
+  control_id: string
+  domain: string
+  title: string
+  objective: string
+  check_target: string
+  evidence: string[]
+  automation: string
+}
+
+interface PaymentDomain {
+  id: string
+  name: string
+  description: string
+}
+
+interface Assessment {
+  id: string
+  project_name: string
+  tender_reference: string
+  customer_name: string
+  system_type: string
+  total_controls: number
+  controls_passed: number
+  controls_failed: number
+  controls_partial: number
+  controls_not_applicable: number
+  controls_not_checked: number
+  compliance_score: number
+  status: string
+  created_at: string
+}
+
+interface TenderAnalysis {
+  id: string
+  file_name: string
+  file_size: number
+  project_name: string
+  customer_name: string
+  status: string
+  total_requirements: number
+  matched_count: number
+  unmatched_count: number
+  partial_count: number
+  requirements?: Array<{ req_id: string; text: string; obligation_level: string; technical_domain: string; confidence: number }>
+  match_results?: Array<{ req_id: string; req_text: string; verdict: string; matched_controls: Array<{ control_id: string; title: string; relevance: number }>; gap_description?: string }>
+  created_at: string
+}
+
+const AUTOMATION_STYLES: Record<string, { bg: string; text: string }> = {
+  high: { bg: 'bg-green-100', text: 'text-green-700' },
+  medium: { bg: 'bg-yellow-100', text: 'text-yellow-700' },
+  partial: { bg: 'bg-orange-100', text: 'text-orange-700' },
+  low: { bg: 'bg-red-100', text: 'text-red-700' },
+}
+
+const TARGET_ICONS: Record<string, string> = {
+  code: '💻', system: '🖥️', config: '⚙️', process: '📋',
+  repository: '📦', certificate: '📜',
+}
+
+export default function PaymentCompliancePage() {
+  const [controls, setControls] = useState<PaymentControl[]>([])
+  const [domains, setDomains] = useState<PaymentDomain[]>([])
+  const [assessments, setAssessments] = useState<Assessment[]>([])
+  const [tenderAnalyses, setTenderAnalyses] = useState<TenderAnalysis[]>([])
+  const [selectedTender, setSelectedTender] = useState<TenderAnalysis | null>(null)
+  const [selectedDomain, setSelectedDomain] = useState<string>('all')
+  const [loading, setLoading] = useState(true)
+  const [tab, setTab] = useState<'controls' | 'assessments' | 'tender'>('controls')
+  const [uploading, setUploading] = useState(false)
+  const [processing, setProcessing] = useState(false)
+  const [showNewAssessment, setShowNewAssessment] = useState(false)
+  const [newProject, setNewProject] = useState({ project_name: '', tender_reference: '', customer_name: '', system_type: 'full_stack' })
+
+  useEffect(() => {
+    loadData()
+  }, [])
+
+  async function loadData() {
+    try {
+      setLoading(true)
+      const [ctrlResp, assessResp, tenderResp] = await Promise.all([
+        fetch('/api/sdk/v1/payment-compliance?endpoint=controls'),
+        fetch('/api/sdk/v1/payment-compliance?endpoint=assessments'),
+        fetch('/api/sdk/v1/payment-compliance/tender'),
+      ])
+      if (ctrlResp.ok) {
+        const data = await ctrlResp.json()
+        setControls(data.controls || [])
+        setDomains(data.domains || [])
+      }
+      if (assessResp.ok) {
+        const data = await assessResp.json()
+        setAssessments(data.assessments || [])
+      }
+      if (tenderResp.ok) {
+        const data = await tenderResp.json()
+        setTenderAnalyses(data.analyses || [])
+      }
+    } catch {}
+    finally { setLoading(false) }
+  }
+
+  async function handleTenderUpload(e: React.ChangeEvent<HTMLInputElement>) {
+    const file = e.target.files?.[0]
+    if (!file) return
+    setUploading(true)
+    try {
+      const formData = new FormData()
+      formData.append('file', file)
+      formData.append('project_name', file.name.replace(/\.[^.]+$/, ''))
+      const resp = await fetch('/api/sdk/v1/payment-compliance/tender', { method: 'POST', body: formData })
+      if (resp.ok) {
+        const data = await resp.json()
+        // Auto-start extraction + matching
+        setProcessing(true)
+        const extractResp = await fetch(`/api/sdk/v1/payment-compliance/tender/${data.id}?action=extract`, { method: 'POST' })
+        if (extractResp.ok) {
+          await fetch(`/api/sdk/v1/payment-compliance/tender/${data.id}?action=match`, { method: 'POST' })
+        }
+        // Reload and show result
+        const detailResp = await fetch(`/api/sdk/v1/payment-compliance/tender/${data.id}`)
+        if (detailResp.ok) {
+          const detail = await detailResp.json()
+          setSelectedTender(detail)
+        }
+        loadData()
+      }
+    } catch {} finally {
+      setUploading(false)
+      setProcessing(false)
+    }
+  }
+
+  async function handleViewTender(id: string) {
+    const resp = await fetch(`/api/sdk/v1/payment-compliance/tender/${id}`)
+    if (resp.ok) {
+      setSelectedTender(await resp.json())
+    }
+  }
+
+  async function handleCreateAssessment() {
+    const resp = await fetch('/api/sdk/v1/payment-compliance', {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify(newProject),
+    })
+    if (resp.ok) {
+      setShowNewAssessment(false)
+      setNewProject({ project_name: '', tender_reference: '', customer_name: '', system_type: 'full_stack' })
+      loadData()
+    }
+  }
+
+  const filteredControls = selectedDomain === 'all'
+    ? controls
+    : controls.filter(c => c.domain === selectedDomain)
+
+  const domainStats = domains.map(d => ({
+    ...d,
+    count: controls.filter(c => c.domain === d.id).length,
+  }))
+
+  return (
+    <div className="max-w-6xl mx-auto p-6">
+      {/* Header */}
+      <div className="flex items-center justify-between mb-8">
+        <div>
+          <h1 className="text-2xl font-bold text-gray-900">Payment Terminal Compliance</h1>
+          <p className="text-sm text-gray-500 mt-1">
+            Technische Pruefbibliothek fuer Zahlungssysteme — {controls.length} Controls in {domains.length} Domaenen
+          </p>
+        </div>
+        <div className="flex gap-2">
+          <button onClick={() => setTab('controls')}
+            className={`px-4 py-2 rounded-lg text-sm font-medium ${tab === 'controls' ? 'bg-purple-600 text-white' : 'bg-gray-100 text-gray-700'}`}>
+            Controls ({controls.length})
+          </button>
+          <button onClick={() => setTab('assessments')}
+            className={`px-4 py-2 rounded-lg text-sm font-medium ${tab === 'assessments' ? 'bg-purple-600 text-white' : 'bg-gray-100 text-gray-700'}`}>
+            Assessments ({assessments.length})
+          </button>
+          <button onClick={() => setTab('tender')}
+            className={`px-4 py-2 rounded-lg text-sm font-medium ${tab === 'tender' ? 'bg-purple-600 text-white' : 'bg-gray-100 text-gray-700'}`}>
+            Ausschreibung ({tenderAnalyses.length})
+          </button>
+        </div>
+      </div>
+
+      {/* Info Box */}
+      <div className="mb-6 p-4 bg-blue-50 border border-blue-200 rounded-xl text-sm text-blue-800">
+        <div className="font-semibold mb-2">Wie funktioniert Payment Terminal Compliance?</div>
+        <div className="grid grid-cols-3 gap-4">
+          <div>
+            <div className="font-medium mb-1">1. Controls durchsuchen</div>
+            <p className="text-xs text-blue-700">Unsere Bibliothek enthaelt {controls.length} technische Pruefregeln fuer Zahlungssysteme — von Transaktionslogik ueber Kryptographie bis ZVT/OPI-Protokollverhalten. Jeder Control definiert was geprueft wird und welche Evidenz noetig ist.</p>
+          </div>
+          <div>
+            <div className="font-medium mb-1">2. Assessment erstellen</div>
+            <p className="text-xs text-blue-700">Ein Assessment ist eine projektbezogene Pruefung — z.B. fuer eine bestimmte Ausschreibung oder einen Kunden. Sie ordnet jedem Control einen Status zu: bestanden, fehlgeschlagen, teilweise oder nicht anwendbar.</p>
+          </div>
+          <div>
+            <div className="font-medium mb-1">3. Ausschreibung analysieren</div>
+            <p className="text-xs text-blue-700">Laden Sie ein Ausschreibungsdokument hoch. Die KI extrahiert automatisch die Anforderungen und matcht sie gegen unsere Controls. Ergebnis: Welche Anforderungen sind abgedeckt und wo gibt es Luecken.</p>
+          </div>
+        </div>
+      </div>
+
+      {loading ? (
+        <div className="text-center py-12 text-gray-500">Lade...</div>
+      ) : tab === 'controls' ? (
+        <>
+          {/* Domain Filter */}
+          <div className="grid grid-cols-5 gap-3 mb-6">
+            <button onClick={() => setSelectedDomain('all')}
+              className={`p-3 rounded-xl border text-center ${selectedDomain === 'all' ? 'border-purple-500 bg-purple-50' : 'border-gray-200 hover:border-purple-300'}`}>
+              <div className="text-lg font-bold text-purple-700">{controls.length}</div>
+              <div className="text-xs text-gray-500">Alle</div>
+            </button>
+            {domainStats.map(d => (
+              <button key={d.id} onClick={() => setSelectedDomain(d.id)}
+                className={`p-3 rounded-xl border text-center ${selectedDomain === d.id ? 'border-purple-500 bg-purple-50' : 'border-gray-200 hover:border-purple-300'}`}>
+                <div className="text-lg font-bold text-gray-900">{d.count}</div>
+                <div className="text-xs text-gray-500 truncate">{d.id}</div>
+              </button>
+            ))}
+          </div>
+
+          {/* Domain Description */}
+          {selectedDomain !== 'all' && (
+            <div className="mb-4 p-3 bg-blue-50 border border-blue-200 rounded-lg text-sm text-blue-800">
+              <strong>{domains.find(d => d.id === selectedDomain)?.name}:</strong>{' '}
+              {domains.find(d => d.id === selectedDomain)?.description}
+            </div>
+          )}
+
+          {/* Controls List */}
+          <div className="space-y-3">
+            {filteredControls.map(ctrl => {
+              const autoStyle = AUTOMATION_STYLES[ctrl.automation] || AUTOMATION_STYLES.low
+              return (
+                <div key={ctrl.control_id} className="bg-white rounded-xl border border-gray-200 p-4 hover:border-purple-300 transition-all">
+                  <div className="flex items-start justify-between">
+                    <div className="flex-1">
+                      <div className="flex items-center gap-2 mb-1">
+                        <span className="text-xs font-mono text-purple-600 bg-purple-50 px-2 py-0.5 rounded">{ctrl.control_id}</span>
+                        <span className="text-xs text-gray-400">{TARGET_ICONS[ctrl.check_target] || '🔍'} {ctrl.check_target}</span>
+                        <span className={`text-xs px-2 py-0.5 rounded-full ${autoStyle.bg} ${autoStyle.text}`}>
+                          {ctrl.automation}
+                        </span>
+                      </div>
+                      <h3 className="text-sm font-semibold text-gray-900">{ctrl.title}</h3>
+                      <p className="text-xs text-gray-500 mt-1">{ctrl.objective}</p>
+                    </div>
+                  </div>
+                  <div className="flex gap-1 mt-2">
+                    {ctrl.evidence.map(ev => (
+                      <span key={ev} className="text-xs bg-gray-100 text-gray-600 px-2 py-0.5 rounded">{ev}</span>
+                    ))}
+                  </div>
+                </div>
+              )
+            })}
+          </div>
+        </>
+      ) : tab === 'assessments' ? (
+        <>
+          {/* Assessments Tab */}
+          <div className="mb-4">
+            <button onClick={() => setShowNewAssessment(true)}
+              className="px-4 py-2 bg-purple-600 text-white rounded-lg hover:bg-purple-700">
+              + Neues Assessment
+            </button>
+          </div>
+
+          {showNewAssessment && (
+            <div className="mb-6 p-6 bg-white rounded-xl border border-purple-200">
+              <h3 className="font-semibold text-gray-900 mb-4">Neues Payment Compliance Assessment</h3>
+              <div className="grid grid-cols-2 gap-4">
+                <div>
+                  <label className="block text-sm font-medium text-gray-700 mb-1">Projektname *</label>
+                  <input value={newProject.project_name} onChange={e => setNewProject(p => ({ ...p, project_name: e.target.value }))}
+                    className="w-full px-3 py-2 border rounded-lg focus:ring-2 focus:ring-purple-500" placeholder="z.B. Ausschreibung Muenchen 2026" />
+                </div>
+                <div>
+                  <label className="block text-sm font-medium text-gray-700 mb-1">Ausschreibungs-Referenz</label>
+                  <input value={newProject.tender_reference} onChange={e => setNewProject(p => ({ ...p, tender_reference: e.target.value }))}
+                    className="w-full px-3 py-2 border rounded-lg focus:ring-2 focus:ring-purple-500" placeholder="z.B. 2026-PAY-001" />
+                </div>
+                <div>
+                  <label className="block text-sm font-medium text-gray-700 mb-1">Kunde</label>
+                  <input value={newProject.customer_name} onChange={e => setNewProject(p => ({ ...p, customer_name: e.target.value }))}
+                    className="w-full px-3 py-2 border rounded-lg focus:ring-2 focus:ring-purple-500" placeholder="z.B. Stadt Muenchen" />
+                </div>
+                <div>
+                  <label className="block text-sm font-medium text-gray-700 mb-1">Systemtyp</label>
+                  <select value={newProject.system_type} onChange={e => setNewProject(p => ({ ...p, system_type: e.target.value }))}
+                    className="w-full px-3 py-2 border rounded-lg focus:ring-2 focus:ring-purple-500">
+                    <option value="full_stack">Full Stack (Terminal + Backend)</option>
+                    <option value="terminal">Nur Terminal</option>
+                    <option value="backend">Nur Backend</option>
+                  </select>
+                </div>
+              </div>
+              <div className="flex gap-2 mt-4">
+                <button onClick={handleCreateAssessment} disabled={!newProject.project_name}
+                  className="px-4 py-2 bg-green-600 text-white rounded-lg hover:bg-green-700 disabled:opacity-50">Erstellen</button>
+                <button onClick={() => setShowNewAssessment(false)}
+                  className="px-4 py-2 bg-gray-100 text-gray-700 rounded-lg hover:bg-gray-200">Abbrechen</button>
+              </div>
+            </div>
+          )}
+
+          {assessments.length === 0 ? (
+            <div className="text-center py-12 text-gray-400">
+              <p className="text-lg mb-2">Noch keine Assessments</p>
+              <p className="text-sm">Erstelle ein neues Assessment fuer eine Ausschreibung.</p>
+            </div>
+          ) : (
+            <div className="space-y-4">
+              {assessments.map(a => (
+                <div key={a.id} className="bg-white rounded-xl border border-gray-200 p-6">
+                  <div className="flex items-center justify-between mb-3">
+                    <div>
+                      <h3 className="text-lg font-semibold text-gray-900">{a.project_name}</h3>
+                      <div className="text-sm text-gray-500">
+                        {a.customer_name && <span>{a.customer_name} · </span>}
+                        {a.tender_reference && <span>Ref: {a.tender_reference} · </span>}
+                        <span>{new Date(a.created_at).toLocaleDateString('de-DE')}</span>
+                      </div>
+                    </div>
+                    <span className={`px-3 py-1 rounded-full text-sm font-medium ${
+                      a.status === 'completed' ? 'bg-green-100 text-green-700' :
+                      a.status === 'in_progress' ? 'bg-yellow-100 text-yellow-700' :
+                      'bg-gray-100 text-gray-700'
+                    }`}>{a.status}</span>
+                  </div>
+                  <div className="grid grid-cols-6 gap-2">
+                    <div className="text-center p-2 bg-gray-50 rounded">
+                      <div className="text-lg font-bold">{a.total_controls}</div>
+                      <div className="text-xs text-gray-500">Total</div>
+                    </div>
+                    <div className="text-center p-2 bg-green-50 rounded">
+                      <div className="text-lg font-bold text-green-700">{a.controls_passed}</div>
+                      <div className="text-xs text-gray-500">Passed</div>
+                    </div>
+                    <div className="text-center p-2 bg-red-50 rounded">
+                      <div className="text-lg font-bold text-red-700">{a.controls_failed}</div>
+                      <div className="text-xs text-gray-500">Failed</div>
+                    </div>
+                    <div className="text-center p-2 bg-yellow-50 rounded">
+                      <div className="text-lg font-bold text-yellow-700">{a.controls_partial}</div>
+                      <div className="text-xs text-gray-500">Partial</div>
+                    </div>
+                    <div className="text-center p-2 bg-gray-50 rounded">
+                      <div className="text-lg font-bold text-gray-400">{a.controls_not_applicable}</div>
+                      <div className="text-xs text-gray-500">N/A</div>
+                    </div>
+                    <div className="text-center p-2 bg-gray-50 rounded">
+                      <div className="text-lg font-bold text-gray-400">{a.controls_not_checked}</div>
+                      <div className="text-xs text-gray-500">Offen</div>
+                    </div>
+                  </div>
+                </div>
+              ))}
+            </div>
+          )}
+        </>
+      ) : tab === 'tender' ? (
+        <>
+          {/* Tender Analysis Tab */}
+          <div className="mb-6 p-6 bg-white rounded-xl border-2 border-dashed border-purple-300 text-center">
+            <h3 className="text-lg font-semibold text-gray-900 mb-2">Ausschreibung analysieren</h3>
+            <p className="text-sm text-gray-500 mb-4">
+              Laden Sie ein Ausschreibungsdokument hoch. Die KI extrahiert automatisch alle Anforderungen und matcht sie gegen die Control-Bibliothek.
+            </p>
+            <label className="inline-block px-6 py-3 bg-purple-600 text-white rounded-lg hover:bg-purple-700 cursor-pointer">
+              {uploading ? 'Hochladen...' : processing ? 'Analysiere...' : 'PDF / Dokument hochladen'}
+              <input type="file" className="hidden" accept=".pdf,.txt,.doc,.docx" onChange={handleTenderUpload} disabled={uploading || processing} />
+            </label>
+            <p className="text-xs text-gray-400 mt-2">PDF, TXT oder Word. Max 50 MB. Dokument wird nur fuer diese Analyse verwendet.</p>
+          </div>
+
+          {/* Selected Tender Detail */}
+          {selectedTender && (
+            <div className="mb-6 p-6 bg-white rounded-xl border border-purple-200">
+              <div className="flex items-center justify-between mb-4">
+                <div>
+                  <h3 className="text-lg font-semibold text-gray-900">{selectedTender.project_name}</h3>
+                  <p className="text-sm text-gray-500">{selectedTender.file_name} — {selectedTender.status}</p>
+                </div>
+                <button onClick={() => setSelectedTender(null)} className="text-gray-400 hover:text-gray-600 text-xl">&times;</button>
+              </div>
+
+              {/* Stats */}
+              <div className="grid grid-cols-4 gap-3 mb-6">
+                <div className="text-center p-3 bg-gray-50 rounded-lg">
+                  <div className="text-2xl font-bold">{selectedTender.total_requirements}</div>
+                  <div className="text-xs text-gray-500">Anforderungen</div>
+                </div>
+                <div className="text-center p-3 bg-green-50 rounded-lg">
+                  <div className="text-2xl font-bold text-green-700">{selectedTender.matched_count}</div>
+                  <div className="text-xs text-gray-500">Abgedeckt</div>
+                </div>
+                <div className="text-center p-3 bg-yellow-50 rounded-lg">
+                  <div className="text-2xl font-bold text-yellow-700">{selectedTender.partial_count}</div>
+                  <div className="text-xs text-gray-500">Teilweise</div>
+                </div>
+                <div className="text-center p-3 bg-red-50 rounded-lg">
+                  <div className="text-2xl font-bold text-red-700">{selectedTender.unmatched_count}</div>
+                  <div className="text-xs text-gray-500">Luecken</div>
+                </div>
+              </div>
+
+              {/* Match Results */}
+              {selectedTender.match_results && selectedTender.match_results.length > 0 && (
+                <div className="space-y-3">
+                  <h4 className="font-semibold text-gray-900">Requirement → Control Matching</h4>
+                  {selectedTender.match_results.map((mr, idx) => (
+                    <div key={idx} className={`p-4 rounded-lg border ${
+                      mr.verdict === 'matched' ? 'border-green-200 bg-green-50' :
+                      mr.verdict === 'partial' ? 'border-yellow-200 bg-yellow-50' :
+                      'border-red-200 bg-red-50'
+                    }`}>
+                      <div className="flex items-start justify-between mb-2">
+                        <div className="flex-1">
+                          <div className="flex items-center gap-2 mb-1">
+                            <span className="text-xs font-mono bg-white px-2 py-0.5 rounded border">{mr.req_id}</span>
+                            <span className={`text-xs px-2 py-0.5 rounded-full ${
+                              mr.verdict === 'matched' ? 'bg-green-200 text-green-800' :
+                              mr.verdict === 'partial' ? 'bg-yellow-200 text-yellow-800' :
+                              'bg-red-200 text-red-800'
+                            }`}>
+                              {mr.verdict === 'matched' ? 'Abgedeckt' : mr.verdict === 'partial' ? 'Teilweise' : 'Luecke'}
+                            </span>
+                          </div>
+                          <p className="text-sm text-gray-900">{mr.req_text}</p>
+                        </div>
+                      </div>
+                      {mr.matched_controls && mr.matched_controls.length > 0 && (
+                        <div className="mt-2 flex flex-wrap gap-1">
+                          {mr.matched_controls.map(mc => (
+                            <span key={mc.control_id} className="text-xs bg-white border px-2 py-0.5 rounded">
+                              {mc.control_id} ({Math.round(mc.relevance * 100)}%)
+                            </span>
+                          ))}
+                        </div>
+                      )}
+                      {mr.gap_description && (
+                        <p className="text-xs text-orange-700 mt-2">{mr.gap_description}</p>
+                      )}
+                    </div>
+                  ))}
+                </div>
+              )}
+            </div>
+          )}
+
+          {/* Previous Analyses */}
+          {tenderAnalyses.length > 0 && (
+            <div>
+              <h4 className="font-semibold text-gray-900 mb-3">Bisherige Analysen</h4>
+              <div className="space-y-3">
+                {tenderAnalyses.map(ta => (
+                  <button key={ta.id} onClick={() => handleViewTender(ta.id)}
+                    className="w-full text-left bg-white rounded-xl border border-gray-200 p-4 hover:border-purple-300 transition-all">
+                    <div className="flex items-center justify-between">
+                      <div>
+                        <h3 className="font-medium text-gray-900">{ta.project_name}</h3>
+                        <p className="text-xs text-gray-500">{ta.file_name} — {new Date(ta.created_at).toLocaleDateString('de-DE')}</p>
+                      </div>
+                      <div className="flex gap-2">
+                        <span className="text-xs bg-green-100 text-green-700 px-2 py-0.5 rounded-full">{ta.matched_count} matched</span>
+                        {ta.unmatched_count > 0 && (
+                          <span className="text-xs bg-red-100 text-red-700 px-2 py-0.5 rounded-full">{ta.unmatched_count} gaps</span>
+                        )}
+                        <span className={`text-xs px-2 py-0.5 rounded-full ${
+                          ta.status === 'matched' ? 'bg-blue-100 text-blue-700' : 'bg-gray-100 text-gray-700'
+                        }`}>{ta.status}</span>
+                      </div>
+                    </div>
+                  </button>
+                ))}
+              </div>
+            </div>
+          )}
+        </>
+      ) : null}
+    </div>
+  )
+}
diff --git a/admin-compliance/app/sdk/sdk-flow/steps-vorbereitung.ts b/admin-compliance/app/sdk/sdk-flow/steps-vorbereitung.ts
index 00fd8ae..5a2defb 100644
--- a/admin-compliance/app/sdk/sdk-flow/steps-vorbereitung.ts
+++ b/admin-compliance/app/sdk/sdk-flow/steps-vorbereitung.ts
@@ -53,7 +53,7 @@ export const STEPS_VORBEREITUNG: SDKFlowStep[] = [
     checkpointId: 'CP-UC',
     checkpointType: 'REQUIRED',
     checkpointReviewer: 'NONE',
-    description: 'Systematische Erfassung aller Datenverarbeitungs- und KI-Anwendungsfaelle ueber einen 8-Schritte-Wizard mit Kachel-Auswahl.',
+    description: 'Systematische Erfassung aller Datenverarbeitungs- und KI-Anwendungsfaelle ueber einen 8-Schritte-Wizard mit Kachel-Auswahl. Inkl. BetrVG-Mitbestimmungspruefung und Betriebsrats-Konflikt-Score.',
     descriptionLong: 'In einem 8-Schritte-Wizard werden alle Use Cases erfasst: (1) Grundlegendes — Titel, Beschreibung, KI-Kategorie (21 Kacheln), Branche wird automatisch aus dem Profil abgeleitet. (2) Datenkategorien — ~60 Kategorien in 10 Gruppen als Kacheln (inkl. Art. 9 hervorgehoben). (3) Verarbeitungszweck — 16 Zweck-Kacheln, Rechtsgrundlage wird vom SDK automatisch ermittelt. (4) Automatisierungsgrad — assistiv/teilautomatisiert/vollautomatisiert. (5) Hosting & Modell — Provider, Region, Modellnutzung (Inferenz/RAG/Fine-Tuning/Training). (6) Datentransfer — Transferziele und Schutzmechanismen. (7) Datenhaltung — Aufbewahrungsfristen. (8) Vertraege — vorhandene Compliance-Dokumente. Die RAG-Collection bp_compliance_ce wird verwendet, um relevante CE-Regulierungen automatisch den Use Cases zuzuordnen (UCCA).',
     legalBasis: 'Art. 30 DSGVO (Verzeichnis von Verarbeitungstaetigkeiten)',
     inputs: ['companyProfile'],
@@ -66,6 +66,27 @@ export const STEPS_VORBEREITUNG: SDKFlowStep[] = [
     isOptional: false,
     url: '/sdk/use-cases',
   },
+  {
+    id: 'ai-registration',
+    name: 'EU AI Database Registrierung',
+    nameShort: 'EU-Reg',
+    package: 'vorbereitung',
+    seq: 350,
+    checkpointId: 'CP-REG',
+    checkpointType: 'CONDITIONAL',
+    checkpointReviewer: 'NONE',
+    description: 'Registrierung von Hochrisiko-KI-Systemen in der EU AI Database gemaess Art. 49 KI-Verordnung.',
+    descriptionLong: 'Fuer Hochrisiko-KI-Systeme (Annex III) ist eine Registrierung in der EU AI Database Pflicht. Ein 6-Schritte-Wizard fuehrt durch den Prozess: (1) Anbieter-Daten — Name, Rechtsform, Adresse, EU-Repraesentant. (2) System-Details — Name, Version, Beschreibung, Einsatzzweck (vorausgefuellt aus UCCA Assessment). (3) Klassifikation — Risikoklasse und Annex III Kategorie (aus Decision Tree). (4) Konformitaet — CE-Kennzeichnung, Notified Body. (5) Trainingsdaten — Zusammenfassung der Datenquellen (Art. 10). (6) Pruefung + Export — JSON-Download fuer EU-Datenbank-Submission. Der Status-Workflow ist: Entwurf → Bereit → Eingereicht → Registriert.',
+    legalBasis: 'Art. 49 KI-Verordnung (EU) 2024/1689',
+    inputs: ['useCases', 'companyProfile'],
+    outputs: ['euRegistration'],
+    prerequisiteSteps: ['use-case-assessment'],
+    dbTables: ['ai_system_registrations'],
+    dbMode: 'read/write',
+    ragCollections: [],
+    isOptional: true,
+    url: '/sdk/ai-registration',
+  },
   {
     id: 'import',
     name: 'Dokument-Import',
diff --git a/admin-compliance/app/sdk/use-cases/[id]/page.tsx b/admin-compliance/app/sdk/use-cases/[id]/page.tsx
index 91aebdc..9046973 100644
--- a/admin-compliance/app/sdk/use-cases/[id]/page.tsx
+++ b/admin-compliance/app/sdk/use-cases/[id]/page.tsx
@@ -57,6 +57,8 @@ interface FullAssessment {
   dsfa_recommended: boolean
   art22_risk: boolean
   training_allowed: string
+  betrvg_conflict_score?: number
+  betrvg_consultation_required?: boolean
   triggered_rules?: TriggeredRule[]
   required_controls?: RequiredControl[]
   recommended_architecture?: PatternRecommendation[]
@@ -167,6 +169,8 @@ export default function AssessmentDetailPage() {
     dsfa_recommended: assessment.dsfa_recommended,
     art22_risk: assessment.art22_risk,
     training_allowed: assessment.training_allowed,
+    betrvg_conflict_score: assessment.betrvg_conflict_score,
+    betrvg_consultation_required: assessment.betrvg_consultation_required,
     // AssessmentResultCard expects rule_code; backend stores code — map here
     triggered_rules: assessment.triggered_rules?.map(r => ({
       rule_code: r.code,
diff --git a/admin-compliance/app/sdk/use-cases/page.tsx b/admin-compliance/app/sdk/use-cases/page.tsx
index 8c0e297..84d5367 100644
--- a/admin-compliance/app/sdk/use-cases/page.tsx
+++ b/admin-compliance/app/sdk/use-cases/page.tsx
@@ -10,6 +10,8 @@ interface Assessment {
   feasibility: string
   risk_level: string
   risk_score: number
+  betrvg_conflict_score?: number
+  betrvg_consultation_required?: boolean
   domain: string
   created_at: string
 }
@@ -194,6 +196,16 @@ export default function UseCasesPage() {
                       <span className={`px-2 py-0.5 text-xs rounded-full ${feasibility.bg} ${feasibility.text}`}>
                         {feasibility.label}
                       </span>
+                      {assessment.betrvg_conflict_score != null && assessment.betrvg_conflict_score > 0 && (
+                        <span className={`px-2 py-0.5 text-xs rounded-full ${
+                          assessment.betrvg_conflict_score >= 75 ? 'bg-red-100 text-red-700' :
+                          assessment.betrvg_conflict_score >= 50 ? 'bg-orange-100 text-orange-700' :
+                          assessment.betrvg_conflict_score >= 25 ? 'bg-yellow-100 text-yellow-700' :
+                          'bg-green-100 text-green-700'
+                        }`}>
+                          BR {assessment.betrvg_conflict_score}
+                        </span>
+                      )}
                     </div>
                     <div className="flex items-center gap-4 text-sm text-gray-500">
                       <span>{assessment.domain}</span>
diff --git a/admin-compliance/components/sdk/Sidebar/SidebarModuleList.tsx b/admin-compliance/components/sdk/Sidebar/SidebarModuleList.tsx
index 986dc84..e0fd69a 100644
--- a/admin-compliance/components/sdk/Sidebar/SidebarModuleList.tsx
+++ b/admin-compliance/components/sdk/Sidebar/SidebarModuleList.tsx
@@ -42,6 +42,29 @@ export function SidebarModuleList({ collapsed, projectId, pendingCRCount }: Side
         />
       </div>
 
+      {/* KI-Compliance */}
+      <div className="border-t border-gray-100 py-2">
+        {!collapsed && (
+          <div className="px-4 py-2 text-xs font-medium text-gray-400 uppercase tracking-wider">
+            KI-Compliance
+          </div>
+        )}
+        <AdditionalModuleItem href="/sdk/advisory-board" icon={<svg className="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2" /></svg>} label="Use Case Erfassung" isActive={pathname === '/sdk/advisory-board'} collapsed={collapsed} projectId={projectId} />
+        <AdditionalModuleItem href="/sdk/use-cases" icon={<svg className="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M4 6h16M4 10h16M4 14h16M4 18h16" /></svg>} label="Use Cases" isActive={pathname?.startsWith('/sdk/use-cases') ?? false} collapsed={collapsed} projectId={projectId} />
+        <AdditionalModuleItem href="/sdk/ai-act" icon={<svg className="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M13 10V3L4 14h7v7l9-11h-7z" /></svg>} label="AI Act" isActive={pathname?.startsWith('/sdk/ai-act') ?? false} collapsed={collapsed} projectId={projectId} />
+        <AdditionalModuleItem href="/sdk/ai-registration" icon={<svg className="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M19 21V5a2 2 0 00-2-2H7a2 2 0 00-2 2v16m14 0h2m-2 0h-5m-9 0H3m2 0h5M9 7h1m-1 4h1m4-4h1m-1 4h1m-5 10v-5a1 1 0 011-1h2a1 1 0 011 1v5m-4 0h4" /></svg>} label="EU Registrierung" isActive={pathname?.startsWith('/sdk/ai-registration') ?? false} collapsed={collapsed} projectId={projectId} />
+      </div>
+
+      {/* Payment / Terminal */}
+      <div className="border-t border-gray-100 py-2">
+        {!collapsed && (
+          <div className="px-4 py-2 text-xs font-medium text-gray-400 uppercase tracking-wider">
+            Payment / Terminal
+          </div>
+        )}
+        <AdditionalModuleItem href="/sdk/payment-compliance" icon={<svg className="w-5 h-5" fill="none" stroke="currentColor" viewBox="0 0 24 24"><path strokeLinecap="round" strokeLinejoin="round" strokeWidth={2} d="M3 10h18M7 15h1m4 0h1m-7 4h12a3 3 0 003-3V8a3 3 0 00-3-3H6a3 3 0 00-3 3v8a3 3 0 003 3z" /></svg>} label="Payment Compliance" isActive={pathname?.startsWith('/sdk/payment-compliance') ?? false} collapsed={collapsed} projectId={projectId} />
+      </div>
+
       {/* Additional Modules */}
       <div className="border-t border-gray-100 py-2">
         {!collapsed && (
diff --git a/admin-compliance/components/sdk/ai-act/DecisionTreeWizard.tsx b/admin-compliance/components/sdk/ai-act/DecisionTreeWizard.tsx
new file mode 100644
index 0000000..c00310d
--- /dev/null
+++ b/admin-compliance/components/sdk/ai-act/DecisionTreeWizard.tsx
@@ -0,0 +1,554 @@
+'use client'
+
+import React, { useState, useEffect, useCallback } from 'react'
+
+// =============================================================================
+// TYPES
+// =============================================================================
+
+interface DecisionTreeQuestion {
+  id: string
+  axis: 'high_risk' | 'gpai'
+  question: string
+  description: string
+  article_ref: string
+  skip_if?: string
+}
+
+interface DecisionTreeDefinition {
+  id: string
+  name: string
+  version: string
+  questions: DecisionTreeQuestion[]
+}
+
+interface DecisionTreeAnswer {
+  question_id: string
+  value: boolean
+  note?: string
+}
+
+interface GPAIClassification {
+  is_gpai: boolean
+  is_systemic_risk: boolean
+  gpai_category: 'none' | 'standard' | 'systemic'
+  applicable_articles: string[]
+  obligations: string[]
+}
+
+interface DecisionTreeResult {
+  id: string
+  tenant_id: string
+  system_name: string
+  system_description?: string
+  answers: Record<string, DecisionTreeAnswer>
+  high_risk_result: string
+  gpai_result: GPAIClassification
+  combined_obligations: string[]
+  applicable_articles: string[]
+  created_at: string
+}
+
+// =============================================================================
+// CONSTANTS
+// =============================================================================
+
+const RISK_LEVEL_CONFIG: Record<string, { label: string; color: string; bg: string; border: string }> = {
+  unacceptable: { label: 'Unzulässig', color: 'text-red-700', bg: 'bg-red-50', border: 'border-red-200' },
+  high_risk: { label: 'Hochrisiko', color: 'text-orange-700', bg: 'bg-orange-50', border: 'border-orange-200' },
+  limited_risk: { label: 'Begrenztes Risiko', color: 'text-yellow-700', bg: 'bg-yellow-50', border: 'border-yellow-200' },
+  minimal_risk: { label: 'Minimales Risiko', color: 'text-green-700', bg: 'bg-green-50', border: 'border-green-200' },
+  not_applicable: { label: 'Nicht anwendbar', color: 'text-gray-500', bg: 'bg-gray-50', border: 'border-gray-200' },
+}
+
+const GPAI_CONFIG: Record<string, { label: string; color: string; bg: string; border: string }> = {
+  none: { label: 'Kein GPAI', color: 'text-gray-500', bg: 'bg-gray-50', border: 'border-gray-200' },
+  standard: { label: 'GPAI Standard', color: 'text-blue-700', bg: 'bg-blue-50', border: 'border-blue-200' },
+  systemic: { label: 'GPAI Systemisches Risiko', color: 'text-purple-700', bg: 'bg-purple-50', border: 'border-purple-200' },
+}
+
+// =============================================================================
+// MAIN COMPONENT
+// =============================================================================
+
+export default function DecisionTreeWizard() {
+  const [definition, setDefinition] = useState<DecisionTreeDefinition | null>(null)
+  const [answers, setAnswers] = useState<Record<string, DecisionTreeAnswer>>({})
+  const [currentIdx, setCurrentIdx] = useState(0)
+  const [systemName, setSystemName] = useState('')
+  const [systemDescription, setSystemDescription] = useState('')
+  const [result, setResult] = useState<DecisionTreeResult | null>(null)
+  const [loading, setLoading] = useState(true)
+  const [saving, setSaving] = useState(false)
+  const [error, setError] = useState<string | null>(null)
+  const [phase, setPhase] = useState<'intro' | 'questions' | 'result'>('intro')
+
+  // Load decision tree definition
+  useEffect(() => {
+    const load = async () => {
+      try {
+        const res = await fetch('/api/sdk/v1/ucca/decision-tree')
+        if (res.ok) {
+          const data = await res.json()
+          setDefinition(data)
+        } else {
+          setError('Entscheidungsbaum konnte nicht geladen werden')
+        }
+      } catch {
+        setError('Verbindung zum Backend fehlgeschlagen')
+      } finally {
+        setLoading(false)
+      }
+    }
+    load()
+  }, [])
+
+  // Get visible questions (respecting skip logic)
+  const getVisibleQuestions = useCallback((): DecisionTreeQuestion[] => {
+    if (!definition) return []
+    return definition.questions.filter(q => {
+      if (!q.skip_if) return true
+      // Skip this question if the gate question was answered "no"
+      const gateAnswer = answers[q.skip_if]
+      if (gateAnswer && !gateAnswer.value) return false
+      return true
+    })
+  }, [definition, answers])
+
+  const visibleQuestions = getVisibleQuestions()
+  const currentQuestion = visibleQuestions[currentIdx]
+  const totalVisible = visibleQuestions.length
+
+  const highRiskQuestions = visibleQuestions.filter(q => q.axis === 'high_risk')
+  const gpaiQuestions = visibleQuestions.filter(q => q.axis === 'gpai')
+
+  const handleAnswer = (value: boolean) => {
+    if (!currentQuestion) return
+    setAnswers(prev => ({
+      ...prev,
+      [currentQuestion.id]: {
+        question_id: currentQuestion.id,
+        value,
+      },
+    }))
+
+    // Auto-advance
+    if (currentIdx < totalVisible - 1) {
+      setCurrentIdx(prev => prev + 1)
+    }
+  }
+
+  const handleBack = () => {
+    if (currentIdx > 0) {
+      setCurrentIdx(prev => prev - 1)
+    }
+  }
+
+  const handleSubmit = async () => {
+    setSaving(true)
+    setError(null)
+
+    try {
+      const res = await fetch('/api/sdk/v1/ucca/decision-tree/evaluate', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          system_name: systemName,
+          system_description: systemDescription,
+          answers,
+        }),
+      })
+
+      if (res.ok) {
+        const data = await res.json()
+        setResult(data)
+        setPhase('result')
+      } else {
+        const err = await res.json().catch(() => ({ error: 'Auswertung fehlgeschlagen' }))
+        setError(err.error || 'Auswertung fehlgeschlagen')
+      }
+    } catch {
+      setError('Verbindung zum Backend fehlgeschlagen')
+    } finally {
+      setSaving(false)
+    }
+  }
+
+  const handleReset = () => {
+    setAnswers({})
+    setCurrentIdx(0)
+    setSystemName('')
+    setSystemDescription('')
+    setResult(null)
+    setPhase('intro')
+    setError(null)
+  }
+
+  const allAnswered = visibleQuestions.every(q => answers[q.id] !== undefined)
+
+  if (loading) {
+    return (
+      <div className="bg-white rounded-xl border border-gray-200 p-12 text-center">
+        <div className="w-10 h-10 border-2 border-purple-500 border-t-transparent rounded-full animate-spin mx-auto mb-4" />
+        <p className="text-gray-500">Entscheidungsbaum wird geladen...</p>
+      </div>
+    )
+  }
+
+  if (error && !definition) {
+    return (
+      <div className="bg-red-50 border border-red-200 rounded-xl p-6 text-center">
+        <p className="text-red-700">{error}</p>
+        <p className="text-red-500 text-sm mt-2">Bitte stellen Sie sicher, dass der AI Compliance SDK Service läuft.</p>
+      </div>
+    )
+  }
+
+  // =========================================================================
+  // INTRO PHASE
+  // =========================================================================
+  if (phase === 'intro') {
+    return (
+      <div className="space-y-6">
+        <div className="bg-white rounded-xl border border-gray-200 p-6">
+          <h3 className="text-lg font-semibold text-gray-900 mb-2">AI Act Entscheidungsbaum</h3>
+          <p className="text-sm text-gray-500 mb-6">
+            Klassifizieren Sie Ihr KI-System anhand von 12 Fragen auf zwei Achsen:
+            <strong> High-Risk</strong> (Anhang III) und <strong>GPAI</strong> (Art. 51–56).
+          </p>
+
+          <div className="grid grid-cols-1 md:grid-cols-2 gap-4 mb-6">
+            <div className="p-4 bg-orange-50 border border-orange-200 rounded-lg">
+              <div className="flex items-center gap-2 mb-2">
+                <svg className="w-5 h-5 text-orange-600" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={2}>
+                  <path strokeLinecap="round" strokeLinejoin="round" d="M12 9v3.75m-9.303 3.376c-.866 1.5.217 3.374 1.948 3.374h14.71c1.73 0 2.813-1.874 1.948-3.374L13.949 3.378c-.866-1.5-3.032-1.5-3.898 0L2.697 16.126z" />
+                </svg>
+                <span className="font-medium text-orange-700">Achse 1: High-Risk</span>
+              </div>
+              <p className="text-sm text-orange-600">7 Fragen zu Anhang III Kategorien (Biometrie, kritische Infrastruktur, Bildung, Beschäftigung, etc.)</p>
+            </div>
+            <div className="p-4 bg-blue-50 border border-blue-200 rounded-lg">
+              <div className="flex items-center gap-2 mb-2">
+                <svg className="w-5 h-5 text-blue-600" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={2}>
+                  <path strokeLinecap="round" strokeLinejoin="round" d="M9.813 15.904L9 18.75l-.813-2.846a4.5 4.5 0 00-3.09-3.09L2.25 12l2.846-.813a4.5 4.5 0 003.09-3.09L9 5.25l.813 2.846a4.5 4.5 0 003.09 3.09L15.75 12l-2.846.813a4.5 4.5 0 00-3.09 3.09z" />
+                </svg>
+                <span className="font-medium text-blue-700">Achse 2: GPAI</span>
+              </div>
+              <p className="text-sm text-blue-600">5 Fragen zu General-Purpose AI (Foundation Models, systemisches Risiko, Art. 51–56)</p>
+            </div>
+          </div>
+
+          <div className="space-y-4">
+            <div>
+              <label className="block text-sm font-medium text-gray-700 mb-1">Name des KI-Systems *</label>
+              <input
+                type="text"
+                value={systemName}
+                onChange={e => setSystemName(e.target.value)}
+                placeholder="z.B. Dokumenten-Analyse-KI, Chatbot-Service, Code-Assistent"
+                className="w-full px-4 py-2 border border-gray-300 rounded-lg focus:ring-2 focus:ring-purple-500 focus:border-transparent"
+              />
+            </div>
+            <div>
+              <label className="block text-sm font-medium text-gray-700 mb-1">Beschreibung (optional)</label>
+              <textarea
+                value={systemDescription}
+                onChange={e => setSystemDescription(e.target.value)}
+                placeholder="Kurze Beschreibung des KI-Systems und seines Einsatzzwecks..."
+                rows={2}
+                className="w-full px-4 py-2 border border-gray-300 rounded-lg focus:ring-2 focus:ring-purple-500 focus:border-transparent"
+              />
+            </div>
+          </div>
+
+          <div className="mt-6 flex justify-end">
+            <button
+              onClick={() => setPhase('questions')}
+              disabled={!systemName.trim()}
+              className={`px-6 py-2 rounded-lg font-medium transition-colors ${
+                systemName.trim()
+                  ? 'bg-purple-600 text-white hover:bg-purple-700'
+                  : 'bg-gray-200 text-gray-400 cursor-not-allowed'
+              }`}
+            >
+              Klassifizierung starten
+            </button>
+          </div>
+        </div>
+      </div>
+    )
+  }
+
+  // =========================================================================
+  // RESULT PHASE
+  // =========================================================================
+  if (phase === 'result' && result) {
+    const riskConfig = RISK_LEVEL_CONFIG[result.high_risk_result] || RISK_LEVEL_CONFIG.not_applicable
+    const gpaiConfig = GPAI_CONFIG[result.gpai_result.gpai_category] || GPAI_CONFIG.none
+
+    return (
+      <div className="space-y-6">
+        {/* Header */}
+        <div className="bg-white rounded-xl border border-gray-200 p-6">
+          <div className="flex items-center justify-between mb-4">
+            <h3 className="text-lg font-semibold text-gray-900">Klassifizierungsergebnis: {result.system_name}</h3>
+            <button
+              onClick={handleReset}
+              className="px-4 py-2 text-sm text-purple-600 hover:bg-purple-50 rounded-lg transition-colors"
+            >
+              Neue Klassifizierung
+            </button>
+          </div>
+
+          {/* Two-Axis Result Cards */}
+          <div className="grid grid-cols-1 md:grid-cols-2 gap-4 mb-6">
+            <div className={`p-5 rounded-xl border-2 ${riskConfig.border} ${riskConfig.bg}`}>
+              <div className="text-sm font-medium text-gray-500 mb-1">Achse 1: High-Risk (Anhang III)</div>
+              <div className={`text-xl font-bold ${riskConfig.color}`}>{riskConfig.label}</div>
+            </div>
+            <div className={`p-5 rounded-xl border-2 ${gpaiConfig.border} ${gpaiConfig.bg}`}>
+              <div className="text-sm font-medium text-gray-500 mb-1">Achse 2: GPAI (Art. 51–56)</div>
+              <div className={`text-xl font-bold ${gpaiConfig.color}`}>{gpaiConfig.label}</div>
+              {result.gpai_result.is_systemic_risk && (
+                <div className="mt-1 text-xs text-purple-600 font-medium">Systemisches Risiko</div>
+              )}
+            </div>
+          </div>
+        </div>
+
+        {/* Applicable Articles */}
+        {result.applicable_articles && result.applicable_articles.length > 0 && (
+          <div className="bg-white rounded-xl border border-gray-200 p-6">
+            <h4 className="text-sm font-semibold text-gray-900 mb-3">Anwendbare Artikel</h4>
+            <div className="flex flex-wrap gap-2">
+              {result.applicable_articles.map(art => (
+                <span key={art} className="px-3 py-1 text-xs bg-indigo-50 text-indigo-700 rounded-full border border-indigo-200">
+                  {art}
+                </span>
+              ))}
+            </div>
+          </div>
+        )}
+
+        {/* Combined Obligations */}
+        {result.combined_obligations && result.combined_obligations.length > 0 && (
+          <div className="bg-white rounded-xl border border-gray-200 p-6">
+            <h4 className="text-sm font-semibold text-gray-900 mb-3">
+              Pflichten ({result.combined_obligations.length})
+            </h4>
+            <div className="space-y-2">
+              {result.combined_obligations.map((obl, i) => (
+                <div key={i} className="flex items-start gap-2 text-sm">
+                  <svg className="w-4 h-4 text-purple-500 mt-0.5 flex-shrink-0" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={2}>
+                    <path strokeLinecap="round" strokeLinejoin="round" d="M9 12.75L11.25 15 15 9.75M21 12a9 9 0 11-18 0 9 9 0 0118 0z" />
+                  </svg>
+                  <span className="text-gray-700">{obl}</span>
+                </div>
+              ))}
+            </div>
+          </div>
+        )}
+
+        {/* GPAI-specific obligations */}
+        {result.gpai_result.is_gpai && result.gpai_result.obligations.length > 0 && (
+          <div className="bg-blue-50 rounded-xl border border-blue-200 p-6">
+            <h4 className="text-sm font-semibold text-blue-900 mb-3">
+              GPAI-spezifische Pflichten ({result.gpai_result.obligations.length})
+            </h4>
+            <div className="space-y-2">
+              {result.gpai_result.obligations.map((obl, i) => (
+                <div key={i} className="flex items-start gap-2 text-sm">
+                  <svg className="w-4 h-4 text-blue-500 mt-0.5 flex-shrink-0" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={2}>
+                    <path strokeLinecap="round" strokeLinejoin="round" d="M11.25 11.25l.041-.02a.75.75 0 011.063.852l-.708 2.836a.75.75 0 001.063.853l.041-.021M21 12a9 9 0 11-18 0 9 9 0 0118 0zm-9-3.75h.008v.008H12V8.25z" />
+                  </svg>
+                  <span className="text-blue-800">{obl}</span>
+                </div>
+              ))}
+            </div>
+          </div>
+        )}
+
+        {/* Answer Summary */}
+        <div className="bg-white rounded-xl border border-gray-200 p-6">
+          <h4 className="text-sm font-semibold text-gray-900 mb-3">Ihre Antworten</h4>
+          <div className="space-y-2">
+            {definition?.questions.map(q => {
+              const answer = result.answers[q.id]
+              if (!answer) return null
+              return (
+                <div key={q.id} className="flex items-center gap-3 text-sm py-1.5 border-b border-gray-100 last:border-0">
+                  <span className="text-xs font-mono text-gray-400 w-8">{q.id}</span>
+                  <span className="flex-1 text-gray-600">{q.question}</span>
+                  <span className={`px-2 py-0.5 rounded text-xs font-medium ${
+                    answer.value ? 'bg-green-100 text-green-700' : 'bg-gray-100 text-gray-500'
+                  }`}>
+                    {answer.value ? 'Ja' : 'Nein'}
+                  </span>
+                </div>
+              )
+            })}
+          </div>
+        </div>
+      </div>
+    )
+  }
+
+  // =========================================================================
+  // QUESTIONS PHASE
+  // =========================================================================
+  return (
+    <div className="space-y-6">
+      {/* Progress */}
+      <div className="bg-white rounded-xl border border-gray-200 p-4">
+        <div className="flex items-center justify-between mb-3">
+          <span className="text-sm font-medium text-gray-700">
+            {systemName} — Frage {currentIdx + 1} von {totalVisible}
+          </span>
+          <span className={`px-2 py-1 text-xs rounded-full font-medium ${
+            currentQuestion?.axis === 'high_risk'
+              ? 'bg-orange-100 text-orange-700'
+              : 'bg-blue-100 text-blue-700'
+          }`}>
+            {currentQuestion?.axis === 'high_risk' ? 'High-Risk' : 'GPAI'}
+          </span>
+        </div>
+
+        {/* Dual progress bar */}
+        <div className="flex gap-2">
+          <div className="flex-1">
+            <div className="text-[10px] text-orange-600 mb-1 font-medium">
+              Achse 1: High-Risk ({highRiskQuestions.filter(q => answers[q.id] !== undefined).length}/{highRiskQuestions.length})
+            </div>
+            <div className="h-1.5 bg-gray-100 rounded-full overflow-hidden">
+              <div
+                className="h-full bg-orange-500 rounded-full transition-all"
+                style={{ width: `${highRiskQuestions.length ? (highRiskQuestions.filter(q => answers[q.id] !== undefined).length / highRiskQuestions.length) * 100 : 0}%` }}
+              />
+            </div>
+          </div>
+          <div className="flex-1">
+            <div className="text-[10px] text-blue-600 mb-1 font-medium">
+              Achse 2: GPAI ({gpaiQuestions.filter(q => answers[q.id] !== undefined).length}/{gpaiQuestions.length})
+            </div>
+            <div className="h-1.5 bg-gray-100 rounded-full overflow-hidden">
+              <div
+                className="h-full bg-blue-500 rounded-full transition-all"
+                style={{ width: `${gpaiQuestions.length ? (gpaiQuestions.filter(q => answers[q.id] !== undefined).length / gpaiQuestions.length) * 100 : 0}%` }}
+              />
+            </div>
+          </div>
+        </div>
+      </div>
+
+      {/* Error */}
+      {error && (
+        <div className="p-4 bg-red-50 border border-red-200 rounded-lg text-red-700 flex items-center justify-between">
+          <span>{error}</span>
+          <button onClick={() => setError(null)} className="text-red-500 hover:text-red-700">&times;</button>
+        </div>
+      )}
+
+      {/* Current Question */}
+      {currentQuestion && (
+        <div className="bg-white rounded-xl border border-gray-200 p-6">
+          <div className="flex items-start gap-3 mb-4">
+            <span className="px-2 py-1 text-xs font-mono bg-gray-100 text-gray-500 rounded">{currentQuestion.id}</span>
+            <span className="px-2 py-1 text-xs bg-purple-50 text-purple-700 rounded">{currentQuestion.article_ref}</span>
+          </div>
+
+          <h3 className="text-lg font-semibold text-gray-900 mb-3">{currentQuestion.question}</h3>
+          <p className="text-sm text-gray-500 mb-6">{currentQuestion.description}</p>
+
+          {/* Answer buttons */}
+          <div className="grid grid-cols-2 gap-4">
+            <button
+              onClick={() => handleAnswer(true)}
+              className={`p-4 rounded-xl border-2 transition-all text-center font-medium ${
+                answers[currentQuestion.id]?.value === true
+                  ? 'border-green-500 bg-green-50 text-green-700'
+                  : 'border-gray-200 hover:border-green-300 hover:bg-green-50/50 text-gray-700'
+              }`}
+            >
+              <svg className="w-8 h-8 mx-auto mb-2 text-green-500" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={2}>
+                <path strokeLinecap="round" strokeLinejoin="round" d="M9 12.75L11.25 15 15 9.75M21 12a9 9 0 11-18 0 9 9 0 0118 0z" />
+              </svg>
+              Ja
+            </button>
+            <button
+              onClick={() => handleAnswer(false)}
+              className={`p-4 rounded-xl border-2 transition-all text-center font-medium ${
+                answers[currentQuestion.id]?.value === false
+                  ? 'border-gray-500 bg-gray-50 text-gray-700'
+                  : 'border-gray-200 hover:border-gray-300 hover:bg-gray-50/50 text-gray-700'
+              }`}
+            >
+              <svg className="w-8 h-8 mx-auto mb-2 text-gray-400" fill="none" viewBox="0 0 24 24" stroke="currentColor" strokeWidth={2}>
+                <path strokeLinecap="round" strokeLinejoin="round" d="M9.75 9.75l4.5 4.5m0-4.5l-4.5 4.5M21 12a9 9 0 11-18 0 9 9 0 0118 0z" />
+              </svg>
+              Nein
+            </button>
+          </div>
+        </div>
+      )}
+
+      {/* Navigation */}
+      <div className="flex items-center justify-between">
+        <button
+          onClick={currentIdx === 0 ? () => setPhase('intro') : handleBack}
+          className="px-4 py-2 text-sm text-gray-600 hover:bg-gray-100 rounded-lg transition-colors"
+        >
+          Zurück
+        </button>
+
+        <div className="flex items-center gap-1">
+          {visibleQuestions.map((q, i) => (
+            <button
+              key={q.id}
+              onClick={() => setCurrentIdx(i)}
+              className={`w-2.5 h-2.5 rounded-full transition-colors ${
+                i === currentIdx
+                  ? q.axis === 'high_risk' ? 'bg-orange-500' : 'bg-blue-500'
+                  : answers[q.id] !== undefined
+                    ? 'bg-green-400'
+                    : 'bg-gray-200'
+              }`}
+              title={`${q.id}: ${q.question}`}
+            />
+          ))}
+        </div>
+
+        {allAnswered ? (
+          <button
+            onClick={handleSubmit}
+            disabled={saving}
+            className={`px-6 py-2 rounded-lg font-medium transition-colors ${
+              saving
+                ? 'bg-purple-300 text-white cursor-wait'
+                : 'bg-purple-600 text-white hover:bg-purple-700'
+            }`}
+          >
+            {saving ? (
+              <span className="flex items-center gap-2">
+                <svg className="w-4 h-4 animate-spin" fill="none" viewBox="0 0 24 24">
+                  <circle className="opacity-25" cx="12" cy="12" r="10" stroke="currentColor" strokeWidth="4" />
+                  <path className="opacity-75" fill="currentColor" d="M4 12a8 8 0 018-8V0C5.373 0 0 5.373 0 12h4z" />
+                </svg>
+                Auswertung...
+              </span>
+            ) : (
+              'Auswerten'
+            )}
+          </button>
+        ) : (
+          <button
+            onClick={() => setCurrentIdx(prev => Math.min(prev + 1, totalVisible - 1))}
+            disabled={currentIdx >= totalVisible - 1}
+            className="px-4 py-2 text-sm text-purple-600 hover:bg-purple-50 rounded-lg transition-colors disabled:opacity-30"
+          >
+            Weiter
+          </button>
+        )}
+      </div>
+    </div>
+  )
+}
diff --git a/admin-compliance/components/sdk/use-case-assessment/AssessmentResultCard.tsx b/admin-compliance/components/sdk/use-case-assessment/AssessmentResultCard.tsx
index e9642f7..43cfa31 100644
--- a/admin-compliance/components/sdk/use-case-assessment/AssessmentResultCard.tsx
+++ b/admin-compliance/components/sdk/use-case-assessment/AssessmentResultCard.tsx
@@ -10,6 +10,8 @@ interface AssessmentResult {
   dsfa_recommended: boolean
   art22_risk: boolean
   training_allowed: string
+  betrvg_conflict_score?: number
+  betrvg_consultation_required?: boolean
   summary: string
   recommendation: string
   alternative_approach?: string
@@ -76,6 +78,21 @@ export function AssessmentResultCard({ result }: AssessmentResultCardProps) {
                   Art. 22 Risiko
                 </span>
               )}
+              {result.betrvg_conflict_score != null && result.betrvg_conflict_score > 0 && (
+                <span className={`px-3 py-1 rounded-full text-sm font-medium ${
+                  result.betrvg_conflict_score >= 75 ? 'bg-red-100 text-red-700' :
+                  result.betrvg_conflict_score >= 50 ? 'bg-orange-100 text-orange-700' :
+                  result.betrvg_conflict_score >= 25 ? 'bg-yellow-100 text-yellow-700' :
+                  'bg-green-100 text-green-700'
+                }`}>
+                  BR-Konflikt: {result.betrvg_conflict_score}/100
+                </span>
+              )}
+              {result.betrvg_consultation_required && (
+                <span className="px-3 py-1 rounded-full text-sm bg-purple-100 text-purple-700">
+                  BR-Konsultation erforderlich
+                </span>
+              )}
             </div>
             <p className="text-gray-700">{result.summary}</p>
             <p className="text-sm text-gray-500 mt-2">{result.recommendation}</p>
diff --git a/admin-compliance/migrations/wiki_betrvg_article.sql b/admin-compliance/migrations/wiki_betrvg_article.sql
new file mode 100644
index 0000000..58d19cf
--- /dev/null
+++ b/admin-compliance/migrations/wiki_betrvg_article.sql
@@ -0,0 +1,53 @@
+-- Wiki Article: BetrVG & KI — Mitbestimmung bei IT-Systemen
+-- Kategorie: arbeitsrecht (existiert bereits)
+-- Ausfuehren auf Production-DB nach Compliance-Refactoring
+
+INSERT INTO compliance.compliance_wiki_articles (id, category_id, title, summary, content, legal_refs, tags, relevance, source_urls, version)
+VALUES
+('betrvg-ki-mitbestimmung', 'arbeitsrecht',
+ 'BetrVG & KI — Mitbestimmung bei IT-Systemen',
+ 'Uebersicht der Mitbestimmungsrechte des Betriebsrats bei Einfuehrung von KI- und IT-Systemen gemaess §87 Abs.1 Nr.6 BetrVG. Inkl. BAG-Rechtsprechung und Konflikt-Score.',
+ '# BetrVG & KI — Mitbestimmung bei IT-Systemen
+
+## Kernregel: §87 Abs.1 Nr.6 BetrVG
+
+Die **Einfuehrung und Anwendung** von technischen Einrichtungen, die dazu **geeignet** sind, das Verhalten oder die Leistung der Arbeitnehmer zu ueberwachen, beduerfen der **Zustimmung des Betriebsrats**.
+
+### Wichtig: Eignung genuegt!
+Das BAG hat klargestellt: Bereits die **objektive Eignung** zur Ueberwachung genuegt — eine tatsaechliche Nutzung zu diesem Zweck ist nicht erforderlich.
+
+---
+
+## Leitentscheidungen des BAG
+
+### Microsoft Office 365 (BAG 1 ABR 20/21, 08.03.2022)
+Das BAG hat ausdruecklich entschieden, dass Microsoft Office 365 der Mitbestimmung unterliegt.
+
+### Standardsoftware (BAG 1 ABN 36/18, 23.10.2018)
+Auch alltaegliche Standardsoftware wie Excel ist mitbestimmungsrelevant. Keine Geringfuegigkeitsschwelle.
+
+### SAP ERP (BAG 1 ABR 45/11, 25.09.2012)
+HR-/ERP-Systeme erheben und verknuepfen individualisierbare Verhaltens- und Leistungsdaten.
+
+### SaaS/Cloud (BAG 1 ABR 68/13, 21.07.2015)
+Auch bei Ueberwachung ueber Dritt-Systeme bleibt der Betriebsrat zu beteiligen.
+
+### Belastungsstatistik (BAG 1 ABR 46/15, 25.04.2017)
+Dauerhafte Kennzahlenueberwachung ist ein schwerwiegender Eingriff in das Persoenlichkeitsrecht.
+
+---
+
+## Betriebsrats-Konflikt-Score (SDK)
+
+Das SDK berechnet automatisch einen Konflikt-Score (0-100):
+- Beschaeftigtendaten (+10), Ueberwachungseignung (+20), HR-Bezug (+20)
+- Individualisierbare Logs (+15), Kommunikationsanalyse (+10)
+- Scoring/Ranking (+10), Vollautomatisiert (+10), Keine BR-Konsultation (+5)
+
+Eskalation: Score >= 50 ohne BR → E2, Score >= 75 → E3.',
+ '["§87 Abs.1 Nr.6 BetrVG", "§90 BetrVG", "§94 BetrVG", "§95 BetrVG", "Art. 88 DSGVO", "§26 BDSG"]',
+ ARRAY['BetrVG', 'Mitbestimmung', 'Betriebsrat', 'KI', 'Ueberwachung', 'Microsoft 365'],
+ 'critical',
+ '["https://www.bundesarbeitsgericht.de/entscheidung/1-abr-20-21/", "https://www.bundesarbeitsgericht.de/entscheidung/1-abn-36-18/"]',
+ 1)
+ON CONFLICT (id) DO UPDATE SET content = EXCLUDED.content, summary = EXCLUDED.summary, updated_at = NOW();
diff --git a/admin-compliance/migrations/wiki_domain_articles.sql b/admin-compliance/migrations/wiki_domain_articles.sql
new file mode 100644
index 0000000..21369ee
--- /dev/null
+++ b/admin-compliance/migrations/wiki_domain_articles.sql
@@ -0,0 +1,157 @@
+-- Wiki Articles: Domain-spezifische KI-Compliance
+-- 4 Artikel fuer die wichtigsten Hochrisiko-Domains
+
+-- 1. KI im Recruiting
+INSERT INTO compliance.compliance_wiki_articles (id, category_id, title, summary, content, legal_refs, tags, relevance, source_urls, version)
+VALUES ('ki-recruiting-compliance', 'arbeitsrecht',
+'KI im Recruiting — AGG, DSGVO Art. 22, AI Act Hochrisiko',
+'Compliance-Anforderungen bei KI-gestuetzter Personalauswahl: Automatisierte Absagen, Bias-Risiken, Beweislastumkehr.',
+'# KI im Recruiting — Compliance-Anforderungen
+
+## AI Act Einstufung
+KI im Recruiting faellt unter **Annex III Nr. 4 (Employment)** = **High-Risk**.
+
+## Kritische Punkte
+
+### Art. 22 DSGVO — Automatisierte Entscheidungen
+Vollautomatische Absagen ohne menschliche Pruefung sind **grundsaetzlich unzulaessig**.
+Erlaubt: KI erstellt Vorschlag → Mensch prueft → Mensch entscheidet → Mensch gibt Absage frei.
+
+### AGG — Diskriminierungsverbot
+- § 1 AGG: Keine Benachteiligung nach Geschlecht, Alter, Herkunft, Religion, Behinderung
+- § 22 AGG: **Beweislastumkehr** — Arbeitgeber muss beweisen, dass KEINE Diskriminierung vorliegt
+- § 15 AGG: Schadensersatz bis 3 Monatsgehaelter pro Fall
+- Proxy-Merkmale vermeiden: Name→Herkunft, Foto→Alter
+
+### BetrVG — Mitbestimmung
+- § 87 Abs. 1 Nr. 6: Betriebsrat muss zustimmen
+- § 95: Auswahlrichtlinien mitbestimmungspflichtig
+- BAG 1 ABR 20/21: Gilt auch fuer Standardsoftware
+
+## Pflichtmassnahmen
+1. Human-in-the-Loop (echt, kein Rubber Stamping)
+2. Regelmaessige Bias-Audits
+3. DSFA durchfuehren
+4. Betriebsvereinbarung abschliessen
+5. Bewerber ueber KI-Nutzung informieren',
+'["Art. 22 DSGVO", "§ 1 AGG", "§ 22 AGG", "§ 15 AGG", "§ 87 BetrVG", "§ 95 BetrVG", "Annex III Nr. 4 AI Act"]',
+ARRAY['Recruiting', 'HR', 'AGG', 'Bias', 'Art. 22', 'Beweislastumkehr', 'Betriebsrat'],
+'critical',
+'["https://www.bundesarbeitsgericht.de/entscheidung/1-abr-20-21/"]',
+1)
+ON CONFLICT (id) DO UPDATE SET content = EXCLUDED.content, updated_at = NOW();
+
+-- 2. KI in der Bildung
+INSERT INTO compliance.compliance_wiki_articles (id, category_id, title, summary, content, legal_refs, tags, relevance, source_urls, version)
+VALUES ('ki-bildung-compliance', 'branchenspezifisch',
+'KI in der Bildung — Notenvergabe, Pruefungsbewertung, Minderjaehrige',
+'AI Act Annex III Nr. 3: Hochrisiko bei KI-gestuetzter Bewertung in Bildung und Ausbildung.',
+'# KI in der Bildung — Compliance-Anforderungen
+
+## AI Act Einstufung
+KI in Bildung/Ausbildung faellt unter **Annex III Nr. 3 (Education)** = **High-Risk**.
+
+## Kritische Szenarien
+- KI beeinflusst Noten → High-Risk
+- KI bewertet Pruefungen → High-Risk
+- KI steuert Zugang zu Bildungsangeboten → High-Risk
+- Minderjaehrige betroffen → Besonderer Schutz (Art. 24 EU-Grundrechtecharta)
+
+## BLOCK-Regel
+**Minderjaehrige betroffen + keine Lehrkraft-Pruefung = UNZULAESSIG**
+
+## Pflichtmassnahmen
+1. Lehrkraft prueft JEDES KI-Ergebnis vor Mitteilung an Schueler
+2. Chancengleichheit unabhaengig von sozioekonomischem Hintergrund
+3. Keine Benachteiligung durch Sprache oder Behinderung
+4. FRIA durchfuehren (Grundrechte-Folgenabschaetzung)
+5. DSFA bei Verarbeitung von Schuelerdaten
+
+## Grundrechte
+- Recht auf Bildung (Art. 14 EU-Charta)
+- Rechte des Kindes (Art. 24 EU-Charta)
+- Nicht-Diskriminierung (Art. 21 EU-Charta)',
+'["Annex III Nr. 3 AI Act", "Art. 14 EU-Grundrechtecharta", "Art. 24 EU-Grundrechtecharta", "Art. 35 DSGVO"]',
+ARRAY['Bildung', 'Education', 'Noten', 'Pruefung', 'Minderjaehrige', 'Schule'],
+'critical',
+'[]',
+1)
+ON CONFLICT (id) DO UPDATE SET content = EXCLUDED.content, updated_at = NOW();
+
+-- 3. KI im Gesundheitswesen
+INSERT INTO compliance.compliance_wiki_articles (id, category_id, title, summary, content, legal_refs, tags, relevance, source_urls, version)
+VALUES ('ki-gesundheit-compliance', 'branchenspezifisch',
+'KI im Gesundheitswesen — MDR, Diagnose, Triage',
+'AI Act Annex III Nr. 5 + MDR: Hochrisiko bei KI in Diagnose, Behandlung und Triage.',
+'# KI im Gesundheitswesen — Compliance-Anforderungen
+
+## Regulatorischer Rahmen
+- **AI Act Annex III Nr. 5** — Zugang zu wesentlichen Diensten (Gesundheit)
+- **MDR (EU) 2017/745** — Medizinprodukteverordnung
+- **DSGVO Art. 9** — Gesundheitsdaten = besondere Kategorie
+
+## Kritische Szenarien
+- KI unterstuetzt Diagnosen → High-Risk + DSFA Pflicht
+- KI priorisiert Patienten (Triage) → Lebenskritisch, hoechste Anforderungen
+- KI empfiehlt Behandlungen → High-Risk
+- System ist Medizinprodukt → MDR-Zertifizierung erforderlich
+
+## BLOCK-Regeln
+- **Medizinprodukt ohne klinische Validierung = UNZULAESSIG**
+- MDR Art. 61: Klinische Bewertung ist Pflicht
+
+## Grundrechte
+- Menschenwuerde (Art. 1 EU-Charta)
+- Schutz personenbezogener Daten (Art. 8 EU-Charta)
+- Patientenautonomie
+
+## Pflichtmassnahmen
+1. Klinische Validierung vor Einsatz
+2. Human Oversight durch qualifiziertes Fachpersonal
+3. DSFA fuer Gesundheitsdatenverarbeitung
+4. Genauigkeitsmetriken definieren und messen
+5. Incident Reporting bei Fehlfunktionen',
+'["Annex III Nr. 5 AI Act", "MDR (EU) 2017/745", "Art. 9 DSGVO", "Art. 35 DSGVO"]',
+ARRAY['Gesundheit', 'Healthcare', 'MDR', 'Diagnose', 'Triage', 'Medizinprodukt'],
+'critical',
+'[]',
+1)
+ON CONFLICT (id) DO UPDATE SET content = EXCLUDED.content, updated_at = NOW();
+
+-- 4. KI in Finanzdienstleistungen
+INSERT INTO compliance.compliance_wiki_articles (id, category_id, title, summary, content, legal_refs, tags, relevance, source_urls, version)
+VALUES ('ki-finance-compliance', 'branchenspezifisch',
+'KI in Finanzdienstleistungen — Scoring, DORA, Versicherung',
+'AI Act Annex III Nr. 5 + DORA + MaRisk: Compliance bei Kredit-Scoring, Algo-Trading, Versicherungspraemien.',
+'# KI in Finanzdienstleistungen — Compliance-Anforderungen
+
+## Regulatorischer Rahmen
+- **AI Act Annex III Nr. 5** — Zugang zu wesentlichen Diensten
+- **DORA** — Digital Operational Resilience Act
+- **MaRisk/BAIT** — Bankaufsichtliche Anforderungen
+- **MiFID II** — Algorithmischer Handel
+
+## Kritische Szenarien
+- Kredit-Scoring → High-Risk (Art. 22 DSGVO + Annex III)
+- Automatisierte Schadenbearbeitung → Art. 22 Risiko
+- Individuelle Praemienberechnung → Diskriminierungsrisiko
+- Algo-Trading → MiFID II Anforderungen
+- Robo Advisor → WpHG-Pflichten
+
+## Pflichtmassnahmen
+1. Transparenz bei Scoring-Entscheidungen
+2. Bias-Audits bei Kreditvergabe
+3. Human Oversight bei Ablehnungen
+4. DORA-konforme IT-Resilienz
+5. Incident Reporting
+
+## Besondere Risiken
+- Diskriminierendes Kredit-Scoring (AGG + AI Act)
+- Ungerechtfertigte Verweigerung von Finanzdienstleistungen
+- Mangelnde Erklaerbarkeit bei Scoring-Algorithmen',
+'["Annex III Nr. 5 AI Act", "DORA", "MaRisk", "MiFID II", "Art. 22 DSGVO", "§ 1 AGG"]',
+ARRAY['Finance', 'Banking', 'Versicherung', 'Scoring', 'DORA', 'Kredit', 'Algo-Trading'],
+'critical',
+'[]',
+1)
+ON CONFLICT (id) DO UPDATE SET content = EXCLUDED.content, updated_at = NOW();
diff --git a/ai-compliance-sdk/internal/api/handlers/payment_handlers.go b/ai-compliance-sdk/internal/api/handlers/payment_handlers.go
new file mode 100644
index 0000000..94567ea
--- /dev/null
+++ b/ai-compliance-sdk/internal/api/handlers/payment_handlers.go
@@ -0,0 +1,290 @@
+package handlers
+
+import (
+	"encoding/json"
+	"net/http"
+	"os"
+	"path/filepath"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// PaymentHandlers handles payment compliance endpoints
+type PaymentHandlers struct {
+	pool     *pgxpool.Pool
+	controls *PaymentControlLibrary
+}
+
+// PaymentControlLibrary holds the control catalog
+type PaymentControlLibrary struct {
+	Domains  []PaymentDomain  `json:"domains"`
+	Controls []PaymentControl `json:"controls"`
+}
+
+type PaymentDomain struct {
+	ID          string `json:"id"`
+	Name        string `json:"name"`
+	Description string `json:"description"`
+}
+
+type PaymentControl struct {
+	ControlID  string   `json:"control_id"`
+	Domain     string   `json:"domain"`
+	Title      string   `json:"title"`
+	Objective  string   `json:"objective"`
+	CheckTarget string  `json:"check_target"`
+	Evidence   []string `json:"evidence"`
+	Automation string   `json:"automation"`
+}
+
+type PaymentAssessment struct {
+	ID              uuid.UUID       `json:"id"`
+	TenantID        uuid.UUID       `json:"tenant_id"`
+	ProjectName     string          `json:"project_name"`
+	TenderReference string          `json:"tender_reference,omitempty"`
+	CustomerName    string          `json:"customer_name,omitempty"`
+	Description     string          `json:"description,omitempty"`
+	SystemType      string          `json:"system_type,omitempty"`
+	PaymentMethods  json.RawMessage `json:"payment_methods,omitempty"`
+	Protocols       json.RawMessage `json:"protocols,omitempty"`
+	TotalControls   int             `json:"total_controls"`
+	ControlsPassed  int             `json:"controls_passed"`
+	ControlsFailed  int             `json:"controls_failed"`
+	ControlsPartial int             `json:"controls_partial"`
+	ControlsNA      int             `json:"controls_not_applicable"`
+	ControlsUnchecked int           `json:"controls_not_checked"`
+	ComplianceScore float64         `json:"compliance_score"`
+	Status          string          `json:"status"`
+	ControlResults  json.RawMessage `json:"control_results,omitempty"`
+	CreatedAt       time.Time       `json:"created_at"`
+	UpdatedAt       time.Time       `json:"updated_at"`
+	CreatedBy       string          `json:"created_by,omitempty"`
+}
+
+// NewPaymentHandlers creates payment handlers with loaded control library
+func NewPaymentHandlers(pool *pgxpool.Pool) *PaymentHandlers {
+	lib := loadControlLibrary()
+	return &PaymentHandlers{pool: pool, controls: lib}
+}
+
+func loadControlLibrary() *PaymentControlLibrary {
+	// Try to load from policies directory
+	paths := []string{
+		"policies/payment_controls_v1.json",
+		"/app/policies/payment_controls_v1.json",
+	}
+	for _, p := range paths {
+		data, err := os.ReadFile(p)
+		if err != nil {
+			// Try relative to executable
+			execDir, _ := os.Executable()
+			altPath := filepath.Join(filepath.Dir(execDir), p)
+			data, err = os.ReadFile(altPath)
+			if err != nil {
+				continue
+			}
+		}
+		var lib PaymentControlLibrary
+		if err := json.Unmarshal(data, &lib); err == nil {
+			return &lib
+		}
+	}
+	return &PaymentControlLibrary{}
+}
+
+// GetControlLibrary returns the loaded control library (for tender matching)
+func (h *PaymentHandlers) GetControlLibrary() *PaymentControlLibrary {
+	return h.controls
+}
+
+// ListControls returns the control library
+func (h *PaymentHandlers) ListControls(c *gin.Context) {
+	domain := c.Query("domain")
+	automation := c.Query("automation")
+
+	controls := h.controls.Controls
+	if domain != "" {
+		var filtered []PaymentControl
+		for _, ctrl := range controls {
+			if ctrl.Domain == domain {
+				filtered = append(filtered, ctrl)
+			}
+		}
+		controls = filtered
+	}
+	if automation != "" {
+		var filtered []PaymentControl
+		for _, ctrl := range controls {
+			if ctrl.Automation == automation {
+				filtered = append(filtered, ctrl)
+			}
+		}
+		controls = filtered
+	}
+
+	c.JSON(http.StatusOK, gin.H{
+		"controls": controls,
+		"domains":  h.controls.Domains,
+		"total":    len(controls),
+	})
+}
+
+// CreateAssessment creates a new payment compliance assessment
+func (h *PaymentHandlers) CreateAssessment(c *gin.Context) {
+	var req PaymentAssessment
+	if err := c.ShouldBindJSON(&req); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	tenantID, _ := uuid.Parse(c.GetHeader("X-Tenant-ID"))
+	if tenantID == uuid.Nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "tenant ID required"})
+		return
+	}
+
+	req.ID = uuid.New()
+	req.TenantID = tenantID
+	req.Status = "draft"
+	req.TotalControls = len(h.controls.Controls)
+	req.ControlsUnchecked = req.TotalControls
+	req.CreatedAt = time.Now()
+	req.UpdatedAt = time.Now()
+
+	_, err := h.pool.Exec(c.Request.Context(), `
+		INSERT INTO payment_compliance_assessments (
+			id, tenant_id, project_name, tender_reference, customer_name, description,
+			system_type, payment_methods, protocols,
+			total_controls, controls_not_checked, status, created_by
+		) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)`,
+		req.ID, req.TenantID, req.ProjectName, req.TenderReference, req.CustomerName, req.Description,
+		req.SystemType, req.PaymentMethods, req.Protocols,
+		req.TotalControls, req.ControlsUnchecked, req.Status, req.CreatedBy,
+	)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusCreated, req)
+}
+
+// ListAssessments lists all payment assessments for a tenant
+func (h *PaymentHandlers) ListAssessments(c *gin.Context) {
+	tenantID, _ := uuid.Parse(c.GetHeader("X-Tenant-ID"))
+	if tenantID == uuid.Nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "tenant ID required"})
+		return
+	}
+
+	rows, err := h.pool.Query(c.Request.Context(), `
+		SELECT id, tenant_id, project_name, tender_reference, customer_name,
+			system_type, total_controls, controls_passed, controls_failed,
+			controls_partial, controls_not_applicable, controls_not_checked,
+			compliance_score, status, created_at, updated_at
+		FROM payment_compliance_assessments
+		WHERE tenant_id = $1
+		ORDER BY created_at DESC`, tenantID)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	defer rows.Close()
+
+	var assessments []PaymentAssessment
+	for rows.Next() {
+		var a PaymentAssessment
+		rows.Scan(&a.ID, &a.TenantID, &a.ProjectName, &a.TenderReference, &a.CustomerName,
+			&a.SystemType, &a.TotalControls, &a.ControlsPassed, &a.ControlsFailed,
+			&a.ControlsPartial, &a.ControlsNA, &a.ControlsUnchecked,
+			&a.ComplianceScore, &a.Status, &a.CreatedAt, &a.UpdatedAt)
+		assessments = append(assessments, a)
+	}
+	if assessments == nil {
+		assessments = []PaymentAssessment{}
+	}
+
+	c.JSON(http.StatusOK, gin.H{"assessments": assessments, "total": len(assessments)})
+}
+
+// GetAssessment returns a single assessment with control results
+func (h *PaymentHandlers) GetAssessment(c *gin.Context) {
+	id, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid ID"})
+		return
+	}
+
+	var a PaymentAssessment
+	err = h.pool.QueryRow(c.Request.Context(), `
+		SELECT id, tenant_id, project_name, tender_reference, customer_name, description,
+			system_type, payment_methods, protocols,
+			total_controls, controls_passed, controls_failed, controls_partial,
+			controls_not_applicable, controls_not_checked, compliance_score,
+			status, control_results, created_at, updated_at, created_by
+		FROM payment_compliance_assessments WHERE id = $1`, id).Scan(
+		&a.ID, &a.TenantID, &a.ProjectName, &a.TenderReference, &a.CustomerName, &a.Description,
+		&a.SystemType, &a.PaymentMethods, &a.Protocols,
+		&a.TotalControls, &a.ControlsPassed, &a.ControlsFailed, &a.ControlsPartial,
+		&a.ControlsNA, &a.ControlsUnchecked, &a.ComplianceScore,
+		&a.Status, &a.ControlResults, &a.CreatedAt, &a.UpdatedAt, &a.CreatedBy)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "assessment not found"})
+		return
+	}
+
+	c.JSON(http.StatusOK, a)
+}
+
+// UpdateControlVerdict updates the verdict for a single control
+func (h *PaymentHandlers) UpdateControlVerdict(c *gin.Context) {
+	id, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid ID"})
+		return
+	}
+
+	var body struct {
+		ControlID string `json:"control_id"`
+		Verdict   string `json:"verdict"` // passed, failed, partial, na, unchecked
+		Evidence  string `json:"evidence,omitempty"`
+		Notes     string `json:"notes,omitempty"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": err.Error()})
+		return
+	}
+
+	// Update the control_results JSONB and recalculate scores
+	_, err = h.pool.Exec(c.Request.Context(), `
+		WITH updated AS (
+			SELECT id,
+				COALESCE(control_results, '[]'::jsonb) AS existing_results
+			FROM payment_compliance_assessments WHERE id = $1
+		)
+		UPDATE payment_compliance_assessments SET
+			control_results = (
+				SELECT jsonb_agg(
+					CASE WHEN elem->>'control_id' = $2 THEN
+						jsonb_build_object('control_id', $2, 'verdict', $3, 'evidence', $4, 'notes', $5)
+					ELSE elem END
+				) FROM updated, jsonb_array_elements(
+					CASE WHEN existing_results @> jsonb_build_array(jsonb_build_object('control_id', $2))
+					THEN existing_results
+					ELSE existing_results || jsonb_build_array(jsonb_build_object('control_id', $2, 'verdict', $3, 'evidence', $4, 'notes', $5))
+					END
+				) AS elem
+			),
+			updated_at = NOW()
+		WHERE id = $1`,
+		id, body.ControlID, body.Verdict, body.Evidence, body.Notes)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"status": "updated", "control_id": body.ControlID, "verdict": body.Verdict})
+}
diff --git a/ai-compliance-sdk/internal/api/handlers/registration_handlers.go b/ai-compliance-sdk/internal/api/handlers/registration_handlers.go
new file mode 100644
index 0000000..71694fe
--- /dev/null
+++ b/ai-compliance-sdk/internal/api/handlers/registration_handlers.go
@@ -0,0 +1,220 @@
+package handlers
+
+import (
+	"net/http"
+
+	"github.com/breakpilot/ai-compliance-sdk/internal/ucca"
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+)
+
+// RegistrationHandlers handles EU AI Database registration endpoints
+type RegistrationHandlers struct {
+	store     *ucca.RegistrationStore
+	uccaStore *ucca.Store
+}
+
+// NewRegistrationHandlers creates new registration handlers
+func NewRegistrationHandlers(store *ucca.RegistrationStore, uccaStore *ucca.Store) *RegistrationHandlers {
+	return &RegistrationHandlers{store: store, uccaStore: uccaStore}
+}
+
+// Create creates a new registration
+func (h *RegistrationHandlers) Create(c *gin.Context) {
+	var reg ucca.AIRegistration
+	if err := c.ShouldBindJSON(&reg); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid request: " + err.Error()})
+		return
+	}
+
+	tenantID, _ := uuid.Parse(c.GetHeader("X-Tenant-ID"))
+	if tenantID == uuid.Nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "tenant ID required"})
+		return
+	}
+	reg.TenantID = tenantID
+
+	if reg.SystemName == "" {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "system_name required"})
+		return
+	}
+
+	if err := h.store.Create(c.Request.Context(), &reg); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to create registration: " + err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusCreated, reg)
+}
+
+// List lists all registrations for the tenant
+func (h *RegistrationHandlers) List(c *gin.Context) {
+	tenantID, _ := uuid.Parse(c.GetHeader("X-Tenant-ID"))
+	if tenantID == uuid.Nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "tenant ID required"})
+		return
+	}
+
+	registrations, err := h.store.List(c.Request.Context(), tenantID)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to list registrations: " + err.Error()})
+		return
+	}
+	if registrations == nil {
+		registrations = []ucca.AIRegistration{}
+	}
+
+	c.JSON(http.StatusOK, gin.H{"registrations": registrations, "total": len(registrations)})
+}
+
+// Get returns a single registration
+func (h *RegistrationHandlers) Get(c *gin.Context) {
+	id, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid ID"})
+		return
+	}
+
+	reg, err := h.store.GetByID(c.Request.Context(), id)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Registration not found"})
+		return
+	}
+
+	c.JSON(http.StatusOK, reg)
+}
+
+// Update updates a registration
+func (h *RegistrationHandlers) Update(c *gin.Context) {
+	id, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid ID"})
+		return
+	}
+
+	existing, err := h.store.GetByID(c.Request.Context(), id)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Registration not found"})
+		return
+	}
+
+	var updates ucca.AIRegistration
+	if err := c.ShouldBindJSON(&updates); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid request: " + err.Error()})
+		return
+	}
+
+	// Merge updates into existing
+	updates.ID = existing.ID
+	updates.TenantID = existing.TenantID
+	updates.CreatedAt = existing.CreatedAt
+
+	if err := h.store.Update(c.Request.Context(), &updates); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update: " + err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusOK, updates)
+}
+
+// UpdateStatus changes the registration status
+func (h *RegistrationHandlers) UpdateStatus(c *gin.Context) {
+	id, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid ID"})
+		return
+	}
+
+	var body struct {
+		Status      string `json:"status"`
+		SubmittedBy string `json:"submitted_by"`
+	}
+	if err := c.ShouldBindJSON(&body); err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid request"})
+		return
+	}
+
+	validStatuses := map[string]bool{
+		"draft": true, "ready": true, "submitted": true,
+		"registered": true, "update_required": true, "withdrawn": true,
+	}
+	if !validStatuses[body.Status] {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid status. Valid: draft, ready, submitted, registered, update_required, withdrawn"})
+		return
+	}
+
+	if err := h.store.UpdateStatus(c.Request.Context(), id, body.Status, body.SubmittedBy); err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "Failed to update status: " + err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusOK, gin.H{"id": id, "status": body.Status})
+}
+
+// Prefill creates a registration pre-filled from a UCCA assessment
+func (h *RegistrationHandlers) Prefill(c *gin.Context) {
+	assessmentID, err := uuid.Parse(c.Param("assessment_id"))
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid assessment ID"})
+		return
+	}
+
+	tenantID, _ := uuid.Parse(c.GetHeader("X-Tenant-ID"))
+	if tenantID == uuid.Nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "tenant ID required"})
+		return
+	}
+
+	// Load UCCA assessment
+	assessment, err := h.uccaStore.GetAssessment(c.Request.Context(), assessmentID)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Assessment not found"})
+		return
+	}
+
+	// Pre-fill registration from assessment intake
+	intake := assessment.Intake
+
+	reg := ucca.AIRegistration{
+		TenantID:           tenantID,
+		SystemName:         intake.Title,
+		SystemDescription:  intake.UseCaseText,
+		IntendedPurpose:    intake.UseCaseText,
+		RiskClassification: string(assessment.RiskLevel),
+		GPAIClassification: "none",
+		RegistrationStatus: "draft",
+		UCCAAssessmentID:   &assessmentID,
+	}
+
+	// Map domain to readable text
+	if intake.Domain != "" {
+		reg.IntendedPurpose = string(intake.Domain) + ": " + intake.UseCaseText
+	}
+
+	c.JSON(http.StatusOK, reg)
+}
+
+// Export generates the EU AI Database submission JSON
+func (h *RegistrationHandlers) Export(c *gin.Context) {
+	id, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "Invalid ID"})
+		return
+	}
+
+	reg, err := h.store.GetByID(c.Request.Context(), id)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "Registration not found"})
+		return
+	}
+
+	exportJSON := h.store.BuildExportJSON(reg)
+
+	// Save export data to DB
+	reg.ExportData = exportJSON
+	h.store.Update(c.Request.Context(), reg)
+
+	c.Header("Content-Type", "application/json")
+	c.Header("Content-Disposition", "attachment; filename=eu_ai_registration_"+reg.SystemName+".json")
+	c.Data(http.StatusOK, "application/json", exportJSON)
+}
diff --git a/ai-compliance-sdk/internal/api/handlers/tender_handlers.go b/ai-compliance-sdk/internal/api/handlers/tender_handlers.go
new file mode 100644
index 0000000..710ca3c
--- /dev/null
+++ b/ai-compliance-sdk/internal/api/handlers/tender_handlers.go
@@ -0,0 +1,557 @@
+package handlers
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"strings"
+	"time"
+
+	"github.com/gin-gonic/gin"
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// TenderHandlers handles tender upload and requirement extraction
+type TenderHandlers struct {
+	pool     *pgxpool.Pool
+	controls *PaymentControlLibrary
+}
+
+// TenderAnalysis represents a tender document analysis
+type TenderAnalysis struct {
+	ID               uuid.UUID          `json:"id"`
+	TenantID         uuid.UUID          `json:"tenant_id"`
+	FileName         string             `json:"file_name"`
+	FileSize         int64              `json:"file_size"`
+	ProjectName      string             `json:"project_name"`
+	CustomerName     string             `json:"customer_name,omitempty"`
+	Status           string             `json:"status"` // uploaded, extracting, extracted, matched, completed
+	Requirements     []ExtractedReq     `json:"requirements,omitempty"`
+	MatchResults     []MatchResult      `json:"match_results,omitempty"`
+	TotalRequirements int               `json:"total_requirements"`
+	MatchedCount     int                `json:"matched_count"`
+	UnmatchedCount   int                `json:"unmatched_count"`
+	PartialCount     int                `json:"partial_count"`
+	CreatedAt        time.Time          `json:"created_at"`
+	UpdatedAt        time.Time          `json:"updated_at"`
+}
+
+// ExtractedReq represents a single requirement extracted from a tender document
+type ExtractedReq struct {
+	ReqID          string   `json:"req_id"`
+	Text           string   `json:"text"`
+	SourcePage     int      `json:"source_page,omitempty"`
+	SourceSection  string   `json:"source_section,omitempty"`
+	ObligationLevel string  `json:"obligation_level"` // MUST, SHALL, SHOULD, MAY
+	TechnicalDomain string  `json:"technical_domain"` // crypto, logging, payment_flow, etc.
+	CheckTarget    string   `json:"check_target"`     // code, system, config, process, certificate
+	Confidence     float64  `json:"confidence"`
+}
+
+// MatchResult represents the matching of a requirement to controls
+type MatchResult struct {
+	ReqID          string          `json:"req_id"`
+	ReqText        string          `json:"req_text"`
+	ObligationLevel string         `json:"obligation_level"`
+	MatchedControls []ControlMatch `json:"matched_controls"`
+	Verdict        string          `json:"verdict"` // matched, partial, unmatched
+	GapDescription string          `json:"gap_description,omitempty"`
+}
+
+// ControlMatch represents a single control match for a requirement
+type ControlMatch struct {
+	ControlID  string  `json:"control_id"`
+	Title      string  `json:"title"`
+	Relevance  float64 `json:"relevance"` // 0-1
+	CheckTarget string `json:"check_target"`
+}
+
+// NewTenderHandlers creates tender handlers
+func NewTenderHandlers(pool *pgxpool.Pool, controls *PaymentControlLibrary) *TenderHandlers {
+	return &TenderHandlers{pool: pool, controls: controls}
+}
+
+// Upload handles tender document upload
+func (h *TenderHandlers) Upload(c *gin.Context) {
+	tenantID, _ := uuid.Parse(c.GetHeader("X-Tenant-ID"))
+	if tenantID == uuid.Nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "tenant ID required"})
+		return
+	}
+
+	file, header, err := c.Request.FormFile("file")
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "file required"})
+		return
+	}
+	defer file.Close()
+
+	projectName := c.PostForm("project_name")
+	if projectName == "" {
+		projectName = header.Filename
+	}
+	customerName := c.PostForm("customer_name")
+
+	// Read file content
+	content, err := io.ReadAll(file)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to read file"})
+		return
+	}
+
+	// Store analysis record
+	analysisID := uuid.New()
+	now := time.Now()
+
+	_, err = h.pool.Exec(c.Request.Context(), `
+		INSERT INTO tender_analyses (
+			id, tenant_id, file_name, file_size, file_content,
+			project_name, customer_name, status, created_at, updated_at
+		) VALUES ($1, $2, $3, $4, $5, $6, $7, 'uploaded', $8, $9)`,
+		analysisID, tenantID, header.Filename, header.Size, content,
+		projectName, customerName, now, now,
+	)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": "failed to store: " + err.Error()})
+		return
+	}
+
+	c.JSON(http.StatusCreated, gin.H{
+		"id":           analysisID,
+		"file_name":    header.Filename,
+		"file_size":    header.Size,
+		"project_name": projectName,
+		"status":       "uploaded",
+		"message":      "Dokument hochgeladen. Starte Analyse mit POST /extract.",
+	})
+}
+
+// Extract extracts requirements from an uploaded tender document using LLM
+func (h *TenderHandlers) Extract(c *gin.Context) {
+	id, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid ID"})
+		return
+	}
+
+	// Get file content
+	var fileContent []byte
+	var fileName string
+	err = h.pool.QueryRow(c.Request.Context(), `
+		SELECT file_content, file_name FROM tender_analyses WHERE id = $1`, id,
+	).Scan(&fileContent, &fileName)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "analysis not found"})
+		return
+	}
+
+	// Update status
+	h.pool.Exec(c.Request.Context(), `
+		UPDATE tender_analyses SET status = 'extracting', updated_at = NOW() WHERE id = $1`, id)
+
+	// Extract text (simple: treat as text for now, PDF extraction would use embedding-service)
+	text := string(fileContent)
+
+	// Use LLM to extract requirements
+	requirements := h.extractRequirementsWithLLM(c.Request.Context(), text)
+
+	// Store results
+	reqJSON, _ := json.Marshal(requirements)
+	h.pool.Exec(c.Request.Context(), `
+		UPDATE tender_analyses SET
+			status = 'extracted',
+			requirements = $2,
+			total_requirements = $3,
+			updated_at = NOW()
+		WHERE id = $1`, id, reqJSON, len(requirements))
+
+	c.JSON(http.StatusOK, gin.H{
+		"id":            id,
+		"status":        "extracted",
+		"requirements":  requirements,
+		"total":         len(requirements),
+	})
+}
+
+// Match matches extracted requirements against the control library
+func (h *TenderHandlers) Match(c *gin.Context) {
+	id, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid ID"})
+		return
+	}
+
+	// Get requirements
+	var reqJSON json.RawMessage
+	err = h.pool.QueryRow(c.Request.Context(), `
+		SELECT requirements FROM tender_analyses WHERE id = $1`, id,
+	).Scan(&reqJSON)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "analysis not found"})
+		return
+	}
+
+	var requirements []ExtractedReq
+	json.Unmarshal(reqJSON, &requirements)
+
+	// Match each requirement against controls
+	var results []MatchResult
+	matched, unmatched, partial := 0, 0, 0
+
+	for _, req := range requirements {
+		matches := h.findMatchingControls(req)
+		result := MatchResult{
+			ReqID:           req.ReqID,
+			ReqText:         req.Text,
+			ObligationLevel: req.ObligationLevel,
+			MatchedControls: matches,
+		}
+
+		if len(matches) == 0 {
+			result.Verdict = "unmatched"
+			result.GapDescription = "Kein passender Control gefunden — manueller Review erforderlich"
+			unmatched++
+		} else if matches[0].Relevance >= 0.7 {
+			result.Verdict = "matched"
+			matched++
+		} else {
+			result.Verdict = "partial"
+			result.GapDescription = "Teilweise Abdeckung — Control deckt Anforderung nicht vollstaendig ab"
+			partial++
+		}
+
+		results = append(results, result)
+	}
+
+	// Store results
+	resultsJSON, _ := json.Marshal(results)
+	h.pool.Exec(c.Request.Context(), `
+		UPDATE tender_analyses SET
+			status = 'matched',
+			match_results = $2,
+			matched_count = $3,
+			unmatched_count = $4,
+			partial_count = $5,
+			updated_at = NOW()
+		WHERE id = $1`, id, resultsJSON, matched, unmatched, partial)
+
+	c.JSON(http.StatusOK, gin.H{
+		"id":        id,
+		"status":    "matched",
+		"results":   results,
+		"matched":   matched,
+		"unmatched": unmatched,
+		"partial":   partial,
+		"total":     len(requirements),
+	})
+}
+
+// ListAnalyses lists all tender analyses for a tenant
+func (h *TenderHandlers) ListAnalyses(c *gin.Context) {
+	tenantID, _ := uuid.Parse(c.GetHeader("X-Tenant-ID"))
+	if tenantID == uuid.Nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "tenant ID required"})
+		return
+	}
+
+	rows, err := h.pool.Query(c.Request.Context(), `
+		SELECT id, tenant_id, file_name, file_size, project_name, customer_name,
+			status, total_requirements, matched_count, unmatched_count, partial_count,
+			created_at, updated_at
+		FROM tender_analyses
+		WHERE tenant_id = $1
+		ORDER BY created_at DESC`, tenantID)
+	if err != nil {
+		c.JSON(http.StatusInternalServerError, gin.H{"error": err.Error()})
+		return
+	}
+	defer rows.Close()
+
+	var analyses []TenderAnalysis
+	for rows.Next() {
+		var a TenderAnalysis
+		rows.Scan(&a.ID, &a.TenantID, &a.FileName, &a.FileSize, &a.ProjectName, &a.CustomerName,
+			&a.Status, &a.TotalRequirements, &a.MatchedCount, &a.UnmatchedCount, &a.PartialCount,
+			&a.CreatedAt, &a.UpdatedAt)
+		analyses = append(analyses, a)
+	}
+	if analyses == nil {
+		analyses = []TenderAnalysis{}
+	}
+
+	c.JSON(http.StatusOK, gin.H{"analyses": analyses, "total": len(analyses)})
+}
+
+// GetAnalysis returns a single analysis with all details
+func (h *TenderHandlers) GetAnalysis(c *gin.Context) {
+	id, err := uuid.Parse(c.Param("id"))
+	if err != nil {
+		c.JSON(http.StatusBadRequest, gin.H{"error": "invalid ID"})
+		return
+	}
+
+	var a TenderAnalysis
+	var reqJSON, matchJSON json.RawMessage
+	err = h.pool.QueryRow(c.Request.Context(), `
+		SELECT id, tenant_id, file_name, file_size, project_name, customer_name,
+			status, requirements, match_results,
+			total_requirements, matched_count, unmatched_count, partial_count,
+			created_at, updated_at
+		FROM tender_analyses WHERE id = $1`, id).Scan(
+		&a.ID, &a.TenantID, &a.FileName, &a.FileSize, &a.ProjectName, &a.CustomerName,
+		&a.Status, &reqJSON, &matchJSON,
+		&a.TotalRequirements, &a.MatchedCount, &a.UnmatchedCount, &a.PartialCount,
+		&a.CreatedAt, &a.UpdatedAt)
+	if err != nil {
+		c.JSON(http.StatusNotFound, gin.H{"error": "not found"})
+		return
+	}
+
+	if reqJSON != nil {
+		json.Unmarshal(reqJSON, &a.Requirements)
+	}
+	if matchJSON != nil {
+		json.Unmarshal(matchJSON, &a.MatchResults)
+	}
+
+	c.JSON(http.StatusOK, a)
+}
+
+// --- Internal helpers ---
+
+func (h *TenderHandlers) extractRequirementsWithLLM(ctx context.Context, text string) []ExtractedReq {
+	// Try Anthropic API for requirement extraction
+	apiKey := os.Getenv("ANTHROPIC_API_KEY")
+	if apiKey == "" {
+		// Fallback: simple keyword-based extraction
+		return h.extractRequirementsKeyword(text)
+	}
+
+	prompt := fmt.Sprintf(`Analysiere das folgende Ausschreibungsdokument und extrahiere alle technischen Anforderungen.
+
+Fuer jede Anforderung gib zurueck:
+- req_id: fortlaufende ID (REQ-001, REQ-002, ...)
+- text: die Anforderung als kurzer Satz
+- obligation_level: MUST, SHALL, SHOULD oder MAY
+- technical_domain: eines von: payment_flow, logging, crypto, api_security, terminal_comm, firmware, reporting, access_control, error_handling, build_deploy
+- check_target: eines von: code, system, config, process, certificate
+
+Antworte NUR mit JSON Array. Keine Erklaerung.
+
+Dokument:
+%s`, text[:min(len(text), 15000)])
+
+	body := map[string]interface{}{
+		"model":      "claude-haiku-4-5-20251001",
+		"max_tokens": 4096,
+		"messages":   []map[string]string{{"role": "user", "content": prompt}},
+	}
+	bodyJSON, _ := json.Marshal(body)
+
+	req, _ := http.NewRequestWithContext(ctx, "POST", "https://api.anthropic.com/v1/messages", strings.NewReader(string(bodyJSON)))
+	req.Header.Set("x-api-key", apiKey)
+	req.Header.Set("anthropic-version", "2023-06-01")
+	req.Header.Set("content-type", "application/json")
+
+	resp, err := http.DefaultClient.Do(req)
+	if err != nil || resp.StatusCode != 200 {
+		return h.extractRequirementsKeyword(text)
+	}
+	defer resp.Body.Close()
+
+	var result struct {
+		Content []struct {
+			Text string `json:"text"`
+		} `json:"content"`
+	}
+	json.NewDecoder(resp.Body).Decode(&result)
+
+	if len(result.Content) == 0 {
+		return h.extractRequirementsKeyword(text)
+	}
+
+	// Parse LLM response
+	responseText := result.Content[0].Text
+	// Find JSON array in response
+	start := strings.Index(responseText, "[")
+	end := strings.LastIndex(responseText, "]")
+	if start < 0 || end < 0 {
+		return h.extractRequirementsKeyword(text)
+	}
+
+	var reqs []ExtractedReq
+	if err := json.Unmarshal([]byte(responseText[start:end+1]), &reqs); err != nil {
+		return h.extractRequirementsKeyword(text)
+	}
+
+	// Set confidence for LLM-extracted requirements
+	for i := range reqs {
+		reqs[i].Confidence = 0.8
+	}
+
+	return reqs
+}
+
+func (h *TenderHandlers) extractRequirementsKeyword(text string) []ExtractedReq {
+	// Simple keyword-based extraction as fallback
+	keywords := map[string]string{
+		"muss":           "MUST",
+		"muessen":        "MUST",
+		"ist sicherzustellen": "MUST",
+		"soll":           "SHOULD",
+		"sollte":         "SHOULD",
+		"kann":           "MAY",
+		"wird gefordert": "MUST",
+		"nachzuweisen":   "MUST",
+		"zertifiziert":   "MUST",
+	}
+
+	var reqs []ExtractedReq
+	lines := strings.Split(text, "\n")
+	reqNum := 1
+
+	for _, line := range lines {
+		line = strings.TrimSpace(line)
+		if len(line) < 20 || len(line) > 500 {
+			continue
+		}
+
+		for keyword, level := range keywords {
+			if strings.Contains(strings.ToLower(line), keyword) {
+				reqs = append(reqs, ExtractedReq{
+					ReqID:           fmt.Sprintf("REQ-%03d", reqNum),
+					Text:            line,
+					ObligationLevel: level,
+					TechnicalDomain: inferDomain(line),
+					CheckTarget:     inferCheckTarget(line),
+					Confidence:      0.5,
+				})
+				reqNum++
+				break
+			}
+		}
+	}
+
+	return reqs
+}
+
+func (h *TenderHandlers) findMatchingControls(req ExtractedReq) []ControlMatch {
+	var matches []ControlMatch
+
+	reqLower := strings.ToLower(req.Text + " " + req.TechnicalDomain)
+
+	for _, ctrl := range h.controls.Controls {
+		titleLower := strings.ToLower(ctrl.Title + " " + ctrl.Objective)
+		relevance := calculateRelevance(reqLower, titleLower, req.TechnicalDomain, ctrl.Domain)
+
+		if relevance > 0.3 {
+			matches = append(matches, ControlMatch{
+				ControlID:   ctrl.ControlID,
+				Title:       ctrl.Title,
+				Relevance:   relevance,
+				CheckTarget: ctrl.CheckTarget,
+			})
+		}
+	}
+
+	// Sort by relevance (simple bubble sort for small lists)
+	for i := 0; i < len(matches); i++ {
+		for j := i + 1; j < len(matches); j++ {
+			if matches[j].Relevance > matches[i].Relevance {
+				matches[i], matches[j] = matches[j], matches[i]
+			}
+		}
+	}
+
+	// Return top 5
+	if len(matches) > 5 {
+		matches = matches[:5]
+	}
+
+	return matches
+}
+
+func calculateRelevance(reqText, ctrlText, reqDomain, ctrlDomain string) float64 {
+	score := 0.0
+
+	// Domain match bonus
+	domainMap := map[string]string{
+		"payment_flow":   "PAY",
+		"logging":        "LOG",
+		"crypto":         "CRYPTO",
+		"api_security":   "API",
+		"terminal_comm":  "TERM",
+		"firmware":       "FW",
+		"reporting":      "REP",
+		"access_control": "ACC",
+		"error_handling":  "ERR",
+		"build_deploy":   "BLD",
+	}
+
+	if mapped, ok := domainMap[reqDomain]; ok && mapped == ctrlDomain {
+		score += 0.4
+	}
+
+	// Keyword overlap
+	reqWords := strings.Fields(reqText)
+	for _, word := range reqWords {
+		if len(word) > 3 && strings.Contains(ctrlText, word) {
+			score += 0.1
+		}
+	}
+
+	if score > 1.0 {
+		score = 1.0
+	}
+	return score
+}
+
+func inferDomain(text string) string {
+	textLower := strings.ToLower(text)
+	domainKeywords := map[string][]string{
+		"payment_flow":   {"zahlung", "transaktion", "buchung", "payment", "betrag"},
+		"logging":        {"log", "protokoll", "audit", "nachvollzieh"},
+		"crypto":         {"verschlüssel", "schlüssel", "krypto", "tls", "ssl", "hsm", "pin"},
+		"api_security":   {"api", "schnittstelle", "authentifiz", "autorisier"},
+		"terminal_comm":  {"terminal", "zvt", "opi", "gerät", "kontaktlos", "nfc"},
+		"firmware":       {"firmware", "update", "signatur", "boot"},
+		"reporting":      {"bericht", "report", "abrechnung", "export", "abgleich"},
+		"access_control": {"zugang", "benutzer", "passwort", "rolle", "berechtigung"},
+		"error_handling":  {"fehler", "ausfall", "recovery", "offline", "störung"},
+		"build_deploy":   {"build", "deploy", "release", "ci", "pipeline"},
+	}
+
+	for domain, keywords := range domainKeywords {
+		for _, kw := range keywords {
+			if strings.Contains(textLower, kw) {
+				return domain
+			}
+		}
+	}
+	return "general"
+}
+
+func inferCheckTarget(text string) string {
+	textLower := strings.ToLower(text)
+	if strings.Contains(textLower, "zertifik") || strings.Contains(textLower, "zulassung") {
+		return "certificate"
+	}
+	if strings.Contains(textLower, "prozess") || strings.Contains(textLower, "verfahren") {
+		return "process"
+	}
+	if strings.Contains(textLower, "konfigur") {
+		return "config"
+	}
+	return "code"
+}
+
+func min(a, b int) int {
+	if a < b {
+		return a
+	}
+	return b
+}
diff --git a/ai-compliance-sdk/internal/ucca/betrvg_test.go b/ai-compliance-sdk/internal/ucca/betrvg_test.go
new file mode 100644
index 0000000..ecbe8d3
--- /dev/null
+++ b/ai-compliance-sdk/internal/ucca/betrvg_test.go
@@ -0,0 +1,305 @@
+package ucca
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// ============================================================================
+// BetrVG Conflict Score Tests
+// ============================================================================
+
+func TestCalculateBetrvgConflictScore_NoEmployeeData(t *testing.T) {
+	root := getProjectRoot(t)
+	policyPath := filepath.Join(root, "policies", "ucca_policy_v1.yaml")
+	engine, err := NewPolicyEngineFromPath(policyPath)
+	if err != nil {
+		t.Fatalf("Failed to create policy engine: %v", err)
+	}
+
+	intake := &UseCaseIntake{
+		UseCaseText: "Chatbot fuer Kunden-FAQ",
+		Domain:      DomainUtilities,
+		DataTypes: DataTypes{
+			PersonalData: false,
+			PublicData:   true,
+		},
+	}
+
+	result := engine.Evaluate(intake)
+
+	if result.BetrvgConflictScore != 0 {
+		t.Errorf("Expected BetrvgConflictScore 0 for non-employee case, got %d", result.BetrvgConflictScore)
+	}
+	if result.BetrvgConsultationRequired {
+		t.Error("Expected BetrvgConsultationRequired=false for non-employee case")
+	}
+}
+
+func TestCalculateBetrvgConflictScore_EmployeeMonitoring(t *testing.T) {
+	root := getProjectRoot(t)
+	policyPath := filepath.Join(root, "policies", "ucca_policy_v1.yaml")
+	engine, err := NewPolicyEngineFromPath(policyPath)
+	if err != nil {
+		t.Fatalf("Failed to create policy engine: %v", err)
+	}
+
+	intake := &UseCaseIntake{
+		UseCaseText: "Teams Analytics mit Nutzungsstatistiken pro Mitarbeiter",
+		Domain:      DomainIT,
+		DataTypes: DataTypes{
+			PersonalData: true,
+			EmployeeData: true,
+		},
+		EmployeeMonitoring: true,
+	}
+
+	result := engine.Evaluate(intake)
+
+	// employee_data(+10) + employee_monitoring(+20) + not_consulted(+5) = 35
+	if result.BetrvgConflictScore < 30 {
+		t.Errorf("Expected BetrvgConflictScore >= 30 for employee monitoring, got %d", result.BetrvgConflictScore)
+	}
+	if !result.BetrvgConsultationRequired {
+		t.Error("Expected BetrvgConsultationRequired=true for employee monitoring")
+	}
+}
+
+func TestCalculateBetrvgConflictScore_HRDecisionSupport(t *testing.T) {
+	root := getProjectRoot(t)
+	policyPath := filepath.Join(root, "policies", "ucca_policy_v1.yaml")
+	engine, err := NewPolicyEngineFromPath(policyPath)
+	if err != nil {
+		t.Fatalf("Failed to create policy engine: %v", err)
+	}
+
+	intake := &UseCaseIntake{
+		UseCaseText: "KI-gestuetztes Bewerber-Screening",
+		Domain:      DomainHR,
+		DataTypes: DataTypes{
+			PersonalData: true,
+			EmployeeData: true,
+		},
+		EmployeeMonitoring: true,
+		HRDecisionSupport:  true,
+		Automation:         "fully_automated",
+		Outputs: Outputs{
+			Rankings: true,
+		},
+	}
+
+	result := engine.Evaluate(intake)
+
+	// employee_data(+10) + monitoring(+20) + hr(+20) + rankings(+10) + fully_auto(+10) + not_consulted(+5) = 75
+	if result.BetrvgConflictScore < 70 {
+		t.Errorf("Expected BetrvgConflictScore >= 70 for HR+monitoring+automated, got %d", result.BetrvgConflictScore)
+	}
+	if !result.BetrvgConsultationRequired {
+		t.Error("Expected BetrvgConsultationRequired=true")
+	}
+}
+
+func TestCalculateBetrvgConflictScore_ConsultedReducesScore(t *testing.T) {
+	root := getProjectRoot(t)
+	policyPath := filepath.Join(root, "policies", "ucca_policy_v1.yaml")
+	engine, err := NewPolicyEngineFromPath(policyPath)
+	if err != nil {
+		t.Fatalf("Failed to create policy engine: %v", err)
+	}
+
+	// Same as above but works council consulted
+	intakeNotConsulted := &UseCaseIntake{
+		UseCaseText: "Teams mit Nutzungsstatistiken",
+		Domain:      DomainIT,
+		DataTypes: DataTypes{
+			PersonalData: true,
+			EmployeeData: true,
+		},
+		EmployeeMonitoring:    true,
+		WorksCouncilConsulted: false,
+	}
+
+	intakeConsulted := &UseCaseIntake{
+		UseCaseText: "Teams mit Nutzungsstatistiken",
+		Domain:      DomainIT,
+		DataTypes: DataTypes{
+			PersonalData: true,
+			EmployeeData: true,
+		},
+		EmployeeMonitoring:    true,
+		WorksCouncilConsulted: true,
+	}
+
+	resultNot := engine.Evaluate(intakeNotConsulted)
+	resultYes := engine.Evaluate(intakeConsulted)
+
+	if resultYes.BetrvgConflictScore >= resultNot.BetrvgConflictScore {
+		t.Errorf("Expected consulted score (%d) < not-consulted score (%d)",
+			resultYes.BetrvgConflictScore, resultNot.BetrvgConflictScore)
+	}
+}
+
+// ============================================================================
+// BetrVG Escalation Tests
+// ============================================================================
+
+func TestEscalation_BetrvgHighConflict_E3(t *testing.T) {
+	trigger := DefaultEscalationTrigger()
+
+	result := &AssessmentResult{
+		Feasibility:              FeasibilityCONDITIONAL,
+		RiskLevel:                RiskLevelMEDIUM,
+		RiskScore:                45,
+		BetrvgConflictScore:      80,
+		BetrvgConsultationRequired: true,
+		Intake: UseCaseIntake{
+			WorksCouncilConsulted: false,
+		},
+		TriggeredRules: []TriggeredRule{
+			{Code: "R-WARN-001", Severity: "WARN"},
+		},
+	}
+
+	level, reason := trigger.DetermineEscalationLevel(result)
+
+	if level != EscalationLevelE3 {
+		t.Errorf("Expected E3 for high BR conflict without consultation, got %s (reason: %s)", level, reason)
+	}
+}
+
+func TestEscalation_BetrvgMediumConflict_E2(t *testing.T) {
+	trigger := DefaultEscalationTrigger()
+
+	result := &AssessmentResult{
+		Feasibility:              FeasibilityCONDITIONAL,
+		RiskLevel:                RiskLevelLOW,
+		RiskScore:                25,
+		BetrvgConflictScore:      55,
+		BetrvgConsultationRequired: true,
+		Intake: UseCaseIntake{
+			WorksCouncilConsulted: false,
+		},
+		TriggeredRules: []TriggeredRule{
+			{Code: "R-WARN-001", Severity: "WARN"},
+		},
+	}
+
+	level, reason := trigger.DetermineEscalationLevel(result)
+
+	if level != EscalationLevelE2 {
+		t.Errorf("Expected E2 for medium BR conflict without consultation, got %s (reason: %s)", level, reason)
+	}
+}
+
+func TestEscalation_BetrvgConsulted_NoEscalation(t *testing.T) {
+	trigger := DefaultEscalationTrigger()
+
+	result := &AssessmentResult{
+		Feasibility:              FeasibilityYES,
+		RiskLevel:                RiskLevelLOW,
+		RiskScore:                15,
+		BetrvgConflictScore:      55,
+		BetrvgConsultationRequired: true,
+		Intake: UseCaseIntake{
+			WorksCouncilConsulted: true,
+		},
+		TriggeredRules: []TriggeredRule{},
+	}
+
+	level, _ := trigger.DetermineEscalationLevel(result)
+
+	// With consultation done and low risk, should not escalate for BR reasons
+	if level == EscalationLevelE3 {
+		t.Error("Should not escalate to E3 when works council is consulted")
+	}
+}
+
+// ============================================================================
+// BetrVG V2 Obligations Loading Test
+// ============================================================================
+
+func TestBetrvgV2_LoadsFromManifest(t *testing.T) {
+	root := getProjectRoot(t)
+	v2Dir := filepath.Join(root, "policies", "obligations", "v2")
+
+	// Check file exists
+	betrvgPath := filepath.Join(v2Dir, "betrvg_v2.json")
+	if _, err := os.Stat(betrvgPath); os.IsNotExist(err) {
+		t.Fatal("betrvg_v2.json not found in policies/obligations/v2/")
+	}
+
+	// Load all v2 regulations
+	regs, err := LoadAllV2Regulations()
+	if err != nil {
+		t.Fatalf("Failed to load v2 regulations: %v", err)
+	}
+
+	betrvg, ok := regs["betrvg"]
+	if !ok {
+		t.Fatal("betrvg not found in loaded regulations")
+	}
+
+	if betrvg.Regulation != "betrvg" {
+		t.Errorf("Expected regulation 'betrvg', got '%s'", betrvg.Regulation)
+	}
+
+	if len(betrvg.Obligations) < 10 {
+		t.Errorf("Expected at least 10 BetrVG obligations, got %d", len(betrvg.Obligations))
+	}
+
+	// Check first obligation has correct structure
+	obl := betrvg.Obligations[0]
+	if obl.ID != "BETRVG-OBL-001" {
+		t.Errorf("Expected first obligation ID 'BETRVG-OBL-001', got '%s'", obl.ID)
+	}
+	if len(obl.LegalBasis) == 0 {
+		t.Error("Expected legal basis for first obligation")
+	}
+	if obl.LegalBasis[0].Norm != "BetrVG" {
+		t.Errorf("Expected norm 'BetrVG', got '%s'", obl.LegalBasis[0].Norm)
+	}
+}
+
+func TestBetrvgApplicability_Germany(t *testing.T) {
+	regs, err := LoadAllV2Regulations()
+	if err != nil {
+		t.Fatalf("Failed to load v2 regulations: %v", err)
+	}
+
+	betrvgReg := regs["betrvg"]
+	module := NewJSONRegulationModule(betrvgReg)
+
+	// German company with 50 employees — should be applicable
+	factsDE := &UnifiedFacts{
+		Organization: OrganizationFacts{
+			Country:       "DE",
+			EmployeeCount: 50,
+		},
+	}
+	if !module.IsApplicable(factsDE) {
+		t.Error("BetrVG should be applicable for German company with 50 employees")
+	}
+
+	// US company — should NOT be applicable
+	factsUS := &UnifiedFacts{
+		Organization: OrganizationFacts{
+			Country:       "US",
+			EmployeeCount: 50,
+		},
+	}
+	if module.IsApplicable(factsUS) {
+		t.Error("BetrVG should NOT be applicable for US company")
+	}
+
+	// German company with 3 employees — should NOT be applicable (threshold 5)
+	factsSmall := &UnifiedFacts{
+		Organization: OrganizationFacts{
+			Country:       "DE",
+			EmployeeCount: 3,
+		},
+	}
+	if module.IsApplicable(factsSmall) {
+		t.Error("BetrVG should NOT be applicable for company with < 5 employees")
+	}
+}
diff --git a/ai-compliance-sdk/internal/ucca/decision_tree_engine.go b/ai-compliance-sdk/internal/ucca/decision_tree_engine.go
new file mode 100644
index 0000000..d8139d1
--- /dev/null
+++ b/ai-compliance-sdk/internal/ucca/decision_tree_engine.go
@@ -0,0 +1,325 @@
+package ucca
+
+// ============================================================================
+// AI Act Decision Tree Engine
+// ============================================================================
+//
+// Two-axis classification:
+//   Axis 1 (Q1–Q7): High-Risk classification based on Annex III
+//   Axis 2 (Q8–Q12): GPAI classification based on Art. 51–56
+//
+// Deterministic evaluation — no LLM involved.
+//
+// ============================================================================
+
+// Question IDs
+const (
+	Q1  = "Q1"  // Uses AI?
+	Q2  = "Q2"  // Biometric identification?
+	Q3  = "Q3"  // Critical infrastructure?
+	Q4  = "Q4"  // Education / employment / HR?
+	Q5  = "Q5"  // Essential services (credit, insurance)?
+	Q6  = "Q6"  // Law enforcement / migration / justice?
+	Q7  = "Q7"  // Autonomous decisions with legal effect?
+	Q8  = "Q8"  // Foundation Model / GPAI?
+	Q9  = "Q9"  // Generates content (text, image, code, audio)?
+	Q10 = "Q10" // Trained with >10^25 FLOP?
+	Q11 = "Q11" // Model provided as API/service for third parties?
+	Q12 = "Q12" // Significant EU market penetration?
+)
+
+// BuildDecisionTreeDefinition returns the full decision tree structure for the frontend
+func BuildDecisionTreeDefinition() *DecisionTreeDefinition {
+	return &DecisionTreeDefinition{
+		ID:      "ai_act_two_axis",
+		Name:    "AI Act Zwei-Achsen-Klassifikation",
+		Version: "1.0.0",
+		Questions: []DecisionTreeQuestion{
+			// === Axis 1: High-Risk (Annex III) ===
+			{
+				ID:          Q1,
+				Axis:        "high_risk",
+				Question:    "Setzt Ihr System KI-Technologie ein?",
+				Description: "KI im Sinne des AI Act umfasst maschinelles Lernen, logik- und wissensbasierte Ansätze sowie statistische Methoden, die für eine gegebene Reihe von Zielen Ergebnisse wie Inhalte, Vorhersagen, Empfehlungen oder Entscheidungen erzeugen.",
+				ArticleRef:  "Art. 3 Nr. 1",
+			},
+			{
+				ID:          Q2,
+				Axis:        "high_risk",
+				Question:    "Wird das System für biometrische Identifikation oder Kategorisierung natürlicher Personen verwendet?",
+				Description: "Dazu zählen Gesichtserkennung, Stimmerkennung, Fingerabdruck-Analyse, Gangerkennung oder andere biometrische Merkmale zur Identifikation oder Kategorisierung.",
+				ArticleRef:  "Anhang III Nr. 1",
+				SkipIf:      Q1,
+			},
+			{
+				ID:          Q3,
+				Axis:        "high_risk",
+				Question:    "Wird das System in kritischer Infrastruktur eingesetzt (Energie, Verkehr, Wasser, digitale Infrastruktur)?",
+				Description: "Betrifft KI-Systeme als Sicherheitskomponenten in der Verwaltung und dem Betrieb kritischer digitaler Infrastruktur, des Straßenverkehrs oder der Wasser-, Gas-, Heizungs- oder Stromversorgung.",
+				ArticleRef:  "Anhang III Nr. 2",
+				SkipIf:      Q1,
+			},
+			{
+				ID:          Q4,
+				Axis:        "high_risk",
+				Question:    "Betrifft das System Bildung, Beschäftigung oder Personalmanagement?",
+				Description: "KI zur Festlegung des Zugangs zu Bildungseinrichtungen, Bewertung von Prüfungsleistungen, Bewerbungsauswahl, Beförderungsentscheidungen oder Überwachung von Arbeitnehmern.",
+				ArticleRef:  "Anhang III Nr. 3–4",
+				SkipIf:      Q1,
+			},
+			{
+				ID:          Q5,
+				Axis:        "high_risk",
+				Question:    "Betrifft das System den Zugang zu wesentlichen Diensten (Kreditvergabe, Versicherung, öffentliche Leistungen)?",
+				Description: "KI zur Bonitätsbewertung, Risikobewertung bei Versicherungen, Bewertung der Anspruchsberechtigung für öffentliche Unterstützungsleistungen oder Notdienste.",
+				ArticleRef:  "Anhang III Nr. 5",
+				SkipIf:      Q1,
+			},
+			{
+				ID:          Q6,
+				Axis:        "high_risk",
+				Question:    "Wird das System in Strafverfolgung, Migration, Asyl oder Justiz eingesetzt?",
+				Description: "KI für Lügendetektoren, Beweisbewertung, Rückfallprognose, Asylentscheidungen, Grenzkontrolle, Risikobewertung bei Migration oder Unterstützung der Rechtspflege.",
+				ArticleRef:  "Anhang III Nr. 6–8",
+				SkipIf:      Q1,
+			},
+			{
+				ID:          Q7,
+				Axis:        "high_risk",
+				Question:    "Trifft das System autonome Entscheidungen mit rechtlicher Wirkung für natürliche Personen?",
+				Description: "Entscheidungen, die Rechtsverhältnisse begründen, ändern oder aufheben, z.B. Kreditablehnungen, Kündigungen, Sozialleistungsentscheidungen — ohne menschliche Überprüfung im Einzelfall.",
+				ArticleRef:  "Art. 22 DSGVO / Art. 14 AI Act",
+				SkipIf:      Q1,
+			},
+
+			// === Axis 2: GPAI (Art. 51–56) ===
+			{
+				ID:          Q8,
+				Axis:        "gpai",
+				Question:    "Stellst du ein KI-Modell fuer Dritte bereit (API / Plattform / SDK), das fuer viele verschiedene Zwecke einsetzbar ist?",
+				Description: "GPAI-Pflichten (Art. 51-56) gelten fuer den Modellanbieter, nicht den API-Nutzer. Wenn du nur eine API nutzt (z.B. OpenAI, Claude), bist du kein GPAI-Anbieter. GPAI-Anbieter ist, wer ein Modell trainiert/fine-tuned und Dritten zur Verfuegung stellt. Beispiele: GPT, Claude, LLaMA, Gemini, Stable Diffusion.",
+				ArticleRef:  "Art. 3 Nr. 63 / Art. 51",
+			},
+			{
+				ID:          Q9,
+				Axis:        "gpai",
+				Question:    "Kann das System Inhalte generieren (Text, Bild, Code, Audio, Video)?",
+				Description: "Generative KI erzeugt neue Inhalte auf Basis von Eingaben — dazu zählen Chatbots, Bild-/Videogeneratoren, Code-Assistenten, Sprachsynthese und ähnliche Systeme.",
+				ArticleRef:  "Art. 50 / Art. 52",
+				SkipIf:      Q8,
+			},
+			{
+				ID:          Q10,
+				Axis:        "gpai",
+				Question:    "Wurde das Modell mit mehr als 10²⁵ FLOP trainiert oder hat es gleichwertige Fähigkeiten?",
+				Description: "GPAI-Modelle mit einem kumulativen Rechenaufwand von mehr als 10²⁵ Gleitkommaoperationen gelten als Modelle mit systemischem Risiko (Art. 51 Abs. 2).",
+				ArticleRef:  "Art. 51 Abs. 2",
+				SkipIf:      Q8,
+			},
+			{
+				ID:          Q11,
+				Axis:        "gpai",
+				Question:    "Wird das Modell als API oder Service für Dritte bereitgestellt?",
+				Description: "Stellen Sie das Modell anderen Unternehmen oder Entwicklern zur Nutzung bereit (API, SaaS, Plattform-Integration)?",
+				ArticleRef:  "Art. 53",
+				SkipIf:      Q8,
+			},
+			{
+				ID:          Q12,
+				Axis:        "gpai",
+				Question:    "Hat das Modell eine signifikante Marktdurchdringung in der EU (>10.000 registrierte Geschäftsnutzer)?",
+				Description: "Modelle mit hoher Marktdurchdringung können auch ohne 10²⁵ FLOP als systemisches Risiko eingestuft werden, wenn die EU-Kommission dies feststellt.",
+				ArticleRef:  "Art. 51 Abs. 3",
+				SkipIf:      Q8,
+			},
+		},
+	}
+}
+
+// EvaluateDecisionTree evaluates the answers and returns the combined result
+func EvaluateDecisionTree(req *DecisionTreeEvalRequest) *DecisionTreeResult {
+	result := &DecisionTreeResult{
+		SystemName:        req.SystemName,
+		SystemDescription: req.SystemDescription,
+		Answers:           req.Answers,
+	}
+
+	// Evaluate Axis 1: High-Risk
+	result.HighRiskResult = evaluateHighRiskAxis(req.Answers)
+
+	// Evaluate Axis 2: GPAI
+	result.GPAIResult = evaluateGPAIAxis(req.Answers)
+
+	// Combine obligations and articles
+	result.CombinedObligations = combineObligations(result.HighRiskResult, result.GPAIResult)
+	result.ApplicableArticles = combineArticles(result.HighRiskResult, result.GPAIResult)
+
+	return result
+}
+
+// evaluateHighRiskAxis determines the AI Act risk level from Q1–Q7
+func evaluateHighRiskAxis(answers map[string]DecisionTreeAnswer) AIActRiskLevel {
+	// Q1: Uses AI at all?
+	if !answerIsYes(answers, Q1) {
+		return AIActNotApplicable
+	}
+
+	// Q2–Q6: Annex III high-risk categories
+	if answerIsYes(answers, Q2) || answerIsYes(answers, Q3) ||
+		answerIsYes(answers, Q4) || answerIsYes(answers, Q5) ||
+		answerIsYes(answers, Q6) {
+		return AIActHighRisk
+	}
+
+	// Q7: Autonomous decisions with legal effect
+	if answerIsYes(answers, Q7) {
+		return AIActHighRisk
+	}
+
+	// AI is used but no high-risk category triggered
+	return AIActMinimalRisk
+}
+
+// evaluateGPAIAxis determines the GPAI classification from Q8–Q12
+func evaluateGPAIAxis(answers map[string]DecisionTreeAnswer) GPAIClassification {
+	gpai := GPAIClassification{
+		Category:           GPAICategoryNone,
+		ApplicableArticles: []string{},
+		Obligations:        []string{},
+	}
+
+	// Q8: Is GPAI?
+	if !answerIsYes(answers, Q8) {
+		return gpai
+	}
+
+	gpai.IsGPAI = true
+	gpai.Category = GPAICategoryStandard
+	gpai.ApplicableArticles = append(gpai.ApplicableArticles, "Art. 51", "Art. 53")
+	gpai.Obligations = append(gpai.Obligations,
+		"Technische Dokumentation erstellen (Art. 53 Abs. 1a)",
+		"Informationen für nachgelagerte Anbieter bereitstellen (Art. 53 Abs. 1b)",
+		"Urheberrechtsrichtlinie einhalten (Art. 53 Abs. 1c)",
+		"Trainingsdaten-Zusammenfassung veröffentlichen (Art. 53 Abs. 1d)",
+	)
+
+	// Q9: Generative AI — adds transparency obligations
+	if answerIsYes(answers, Q9) {
+		gpai.ApplicableArticles = append(gpai.ApplicableArticles, "Art. 50")
+		gpai.Obligations = append(gpai.Obligations,
+			"KI-generierte Inhalte kennzeichnen (Art. 50 Abs. 2)",
+			"Maschinenlesbare Kennzeichnung synthetischer Inhalte (Art. 50 Abs. 2)",
+		)
+	}
+
+	// Q10: Systemic risk threshold (>10^25 FLOP)
+	if answerIsYes(answers, Q10) {
+		gpai.IsSystemicRisk = true
+		gpai.Category = GPAICategorySystemic
+		gpai.ApplicableArticles = append(gpai.ApplicableArticles, "Art. 55")
+		gpai.Obligations = append(gpai.Obligations,
+			"Modellbewertung nach Stand der Technik durchführen (Art. 55 Abs. 1a)",
+			"Systemische Risiken bewerten und mindern (Art. 55 Abs. 1b)",
+			"Schwerwiegende Vorfälle melden (Art. 55 Abs. 1c)",
+			"Angemessenes Cybersicherheitsniveau gewährleisten (Art. 55 Abs. 1d)",
+		)
+	}
+
+	// Q11: API/Service provider — additional downstream obligations
+	if answerIsYes(answers, Q11) {
+		gpai.Obligations = append(gpai.Obligations,
+			"Downstream-Informationspflichten erfüllen (Art. 53 Abs. 1b)",
+		)
+	}
+
+	// Q12: Significant market penetration — potential systemic risk
+	if answerIsYes(answers, Q12) && !gpai.IsSystemicRisk {
+		// EU Commission can designate as systemic risk
+		gpai.ApplicableArticles = append(gpai.ApplicableArticles, "Art. 51 Abs. 3")
+		gpai.Obligations = append(gpai.Obligations,
+			"Achtung: EU-Kommission kann GPAI mit hoher Marktdurchdringung als systemisches Risiko einstufen (Art. 51 Abs. 3)",
+		)
+	}
+
+	return gpai
+}
+
+// combineObligations merges obligations from both axes
+func combineObligations(highRisk AIActRiskLevel, gpai GPAIClassification) []string {
+	var obligations []string
+
+	// High-Risk obligations
+	switch highRisk {
+	case AIActHighRisk:
+		obligations = append(obligations,
+			"Risikomanagementsystem einrichten (Art. 9)",
+			"Daten-Governance sicherstellen (Art. 10)",
+			"Technische Dokumentation erstellen (Art. 11)",
+			"Protokollierungsfunktion implementieren (Art. 12)",
+			"Transparenz und Nutzerinformation (Art. 13)",
+			"Menschliche Aufsicht ermöglichen (Art. 14)",
+			"Genauigkeit, Robustheit und Cybersicherheit (Art. 15)",
+			"EU-Datenbank-Registrierung (Art. 49)",
+		)
+	case AIActMinimalRisk:
+		obligations = append(obligations,
+			"Freiwillige Verhaltenskodizes empfohlen (Art. 95)",
+		)
+	case AIActNotApplicable:
+		// No obligations
+	}
+
+	// GPAI obligations
+	obligations = append(obligations, gpai.Obligations...)
+
+	// Universal obligation for all AI users
+	if highRisk != AIActNotApplicable {
+		obligations = append(obligations,
+			"KI-Kompetenz sicherstellen (Art. 4)",
+			"Verbotene Praktiken vermeiden (Art. 5)",
+		)
+	}
+
+	return obligations
+}
+
+// combineArticles merges applicable articles from both axes
+func combineArticles(highRisk AIActRiskLevel, gpai GPAIClassification) []string {
+	articles := map[string]bool{}
+
+	// Universal
+	if highRisk != AIActNotApplicable {
+		articles["Art. 4"] = true
+		articles["Art. 5"] = true
+	}
+
+	// High-Risk
+	switch highRisk {
+	case AIActHighRisk:
+		for _, a := range []string{"Art. 9", "Art. 10", "Art. 11", "Art. 12", "Art. 13", "Art. 14", "Art. 15", "Art. 26", "Art. 49"} {
+			articles[a] = true
+		}
+	case AIActMinimalRisk:
+		articles["Art. 95"] = true
+	}
+
+	// GPAI
+	for _, a := range gpai.ApplicableArticles {
+		articles[a] = true
+	}
+
+	var result []string
+	for a := range articles {
+		result = append(result, a)
+	}
+	return result
+}
+
+// answerIsYes checks if a question was answered with "yes" (true)
+func answerIsYes(answers map[string]DecisionTreeAnswer, questionID string) bool {
+	a, ok := answers[questionID]
+	if !ok {
+		return false
+	}
+	return a.Value
+}
diff --git a/ai-compliance-sdk/internal/ucca/decision_tree_engine_test.go b/ai-compliance-sdk/internal/ucca/decision_tree_engine_test.go
new file mode 100644
index 0000000..44c3dd7
--- /dev/null
+++ b/ai-compliance-sdk/internal/ucca/decision_tree_engine_test.go
@@ -0,0 +1,420 @@
+package ucca
+
+import (
+	"testing"
+)
+
+func TestBuildDecisionTreeDefinition_ReturnsValidTree(t *testing.T) {
+	tree := BuildDecisionTreeDefinition()
+
+	if tree == nil {
+		t.Fatal("Expected non-nil tree definition")
+	}
+	if tree.ID != "ai_act_two_axis" {
+		t.Errorf("Expected ID 'ai_act_two_axis', got '%s'", tree.ID)
+	}
+	if tree.Version != "1.0.0" {
+		t.Errorf("Expected version '1.0.0', got '%s'", tree.Version)
+	}
+	if len(tree.Questions) != 12 {
+		t.Errorf("Expected 12 questions, got %d", len(tree.Questions))
+	}
+
+	// Check axis distribution
+	hrCount := 0
+	gpaiCount := 0
+	for _, q := range tree.Questions {
+		switch q.Axis {
+		case "high_risk":
+			hrCount++
+		case "gpai":
+			gpaiCount++
+		default:
+			t.Errorf("Unexpected axis '%s' for question %s", q.Axis, q.ID)
+		}
+	}
+	if hrCount != 7 {
+		t.Errorf("Expected 7 high_risk questions, got %d", hrCount)
+	}
+	if gpaiCount != 5 {
+		t.Errorf("Expected 5 gpai questions, got %d", gpaiCount)
+	}
+
+	// Check all questions have required fields
+	for _, q := range tree.Questions {
+		if q.ID == "" {
+			t.Error("Question has empty ID")
+		}
+		if q.Question == "" {
+			t.Errorf("Question %s has empty question text", q.ID)
+		}
+		if q.Description == "" {
+			t.Errorf("Question %s has empty description", q.ID)
+		}
+		if q.ArticleRef == "" {
+			t.Errorf("Question %s has empty article_ref", q.ID)
+		}
+	}
+}
+
+func TestEvaluateDecisionTree_NotApplicable(t *testing.T) {
+	// Q1=No → AI Act not applicable
+	req := &DecisionTreeEvalRequest{
+		SystemName: "Test System",
+		Answers: map[string]DecisionTreeAnswer{
+			Q1: {QuestionID: Q1, Value: false},
+		},
+	}
+
+	result := EvaluateDecisionTree(req)
+
+	if result.HighRiskResult != AIActNotApplicable {
+		t.Errorf("Expected not_applicable, got %s", result.HighRiskResult)
+	}
+	if result.GPAIResult.IsGPAI {
+		t.Error("Expected GPAI to be false when Q8 is not answered")
+	}
+	if result.SystemName != "Test System" {
+		t.Errorf("Expected system name 'Test System', got '%s'", result.SystemName)
+	}
+}
+
+func TestEvaluateDecisionTree_MinimalRisk(t *testing.T) {
+	// Q1=Yes, Q2-Q7=No → minimal risk
+	req := &DecisionTreeEvalRequest{
+		SystemName: "Simple Tool",
+		Answers: map[string]DecisionTreeAnswer{
+			Q1: {QuestionID: Q1, Value: true},
+			Q2: {QuestionID: Q2, Value: false},
+			Q3: {QuestionID: Q3, Value: false},
+			Q4: {QuestionID: Q4, Value: false},
+			Q5: {QuestionID: Q5, Value: false},
+			Q6: {QuestionID: Q6, Value: false},
+			Q7: {QuestionID: Q7, Value: false},
+			Q8: {QuestionID: Q8, Value: false},
+		},
+	}
+
+	result := EvaluateDecisionTree(req)
+
+	if result.HighRiskResult != AIActMinimalRisk {
+		t.Errorf("Expected minimal_risk, got %s", result.HighRiskResult)
+	}
+	if result.GPAIResult.IsGPAI {
+		t.Error("Expected GPAI to be false")
+	}
+	if result.GPAIResult.Category != GPAICategoryNone {
+		t.Errorf("Expected GPAI category 'none', got '%s'", result.GPAIResult.Category)
+	}
+}
+
+func TestEvaluateDecisionTree_HighRisk_Biometric(t *testing.T) {
+	// Q1=Yes, Q2=Yes → high risk (biometric)
+	req := &DecisionTreeEvalRequest{
+		SystemName: "Face Recognition",
+		Answers: map[string]DecisionTreeAnswer{
+			Q1: {QuestionID: Q1, Value: true},
+			Q2: {QuestionID: Q2, Value: true},
+			Q3: {QuestionID: Q3, Value: false},
+			Q4: {QuestionID: Q4, Value: false},
+			Q5: {QuestionID: Q5, Value: false},
+			Q6: {QuestionID: Q6, Value: false},
+			Q7: {QuestionID: Q7, Value: false},
+		},
+	}
+
+	result := EvaluateDecisionTree(req)
+
+	if result.HighRiskResult != AIActHighRisk {
+		t.Errorf("Expected high_risk, got %s", result.HighRiskResult)
+	}
+
+	// Should have high-risk obligations
+	if len(result.CombinedObligations) == 0 {
+		t.Error("Expected non-empty obligations for high-risk system")
+	}
+}
+
+func TestEvaluateDecisionTree_HighRisk_CriticalInfrastructure(t *testing.T) {
+	// Q1=Yes, Q3=Yes → high risk (critical infrastructure)
+	req := &DecisionTreeEvalRequest{
+		SystemName: "Energy Grid AI",
+		Answers: map[string]DecisionTreeAnswer{
+			Q1: {QuestionID: Q1, Value: true},
+			Q2: {QuestionID: Q2, Value: false},
+			Q3: {QuestionID: Q3, Value: true},
+			Q4: {QuestionID: Q4, Value: false},
+			Q5: {QuestionID: Q5, Value: false},
+			Q6: {QuestionID: Q6, Value: false},
+			Q7: {QuestionID: Q7, Value: false},
+		},
+	}
+
+	result := EvaluateDecisionTree(req)
+
+	if result.HighRiskResult != AIActHighRisk {
+		t.Errorf("Expected high_risk, got %s", result.HighRiskResult)
+	}
+}
+
+func TestEvaluateDecisionTree_HighRisk_Education(t *testing.T) {
+	// Q1=Yes, Q4=Yes → high risk (education/employment)
+	req := &DecisionTreeEvalRequest{
+		SystemName: "Exam Grading AI",
+		Answers: map[string]DecisionTreeAnswer{
+			Q1: {QuestionID: Q1, Value: true},
+			Q2: {QuestionID: Q2, Value: false},
+			Q3: {QuestionID: Q3, Value: false},
+			Q4: {QuestionID: Q4, Value: true},
+		},
+	}
+
+	result := EvaluateDecisionTree(req)
+
+	if result.HighRiskResult != AIActHighRisk {
+		t.Errorf("Expected high_risk, got %s", result.HighRiskResult)
+	}
+}
+
+func TestEvaluateDecisionTree_HighRisk_AutonomousDecisions(t *testing.T) {
+	// Q1=Yes, Q7=Yes → high risk (autonomous decisions)
+	req := &DecisionTreeEvalRequest{
+		SystemName: "Credit Scoring AI",
+		Answers: map[string]DecisionTreeAnswer{
+			Q1: {QuestionID: Q1, Value: true},
+			Q2: {QuestionID: Q2, Value: false},
+			Q3: {QuestionID: Q3, Value: false},
+			Q4: {QuestionID: Q4, Value: false},
+			Q5: {QuestionID: Q5, Value: false},
+			Q6: {QuestionID: Q6, Value: false},
+			Q7: {QuestionID: Q7, Value: true},
+		},
+	}
+
+	result := EvaluateDecisionTree(req)
+
+	if result.HighRiskResult != AIActHighRisk {
+		t.Errorf("Expected high_risk, got %s", result.HighRiskResult)
+	}
+}
+
+func TestEvaluateDecisionTree_GPAI_Standard(t *testing.T) {
+	// Q8=Yes, Q10=No → GPAI standard
+	req := &DecisionTreeEvalRequest{
+		SystemName: "Custom LLM",
+		Answers: map[string]DecisionTreeAnswer{
+			Q1:  {QuestionID: Q1, Value: true},
+			Q8:  {QuestionID: Q8, Value: true},
+			Q9:  {QuestionID: Q9, Value: true},
+			Q10: {QuestionID: Q10, Value: false},
+			Q11: {QuestionID: Q11, Value: false},
+			Q12: {QuestionID: Q12, Value: false},
+		},
+	}
+
+	result := EvaluateDecisionTree(req)
+
+	if !result.GPAIResult.IsGPAI {
+		t.Error("Expected IsGPAI to be true")
+	}
+	if result.GPAIResult.Category != GPAICategoryStandard {
+		t.Errorf("Expected category 'standard', got '%s'", result.GPAIResult.Category)
+	}
+	if result.GPAIResult.IsSystemicRisk {
+		t.Error("Expected IsSystemicRisk to be false")
+	}
+
+	// Should have Art. 51, 53, 50 (generative)
+	hasArt51 := false
+	hasArt53 := false
+	hasArt50 := false
+	for _, a := range result.GPAIResult.ApplicableArticles {
+		if a == "Art. 51" {
+			hasArt51 = true
+		}
+		if a == "Art. 53" {
+			hasArt53 = true
+		}
+		if a == "Art. 50" {
+			hasArt50 = true
+		}
+	}
+	if !hasArt51 {
+		t.Error("Expected Art. 51 in applicable articles")
+	}
+	if !hasArt53 {
+		t.Error("Expected Art. 53 in applicable articles")
+	}
+	if !hasArt50 {
+		t.Error("Expected Art. 50 in applicable articles (generative AI)")
+	}
+}
+
+func TestEvaluateDecisionTree_GPAI_SystemicRisk(t *testing.T) {
+	// Q8=Yes, Q10=Yes → GPAI systemic risk
+	req := &DecisionTreeEvalRequest{
+		SystemName: "GPT-5",
+		Answers: map[string]DecisionTreeAnswer{
+			Q1:  {QuestionID: Q1, Value: true},
+			Q8:  {QuestionID: Q8, Value: true},
+			Q9:  {QuestionID: Q9, Value: true},
+			Q10: {QuestionID: Q10, Value: true},
+			Q11: {QuestionID: Q11, Value: true},
+			Q12: {QuestionID: Q12, Value: true},
+		},
+	}
+
+	result := EvaluateDecisionTree(req)
+
+	if !result.GPAIResult.IsGPAI {
+		t.Error("Expected IsGPAI to be true")
+	}
+	if result.GPAIResult.Category != GPAICategorySystemic {
+		t.Errorf("Expected category 'systemic', got '%s'", result.GPAIResult.Category)
+	}
+	if !result.GPAIResult.IsSystemicRisk {
+		t.Error("Expected IsSystemicRisk to be true")
+	}
+
+	// Should have Art. 55
+	hasArt55 := false
+	for _, a := range result.GPAIResult.ApplicableArticles {
+		if a == "Art. 55" {
+			hasArt55 = true
+		}
+	}
+	if !hasArt55 {
+		t.Error("Expected Art. 55 in applicable articles (systemic risk)")
+	}
+}
+
+func TestEvaluateDecisionTree_Combined_HighRiskAndGPAI(t *testing.T) {
+	// Q1=Yes, Q4=Yes (high risk) + Q8=Yes, Q9=Yes (GPAI standard)
+	req := &DecisionTreeEvalRequest{
+		SystemName:        "HR Screening with LLM",
+		SystemDescription: "LLM-based applicant screening system",
+		Answers: map[string]DecisionTreeAnswer{
+			Q1:  {QuestionID: Q1, Value: true},
+			Q2:  {QuestionID: Q2, Value: false},
+			Q3:  {QuestionID: Q3, Value: false},
+			Q4:  {QuestionID: Q4, Value: true},
+			Q5:  {QuestionID: Q5, Value: false},
+			Q6:  {QuestionID: Q6, Value: false},
+			Q7:  {QuestionID: Q7, Value: true},
+			Q8:  {QuestionID: Q8, Value: true},
+			Q9:  {QuestionID: Q9, Value: true},
+			Q10: {QuestionID: Q10, Value: false},
+			Q11: {QuestionID: Q11, Value: false},
+			Q12: {QuestionID: Q12, Value: false},
+		},
+	}
+
+	result := EvaluateDecisionTree(req)
+
+	// Both axes should be triggered
+	if result.HighRiskResult != AIActHighRisk {
+		t.Errorf("Expected high_risk, got %s", result.HighRiskResult)
+	}
+	if !result.GPAIResult.IsGPAI {
+		t.Error("Expected GPAI to be true")
+	}
+	if result.GPAIResult.Category != GPAICategoryStandard {
+		t.Errorf("Expected GPAI category 'standard', got '%s'", result.GPAIResult.Category)
+	}
+
+	// Combined obligations should include both axes
+	if len(result.CombinedObligations) < 5 {
+		t.Errorf("Expected at least 5 combined obligations, got %d", len(result.CombinedObligations))
+	}
+
+	// Should have articles from both axes
+	if len(result.ApplicableArticles) < 3 {
+		t.Errorf("Expected at least 3 applicable articles, got %d", len(result.ApplicableArticles))
+	}
+
+	// Check system name preserved
+	if result.SystemName != "HR Screening with LLM" {
+		t.Errorf("Expected system name preserved, got '%s'", result.SystemName)
+	}
+	if result.SystemDescription != "LLM-based applicant screening system" {
+		t.Errorf("Expected description preserved, got '%s'", result.SystemDescription)
+	}
+}
+
+func TestEvaluateDecisionTree_GPAI_MarketPenetration(t *testing.T) {
+	// Q8=Yes, Q10=No, Q12=Yes → GPAI standard with market penetration warning
+	req := &DecisionTreeEvalRequest{
+		SystemName: "Popular Chatbot",
+		Answers: map[string]DecisionTreeAnswer{
+			Q1:  {QuestionID: Q1, Value: true},
+			Q8:  {QuestionID: Q8, Value: true},
+			Q9:  {QuestionID: Q9, Value: true},
+			Q10: {QuestionID: Q10, Value: false},
+			Q11: {QuestionID: Q11, Value: true},
+			Q12: {QuestionID: Q12, Value: true},
+		},
+	}
+
+	result := EvaluateDecisionTree(req)
+
+	if result.GPAIResult.Category != GPAICategoryStandard {
+		t.Errorf("Expected category 'standard' (not systemic because Q10=No), got '%s'", result.GPAIResult.Category)
+	}
+
+	// Should have Art. 51 Abs. 3 warning
+	hasArt51_3 := false
+	for _, a := range result.GPAIResult.ApplicableArticles {
+		if a == "Art. 51 Abs. 3" {
+			hasArt51_3 = true
+		}
+	}
+	if !hasArt51_3 {
+		t.Error("Expected Art. 51 Abs. 3 in applicable articles for high market penetration")
+	}
+}
+
+func TestEvaluateDecisionTree_NoGPAI(t *testing.T) {
+	// Q8=No → No GPAI classification
+	req := &DecisionTreeEvalRequest{
+		SystemName: "Traditional ML",
+		Answers: map[string]DecisionTreeAnswer{
+			Q1: {QuestionID: Q1, Value: true},
+			Q8: {QuestionID: Q8, Value: false},
+		},
+	}
+
+	result := EvaluateDecisionTree(req)
+
+	if result.GPAIResult.IsGPAI {
+		t.Error("Expected IsGPAI to be false")
+	}
+	if result.GPAIResult.Category != GPAICategoryNone {
+		t.Errorf("Expected category 'none', got '%s'", result.GPAIResult.Category)
+	}
+	if len(result.GPAIResult.Obligations) != 0 {
+		t.Errorf("Expected 0 GPAI obligations, got %d", len(result.GPAIResult.Obligations))
+	}
+}
+
+func TestAnswerIsYes(t *testing.T) {
+	tests := []struct {
+		name     string
+		answers  map[string]DecisionTreeAnswer
+		qID      string
+		expected bool
+	}{
+		{"yes answer", map[string]DecisionTreeAnswer{"Q1": {Value: true}}, "Q1", true},
+		{"no answer", map[string]DecisionTreeAnswer{"Q1": {Value: false}}, "Q1", false},
+		{"missing answer", map[string]DecisionTreeAnswer{}, "Q1", false},
+		{"different question", map[string]DecisionTreeAnswer{"Q2": {Value: true}}, "Q1", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := answerIsYes(tt.answers, tt.qID)
+			if result != tt.expected {
+				t.Errorf("Expected %v, got %v", tt.expected, result)
+			}
+		})
+	}
+}
diff --git a/ai-compliance-sdk/internal/ucca/domain_context_test.go b/ai-compliance-sdk/internal/ucca/domain_context_test.go
new file mode 100644
index 0000000..60d2ba5
--- /dev/null
+++ b/ai-compliance-sdk/internal/ucca/domain_context_test.go
@@ -0,0 +1,542 @@
+package ucca
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// ============================================================================
+// HR Domain Context Tests
+// ============================================================================
+
+func TestHRContext_AutomatedRejection_BLOCK(t *testing.T) {
+	root := getProjectRoot(t)
+	policyPath := filepath.Join(root, "policies", "ucca_policy_v1.yaml")
+	engine, err := NewPolicyEngineFromPath(policyPath)
+	if err != nil {
+		t.Fatalf("Failed to create policy engine: %v", err)
+	}
+
+	intake := &UseCaseIntake{
+		UseCaseText: "KI generiert und versendet Absagen automatisch",
+		Domain:      DomainHR,
+		DataTypes:   DataTypes{PersonalData: true, EmployeeData: true},
+		HRContext: &HRContext{
+			AutomatedScreening: true,
+			AutomatedRejection: true,
+		},
+	}
+
+	result := engine.Evaluate(intake)
+
+	if result.Feasibility != FeasibilityNO {
+		t.Errorf("Expected NO feasibility for automated rejection, got %s", result.Feasibility)
+	}
+	if !result.Art22Risk {
+		t.Error("Expected Art22Risk=true for automated rejection")
+	}
+}
+
+func TestHRContext_ScreeningWithHumanReview_OK(t *testing.T) {
+	root := getProjectRoot(t)
+	policyPath := filepath.Join(root, "policies", "ucca_policy_v1.yaml")
+	engine, err := NewPolicyEngineFromPath(policyPath)
+	if err != nil {
+		t.Fatalf("Failed to create policy engine: %v", err)
+	}
+
+	intake := &UseCaseIntake{
+		UseCaseText: "KI sortiert Bewerber vor, Mensch prueft jeden Vorschlag",
+		Domain:      DomainHR,
+		DataTypes:   DataTypes{PersonalData: true, EmployeeData: true},
+		HRContext: &HRContext{
+			AutomatedScreening:  true,
+			AutomatedRejection:  false,
+			HumanReviewEnforced: true,
+			BiasAuditsDone:      true,
+		},
+	}
+
+	result := engine.Evaluate(intake)
+
+	// Should NOT block — human review is enforced
+	if result.Feasibility == FeasibilityNO {
+		t.Error("Expected feasibility != NO when human review is enforced")
+	}
+}
+
+func TestHRContext_AGGVisible_RiskIncrease(t *testing.T) {
+	root := getProjectRoot(t)
+	policyPath := filepath.Join(root, "policies", "ucca_policy_v1.yaml")
+	engine, err := NewPolicyEngineFromPath(policyPath)
+	if err != nil {
+		t.Fatalf("Failed to create policy engine: %v", err)
+	}
+
+	intakeWithAGG := &UseCaseIntake{
+		UseCaseText: "CV-Screening mit Foto und Name sichtbar",
+		Domain:      DomainHR,
+		DataTypes:   DataTypes{PersonalData: true, EmployeeData: true},
+		HRContext:   &HRContext{AGGCategoriesVisible: true},
+	}
+	intakeWithout := &UseCaseIntake{
+		UseCaseText: "CV-Screening anonymisiert",
+		Domain:      DomainHR,
+		DataTypes:   DataTypes{PersonalData: true, EmployeeData: true},
+		HRContext:   &HRContext{AGGCategoriesVisible: false},
+	}
+
+	resultWith := engine.Evaluate(intakeWithAGG)
+	resultWithout := engine.Evaluate(intakeWithout)
+
+	if resultWith.RiskScore <= resultWithout.RiskScore {
+		t.Errorf("Expected higher risk with AGG visible (%d) vs without (%d)",
+			resultWith.RiskScore, resultWithout.RiskScore)
+	}
+}
+
+// ============================================================================
+// Education Domain Context Tests
+// ============================================================================
+
+func TestEducationContext_MinorsWithoutTeacher_BLOCK(t *testing.T) {
+	root := getProjectRoot(t)
+	policyPath := filepath.Join(root, "policies", "ucca_policy_v1.yaml")
+	engine, err := NewPolicyEngineFromPath(policyPath)
+	if err != nil {
+		t.Fatalf("Failed to create policy engine: %v", err)
+	}
+
+	intake := &UseCaseIntake{
+		UseCaseText: "KI bewertet Schuelerarbeiten ohne Lehrkraft-Pruefung",
+		Domain:      DomainEducation,
+		DataTypes:   DataTypes{PersonalData: true, MinorData: true},
+		EducationContext: &EducationContext{
+			GradeInfluence:        true,
+			MinorsInvolved:        true,
+			TeacherReviewRequired: false,
+		},
+	}
+
+	result := engine.Evaluate(intake)
+
+	if result.Feasibility != FeasibilityNO {
+		t.Errorf("Expected NO feasibility for minors without teacher review, got %s", result.Feasibility)
+	}
+}
+
+func TestEducationContext_WithTeacherReview_Allowed(t *testing.T) {
+	root := getProjectRoot(t)
+	policyPath := filepath.Join(root, "policies", "ucca_policy_v1.yaml")
+	engine, err := NewPolicyEngineFromPath(policyPath)
+	if err != nil {
+		t.Fatalf("Failed to create policy engine: %v", err)
+	}
+
+	intake := &UseCaseIntake{
+		UseCaseText: "KI schlaegt Noten vor, Lehrkraft prueft und entscheidet",
+		Domain:      DomainEducation,
+		DataTypes:   DataTypes{PersonalData: true, MinorData: true},
+		EducationContext: &EducationContext{
+			GradeInfluence:        true,
+			MinorsInvolved:        true,
+			TeacherReviewRequired: true,
+		},
+	}
+
+	result := engine.Evaluate(intake)
+
+	if result.Feasibility == FeasibilityNO {
+		t.Error("Expected feasibility != NO when teacher review is required")
+	}
+}
+
+// ============================================================================
+// Healthcare Domain Context Tests
+// ============================================================================
+
+func TestHealthcareContext_MDRWithoutValidation_BLOCK(t *testing.T) {
+	root := getProjectRoot(t)
+	policyPath := filepath.Join(root, "policies", "ucca_policy_v1.yaml")
+	engine, err := NewPolicyEngineFromPath(policyPath)
+	if err != nil {
+		t.Fatalf("Failed to create policy engine: %v", err)
+	}
+
+	intake := &UseCaseIntake{
+		UseCaseText: "KI-Diagnosetool als Medizinprodukt ohne klinische Validierung",
+		Domain:      DomainHealthcare,
+		DataTypes:   DataTypes{PersonalData: true, Article9Data: true},
+		HealthcareContext: &HealthcareContext{
+			DiagnosisSupport: true,
+			MedicalDevice:    true,
+			ClinicalValidation: false,
+		},
+	}
+
+	result := engine.Evaluate(intake)
+
+	if result.Feasibility != FeasibilityNO {
+		t.Errorf("Expected NO for medical device without clinical validation, got %s", result.Feasibility)
+	}
+}
+
+func TestHealthcareContext_Triage_HighRisk(t *testing.T) {
+	root := getProjectRoot(t)
+	policyPath := filepath.Join(root, "policies", "ucca_policy_v1.yaml")
+	engine, err := NewPolicyEngineFromPath(policyPath)
+	if err != nil {
+		t.Fatalf("Failed to create policy engine: %v", err)
+	}
+
+	intake := &UseCaseIntake{
+		UseCaseText: "KI priorisiert Patienten in der Notaufnahme",
+		Domain:      DomainHealthcare,
+		DataTypes:   DataTypes{PersonalData: true, Article9Data: true},
+		HealthcareContext: &HealthcareContext{
+			TriageDecision:       true,
+			PatientDataProcessed: true,
+		},
+	}
+
+	result := engine.Evaluate(intake)
+
+	if result.RiskScore < 40 {
+		t.Errorf("Expected high risk score for triage, got %d", result.RiskScore)
+	}
+	if !result.DSFARecommended {
+		t.Error("Expected DSFA recommended for triage")
+	}
+}
+
+// ============================================================================
+// Critical Infrastructure Tests
+// ============================================================================
+
+func TestCriticalInfra_SafetyCriticalNoRedundancy_BLOCK(t *testing.T) {
+	root := getProjectRoot(t)
+	policyPath := filepath.Join(root, "policies", "ucca_policy_v1.yaml")
+	engine, err := NewPolicyEngineFromPath(policyPath)
+	if err != nil {
+		t.Fatalf("Failed to create policy engine: %v", err)
+	}
+
+	intake := &UseCaseIntake{
+		UseCaseText: "KI steuert Stromnetz ohne Fallback",
+		Domain:      DomainEnergy,
+		CriticalInfraContext: &CriticalInfraContext{
+			GridControl:    true,
+			SafetyCritical: true,
+			RedundancyExists: false,
+		},
+	}
+
+	result := engine.Evaluate(intake)
+
+	if result.Feasibility != FeasibilityNO {
+		t.Errorf("Expected NO for safety-critical without redundancy, got %s", result.Feasibility)
+	}
+}
+
+// ============================================================================
+// Marketing — Deepfake BLOCK Test
+// ============================================================================
+
+func TestMarketing_DeepfakeUnlabeled_BLOCK(t *testing.T) {
+	root := getProjectRoot(t)
+	policyPath := filepath.Join(root, "policies", "ucca_policy_v1.yaml")
+	engine, err := NewPolicyEngineFromPath(policyPath)
+	if err != nil {
+		t.Fatalf("Failed to create policy engine: %v", err)
+	}
+
+	intake := &UseCaseIntake{
+		UseCaseText: "KI generiert Werbevideos ohne Kennzeichnung",
+		Domain:      DomainMarketing,
+		MarketingContext: &MarketingContext{
+			DeepfakeContent: true,
+			AIContentLabeled: false,
+		},
+	}
+
+	result := engine.Evaluate(intake)
+
+	if result.Feasibility != FeasibilityNO {
+		t.Errorf("Expected NO for unlabeled deepfakes, got %s", result.Feasibility)
+	}
+}
+
+func TestMarketing_DeepfakeLabeled_OK(t *testing.T) {
+	root := getProjectRoot(t)
+	policyPath := filepath.Join(root, "policies", "ucca_policy_v1.yaml")
+	engine, err := NewPolicyEngineFromPath(policyPath)
+	if err != nil {
+		t.Fatalf("Failed to create policy engine: %v", err)
+	}
+
+	intake := &UseCaseIntake{
+		UseCaseText: "KI generiert Werbevideos mit Kennzeichnung",
+		Domain:      DomainMarketing,
+		MarketingContext: &MarketingContext{
+			DeepfakeContent: true,
+			AIContentLabeled: true,
+		},
+	}
+
+	result := engine.Evaluate(intake)
+
+	if result.Feasibility == FeasibilityNO {
+		t.Error("Expected feasibility != NO when deepfakes are properly labeled")
+	}
+}
+
+// ============================================================================
+// Manufacturing — Safety BLOCK Test
+// ============================================================================
+
+func TestManufacturing_SafetyUnvalidated_BLOCK(t *testing.T) {
+	root := getProjectRoot(t)
+	policyPath := filepath.Join(root, "policies", "ucca_policy_v1.yaml")
+	engine, err := NewPolicyEngineFromPath(policyPath)
+	if err != nil {
+		t.Fatalf("Failed to create policy engine: %v", err)
+	}
+
+	intake := &UseCaseIntake{
+		UseCaseText: "KI in Maschinensicherheit ohne Validierung",
+		Domain:      DomainMechanicalEngineering,
+		ManufacturingContext: &ManufacturingContext{
+			MachineSafety:   true,
+			SafetyValidated: false,
+		},
+	}
+
+	result := engine.Evaluate(intake)
+
+	if result.Feasibility != FeasibilityNO {
+		t.Errorf("Expected NO for unvalidated machine safety, got %s", result.Feasibility)
+	}
+}
+
+// ============================================================================
+// AGG V2 Obligations Loading Test
+// ============================================================================
+
+func TestAGGV2_LoadsFromManifest(t *testing.T) {
+	regs, err := LoadAllV2Regulations()
+	if err != nil {
+		t.Fatalf("Failed to load v2 regulations: %v", err)
+	}
+
+	agg, ok := regs["agg"]
+	if !ok {
+		t.Fatal("agg not found in loaded regulations")
+	}
+
+	if len(agg.Obligations) < 8 {
+		t.Errorf("Expected at least 8 AGG obligations, got %d", len(agg.Obligations))
+	}
+
+	// Check first obligation
+	if agg.Obligations[0].ID != "AGG-OBL-001" {
+		t.Errorf("Expected first ID 'AGG-OBL-001', got '%s'", agg.Obligations[0].ID)
+	}
+}
+
+func TestAGGApplicability_Germany(t *testing.T) {
+	regs, err := LoadAllV2Regulations()
+	if err != nil {
+		t.Fatalf("Failed to load v2 regulations: %v", err)
+	}
+
+	module := NewJSONRegulationModule(regs["agg"])
+
+	factsDE := &UnifiedFacts{Organization: OrganizationFacts{Country: "DE"}}
+	if !module.IsApplicable(factsDE) {
+		t.Error("AGG should be applicable for German company")
+	}
+
+	factsUS := &UnifiedFacts{Organization: OrganizationFacts{Country: "US"}}
+	if module.IsApplicable(factsUS) {
+		t.Error("AGG should NOT be applicable for US company")
+	}
+}
+
+// ============================================================================
+// AI Act V2 Extended Obligations Test
+// ============================================================================
+
+func TestAIActV2_ExtendedObligations(t *testing.T) {
+	regs, err := LoadAllV2Regulations()
+	if err != nil {
+		t.Fatalf("Failed to load v2 regulations: %v", err)
+	}
+
+	aiAct, ok := regs["ai_act"]
+	if !ok {
+		t.Fatal("ai_act not found in loaded regulations")
+	}
+
+	if len(aiAct.Obligations) < 75 {
+		t.Errorf("Expected at least 75 AI Act obligations (expanded), got %d", len(aiAct.Obligations))
+	}
+
+	// Check GPAI obligations exist (Art. 51-56)
+	hasGPAI := false
+	for _, obl := range aiAct.Obligations {
+		if obl.ID == "AIACT-OBL-078" { // GPAI classification
+			hasGPAI = true
+			break
+		}
+	}
+	if !hasGPAI {
+		t.Error("Expected GPAI obligation AIACT-OBL-078 in expanded AI Act")
+	}
+}
+
+// ============================================================================
+// Field Resolver Tests — Domain Contexts
+// ============================================================================
+
+func TestFieldResolver_HRContext(t *testing.T) {
+	root := getProjectRoot(t)
+	policyPath := filepath.Join(root, "policies", "ucca_policy_v1.yaml")
+	engine, err := NewPolicyEngineFromPath(policyPath)
+	if err != nil {
+		t.Fatalf("Failed to create policy engine: %v", err)
+	}
+
+	intake := &UseCaseIntake{
+		HRContext: &HRContext{AutomatedScreening: true},
+	}
+
+	val := engine.getFieldValue("hr_context.automated_screening", intake)
+	if val != true {
+		t.Errorf("Expected true for hr_context.automated_screening, got %v", val)
+	}
+
+	val2 := engine.getFieldValue("hr_context.automated_rejection", intake)
+	if val2 != false {
+		t.Errorf("Expected false for hr_context.automated_rejection, got %v", val2)
+	}
+}
+
+func TestFieldResolver_NilContext(t *testing.T) {
+	root := getProjectRoot(t)
+	policyPath := filepath.Join(root, "policies", "ucca_policy_v1.yaml")
+	engine, err := NewPolicyEngineFromPath(policyPath)
+	if err != nil {
+		t.Fatalf("Failed to create policy engine: %v", err)
+	}
+
+	intake := &UseCaseIntake{} // No HR context
+
+	val := engine.getFieldValue("hr_context.automated_screening", intake)
+	if val != nil {
+		t.Errorf("Expected nil for nil HR context, got %v", val)
+	}
+}
+
+func TestFieldResolver_HealthcareContext(t *testing.T) {
+	root := getProjectRoot(t)
+	policyPath := filepath.Join(root, "policies", "ucca_policy_v1.yaml")
+	engine, err := NewPolicyEngineFromPath(policyPath)
+	if err != nil {
+		t.Fatalf("Failed to create policy engine: %v", err)
+	}
+
+	intake := &UseCaseIntake{
+		HealthcareContext: &HealthcareContext{
+			TriageDecision: true,
+			MedicalDevice:  false,
+		},
+	}
+
+	val := engine.getFieldValue("healthcare_context.triage_decision", intake)
+	if val != true {
+		t.Errorf("Expected true, got %v", val)
+	}
+
+	val2 := engine.getFieldValue("healthcare_context.medical_device", intake)
+	if val2 != false {
+		t.Errorf("Expected false, got %v", val2)
+	}
+}
+
+// ============================================================================
+// Hospitality — Review Manipulation BLOCK
+// ============================================================================
+
+func TestHospitality_ReviewManipulation_BLOCK(t *testing.T) {
+	root := getProjectRoot(t)
+	policyPath := filepath.Join(root, "policies", "ucca_policy_v1.yaml")
+	engine, err := NewPolicyEngineFromPath(policyPath)
+	if err != nil {
+		t.Fatalf("Failed to create policy engine: %v", err)
+	}
+
+	intake := &UseCaseIntake{
+		UseCaseText: "KI generiert Fake-Bewertungen",
+		Domain:      DomainHospitality,
+		HospitalityContext: &HospitalityContext{
+			ReviewManipulation: true,
+		},
+	}
+
+	result := engine.Evaluate(intake)
+
+	if result.Feasibility != FeasibilityNO {
+		t.Errorf("Expected NO for review manipulation, got %s", result.Feasibility)
+	}
+}
+
+// ============================================================================
+// Total Obligations Count
+// ============================================================================
+
+func TestTotalObligationsCount(t *testing.T) {
+	regs, err := LoadAllV2Regulations()
+	if err != nil {
+		t.Fatalf("Failed to load v2 regulations: %v", err)
+	}
+
+	total := 0
+	for _, reg := range regs {
+		total += len(reg.Obligations)
+	}
+
+	// We expect at least 350 obligations across all regulations
+	if total < 350 {
+		t.Errorf("Expected at least 350 total obligations, got %d", total)
+	}
+
+	t.Logf("Total obligations across all regulations: %d", total)
+	for id, reg := range regs {
+		t.Logf("  %s: %d obligations", id, len(reg.Obligations))
+	}
+}
+
+// ============================================================================
+// Domain constant existence checks
+// ============================================================================
+
+func TestDomainConstants_Exist(t *testing.T) {
+	domains := []Domain{
+		DomainHR, DomainEducation, DomainHealthcare,
+		DomainFinance, DomainBanking, DomainInsurance,
+		DomainEnergy, DomainUtilities,
+		DomainAutomotive, DomainAerospace,
+		DomainRetail, DomainEcommerce,
+		DomainMarketing, DomainMedia,
+		DomainLogistics, DomainConstruction,
+		DomainPublicSector, DomainDefense,
+		DomainMechanicalEngineering,
+	}
+
+	for _, d := range domains {
+		if d == "" {
+			t.Error("Empty domain constant found")
+		}
+	}
+}
diff --git a/ai-compliance-sdk/internal/ucca/escalation_models.go b/ai-compliance-sdk/internal/ucca/escalation_models.go
index ace7074..15da033 100644
--- a/ai-compliance-sdk/internal/ucca/escalation_models.go
+++ b/ai-compliance-sdk/internal/ucca/escalation_models.go
@@ -1,6 +1,7 @@
 package ucca
 
 import (
+	"fmt"
 	"time"
 
 	"github.com/google/uuid"
@@ -187,6 +188,12 @@ func (t *EscalationTrigger) DetermineEscalationLevel(result *AssessmentResult) (
 		}
 	}
 
+	// BetrVG E3: Very high conflict score without consultation
+	if result.BetrvgConflictScore >= 75 && !result.Intake.WorksCouncilConsulted {
+		reasons = append(reasons, "BetrVG-Konfliktpotenzial sehr hoch (Score "+fmt.Sprintf("%d", result.BetrvgConflictScore)+") ohne BR-Konsultation")
+		return EscalationLevelE3, joinReasons(reasons, "E3 erforderlich: ")
+	}
+
 	if hasArt9 || result.DSFARecommended || result.RiskScore > t.E2RiskThreshold {
 		if result.DSFARecommended {
 			reasons = append(reasons, "DSFA empfohlen")
@@ -197,6 +204,12 @@ func (t *EscalationTrigger) DetermineEscalationLevel(result *AssessmentResult) (
 		return EscalationLevelE2, joinReasons(reasons, "DSB-Konsultation erforderlich: ")
 	}
 
+	// BetrVG E2: High conflict score
+	if result.BetrvgConflictScore >= 50 && result.BetrvgConsultationRequired && !result.Intake.WorksCouncilConsulted {
+		reasons = append(reasons, "BetrVG-Mitbestimmung erforderlich (Score "+fmt.Sprintf("%d", result.BetrvgConflictScore)+"), BR nicht konsultiert")
+		return EscalationLevelE2, joinReasons(reasons, "BR-Konsultation erforderlich: ")
+	}
+
 	// E1: Low priority checks
 	// - WARN rules triggered
 	// - Risk 20-40
diff --git a/ai-compliance-sdk/internal/ucca/json_regulation_module.go b/ai-compliance-sdk/internal/ucca/json_regulation_module.go
index d4ba2df..0419f5c 100644
--- a/ai-compliance-sdk/internal/ucca/json_regulation_module.go
+++ b/ai-compliance-sdk/internal/ucca/json_regulation_module.go
@@ -56,6 +56,10 @@ func (m *JSONRegulationModule) defaultApplicability(facts *UnifiedFacts) bool {
 		return facts.Organization.EUMember && facts.AIUsage.UsesAI
 	case "dora":
 		return facts.Financial.DORAApplies || facts.Financial.IsRegulated
+	case "betrvg":
+		return facts.Organization.Country == "DE" && facts.Organization.EmployeeCount >= 5
+	case "agg":
+		return facts.Organization.Country == "DE"
 	default:
 		return true
 	}
diff --git a/ai-compliance-sdk/internal/ucca/models.go b/ai-compliance-sdk/internal/ucca/models.go
index f5af98c..77ec727 100644
--- a/ai-compliance-sdk/internal/ucca/models.go
+++ b/ai-compliance-sdk/internal/ucca/models.go
@@ -178,3 +178,73 @@ const (
 	ExportFormatJSON     ExportFormat = "json"
 	ExportFormatMarkdown ExportFormat = "md"
 )
+
+// ============================================================================
+// AI Act Decision Tree Types
+// ============================================================================
+
+// GPAICategory represents the GPAI classification result
+type GPAICategory string
+
+const (
+	GPAICategoryNone     GPAICategory = "none"
+	GPAICategoryStandard GPAICategory = "standard"
+	GPAICategorySystemic GPAICategory = "systemic"
+)
+
+// GPAIClassification represents the result of the GPAI axis evaluation
+type GPAIClassification struct {
+	IsGPAI             bool     `json:"is_gpai"`
+	IsSystemicRisk     bool     `json:"is_systemic_risk"`
+	Category           GPAICategory `json:"gpai_category"`
+	ApplicableArticles []string `json:"applicable_articles"`
+	Obligations        []string `json:"obligations"`
+}
+
+// DecisionTreeAnswer represents a user's answer to a decision tree question
+type DecisionTreeAnswer struct {
+	QuestionID string `json:"question_id"`
+	Value      bool   `json:"value"`
+	Note       string `json:"note,omitempty"`
+}
+
+// DecisionTreeQuestion represents a single question in the decision tree
+type DecisionTreeQuestion struct {
+	ID          string `json:"id"`
+	Axis        string `json:"axis"`        // "high_risk" or "gpai"
+	Question    string `json:"question"`
+	Description string `json:"description"` // Additional context
+	ArticleRef  string `json:"article_ref"` // e.g., "Art. 5", "Anhang III"
+	SkipIf      string `json:"skip_if,omitempty"` // Question ID — skip if that was answered "no"
+}
+
+// DecisionTreeDefinition represents the full decision tree structure for the frontend
+type DecisionTreeDefinition struct {
+	ID        string                 `json:"id"`
+	Name      string                 `json:"name"`
+	Version   string                 `json:"version"`
+	Questions []DecisionTreeQuestion `json:"questions"`
+}
+
+// DecisionTreeEvalRequest is the API request for evaluating the decision tree
+type DecisionTreeEvalRequest struct {
+	SystemName        string                        `json:"system_name"`
+	SystemDescription string                        `json:"system_description,omitempty"`
+	Answers           map[string]DecisionTreeAnswer  `json:"answers"`
+}
+
+// DecisionTreeResult represents the combined evaluation result
+type DecisionTreeResult struct {
+	ID                  uuid.UUID          `json:"id"`
+	TenantID            uuid.UUID          `json:"tenant_id"`
+	ProjectID           *uuid.UUID         `json:"project_id,omitempty"`
+	SystemName          string             `json:"system_name"`
+	SystemDescription   string             `json:"system_description,omitempty"`
+	Answers             map[string]DecisionTreeAnswer `json:"answers"`
+	HighRiskResult      AIActRiskLevel     `json:"high_risk_result"`
+	GPAIResult          GPAIClassification `json:"gpai_result"`
+	CombinedObligations []string           `json:"combined_obligations"`
+	ApplicableArticles  []string           `json:"applicable_articles"`
+	CreatedAt           time.Time          `json:"created_at"`
+	UpdatedAt           time.Time          `json:"updated_at"`
+}
diff --git a/ai-compliance-sdk/internal/ucca/registration_store.go b/ai-compliance-sdk/internal/ucca/registration_store.go
new file mode 100644
index 0000000..dae3415
--- /dev/null
+++ b/ai-compliance-sdk/internal/ucca/registration_store.go
@@ -0,0 +1,274 @@
+package ucca
+
+import (
+	"context"
+	"encoding/json"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/jackc/pgx/v5/pgxpool"
+)
+
+// AIRegistration represents an EU AI Database registration entry
+type AIRegistration struct {
+	ID        uuid.UUID `json:"id"`
+	TenantID  uuid.UUID `json:"tenant_id"`
+
+	// System
+	SystemName        string `json:"system_name"`
+	SystemVersion     string `json:"system_version,omitempty"`
+	SystemDescription string `json:"system_description,omitempty"`
+	IntendedPurpose   string `json:"intended_purpose,omitempty"`
+
+	// Provider
+	ProviderName            string `json:"provider_name,omitempty"`
+	ProviderLegalForm       string `json:"provider_legal_form,omitempty"`
+	ProviderAddress         string `json:"provider_address,omitempty"`
+	ProviderCountry         string `json:"provider_country,omitempty"`
+	EURepresentativeName    string `json:"eu_representative_name,omitempty"`
+	EURepresentativeContact string `json:"eu_representative_contact,omitempty"`
+
+	// Classification
+	RiskClassification string `json:"risk_classification"`
+	AnnexIIICategory   string `json:"annex_iii_category,omitempty"`
+	GPAIClassification string `json:"gpai_classification"`
+
+	// Conformity
+	ConformityAssessmentType string `json:"conformity_assessment_type,omitempty"`
+	NotifiedBodyName         string `json:"notified_body_name,omitempty"`
+	NotifiedBodyID           string `json:"notified_body_id,omitempty"`
+	CEMarking                bool   `json:"ce_marking"`
+
+	// Training data
+	TrainingDataCategories json.RawMessage `json:"training_data_categories,omitempty"`
+	TrainingDataSummary    string          `json:"training_data_summary,omitempty"`
+
+	// Status
+	RegistrationStatus string     `json:"registration_status"`
+	EUDatabaseID       string     `json:"eu_database_id,omitempty"`
+	RegistrationDate   *time.Time `json:"registration_date,omitempty"`
+	LastUpdateDate     *time.Time `json:"last_update_date,omitempty"`
+
+	// Links
+	UCCAAssessmentID     *uuid.UUID `json:"ucca_assessment_id,omitempty"`
+	DecisionTreeResultID *uuid.UUID `json:"decision_tree_result_id,omitempty"`
+
+	// Export
+	ExportData json.RawMessage `json:"export_data,omitempty"`
+
+	// Audit
+	CreatedAt   time.Time `json:"created_at"`
+	UpdatedAt   time.Time `json:"updated_at"`
+	CreatedBy   string    `json:"created_by,omitempty"`
+	SubmittedBy string    `json:"submitted_by,omitempty"`
+}
+
+// RegistrationStore handles AI registration persistence
+type RegistrationStore struct {
+	pool *pgxpool.Pool
+}
+
+// NewRegistrationStore creates a new registration store
+func NewRegistrationStore(pool *pgxpool.Pool) *RegistrationStore {
+	return &RegistrationStore{pool: pool}
+}
+
+// Create creates a new registration
+func (s *RegistrationStore) Create(ctx context.Context, r *AIRegistration) error {
+	r.ID = uuid.New()
+	r.CreatedAt = time.Now()
+	r.UpdatedAt = time.Now()
+	if r.RegistrationStatus == "" {
+		r.RegistrationStatus = "draft"
+	}
+	if r.RiskClassification == "" {
+		r.RiskClassification = "not_classified"
+	}
+	if r.GPAIClassification == "" {
+		r.GPAIClassification = "none"
+	}
+
+	_, err := s.pool.Exec(ctx, `
+		INSERT INTO ai_system_registrations (
+			id, tenant_id, system_name, system_version, system_description, intended_purpose,
+			provider_name, provider_legal_form, provider_address, provider_country,
+			eu_representative_name, eu_representative_contact,
+			risk_classification, annex_iii_category, gpai_classification,
+			conformity_assessment_type, notified_body_name, notified_body_id, ce_marking,
+			training_data_categories, training_data_summary,
+			registration_status, ucca_assessment_id, decision_tree_result_id,
+			created_by
+		) VALUES (
+			$1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12,
+			$13, $14, $15, $16, $17, $18, $19, $20, $21, $22, $23, $24, $25
+		)`,
+		r.ID, r.TenantID, r.SystemName, r.SystemVersion, r.SystemDescription, r.IntendedPurpose,
+		r.ProviderName, r.ProviderLegalForm, r.ProviderAddress, r.ProviderCountry,
+		r.EURepresentativeName, r.EURepresentativeContact,
+		r.RiskClassification, r.AnnexIIICategory, r.GPAIClassification,
+		r.ConformityAssessmentType, r.NotifiedBodyName, r.NotifiedBodyID, r.CEMarking,
+		r.TrainingDataCategories, r.TrainingDataSummary,
+		r.RegistrationStatus, r.UCCAAssessmentID, r.DecisionTreeResultID,
+		r.CreatedBy,
+	)
+	return err
+}
+
+// List returns all registrations for a tenant
+func (s *RegistrationStore) List(ctx context.Context, tenantID uuid.UUID) ([]AIRegistration, error) {
+	rows, err := s.pool.Query(ctx, `
+		SELECT id, tenant_id, system_name, system_version, system_description, intended_purpose,
+			provider_name, provider_legal_form, provider_address, provider_country,
+			eu_representative_name, eu_representative_contact,
+			risk_classification, annex_iii_category, gpai_classification,
+			conformity_assessment_type, notified_body_name, notified_body_id, ce_marking,
+			training_data_categories, training_data_summary,
+			registration_status, eu_database_id, registration_date, last_update_date,
+			ucca_assessment_id, decision_tree_result_id, export_data,
+			created_at, updated_at, created_by, submitted_by
+		FROM ai_system_registrations
+		WHERE tenant_id = $1
+		ORDER BY created_at DESC`,
+		tenantID,
+	)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var registrations []AIRegistration
+	for rows.Next() {
+		var r AIRegistration
+		err := rows.Scan(
+			&r.ID, &r.TenantID, &r.SystemName, &r.SystemVersion, &r.SystemDescription, &r.IntendedPurpose,
+			&r.ProviderName, &r.ProviderLegalForm, &r.ProviderAddress, &r.ProviderCountry,
+			&r.EURepresentativeName, &r.EURepresentativeContact,
+			&r.RiskClassification, &r.AnnexIIICategory, &r.GPAIClassification,
+			&r.ConformityAssessmentType, &r.NotifiedBodyName, &r.NotifiedBodyID, &r.CEMarking,
+			&r.TrainingDataCategories, &r.TrainingDataSummary,
+			&r.RegistrationStatus, &r.EUDatabaseID, &r.RegistrationDate, &r.LastUpdateDate,
+			&r.UCCAAssessmentID, &r.DecisionTreeResultID, &r.ExportData,
+			&r.CreatedAt, &r.UpdatedAt, &r.CreatedBy, &r.SubmittedBy,
+		)
+		if err != nil {
+			return nil, err
+		}
+		registrations = append(registrations, r)
+	}
+	return registrations, nil
+}
+
+// GetByID returns a registration by ID
+func (s *RegistrationStore) GetByID(ctx context.Context, id uuid.UUID) (*AIRegistration, error) {
+	var r AIRegistration
+	err := s.pool.QueryRow(ctx, `
+		SELECT id, tenant_id, system_name, system_version, system_description, intended_purpose,
+			provider_name, provider_legal_form, provider_address, provider_country,
+			eu_representative_name, eu_representative_contact,
+			risk_classification, annex_iii_category, gpai_classification,
+			conformity_assessment_type, notified_body_name, notified_body_id, ce_marking,
+			training_data_categories, training_data_summary,
+			registration_status, eu_database_id, registration_date, last_update_date,
+			ucca_assessment_id, decision_tree_result_id, export_data,
+			created_at, updated_at, created_by, submitted_by
+		FROM ai_system_registrations
+		WHERE id = $1`,
+		id,
+	).Scan(
+		&r.ID, &r.TenantID, &r.SystemName, &r.SystemVersion, &r.SystemDescription, &r.IntendedPurpose,
+		&r.ProviderName, &r.ProviderLegalForm, &r.ProviderAddress, &r.ProviderCountry,
+		&r.EURepresentativeName, &r.EURepresentativeContact,
+		&r.RiskClassification, &r.AnnexIIICategory, &r.GPAIClassification,
+		&r.ConformityAssessmentType, &r.NotifiedBodyName, &r.NotifiedBodyID, &r.CEMarking,
+		&r.TrainingDataCategories, &r.TrainingDataSummary,
+		&r.RegistrationStatus, &r.EUDatabaseID, &r.RegistrationDate, &r.LastUpdateDate,
+		&r.UCCAAssessmentID, &r.DecisionTreeResultID, &r.ExportData,
+		&r.CreatedAt, &r.UpdatedAt, &r.CreatedBy, &r.SubmittedBy,
+	)
+	if err != nil {
+		return nil, err
+	}
+	return &r, nil
+}
+
+// Update updates a registration
+func (s *RegistrationStore) Update(ctx context.Context, r *AIRegistration) error {
+	r.UpdatedAt = time.Now()
+	_, err := s.pool.Exec(ctx, `
+		UPDATE ai_system_registrations SET
+			system_name = $2, system_version = $3, system_description = $4, intended_purpose = $5,
+			provider_name = $6, provider_legal_form = $7, provider_address = $8, provider_country = $9,
+			eu_representative_name = $10, eu_representative_contact = $11,
+			risk_classification = $12, annex_iii_category = $13, gpai_classification = $14,
+			conformity_assessment_type = $15, notified_body_name = $16, notified_body_id = $17, ce_marking = $18,
+			training_data_categories = $19, training_data_summary = $20,
+			registration_status = $21, eu_database_id = $22,
+			export_data = $23, updated_at = $24, submitted_by = $25
+		WHERE id = $1`,
+		r.ID, r.SystemName, r.SystemVersion, r.SystemDescription, r.IntendedPurpose,
+		r.ProviderName, r.ProviderLegalForm, r.ProviderAddress, r.ProviderCountry,
+		r.EURepresentativeName, r.EURepresentativeContact,
+		r.RiskClassification, r.AnnexIIICategory, r.GPAIClassification,
+		r.ConformityAssessmentType, r.NotifiedBodyName, r.NotifiedBodyID, r.CEMarking,
+		r.TrainingDataCategories, r.TrainingDataSummary,
+		r.RegistrationStatus, r.EUDatabaseID,
+		r.ExportData, r.UpdatedAt, r.SubmittedBy,
+	)
+	return err
+}
+
+// UpdateStatus changes only the registration status
+func (s *RegistrationStore) UpdateStatus(ctx context.Context, id uuid.UUID, status string, submittedBy string) error {
+	now := time.Now()
+	_, err := s.pool.Exec(ctx, `
+		UPDATE ai_system_registrations
+		SET registration_status = $2, submitted_by = $3, updated_at = $4,
+			registration_date = CASE WHEN $2 = 'submitted' THEN $4 ELSE registration_date END,
+			last_update_date = $4
+		WHERE id = $1`,
+		id, status, submittedBy, now,
+	)
+	return err
+}
+
+// BuildExportJSON creates the EU AI Database submission JSON
+func (s *RegistrationStore) BuildExportJSON(r *AIRegistration) json.RawMessage {
+	export := map[string]interface{}{
+		"schema_version": "1.0",
+		"submission_type": "ai_system_registration",
+		"regulation": "EU AI Act (EU) 2024/1689",
+		"article": "Art. 49",
+		"provider": map[string]interface{}{
+			"name":               r.ProviderName,
+			"legal_form":         r.ProviderLegalForm,
+			"address":            r.ProviderAddress,
+			"country":            r.ProviderCountry,
+			"eu_representative":  r.EURepresentativeName,
+			"eu_rep_contact":     r.EURepresentativeContact,
+		},
+		"system": map[string]interface{}{
+			"name":        r.SystemName,
+			"version":     r.SystemVersion,
+			"description": r.SystemDescription,
+			"purpose":     r.IntendedPurpose,
+		},
+		"classification": map[string]interface{}{
+			"risk_level":         r.RiskClassification,
+			"annex_iii_category": r.AnnexIIICategory,
+			"gpai":               r.GPAIClassification,
+		},
+		"conformity": map[string]interface{}{
+			"assessment_type": r.ConformityAssessmentType,
+			"notified_body":   r.NotifiedBodyName,
+			"notified_body_id": r.NotifiedBodyID,
+			"ce_marking":      r.CEMarking,
+		},
+		"training_data": map[string]interface{}{
+			"categories": r.TrainingDataCategories,
+			"summary":    r.TrainingDataSummary,
+		},
+		"status": r.RegistrationStatus,
+	}
+	data, _ := json.Marshal(export)
+	return data
+}
diff --git a/ai-compliance-sdk/internal/ucca/store.go b/ai-compliance-sdk/internal/ucca/store.go
index f261e9f..771abc7 100644
--- a/ai-compliance-sdk/internal/ucca/store.go
+++ b/ai-compliance-sdk/internal/ucca/store.go
@@ -358,6 +358,128 @@ type AssessmentFilters struct {
 	Offset      int // OFFSET for pagination
 }
 
+// ============================================================================
+// Decision Tree Result CRUD
+// ============================================================================
+
+// CreateDecisionTreeResult stores a new decision tree result
+func (s *Store) CreateDecisionTreeResult(ctx context.Context, r *DecisionTreeResult) error {
+	r.ID = uuid.New()
+	r.CreatedAt = time.Now().UTC()
+	r.UpdatedAt = r.CreatedAt
+
+	answers, _ := json.Marshal(r.Answers)
+	gpaiResult, _ := json.Marshal(r.GPAIResult)
+	obligations, _ := json.Marshal(r.CombinedObligations)
+	articles, _ := json.Marshal(r.ApplicableArticles)
+
+	_, err := s.pool.Exec(ctx, `
+		INSERT INTO ai_act_decision_tree_results (
+			id, tenant_id, project_id, system_name, system_description,
+			answers, high_risk_level, gpai_result,
+			combined_obligations, applicable_articles,
+			created_at, updated_at
+		) VALUES (
+			$1, $2, $3, $4, $5,
+			$6, $7, $8,
+			$9, $10,
+			$11, $12
+		)
+	`,
+		r.ID, r.TenantID, r.ProjectID, r.SystemName, r.SystemDescription,
+		answers, string(r.HighRiskResult), gpaiResult,
+		obligations, articles,
+		r.CreatedAt, r.UpdatedAt,
+	)
+	return err
+}
+
+// GetDecisionTreeResult retrieves a decision tree result by ID
+func (s *Store) GetDecisionTreeResult(ctx context.Context, id uuid.UUID) (*DecisionTreeResult, error) {
+	var r DecisionTreeResult
+	var answersBytes, gpaiBytes, oblBytes, artBytes []byte
+	var highRiskLevel string
+
+	err := s.pool.QueryRow(ctx, `
+		SELECT id, tenant_id, project_id, system_name, system_description,
+			answers, high_risk_level, gpai_result,
+			combined_obligations, applicable_articles,
+			created_at, updated_at
+		FROM ai_act_decision_tree_results WHERE id = $1
+	`, id).Scan(
+		&r.ID, &r.TenantID, &r.ProjectID, &r.SystemName, &r.SystemDescription,
+		&answersBytes, &highRiskLevel, &gpaiBytes,
+		&oblBytes, &artBytes,
+		&r.CreatedAt, &r.UpdatedAt,
+	)
+
+	if err == pgx.ErrNoRows {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+
+	json.Unmarshal(answersBytes, &r.Answers)
+	json.Unmarshal(gpaiBytes, &r.GPAIResult)
+	json.Unmarshal(oblBytes, &r.CombinedObligations)
+	json.Unmarshal(artBytes, &r.ApplicableArticles)
+	r.HighRiskResult = AIActRiskLevel(highRiskLevel)
+
+	return &r, nil
+}
+
+// ListDecisionTreeResults lists all decision tree results for a tenant
+func (s *Store) ListDecisionTreeResults(ctx context.Context, tenantID uuid.UUID) ([]DecisionTreeResult, error) {
+	rows, err := s.pool.Query(ctx, `
+		SELECT id, tenant_id, project_id, system_name, system_description,
+			answers, high_risk_level, gpai_result,
+			combined_obligations, applicable_articles,
+			created_at, updated_at
+		FROM ai_act_decision_tree_results
+		WHERE tenant_id = $1
+		ORDER BY created_at DESC
+		LIMIT 100
+	`, tenantID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var results []DecisionTreeResult
+	for rows.Next() {
+		var r DecisionTreeResult
+		var answersBytes, gpaiBytes, oblBytes, artBytes []byte
+		var highRiskLevel string
+
+		err := rows.Scan(
+			&r.ID, &r.TenantID, &r.ProjectID, &r.SystemName, &r.SystemDescription,
+			&answersBytes, &highRiskLevel, &gpaiBytes,
+			&oblBytes, &artBytes,
+			&r.CreatedAt, &r.UpdatedAt,
+		)
+		if err != nil {
+			return nil, err
+		}
+
+		json.Unmarshal(answersBytes, &r.Answers)
+		json.Unmarshal(gpaiBytes, &r.GPAIResult)
+		json.Unmarshal(oblBytes, &r.CombinedObligations)
+		json.Unmarshal(artBytes, &r.ApplicableArticles)
+		r.HighRiskResult = AIActRiskLevel(highRiskLevel)
+
+		results = append(results, r)
+	}
+
+	return results, nil
+}
+
+// DeleteDecisionTreeResult deletes a decision tree result by ID
+func (s *Store) DeleteDecisionTreeResult(ctx context.Context, id uuid.UUID) error {
+	_, err := s.pool.Exec(ctx, "DELETE FROM ai_act_decision_tree_results WHERE id = $1", id)
+	return err
+}
+
 // ============================================================================
 // Helpers
 // ============================================================================
diff --git a/ai-compliance-sdk/migrations/023_ai_registration_schema.sql b/ai-compliance-sdk/migrations/023_ai_registration_schema.sql
new file mode 100644
index 0000000..134ed24
--- /dev/null
+++ b/ai-compliance-sdk/migrations/023_ai_registration_schema.sql
@@ -0,0 +1,65 @@
+-- Migration 023: AI System Registration Schema (Art. 49 AI Act)
+-- Tracks EU AI Database registrations for High-Risk AI systems
+
+CREATE TABLE IF NOT EXISTS ai_system_registrations (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    tenant_id UUID NOT NULL,
+
+    -- System identification
+    system_name VARCHAR(500) NOT NULL,
+    system_version VARCHAR(100),
+    system_description TEXT,
+    intended_purpose TEXT,
+
+    -- Provider info
+    provider_name VARCHAR(500),
+    provider_legal_form VARCHAR(200),
+    provider_address TEXT,
+    provider_country VARCHAR(10),
+    eu_representative_name VARCHAR(500),
+    eu_representative_contact TEXT,
+
+    -- Classification
+    risk_classification VARCHAR(50) DEFAULT 'not_classified',
+    -- CHECK (risk_classification IN ('not_classified', 'minimal_risk', 'limited_risk', 'high_risk', 'unacceptable'))
+    annex_iii_category VARCHAR(200),
+    gpai_classification VARCHAR(50) DEFAULT 'none',
+    -- CHECK (gpai_classification IN ('none', 'standard', 'systemic'))
+
+    -- Conformity
+    conformity_assessment_type VARCHAR(50),
+    -- CHECK (conformity_assessment_type IN ('internal', 'third_party', 'not_required'))
+    notified_body_name VARCHAR(500),
+    notified_body_id VARCHAR(100),
+    ce_marking BOOLEAN DEFAULT false,
+
+    -- Training data
+    training_data_categories JSONB DEFAULT '[]'::jsonb,
+    training_data_summary TEXT,
+
+    -- Registration status
+    registration_status VARCHAR(50) DEFAULT 'draft',
+    -- CHECK (registration_status IN ('draft', 'ready', 'submitted', 'registered', 'update_required', 'withdrawn'))
+    eu_database_id VARCHAR(200),
+    registration_date TIMESTAMPTZ,
+    last_update_date TIMESTAMPTZ,
+
+    -- Links to other assessments
+    ucca_assessment_id UUID,
+    decision_tree_result_id UUID,
+
+    -- Export data (cached JSON for EU submission)
+    export_data JSONB,
+
+    -- Audit
+    created_at TIMESTAMPTZ DEFAULT NOW(),
+    updated_at TIMESTAMPTZ DEFAULT NOW(),
+    created_by VARCHAR(200),
+    submitted_by VARCHAR(200)
+);
+
+-- Indexes
+CREATE INDEX IF NOT EXISTS idx_air_tenant ON ai_system_registrations (tenant_id);
+CREATE INDEX IF NOT EXISTS idx_air_status ON ai_system_registrations (registration_status);
+CREATE INDEX IF NOT EXISTS idx_air_classification ON ai_system_registrations (risk_classification);
+CREATE INDEX IF NOT EXISTS idx_air_ucca ON ai_system_registrations (ucca_assessment_id);
diff --git a/ai-compliance-sdk/migrations/024_payment_compliance_schema.sql b/ai-compliance-sdk/migrations/024_payment_compliance_schema.sql
new file mode 100644
index 0000000..b51d006
--- /dev/null
+++ b/ai-compliance-sdk/migrations/024_payment_compliance_schema.sql
@@ -0,0 +1,45 @@
+-- Migration 024: Payment Compliance Schema
+-- Tracks payment terminal compliance assessments against control library
+
+CREATE TABLE IF NOT EXISTS payment_compliance_assessments (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    tenant_id UUID NOT NULL,
+
+    -- Project / Tender
+    project_name VARCHAR(500) NOT NULL,
+    tender_reference VARCHAR(200),
+    customer_name VARCHAR(500),
+    description TEXT,
+
+    -- Scope
+    system_type VARCHAR(100), -- terminal, backend, both, full_stack
+    payment_methods JSONB DEFAULT '[]'::jsonb, -- ["card", "nfc", "girocard", "credit"]
+    protocols JSONB DEFAULT '[]'::jsonb, -- ["zvt", "opi", "emv"]
+
+    -- Assessment
+    total_controls INT DEFAULT 0,
+    controls_passed INT DEFAULT 0,
+    controls_failed INT DEFAULT 0,
+    controls_partial INT DEFAULT 0,
+    controls_not_applicable INT DEFAULT 0,
+    controls_not_checked INT DEFAULT 0,
+    compliance_score NUMERIC(5,2) DEFAULT 0,
+
+    -- Status
+    status VARCHAR(50) DEFAULT 'draft',
+    -- CHECK (status IN ('draft', 'in_progress', 'completed', 'approved'))
+
+    -- Results (per control)
+    control_results JSONB DEFAULT '[]'::jsonb,
+    -- Each entry: {"control_id": "PAY-001", "verdict": "passed|failed|partial|na|unchecked", "evidence": "...", "notes": "..."}
+
+    -- Audit
+    created_at TIMESTAMPTZ DEFAULT NOW(),
+    updated_at TIMESTAMPTZ DEFAULT NOW(),
+    created_by VARCHAR(200),
+    approved_by VARCHAR(200),
+    approved_at TIMESTAMPTZ
+);
+
+CREATE INDEX IF NOT EXISTS idx_pca_tenant ON payment_compliance_assessments (tenant_id);
+CREATE INDEX IF NOT EXISTS idx_pca_status ON payment_compliance_assessments (status);
diff --git a/ai-compliance-sdk/migrations/025_tender_analysis_schema.sql b/ai-compliance-sdk/migrations/025_tender_analysis_schema.sql
new file mode 100644
index 0000000..8e6ab80
--- /dev/null
+++ b/ai-compliance-sdk/migrations/025_tender_analysis_schema.sql
@@ -0,0 +1,37 @@
+-- Migration 025: Tender Analysis Schema
+-- Stores uploaded tender documents, extracted requirements, and control matching results
+
+CREATE TABLE IF NOT EXISTS tender_analyses (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    tenant_id UUID NOT NULL,
+
+    -- Document
+    file_name VARCHAR(500) NOT NULL,
+    file_size BIGINT DEFAULT 0,
+    file_content BYTEA,
+
+    -- Project
+    project_name VARCHAR(500),
+    customer_name VARCHAR(500),
+
+    -- Status
+    status VARCHAR(50) DEFAULT 'uploaded',
+    -- CHECK (status IN ('uploaded', 'extracting', 'extracted', 'matched', 'completed', 'error'))
+
+    -- Extracted requirements
+    requirements JSONB DEFAULT '[]'::jsonb,
+    total_requirements INT DEFAULT 0,
+
+    -- Match results
+    match_results JSONB DEFAULT '[]'::jsonb,
+    matched_count INT DEFAULT 0,
+    unmatched_count INT DEFAULT 0,
+    partial_count INT DEFAULT 0,
+
+    -- Audit
+    created_at TIMESTAMPTZ DEFAULT NOW(),
+    updated_at TIMESTAMPTZ DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_ta_tenant ON tender_analyses (tenant_id);
+CREATE INDEX IF NOT EXISTS idx_ta_status ON tender_analyses (status);
diff --git a/ai-compliance-sdk/payment-compliance-pack/README.md b/ai-compliance-sdk/payment-compliance-pack/README.md
new file mode 100644
index 0000000..8012727
--- /dev/null
+++ b/ai-compliance-sdk/payment-compliance-pack/README.md
@@ -0,0 +1,65 @@
+# Payment Compliance Pack
+
+Ausfuehrbares Pruefpaket fuer Payment-Terminal-Systeme.
+
+## Inhalt
+
+### Semgrep-Regeln (25 Regeln)
+
+| Datei | Regeln | Controls |
+|-------|--------|----------|
+| `payment_logging.yml` | 5 | LOG-001, LOG-002, LOG-014 |
+| `payment_crypto.yml` | 6 | CRYPTO-001, CRYPTO-008, CRYPTO-009, KEYMGMT-001 |
+| `payment_api.yml` | 5 | API-004, API-005, API-014, API-017 |
+| `payment_config.yml` | 5 | CONFIG-001 bis CONFIG-004 |
+| `payment_data.yml` | 5 | DATA-004, DATA-005, DATA-013, TELEMETRY-001 |
+
+### CodeQL-Specs (5 Queries)
+
+| Datei | Ziel | Controls |
+|-------|------|----------|
+| `sensitive-data-to-logs.md` | Datenfluss zu Loggern | LOG-001, LOG-002, DATA-013 |
+| `sensitive-data-to-response.md` | Datenfluss in HTTP-Responses | API-009, ERROR-005 |
+| `tenant-context-loss.md` | Mandantenkontext-Verlust | TENANT-001, TENANT-002 |
+| `sensitive-data-to-telemetry.md` | Datenfluss in Telemetrie | TELEMETRY-001, TELEMETRY-002 |
+| `cache-export-leak.md` | Leaks in Cache/Export | DATA-004, DATA-011 |
+
+### State-Machine-Tests (10 Testfaelle)
+
+| Datei | Inhalt |
+|-------|--------|
+| `terminal_states.md` | 11 Zustaende, 15 Events, Transitions |
+| `terminal_invariants.md` | 8 Invarianten |
+| `terminal_testcases.json` | 10 ausfuehrbare Testfaelle |
+
+### Finding-Schema
+
+| Datei | Beschreibung |
+|-------|-------------|
+| `finding.schema.json` | JSON Schema fuer Pruefergebnisse |
+
+## Ausfuehrung
+
+### Semgrep
+
+```bash
+semgrep --config payment-compliance-pack/semgrep/ /path/to/source
+```
+
+### State-Machine-Tests
+
+Die Testfaelle in `terminal_testcases.json` definieren:
+- Ausgangszustand
+- Event-Sequenz
+- Erwarteten Endzustand
+- Zu pruefende Invarianten
+- Gemappte Controls
+
+Diese koennen gegen einen Terminal-Adapter oder Simulator ausgefuehrt werden.
+
+## Priorisierte Umsetzung
+
+1. **Welle 1:** 25 Semgrep-Regeln sofort produktiv
+2. **Welle 2:** 5 CodeQL-Queries fuer Datenfluesse
+3. **Welle 3:** 10 State-Machine-Tests gegen Terminal-Simulator
+4. **Welle 4:** Tender-Mapping (Requirement → Control → Finding → Verdict)
diff --git a/ai-compliance-sdk/payment-compliance-pack/codeql/cache-export-leak.md b/ai-compliance-sdk/payment-compliance-pack/codeql/cache-export-leak.md
new file mode 100644
index 0000000..52a6408
--- /dev/null
+++ b/ai-compliance-sdk/payment-compliance-pack/codeql/cache-export-leak.md
@@ -0,0 +1,20 @@
+# CodeQL Query: Cache and Export Leak
+
+## Ziel
+Finde Leaks sensibler Daten in Caches, Files, Reports und Exportpfaden.
+
+## Sources
+- Sensitive payment attributes (pan, cvv, track2)
+- Full transaction objects with sensitive fields
+
+## Sinks
+- Redis/Memcache writes
+- Temp file writes
+- CSV/PDF/Excel exports
+- Report builders
+
+## Mapped Controls
+- `DATA-004`: Temporaere Speicher ohne sensitive Daten
+- `DATA-005`: Sensitive Daten in Telemetrie nicht offengelegt
+- `DATA-011`: Batch/Queue ohne unnoetige sensitive Felder
+- `REPORT-005`: Berichte beruecksichtigen Zeitzonen konsistent
diff --git a/ai-compliance-sdk/payment-compliance-pack/codeql/sensitive-data-to-logs.md b/ai-compliance-sdk/payment-compliance-pack/codeql/sensitive-data-to-logs.md
new file mode 100644
index 0000000..3b12750
--- /dev/null
+++ b/ai-compliance-sdk/payment-compliance-pack/codeql/sensitive-data-to-logs.md
@@ -0,0 +1,32 @@
+# CodeQL Query: Sensitive Data to Logs
+
+## Ziel
+Finde Fluesse von sensitiven Zahlungsdaten zu Loggern.
+
+## Sources
+Variablen, Felder, Parameter oder JSON-Felder mit Namen:
+- `pan`, `cardNumber`, `card_number`
+- `cvv`, `cvc`
+- `track2`, `track_2`
+- `pin`
+- `expiry`, `ablauf`
+
+## Sinks
+- Logger-Aufrufe (`logging.*`, `logger.*`, `console.*`, `log.*`)
+- Telemetrie-/Tracing-Emitter (`span.set_attribute`, `tracer.*)
+- Audit-Logger (wenn nicht maskiert)
+
+## Expected Result
+| Field | Type |
+|-------|------|
+| file | string |
+| line | int |
+| source_name | string |
+| sink_call | string |
+| path | string[] |
+
+## Mapped Controls
+- `LOG-001`: Keine sensitiven Zahlungsdaten im Log
+- `LOG-002`: PAN maskiert in Logs
+- `DATA-013`: Sensitive Daten in Telemetrie nicht offengelegt
+- `TELEMETRY-001`: Telemetriedaten ohne sensitive Zahlungsdaten
diff --git a/ai-compliance-sdk/payment-compliance-pack/codeql/sensitive-data-to-response.md b/ai-compliance-sdk/payment-compliance-pack/codeql/sensitive-data-to-response.md
new file mode 100644
index 0000000..6e8a050
--- /dev/null
+++ b/ai-compliance-sdk/payment-compliance-pack/codeql/sensitive-data-to-response.md
@@ -0,0 +1,19 @@
+# CodeQL Query: Sensitive Data to HTTP Response
+
+## Ziel
+Finde Fluesse sensibler Daten in HTTP-/API-Responses oder Exception-Bodies.
+
+## Sources
+- Sensible Payment-Felder: pan, cvv, track2, cardNumber, pin, expiry
+- Interne Payment DTOs mit sensitiven Attributen
+
+## Sinks
+- JSON serializer / response builder
+- Exception payload / error handler response
+- Template rendering output
+
+## Mapped Controls
+- `API-009`: API-Antworten minimieren sensible Daten
+- `API-015`: Interne Fehler ohne sensitive Daten an Client
+- `ERROR-005`: Ausnahmebehandlung gibt keine sensitiven Rohdaten zurueck
+- `REPORT-006`: Reports offenbaren nur rollenerforderliche Daten
diff --git a/ai-compliance-sdk/payment-compliance-pack/codeql/sensitive-data-to-telemetry.md b/ai-compliance-sdk/payment-compliance-pack/codeql/sensitive-data-to-telemetry.md
new file mode 100644
index 0000000..15ad098
--- /dev/null
+++ b/ai-compliance-sdk/payment-compliance-pack/codeql/sensitive-data-to-telemetry.md
@@ -0,0 +1,19 @@
+# CodeQL Query: Sensitive Data to Telemetry
+
+## Ziel
+Finde Fluesse sensibler Daten in Metriken, Traces und Telemetrie-Events.
+
+## Sources
+- Payment DTO fields (pan, cvv, track2, cardNumber)
+- Token/Session related fields
+
+## Sinks
+- Span attributes / trace tags
+- Metric labels
+- Telemetry events / exporters
+
+## Mapped Controls
+- `TELEMETRY-001`: Telemetriedaten ohne sensitive Zahlungsdaten
+- `TELEMETRY-002`: Tracing maskiert identifizierende Felder
+- `TELEMETRY-003`: Metriken ohne hochkartesische sensitive Labels
+- `DATA-013`: Sensitive Daten in Telemetrie nicht offengelegt
diff --git a/ai-compliance-sdk/payment-compliance-pack/codeql/tenant-context-loss.md b/ai-compliance-sdk/payment-compliance-pack/codeql/tenant-context-loss.md
new file mode 100644
index 0000000..b2a049b
--- /dev/null
+++ b/ai-compliance-sdk/payment-compliance-pack/codeql/tenant-context-loss.md
@@ -0,0 +1,21 @@
+# CodeQL Query: Tenant Context Loss
+
+## Ziel
+Finde Datenbank-, Cache- oder Exportpfade ohne durchgehenden Tenant-Kontext.
+
+## Sources
+- Request tenant (header, token, session)
+- Device tenant
+- User tenant
+
+## Danger Patterns
+- DB Query ohne tenant filter / WHERE clause
+- Cache key ohne tenant prefix
+- Export job ohne tenant binding
+- Report query ohne Mandanteneinschraenkung
+
+## Mapped Controls
+- `TENANT-001`: Mandantenkontext serverseitig validiert
+- `TENANT-002`: Datenabfragen mandantenbeschraenkt
+- `TENANT-006`: Caching beruecksichtigt Mandantenkontext
+- `TENANT-008`: Datenexporte erzwingen Mandantenisolation
diff --git a/ai-compliance-sdk/payment-compliance-pack/schema/finding.schema.json b/ai-compliance-sdk/payment-compliance-pack/schema/finding.schema.json
new file mode 100644
index 0000000..1778ccd
--- /dev/null
+++ b/ai-compliance-sdk/payment-compliance-pack/schema/finding.schema.json
@@ -0,0 +1,45 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "Payment Compliance Finding",
+  "type": "object",
+  "required": ["control_id", "engine", "status", "confidence", "evidence", "verdict_text"],
+  "properties": {
+    "control_id": { "type": "string" },
+    "engine": {
+      "type": "string",
+      "enum": ["semgrep", "codeql", "contract_test", "state_machine_test", "integration_test", "manual"]
+    },
+    "status": {
+      "type": "string",
+      "enum": ["passed", "failed", "warning", "not_tested", "needs_manual_review"]
+    },
+    "confidence": { "type": "number", "minimum": 0, "maximum": 1 },
+    "severity": {
+      "type": "string",
+      "enum": ["low", "medium", "high", "critical"]
+    },
+    "evidence": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "properties": {
+          "file": { "type": "string" },
+          "line": { "type": "integer" },
+          "snippet_type": { "type": "string" },
+          "scenario": { "type": "string" },
+          "observed_state": { "type": "string" },
+          "expected_state": { "type": "string" },
+          "notes": { "type": "string" }
+        },
+        "additionalProperties": true
+      }
+    },
+    "mapped_requirements": {
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "verdict_text": { "type": "string" },
+    "next_action": { "type": "string" }
+  },
+  "additionalProperties": false
+}
diff --git a/ai-compliance-sdk/payment-compliance-pack/semgrep/payment_api.yml b/ai-compliance-sdk/payment-compliance-pack/semgrep/payment_api.yml
new file mode 100644
index 0000000..36b3921
--- /dev/null
+++ b/ai-compliance-sdk/payment-compliance-pack/semgrep/payment_api.yml
@@ -0,0 +1,37 @@
+rules:
+  - id: payment-debug-route
+    message: Debug- oder Diagnosepfad im produktiven API-Code pruefen.
+    severity: WARNING
+    languages: [python, javascript, typescript, java, go]
+    pattern-regex: (?i)(/debug|/internal|/test|/actuator|/swagger|/openapi)
+
+  - id: payment-admin-route-without-auth
+    message: Administrative Route ohne offensichtlichen Auth-Schutz pruefen.
+    severity: WARNING
+    languages: [python]
+    patterns:
+      - pattern: |
+          @app.$METHOD($ROUTE)
+          def $FUNC(...):
+            ...
+      - metavariable-pattern:
+          metavariable: $ROUTE
+          pattern-regex: (?i).*(admin|config|terminal|maintenance|device|key).*
+
+  - id: payment-raw-exception-response
+    message: Roh-Exceptions duerfen nicht direkt an Clients zurueckgegeben werden.
+    severity: ERROR
+    languages: [python, javascript, typescript]
+    pattern-regex: (?i)(return .*str\(e\)|res\.status\(500\)\.send\(e|json\(.*error.*e)
+
+  - id: payment-missing-input-validation
+    message: Zahlungsrelevanter Endpunkt ohne offensichtliche Validierung pruefen.
+    severity: INFO
+    languages: [python, javascript, typescript]
+    pattern-regex: (?i)(amount|currency|terminalId|transactionId)
+
+  - id: payment-idor-risk
+    message: Direkter Zugriff ueber terminalId/transactionId ohne Pruefung.
+    severity: WARNING
+    languages: [python, javascript, typescript, java, go]
+    pattern-regex: (?i)(get.*terminalId|find.*terminalId|get.*transactionId|find.*transactionId)
diff --git a/ai-compliance-sdk/payment-compliance-pack/semgrep/payment_config.yml b/ai-compliance-sdk/payment-compliance-pack/semgrep/payment_config.yml
new file mode 100644
index 0000000..2ae0ebf
--- /dev/null
+++ b/ai-compliance-sdk/payment-compliance-pack/semgrep/payment_config.yml
@@ -0,0 +1,30 @@
+rules:
+  - id: payment-prod-config-test-endpoint
+    message: Test- oder Sandbox-Endpunkt in produktionsnaher Konfiguration erkannt.
+    severity: ERROR
+    languages: [yaml, json]
+    pattern-regex: (?i)(sandbox|test-endpoint|mock-terminal|dummy-acquirer)
+
+  - id: payment-prod-debug-flag
+    message: Unsicherer Debug-Flag in Konfiguration erkannt.
+    severity: WARNING
+    languages: [yaml, json]
+    pattern-regex: (?i)(debug:\s*true|"debug"\s*:\s*true)
+
+  - id: payment-open-cors
+    message: Offene CORS-Freigabe pruefen.
+    severity: WARNING
+    languages: [yaml, json, javascript, typescript]
+    pattern-regex: (?i)(Access-Control-Allow-Origin.*\*|origin:\s*["']\*["'])
+
+  - id: payment-insecure-session-cookie
+    message: Unsicher gesetzte Session-Cookies pruefen.
+    severity: ERROR
+    languages: [javascript, typescript, python]
+    pattern-regex: (?i)(httpOnly\s*:\s*false|secure\s*:\s*false|sameSite\s*:\s*["']none["'])
+
+  - id: payment-unbounded-retry
+    message: Retry-Konfiguration scheint unbegrenzt oder zu hoch.
+    severity: WARNING
+    languages: [yaml, json]
+    pattern-regex: (?i)(retry.*(9999|infinite|unbounded))
diff --git a/ai-compliance-sdk/payment-compliance-pack/semgrep/payment_crypto.yml b/ai-compliance-sdk/payment-compliance-pack/semgrep/payment_crypto.yml
new file mode 100644
index 0000000..55da435
--- /dev/null
+++ b/ai-compliance-sdk/payment-compliance-pack/semgrep/payment_crypto.yml
@@ -0,0 +1,43 @@
+rules:
+  - id: payment-no-md5-sha1
+    message: Unsichere Hash-Algorithmen erkannt.
+    severity: ERROR
+    languages: [python, javascript, typescript, java, go]
+    pattern-regex: (?i)\b(md5|sha1)\b
+
+  - id: payment-no-des-3des
+    message: Veraltete symmetrische Verfahren erkannt.
+    severity: ERROR
+    languages: [python, javascript, typescript, java, go]
+    pattern-regex: (?i)\b(des|3des|tripledes)\b
+
+  - id: payment-no-ecb
+    message: ECB-Modus ist fuer sensible Daten ungeeignet.
+    severity: ERROR
+    languages: [python, javascript, typescript, java, go]
+    pattern-regex: (?i)\becb\b
+
+  - id: payment-hardcoded-secret
+    message: Moeglicherweise hartkodiertes Secret erkannt.
+    severity: ERROR
+    languages: [python, javascript, typescript, java, go]
+    patterns:
+      - pattern-either:
+          - pattern: $KEY = "..."
+          - pattern: const $KEY = "..."
+          - pattern: final String $KEY = "..."
+      - metavariable-pattern:
+          metavariable: $KEY
+          pattern-regex: (?i).*(secret|apikey|api_key|password|passwd|privatekey|private_key|terminalkey|zvtkey|opiKey).*
+
+  - id: payment-weak-random
+    message: Nicht-kryptographischer Zufall in Sicherheitskontext erkannt.
+    severity: ERROR
+    languages: [python, javascript, typescript, java]
+    pattern-regex: (?i)(Math\.random|random\.random|new Random\()
+
+  - id: payment-disable-tls-verify
+    message: TLS-Zertifikatspruefung scheint deaktiviert zu sein.
+    severity: ERROR
+    languages: [python, javascript, typescript, java, go]
+    pattern-regex: (?i)(verify\s*=\s*False|rejectUnauthorized\s*:\s*false|InsecureSkipVerify\s*:\s*true|trustAll)
diff --git a/ai-compliance-sdk/payment-compliance-pack/semgrep/payment_data.yml b/ai-compliance-sdk/payment-compliance-pack/semgrep/payment_data.yml
new file mode 100644
index 0000000..a02a64b
--- /dev/null
+++ b/ai-compliance-sdk/payment-compliance-pack/semgrep/payment_data.yml
@@ -0,0 +1,30 @@
+rules:
+  - id: payment-sensitive-in-telemetry
+    message: Sensitive Zahlungsdaten in Telemetrie oder Tracing pruefen.
+    severity: ERROR
+    languages: [python, javascript, typescript, java, go]
+    pattern-regex: (?i)(trace|span|metric|telemetry).*(pan|cvv|track2|cardnumber|pin|expiry)
+
+  - id: payment-sensitive-in-cache
+    message: Sensitiver Wert in Cache-Key oder Cache-Payload pruefen.
+    severity: WARNING
+    languages: [python, javascript, typescript, java, go]
+    pattern-regex: (?i)(cache|redis|memcache).*(pan|cvv|track2|cardnumber|pin)
+
+  - id: payment-sensitive-export
+    message: Export oder Report mit sensitiven Feldern pruefen.
+    severity: WARNING
+    languages: [python, javascript, typescript, java, go]
+    pattern-regex: (?i)(export|report|csv|xlsx|pdf).*(pan|cvv|track2|cardnumber|pin)
+
+  - id: payment-test-fixture-real-data
+    message: Testdaten mit moeglichen echten Kartendaten pruefen.
+    severity: WARNING
+    languages: [json, yaml, python, javascript, typescript]
+    pattern-regex: (?i)(4111111111111111|5555555555554444|track2|cvv)
+
+  - id: payment-queue-sensitive-payload
+    message: Queue-Nachricht mit sensitiven Zahlungsfeldern pruefen.
+    severity: WARNING
+    languages: [python, javascript, typescript, java, go]
+    pattern-regex: (?i)(publish|send|enqueue).*(pan|cvv|track2|cardnumber|pin)
diff --git a/ai-compliance-sdk/payment-compliance-pack/semgrep/payment_logging.yml b/ai-compliance-sdk/payment-compliance-pack/semgrep/payment_logging.yml
new file mode 100644
index 0000000..098a103
--- /dev/null
+++ b/ai-compliance-sdk/payment-compliance-pack/semgrep/payment_logging.yml
@@ -0,0 +1,42 @@
+rules:
+  - id: payment-no-sensitive-logging-python
+    message: Sensitive Zahlungsdaten duerfen nicht geloggt werden.
+    severity: ERROR
+    languages: [python]
+    patterns:
+      - pattern-either:
+          - pattern: logging.$METHOD(..., $X, ...)
+          - pattern: logger.$METHOD(..., $X, ...)
+      - metavariable-pattern:
+          metavariable: $X
+          pattern-regex: (?i).*(pan|cvv|cvc|track2|track_2|cardnumber|card_number|karten|pin|expiry|ablauf).*
+
+  - id: payment-no-sensitive-logging-js
+    message: Sensitive Zahlungsdaten duerfen nicht geloggt werden.
+    severity: ERROR
+    languages: [javascript, typescript]
+    patterns:
+      - pattern-either:
+          - pattern: console.$METHOD(..., $X, ...)
+          - pattern: logger.$METHOD(..., $X, ...)
+      - metavariable-pattern:
+          metavariable: $X
+          pattern-regex: (?i).*(pan|cvv|cvc|track2|cardnumber|pin|expiry).*
+
+  - id: payment-no-token-logging
+    message: Tokens oder Session-IDs duerfen nicht geloggt werden.
+    severity: ERROR
+    languages: [python, javascript, typescript, java, go]
+    pattern-regex: (?i)(log|logger|logging|console)\.(debug|info|warn|error).*?(token|sessionid|session_id|authheader|authorization)
+
+  - id: payment-no-debug-logging-prod-flag
+    message: Debug-Logging darf in produktiven Pfaden nicht fest aktiviert sein.
+    severity: WARNING
+    languages: [python, javascript, typescript, java, go]
+    pattern-regex: (?i)(DEBUG\s*=\s*true|debug\s*:\s*true|setLevel\(.*DEBUG.*\))
+
+  - id: payment-audit-log-admin-action
+    message: Administrative sicherheitsrelevante Aktion ohne Audit-Hinweis pruefen.
+    severity: INFO
+    languages: [python, javascript, typescript]
+    pattern-regex: (?i)(deleteTerminal|rotateKey|updateConfig|disableDevice|enableMaintenance)
diff --git a/ai-compliance-sdk/payment-compliance-pack/statemachine/terminal_invariants.md b/ai-compliance-sdk/payment-compliance-pack/statemachine/terminal_invariants.md
new file mode 100644
index 0000000..529ea98
--- /dev/null
+++ b/ai-compliance-sdk/payment-compliance-pack/statemachine/terminal_invariants.md
@@ -0,0 +1,25 @@
+# Terminal State Machine Invariants
+
+## Invariant 1
+APPROVED darf ohne expliziten Reversal-Pfad nicht in WAITING_FOR_TERMINAL zurueckgehen.
+
+## Invariant 2
+DECLINED darf keinen Buchungserfolg oder Success-Report erzeugen.
+
+## Invariant 3
+duplicate_response darf keinen zweiten Commit und keine zweite Success-Bestaetigung erzeugen.
+
+## Invariant 4
+DESYNC muss Audit-Logging und Klaerungsstatus ausloesen.
+
+## Invariant 5
+REVERSAL_PENDING darf nicht mehrfach parallel ausgeloest werden.
+
+## Invariant 6
+invalid_command darf nie zu APPROVED fuehren.
+
+## Invariant 7
+terminal_timeout darf nie stillschweigend als Erfolg interpretiert werden.
+
+## Invariant 8
+Late responses nach finalem Zustand muessen kontrolliert behandelt werden.
diff --git a/ai-compliance-sdk/payment-compliance-pack/statemachine/terminal_states.md b/ai-compliance-sdk/payment-compliance-pack/statemachine/terminal_states.md
new file mode 100644
index 0000000..d48a34d
--- /dev/null
+++ b/ai-compliance-sdk/payment-compliance-pack/statemachine/terminal_states.md
@@ -0,0 +1,47 @@
+# Terminal Payment State Machine
+
+## States
+- IDLE
+- SESSION_OPEN
+- PAYMENT_REQUESTED
+- WAITING_FOR_TERMINAL
+- APPROVED
+- DECLINED
+- CANCELLED
+- REVERSAL_PENDING
+- REVERSED
+- ERROR
+- DESYNC
+
+## Events
+- open_session
+- close_session
+- send_payment
+- terminal_ack
+- terminal_approve
+- terminal_decline
+- terminal_timeout
+- backend_timeout
+- reconnect
+- cancel_request
+- reversal_request
+- reversal_success
+- reversal_fail
+- duplicate_response
+- invalid_command
+
+## Transitions
+| From | Event | To |
+|------|-------|----|
+| IDLE | open_session | SESSION_OPEN |
+| SESSION_OPEN | send_payment | PAYMENT_REQUESTED |
+| PAYMENT_REQUESTED | terminal_ack | WAITING_FOR_TERMINAL |
+| WAITING_FOR_TERMINAL | terminal_approve | APPROVED |
+| WAITING_FOR_TERMINAL | terminal_decline | DECLINED |
+| WAITING_FOR_TERMINAL | terminal_timeout | DESYNC |
+| WAITING_FOR_TERMINAL | cancel_request | CANCELLED |
+| APPROVED | reversal_request | REVERSAL_PENDING |
+| REVERSAL_PENDING | reversal_success | REVERSED |
+| REVERSAL_PENDING | reversal_fail | ERROR |
+| * | invalid_command | ERROR |
+| * | backend_timeout | DESYNC |
diff --git a/ai-compliance-sdk/payment-compliance-pack/statemachine/terminal_testcases.json b/ai-compliance-sdk/payment-compliance-pack/statemachine/terminal_testcases.json
new file mode 100644
index 0000000..6778a66
--- /dev/null
+++ b/ai-compliance-sdk/payment-compliance-pack/statemachine/terminal_testcases.json
@@ -0,0 +1,92 @@
+[
+  {
+    "test_id": "ZVT-SM-001",
+    "name": "Duplicate approved response",
+    "initial_state": "WAITING_FOR_TERMINAL",
+    "events": ["terminal_approve", "duplicate_response"],
+    "expected_final_state": "APPROVED",
+    "invariants": ["Invariant 3"],
+    "mapped_controls": ["TRANS-004", "TRANS-009", "ZVT-RESP-005"]
+  },
+  {
+    "test_id": "ZVT-SM-002",
+    "name": "Timeout then late success",
+    "initial_state": "WAITING_FOR_TERMINAL",
+    "events": ["terminal_timeout", "terminal_approve"],
+    "expected_final_state": "DESYNC",
+    "invariants": ["Invariant 4", "Invariant 7", "Invariant 8"],
+    "mapped_controls": ["TRANS-005", "TRANS-007", "TERMSYNC-009", "TERMSYNC-010"]
+  },
+  {
+    "test_id": "ZVT-SM-003",
+    "name": "Decline must not produce booking",
+    "initial_state": "WAITING_FOR_TERMINAL",
+    "events": ["terminal_decline"],
+    "expected_final_state": "DECLINED",
+    "invariants": ["Invariant 2"],
+    "mapped_controls": ["TRANS-011", "TRANS-025", "ZVT-RESP-002"]
+  },
+  {
+    "test_id": "ZVT-SM-004",
+    "name": "Invalid reversal before approval",
+    "initial_state": "PAYMENT_REQUESTED",
+    "events": ["reversal_request"],
+    "expected_final_state": "ERROR",
+    "invariants": ["Invariant 6"],
+    "mapped_controls": ["ZVT-REV-001", "ZVT-STATE-002", "ZVT-CMD-001"]
+  },
+  {
+    "test_id": "ZVT-SM-005",
+    "name": "Cancel during waiting",
+    "initial_state": "WAITING_FOR_TERMINAL",
+    "events": ["cancel_request"],
+    "expected_final_state": "CANCELLED",
+    "invariants": ["Invariant 7"],
+    "mapped_controls": ["TRANS-006", "ZVT-CMD-001", "ZVT-STATE-003"]
+  },
+  {
+    "test_id": "ZVT-SM-006",
+    "name": "Backend timeout after terminal ack",
+    "initial_state": "WAITING_FOR_TERMINAL",
+    "events": ["terminal_ack", "backend_timeout"],
+    "expected_final_state": "DESYNC",
+    "invariants": ["Invariant 4", "Invariant 7"],
+    "mapped_controls": ["TERMSYNC-010", "TRANS-012", "ZVT-SESSION-003"]
+  },
+  {
+    "test_id": "ZVT-SM-007",
+    "name": "Parallel reversal requests",
+    "initial_state": "APPROVED",
+    "events": ["reversal_request", "reversal_request"],
+    "expected_final_state": "REVERSAL_PENDING",
+    "invariants": ["Invariant 5"],
+    "mapped_controls": ["ZVT-REV-003", "TRANS-016", "TRANS-019"]
+  },
+  {
+    "test_id": "ZVT-SM-008",
+    "name": "Unknown response code",
+    "initial_state": "WAITING_FOR_TERMINAL",
+    "events": ["terminal_ack", "invalid_command"],
+    "expected_final_state": "ERROR",
+    "invariants": ["Invariant 6"],
+    "mapped_controls": ["ZVT-RESP-003", "ZVT-COM-005", "ZVT-STATE-005"]
+  },
+  {
+    "test_id": "ZVT-SM-009",
+    "name": "Reconnect and resume controlled",
+    "initial_state": "SESSION_OPEN",
+    "events": ["send_payment", "terminal_timeout", "reconnect"],
+    "expected_final_state": "WAITING_FOR_TERMINAL",
+    "invariants": ["Invariant 7"],
+    "mapped_controls": ["ZVT-SESSION-004", "TRANS-007", "ZVT-RT-004"]
+  },
+  {
+    "test_id": "ZVT-SM-010",
+    "name": "Late response after cancel",
+    "initial_state": "WAITING_FOR_TERMINAL",
+    "events": ["cancel_request", "terminal_approve"],
+    "expected_final_state": "DESYNC",
+    "invariants": ["Invariant 4", "Invariant 8"],
+    "mapped_controls": ["TERMSYNC-008", "TERMSYNC-009", "TRANS-018"]
+  }
+]
diff --git a/ai-compliance-sdk/policies/obligations/v2/_manifest.json b/ai-compliance-sdk/policies/obligations/v2/_manifest.json
index 6ac257e..e832663 100644
--- a/ai-compliance-sdk/policies/obligations/v2/_manifest.json
+++ b/ai-compliance-sdk/policies/obligations/v2/_manifest.json
@@ -5,13 +5,13 @@
       "id": "dsgvo",
       "file": "dsgvo_v2.json",
       "version": "1.0",
-      "count": 80
+      "count": 84
     },
     {
       "id": "ai_act",
       "file": "ai_act_v2.json",
       "version": "1.0",
-      "count": 60
+      "count": 81
     },
     {
       "id": "nis2",
@@ -54,8 +54,20 @@
       "file": "dora_v2.json",
       "version": "1.0",
       "count": 20
+    },
+    {
+      "id": "betrvg",
+      "file": "betrvg_v2.json",
+      "version": "1.0",
+      "count": 12
+    },
+    {
+      "id": "agg",
+      "file": "agg_v2.json",
+      "version": "1.0",
+      "count": 8
     }
   ],
   "tom_mapping_file": "_tom_mapping.json",
-  "total_obligations": 325
+  "total_obligations": 370
 }
\ No newline at end of file
diff --git a/ai-compliance-sdk/policies/obligations/v2/agg_v2.json b/ai-compliance-sdk/policies/obligations/v2/agg_v2.json
new file mode 100644
index 0000000..af1d901
--- /dev/null
+++ b/ai-compliance-sdk/policies/obligations/v2/agg_v2.json
@@ -0,0 +1,140 @@
+{
+  "regulation": "agg",
+  "regulation_full_name": "Allgemeines Gleichbehandlungsgesetz (AGG)",
+  "version": "1.0",
+  "obligations": [
+    {
+      "id": "AGG-OBL-001",
+      "title": "Diskriminierungsfreie Gestaltung von KI-Auswahlverfahren",
+      "description": "KI-gestuetzte Auswahlverfahren (Recruiting, Befoerderung, Kuendigung) muessen so gestaltet sein, dass keine Benachteiligung nach § 1 AGG Merkmalen (Geschlecht, Alter, ethnische Herkunft, Religion, Behinderung, sexuelle Identitaet) erfolgt.",
+      "applies_when": "AI system used in employment decisions",
+      "applies_when_condition": { "all_of": [{ "field": "organization.country", "operator": "EQUALS", "value": "DE" }, { "field": "hr_context.automated_screening", "operator": "EQUALS", "value": true }] },
+      "legal_basis": [{ "norm": "AGG", "article": "§ 1, § 7", "title": "Benachteiligungsverbot" }, { "norm": "AGG", "article": "§ 11", "title": "Ausschreibung" }],
+      "sources": [{ "type": "national_law", "ref": "§ 1, § 7, § 11 AGG" }],
+      "category": "Governance",
+      "responsible": "HR / Compliance",
+      "deadline": { "type": "on_event", "event": "Vor Einsatz im Auswahlverfahren" },
+      "sanctions": { "description": "Schadensersatz bis 3 Monatsgehaelter (§ 15 AGG), Beweislastumkehr (§ 22 AGG)" },
+      "evidence": [{ "name": "Bias-Audit-Bericht", "required": true }, "AGG-Konformitaetspruefung"],
+      "priority": "kritisch",
+      "tom_control_ids": ["TOM.FAIR.01"],
+      "breakpilot_feature": "/sdk/use-cases",
+      "valid_from": "2006-08-18",
+      "valid_until": null,
+      "version": "1.0"
+    },
+    {
+      "id": "AGG-OBL-002",
+      "title": "Keine Nutzung von Proxy-Merkmalen fuer Diskriminierung",
+      "description": "Das KI-System darf keine Proxy-Merkmale verwenden, die indirekt auf geschuetzte Kategorien schliessen lassen (z.B. Name → Herkunft, Foto → Alter/Geschlecht, PLZ → sozialer Hintergrund).",
+      "applies_when": "AI processes applicant data with identifiable features",
+      "applies_when_condition": { "all_of": [{ "field": "organization.country", "operator": "EQUALS", "value": "DE" }, { "field": "hr_context.agg_categories_visible", "operator": "EQUALS", "value": true }] },
+      "legal_basis": [{ "norm": "AGG", "article": "§ 3 Abs. 2", "title": "Mittelbare Benachteiligung" }],
+      "sources": [{ "type": "national_law", "ref": "§ 3 Abs. 2 AGG" }],
+      "category": "Technisch",
+      "responsible": "Data Science / Compliance",
+      "priority": "kritisch",
+      "evidence": [{ "name": "Feature-Analyse-Dokumentation (keine Proxy-Merkmale)", "required": true }],
+      "tom_control_ids": ["TOM.FAIR.01"],
+      "valid_from": "2006-08-18",
+      "version": "1.0"
+    },
+    {
+      "id": "AGG-OBL-003",
+      "title": "Beweislast-Dokumentation fuehren (§ 22 AGG)",
+      "description": "Bei Indizien fuer eine Benachteiligung kehrt sich die Beweislast um (§ 22 AGG). Der Arbeitgeber muss beweisen, dass KEINE Diskriminierung vorliegt. Daher ist lueckenlose Dokumentation der KI-Entscheidungslogik zwingend.",
+      "applies_when": "AI supports employment decisions in Germany",
+      "applies_when_condition": { "all_of": [{ "field": "organization.country", "operator": "EQUALS", "value": "DE" }, { "field": "data_types.employee_data", "operator": "EQUALS", "value": true }] },
+      "legal_basis": [{ "norm": "AGG", "article": "§ 22", "title": "Beweislast" }],
+      "sources": [{ "type": "national_law", "ref": "§ 22 AGG" }],
+      "category": "Governance",
+      "responsible": "HR / Legal",
+      "priority": "kritisch",
+      "deadline": { "type": "recurring", "interval": "laufend" },
+      "sanctions": { "description": "Ohne Dokumentation kann Beweislastumkehr nicht abgewehrt werden — Schadensersatz nach § 15 AGG" },
+      "evidence": [{ "name": "Entscheidungsprotokoll mit KI-Begruendung", "required": true }, "Audit-Trail aller KI-Bewertungen"],
+      "tom_control_ids": ["TOM.LOG.01", "TOM.GOV.01"],
+      "valid_from": "2006-08-18",
+      "version": "1.0"
+    },
+    {
+      "id": "AGG-OBL-004",
+      "title": "Regelmaessige Bias-Audits bei KI-gestuetzter Personalauswahl",
+      "description": "KI-Systeme im Recruiting muessen regelmaessig auf Bias geprueft werden: statistische Analyse der Ergebnisse nach Geschlecht, Altersgruppen und soweit zulaessig nach Herkunft.",
+      "applies_when": "AI ranks or scores candidates",
+      "applies_when_condition": { "all_of": [{ "field": "organization.country", "operator": "EQUALS", "value": "DE" }, { "field": "hr_context.candidate_ranking", "operator": "EQUALS", "value": true }] },
+      "legal_basis": [{ "norm": "AGG", "article": "§ 1, § 3", "title": "Unmittelbare und mittelbare Benachteiligung" }],
+      "category": "Technisch",
+      "responsible": "Data Science",
+      "priority": "hoch",
+      "deadline": { "type": "recurring", "interval": "quartalsweise" },
+      "evidence": [{ "name": "Bias-Audit-Ergebnis (letzte 3 Monate)", "required": true }],
+      "tom_control_ids": ["TOM.FAIR.01"],
+      "valid_from": "2006-08-18",
+      "version": "1.0"
+    },
+    {
+      "id": "AGG-OBL-005",
+      "title": "Schulung der HR-Entscheider ueber KI-Grenzen",
+      "description": "Personen, die KI-gestuetzte Empfehlungen im Personalbereich nutzen, muessen ueber Systemgrenzen, Bias-Risiken und ihre Pflicht zur eigenstaendigen Pruefung geschult werden.",
+      "applies_when": "AI provides recommendations for HR decisions",
+      "applies_when_condition": { "all_of": [{ "field": "organization.country", "operator": "EQUALS", "value": "DE" }, { "field": "data_types.employee_data", "operator": "EQUALS", "value": true }] },
+      "legal_basis": [{ "norm": "AGG", "article": "§ 12 Abs. 2", "title": "Pflicht des Arbeitgebers zu Schutzmassnahmen" }],
+      "category": "Organisatorisch",
+      "responsible": "HR / Training",
+      "priority": "hoch",
+      "deadline": { "type": "recurring", "interval": "jaehrlich" },
+      "evidence": [{ "name": "Schulungsnachweis AGG + KI-Kompetenz", "required": true }],
+      "tom_control_ids": [],
+      "valid_from": "2006-08-18",
+      "version": "1.0"
+    },
+    {
+      "id": "AGG-OBL-006",
+      "title": "Beschwerdemechanismus fuer abgelehnte Bewerber",
+      "description": "Bewerber muessen die Moeglichkeit haben, sich ueber KI-gestuetzte Auswahlentscheidungen zu beschweren. Die zustaendige Stelle (§ 13 AGG) muss benannt sein.",
+      "applies_when": "AI used in applicant selection process",
+      "applies_when_condition": { "all_of": [{ "field": "organization.country", "operator": "EQUALS", "value": "DE" }, { "field": "hr_context.automated_screening", "operator": "EQUALS", "value": true }] },
+      "legal_basis": [{ "norm": "AGG", "article": "§ 13", "title": "Beschwerderecht" }],
+      "category": "Organisatorisch",
+      "responsible": "HR",
+      "priority": "hoch",
+      "evidence": [{ "name": "Dokumentierter Beschwerdemechanismus", "required": true }],
+      "tom_control_ids": [],
+      "valid_from": "2006-08-18",
+      "version": "1.0"
+    },
+    {
+      "id": "AGG-OBL-007",
+      "title": "Schadensersatzrisiko dokumentieren und versichern",
+      "description": "Das Schadensersatzrisiko bei AGG-Verstoessen (bis 3 Monatsgehaelter pro Fall, § 15 AGG) muss bewertet und dokumentiert werden. Bei hohem Bewerbungsvolumen kann das kumulierte Risiko erheblich sein.",
+      "applies_when": "AI processes high volume of applications",
+      "applies_when_condition": { "all_of": [{ "field": "organization.country", "operator": "EQUALS", "value": "DE" }, { "field": "hr_context.automated_screening", "operator": "EQUALS", "value": true }] },
+      "legal_basis": [{ "norm": "AGG", "article": "§ 15", "title": "Entschaedigung und Schadensersatz" }],
+      "category": "Governance",
+      "responsible": "Legal / Finance",
+      "priority": "hoch",
+      "evidence": [{ "name": "Risikobewertung AGG-Schadensersatz", "required": false }],
+      "tom_control_ids": [],
+      "valid_from": "2006-08-18",
+      "version": "1.0"
+    },
+    {
+      "id": "AGG-OBL-008",
+      "title": "KI-Stellenausschreibungen AGG-konform gestalten",
+      "description": "Wenn KI bei der Erstellung oder Optimierung von Stellenausschreibungen eingesetzt wird, muss sichergestellt sein, dass die Ausschreibungen keine diskriminierenden Formulierungen enthalten (§ 11 AGG).",
+      "applies_when": "AI generates or optimizes job postings",
+      "applies_when_condition": { "all_of": [{ "field": "organization.country", "operator": "EQUALS", "value": "DE" }] },
+      "legal_basis": [{ "norm": "AGG", "article": "§ 11", "title": "Ausschreibung" }],
+      "category": "Organisatorisch",
+      "responsible": "HR / Marketing",
+      "priority": "hoch",
+      "evidence": [{ "name": "Pruefprotokoll Stellenausschreibung auf AGG-Konformitaet", "required": false }],
+      "tom_control_ids": [],
+      "valid_from": "2006-08-18",
+      "version": "1.0"
+    }
+  ],
+  "controls": [],
+  "incident_deadlines": []
+}
diff --git a/ai-compliance-sdk/policies/obligations/v2/ai_act_v2.json b/ai-compliance-sdk/policies/obligations/v2/ai_act_v2.json
index 0e4c8a7..12e0c75 100644
--- a/ai-compliance-sdk/policies/obligations/v2/ai_act_v2.json
+++ b/ai-compliance-sdk/policies/obligations/v2/ai_act_v2.json
@@ -12,24 +12,40 @@
       "applies_when": "uses_ai",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.uses_ai", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.uses_ai",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 5", "title": "Verbotene Praktiken im KI-Bereich"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 5",
+          "title": "Verbotene Praktiken im KI-Bereich"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 5 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 5 AI Act"
+        }
       ],
       "category": "Compliance",
       "responsible": "Geschaeftsfuehrung",
-      "sanctions": {"max_fine": "35 Mio. EUR oder 7% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "35 Mio. EUR oder 7% Jahresumsatz"
+      },
       "evidence": [
         "KI-Inventar mit Risikobewertung",
         "Dokumentierte Pruefung auf verbotene Praktiken"
       ],
       "priority": "kritisch",
-      "tom_control_ids": ["TOM.GOV.01", "TOM.GOV.02"],
+      "tom_control_ids": [
+        "TOM.GOV.01",
+        "TOM.GOV.02"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -41,25 +57,41 @@
       "applies_when": "high_risk",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 9", "title": "Risikomanagementsystem"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 9",
+          "title": "Risikomanagementsystem"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 9 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 9 AI Act"
+        }
       ],
       "category": "Governance",
       "responsible": "KI-Verantwortlicher",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Risikomanagement-Dokumentation",
         "Risikobewertungen pro KI-System",
         "Massnahmenplan"
       ],
       "priority": "kritisch",
-      "tom_control_ids": ["TOM.GOV.03", "TOM.GOV.04"],
+      "tom_control_ids": [
+        "TOM.GOV.03",
+        "TOM.GOV.04"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -71,26 +103,47 @@
       "applies_when": "high_risk_provider",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.is_ai_provider", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.is_ai_provider",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 10", "title": "Daten und Daten-Governance"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 10",
+          "title": "Daten und Daten-Governance"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 10 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 10 AI Act"
+        }
       ],
       "category": "Technisch",
       "responsible": "KI-Verantwortlicher",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Datensatzdokumentation",
         "Bias-Analyse-Berichte",
         "Datenqualitaetsnachweise"
       ],
       "priority": "hoch",
-      "tom_control_ids": ["TOM.DATA.01", "TOM.DATA.02", "TOM.DATA.03"],
+      "tom_control_ids": [
+        "TOM.DATA.01",
+        "TOM.DATA.02",
+        "TOM.DATA.03"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -102,28 +155,55 @@
       "applies_when": "high_risk_provider",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.is_ai_provider", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.is_ai_provider",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 11", "title": "Technische Dokumentation"},
-        {"norm": "AI Act", "article": "Anhang IV", "title": "Technische Dokumentation gemaess Art. 11"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 11",
+          "title": "Technische Dokumentation"
+        },
+        {
+          "norm": "AI Act",
+          "article": "Anhang IV",
+          "title": "Technische Dokumentation gemaess Art. 11"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 11 AI Act"},
-        {"type": "article", "ref": "Anhang IV AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 11 AI Act"
+        },
+        {
+          "type": "article",
+          "ref": "Anhang IV AI Act"
+        }
       ],
       "category": "Dokumentation",
       "responsible": "KI-Verantwortlicher",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Technische Dokumentation nach Anhang IV",
         "Systemarchitektur-Dokumentation",
         "Algorithmus-Beschreibung"
       ],
       "priority": "hoch",
-      "tom_control_ids": ["TOM.GOV.05", "TOM.SDLC.01"],
+      "tom_control_ids": [
+        "TOM.GOV.05",
+        "TOM.SDLC.01"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -135,25 +215,42 @@
       "applies_when": "high_risk",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 12", "title": "Aufzeichnungspflichten"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 12",
+          "title": "Aufzeichnungspflichten"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 12 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 12 AI Act"
+        }
       ],
       "category": "Technisch",
       "responsible": "IT-Leitung",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Log-System-Dokumentation",
         "Beispiel-Logs",
         "Aufbewahrungsrichtlinie"
       ],
       "priority": "hoch",
-      "tom_control_ids": ["TOM.LOG.01", "TOM.LOG.02", "TOM.LOG.03"],
+      "tom_control_ids": [
+        "TOM.LOG.01",
+        "TOM.LOG.02",
+        "TOM.LOG.03"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -165,26 +262,46 @@
       "applies_when": "high_risk_provider",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.is_ai_provider", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.is_ai_provider",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 13", "title": "Transparenz und Information fuer Betreiber"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 13",
+          "title": "Transparenz und Information fuer Betreiber"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 13 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 13 AI Act"
+        }
       ],
       "category": "Organisatorisch",
       "responsible": "KI-Verantwortlicher",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Gebrauchsanweisung",
         "Leistungsdokumentation",
         "Warnhinweise"
       ],
       "priority": "hoch",
-      "tom_control_ids": ["TOM.GOV.06", "TOM.OPS.01"],
+      "tom_control_ids": [
+        "TOM.GOV.06",
+        "TOM.OPS.01"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -196,25 +313,42 @@
       "applies_when": "high_risk",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 14", "title": "Menschliche Aufsicht"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 14",
+          "title": "Menschliche Aufsicht"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 14 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 14 AI Act"
+        }
       ],
       "category": "Organisatorisch",
       "responsible": "KI-Verantwortlicher",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Aufsichtskonzept",
         "Schulungsnachweise fuer Bediener",
         "Notfall-Abschaltprozedur"
       ],
       "priority": "kritisch",
-      "tom_control_ids": ["TOM.GOV.07", "TOM.HR.01", "TOM.OPS.02"],
+      "tom_control_ids": [
+        "TOM.GOV.07",
+        "TOM.HR.01",
+        "TOM.OPS.02"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -226,18 +360,31 @@
       "applies_when": "high_risk",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 15", "title": "Genauigkeit, Robustheit und Cybersicherheit"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 15",
+          "title": "Genauigkeit, Robustheit und Cybersicherheit"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 15 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 15 AI Act"
+        }
       ],
       "category": "Technisch",
       "responsible": "IT-Leitung",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Genauigkeits-Metriken und Tests",
         "Robustheitstests",
@@ -245,7 +392,11 @@
         "Penetrationstest-Bericht"
       ],
       "priority": "hoch",
-      "tom_control_ids": ["TOM.SDLC.02", "TOM.NET.01", "TOM.CRYPTO.01"],
+      "tom_control_ids": [
+        "TOM.SDLC.02",
+        "TOM.NET.01",
+        "TOM.CRYPTO.01"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -257,26 +408,47 @@
       "applies_when": "high_risk_deployer",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.is_ai_deployer", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.is_ai_deployer",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 26", "title": "Pflichten der Betreiber"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 26",
+          "title": "Pflichten der Betreiber"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 26 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 26 AI Act"
+        }
       ],
       "category": "Organisatorisch",
       "responsible": "KI-Verantwortlicher",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Betriebskonzept",
         "Eingabedaten-Pruefung",
         "Monitoring-Dokumentation"
       ],
       "priority": "hoch",
-      "tom_control_ids": ["TOM.OPS.03", "TOM.OPS.04", "TOM.LOG.04"],
+      "tom_control_ids": [
+        "TOM.OPS.03",
+        "TOM.OPS.04",
+        "TOM.LOG.04"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -288,27 +460,51 @@
       "applies_when": "high_risk_deployer_fria",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.is_ai_deployer", "operator": "EQUALS", "value": true},
-          {"field": "organization.is_public_authority", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.is_ai_deployer",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "organization.is_public_authority",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 27", "title": "Grundrechte-Folgenabschaetzung fuer Hochrisiko-KI-Systeme"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 27",
+          "title": "Grundrechte-Folgenabschaetzung fuer Hochrisiko-KI-Systeme"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 27 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 27 AI Act"
+        }
       ],
       "category": "Governance",
       "responsible": "KI-Verantwortlicher",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "FRIA-Dokumentation",
         "Risikobewertung Grundrechte",
         "Abhilfemassnahmen"
       ],
       "priority": "kritisch",
-      "tom_control_ids": ["TOM.GOV.08", "TOM.GOV.09"],
+      "tom_control_ids": [
+        "TOM.GOV.08",
+        "TOM.GOV.09"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -320,25 +516,41 @@
       "applies_when": "limited_risk",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.limited_risk_ai", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.limited_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 50", "title": "Transparenzpflichten fuer bestimmte KI-Systeme"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 50",
+          "title": "Transparenzpflichten fuer bestimmte KI-Systeme"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 50 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 50 AI Act"
+        }
       ],
       "category": "Organisatorisch",
       "responsible": "KI-Verantwortlicher",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Kennzeichnungskonzept",
         "Nutzerhinweise",
         "Deep-Fake-Kennzeichnung"
       ],
       "priority": "hoch",
-      "tom_control_ids": ["TOM.GOV.10", "TOM.OPS.05"],
+      "tom_control_ids": [
+        "TOM.GOV.10",
+        "TOM.OPS.05"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -350,25 +562,41 @@
       "applies_when": "gpai_provider",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.is_gpai_provider", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.is_gpai_provider",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 53", "title": "Pflichten der Anbieter von KI-Modellen mit allgemeinem Verwendungszweck"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 53",
+          "title": "Pflichten der Anbieter von KI-Modellen mit allgemeinem Verwendungszweck"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 53 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 53 AI Act"
+        }
       ],
       "category": "Dokumentation",
       "responsible": "KI-Verantwortlicher",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "GPAI-Dokumentation",
         "Trainingsdaten-Summary",
         "Urheberrechts-Policy"
       ],
       "priority": "hoch",
-      "tom_control_ids": ["TOM.GOV.11", "TOM.DATA.04"],
+      "tom_control_ids": [
+        "TOM.GOV.11",
+        "TOM.DATA.04"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -380,26 +608,47 @@
       "applies_when": "gpai_systemic_risk",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.is_gpai_provider", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.gpai_systemic_risk", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.is_gpai_provider",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.gpai_systemic_risk",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 55", "title": "Pflichten der Anbieter von KI-Modellen mit allgemeinem Verwendungszweck mit systemischem Risiko"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 55",
+          "title": "Pflichten der Anbieter von KI-Modellen mit allgemeinem Verwendungszweck mit systemischem Risiko"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 55 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 55 AI Act"
+        }
       ],
       "category": "Technisch",
       "responsible": "KI-Verantwortlicher",
-      "sanctions": {"max_fine": "35 Mio. EUR oder 7% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "35 Mio. EUR oder 7% Jahresumsatz"
+      },
       "evidence": [
         "Systemische Risikobewertung",
         "Red-Teaming-Berichte",
         "Incident-Dokumentation"
       ],
       "priority": "kritisch",
-      "tom_control_ids": ["TOM.GOV.12", "TOM.NET.02", "TOM.SDLC.03"],
+      "tom_control_ids": [
+        "TOM.GOV.12",
+        "TOM.NET.02",
+        "TOM.SDLC.03"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -411,26 +660,48 @@
       "applies_when": "high_risk",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 49", "title": "Registrierung"},
-        {"norm": "AI Act", "article": "Art. 60", "title": "EU-Datenbank fuer Hochrisiko-KI-Systeme"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 49",
+          "title": "Registrierung"
+        },
+        {
+          "norm": "AI Act",
+          "article": "Art. 60",
+          "title": "EU-Datenbank fuer Hochrisiko-KI-Systeme"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 49 AI Act"},
-        {"type": "article", "ref": "Art. 60 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 49 AI Act"
+        },
+        {
+          "type": "article",
+          "ref": "Art. 60 AI Act"
+        }
       ],
       "category": "Meldepflicht",
       "responsible": "KI-Verantwortlicher",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Registrierungsbestaetigung",
         "EU-Datenbank-Eintrag"
       ],
       "priority": "hoch",
-      "tom_control_ids": ["TOM.GOV.13"],
+      "tom_control_ids": [
+        "TOM.GOV.13"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -442,25 +713,41 @@
       "applies_when": "uses_ai",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.uses_ai", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.uses_ai",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 4", "title": "KI-Kompetenz"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 4",
+          "title": "KI-Kompetenz"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 4 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 4 AI Act"
+        }
       ],
       "category": "Schulung",
       "responsible": "Geschaeftsfuehrung",
-      "sanctions": {"max_fine": "7,5 Mio. EUR oder 1% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "7,5 Mio. EUR oder 1% Jahresumsatz"
+      },
       "evidence": [
         "Schulungsnachweise",
         "Kompetenzmatrix",
         "Awareness-Programm"
       ],
       "priority": "mittel",
-      "tom_control_ids": ["TOM.HR.02", "TOM.HR.03"],
+      "tom_control_ids": [
+        "TOM.HR.02",
+        "TOM.HR.03"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -472,27 +759,50 @@
       "applies_when": "uses_ai",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.uses_ai", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.uses_ai",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 6", "title": "Klassifizierungsregeln fuer Hochrisiko-KI-Systeme"},
-        {"norm": "AI Act", "article": "Anhang III", "title": "Hochrisiko-KI-Systeme gemaess Art. 6 Abs. 2"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 6",
+          "title": "Klassifizierungsregeln fuer Hochrisiko-KI-Systeme"
+        },
+        {
+          "norm": "AI Act",
+          "article": "Anhang III",
+          "title": "Hochrisiko-KI-Systeme gemaess Art. 6 Abs. 2"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 6 AI Act"},
-        {"type": "article", "ref": "Anhang III AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 6 AI Act"
+        },
+        {
+          "type": "article",
+          "ref": "Anhang III AI Act"
+        }
       ],
       "category": "Governance",
       "responsible": "KI-Verantwortlicher",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Klassifizierungsbericht je KI-System",
         "Anhang-III-Pruefung dokumentiert",
         "Entscheidungsmatrix Risikoeinstufung"
       ],
       "priority": "kritisch",
-      "tom_control_ids": ["TOM.GOV.01", "TOM.GOV.03"],
+      "tom_control_ids": [
+        "TOM.GOV.01",
+        "TOM.GOV.03"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -504,24 +814,39 @@
       "applies_when": "uses_ai",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.uses_ai", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.uses_ai",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 7", "title": "Aenderungen des Anhangs III"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 7",
+          "title": "Aenderungen des Anhangs III"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 7 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 7 AI Act"
+        }
       ],
       "category": "Governance",
       "responsible": "KI-Verantwortlicher",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Monitoring-Prozess fuer regulatorische Aenderungen",
         "Re-Klassifizierungsprotokolle"
       ],
       "priority": "mittel",
-      "tom_control_ids": ["TOM.GOV.01"],
+      "tom_control_ids": [
+        "TOM.GOV.01"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -533,26 +858,46 @@
       "applies_when": "high_risk_provider",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.is_ai_provider", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.is_ai_provider",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 8", "title": "Einhaltung der Anforderungen"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 8",
+          "title": "Einhaltung der Anforderungen"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 8 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 8 AI Act"
+        }
       ],
       "category": "Compliance",
       "responsible": "KI-Verantwortlicher",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Compliance-Checkliste Art. 8-15",
         "Nachweis der Anforderungserfuellung",
         "Gap-Analyse"
       ],
       "priority": "hoch",
-      "tom_control_ids": ["TOM.GOV.04", "TOM.GOV.05"],
+      "tom_control_ids": [
+        "TOM.GOV.04",
+        "TOM.GOV.05"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -564,26 +909,47 @@
       "applies_when": "high_risk_provider",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.is_ai_provider", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.is_ai_provider",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 16", "title": "Pflichten der Anbieter von Hochrisiko-KI-Systemen"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 16",
+          "title": "Pflichten der Anbieter von Hochrisiko-KI-Systemen"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 16 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 16 AI Act"
+        }
       ],
       "category": "Compliance",
       "responsible": "Geschaeftsfuehrung",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Anbieter-Compliance-Nachweis",
         "QMS-Dokumentation",
         "Konformitaetserklaerung"
       ],
       "priority": "kritisch",
-      "tom_control_ids": ["TOM.GOV.01", "TOM.GOV.05", "TOM.GOV.14"],
+      "tom_control_ids": [
+        "TOM.GOV.01",
+        "TOM.GOV.05",
+        "TOM.GOV.14"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -595,19 +961,36 @@
       "applies_when": "high_risk_provider",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.is_ai_provider", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.is_ai_provider",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 17", "title": "Qualitaetsmanagementsystem"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 17",
+          "title": "Qualitaetsmanagementsystem"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 17 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 17 AI Act"
+        }
       ],
       "category": "Governance",
       "responsible": "Qualitaetsmanagement",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "QMS-Handbuch",
         "Prozessbeschreibungen",
@@ -615,7 +998,11 @@
         "Management-Review-Protokolle"
       ],
       "priority": "hoch",
-      "tom_control_ids": ["TOM.GOV.14", "TOM.GOV.15", "TOM.SDLC.04"],
+      "tom_control_ids": [
+        "TOM.GOV.14",
+        "TOM.GOV.15",
+        "TOM.SDLC.04"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -627,26 +1014,46 @@
       "applies_when": "high_risk_provider",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.is_ai_provider", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.is_ai_provider",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 18", "title": "Dokumentationspflichten"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 18",
+          "title": "Dokumentationspflichten"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 18 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 18 AI Act"
+        }
       ],
       "category": "Dokumentation",
       "responsible": "KI-Verantwortlicher",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Aufbewahrungsrichtlinie",
         "Archivierungssystem-Nachweis",
         "Zugangsprotokoll fuer Behoerden"
       ],
       "priority": "hoch",
-      "tom_control_ids": ["TOM.DATA.05", "TOM.DATA.06"],
+      "tom_control_ids": [
+        "TOM.DATA.05",
+        "TOM.DATA.06"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -658,28 +1065,55 @@
       "applies_when": "high_risk_provider",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.is_ai_provider", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.is_ai_provider",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 19", "title": "Konformitaetsbewertung"},
-        {"norm": "AI Act", "article": "Art. 43", "title": "Konformitaetsbewertungsverfahren"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 19",
+          "title": "Konformitaetsbewertung"
+        },
+        {
+          "norm": "AI Act",
+          "article": "Art. 43",
+          "title": "Konformitaetsbewertungsverfahren"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 19 AI Act"},
-        {"type": "article", "ref": "Art. 43 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 19 AI Act"
+        },
+        {
+          "type": "article",
+          "ref": "Art. 43 AI Act"
+        }
       ],
       "category": "Audit",
       "responsible": "KI-Verantwortlicher",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Konformitaetsbewertungsbericht",
         "Zertifikat notifizierte Stelle (falls zutreffend)",
         "Interne Audit-Dokumentation"
       ],
       "priority": "kritisch",
-      "tom_control_ids": ["TOM.GOV.04", "TOM.GOV.14"],
+      "tom_control_ids": [
+        "TOM.GOV.04",
+        "TOM.GOV.14"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -691,26 +1125,47 @@
       "applies_when": "high_risk_provider",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.is_ai_provider", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.is_ai_provider",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 20", "title": "Automatisch generierte Protokolle"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 20",
+          "title": "Automatisch generierte Protokolle"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 20 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 20 AI Act"
+        }
       ],
       "category": "Technisch",
       "responsible": "IT-Leitung",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Log-Export-Funktion",
         "Protokoll-Zugriffskonzept",
         "Behoerden-Schnittstelle"
       ],
       "priority": "hoch",
-      "tom_control_ids": ["TOM.LOG.01", "TOM.LOG.05", "TOM.LOG.06"],
+      "tom_control_ids": [
+        "TOM.LOG.01",
+        "TOM.LOG.05",
+        "TOM.LOG.06"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -722,26 +1177,46 @@
       "applies_when": "high_risk_provider",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.is_ai_provider", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.is_ai_provider",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 21", "title": "Korrekturmassnahmen und Informationspflicht"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 21",
+          "title": "Korrekturmassnahmen und Informationspflicht"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 21 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 21 AI Act"
+        }
       ],
       "category": "Compliance",
       "responsible": "Geschaeftsfuehrung",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Korrekturmassnahmen-Prozess",
         "Rueckruf-Verfahren",
         "Behoerden-Meldungen"
       ],
       "priority": "kritisch",
-      "tom_control_ids": ["TOM.OPS.06", "TOM.BCP.01"],
+      "tom_control_ids": [
+        "TOM.OPS.06",
+        "TOM.BCP.01"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -753,28 +1228,55 @@
       "applies_when": "high_risk_provider",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.is_ai_provider", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.is_ai_provider",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 22", "title": "Informationspflichten"},
-        {"norm": "AI Act", "article": "Art. 23", "title": "Zusammenarbeit mit Behoerden"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 22",
+          "title": "Informationspflichten"
+        },
+        {
+          "norm": "AI Act",
+          "article": "Art. 23",
+          "title": "Zusammenarbeit mit Behoerden"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 22 AI Act"},
-        {"type": "article", "ref": "Art. 23 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 22 AI Act"
+        },
+        {
+          "type": "article",
+          "ref": "Art. 23 AI Act"
+        }
       ],
       "category": "Meldepflicht",
       "responsible": "KI-Verantwortlicher",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Behoerden-Kommunikationsprotokoll",
         "Informationsbereitstellungs-Prozess",
         "Ansprechpartner-Benennung"
       ],
       "priority": "hoch",
-      "tom_control_ids": ["TOM.GOV.06", "TOM.GOV.13"],
+      "tom_control_ids": [
+        "TOM.GOV.06",
+        "TOM.GOV.13"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -786,26 +1288,46 @@
       "applies_when": "high_risk_provider",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.is_ai_provider", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.is_ai_provider",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 24", "title": "Pflichten der Bevollmaechtigten"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 24",
+          "title": "Pflichten der Bevollmaechtigten"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 24 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 24 AI Act"
+        }
       ],
       "category": "Organisatorisch",
       "responsible": "Geschaeftsfuehrung",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Bevollmaechtigten-Vertrag",
         "Vollmacht-Dokumentation",
         "Kontaktdaten EU-Bevollmaechtigter"
       ],
       "priority": "hoch",
-      "tom_control_ids": ["TOM.GOV.01", "TOM.VENDOR.01"],
+      "tom_control_ids": [
+        "TOM.GOV.01",
+        "TOM.VENDOR.01"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -817,25 +1339,41 @@
       "applies_when": "high_risk",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 25", "title": "Pflichten der Einführer"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 25",
+          "title": "Pflichten der Einführer"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 25 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 25 AI Act"
+        }
       ],
       "category": "Compliance",
       "responsible": "Geschaeftsfuehrung",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Importeur-Pruefprotokoll",
         "Konformitaetserklaerung des Anbieters",
         "CE-Kennzeichnungsnachweis"
       ],
       "priority": "hoch",
-      "tom_control_ids": ["TOM.VENDOR.02", "TOM.VENDOR.03"],
+      "tom_control_ids": [
+        "TOM.VENDOR.02",
+        "TOM.VENDOR.03"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -847,26 +1385,46 @@
       "applies_when": "high_risk_deployer",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.is_ai_deployer", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.is_ai_deployer",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 26 Abs. 4", "title": "Eingabedatenkontrolle durch Betreiber"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 26 Abs. 4",
+          "title": "Eingabedatenkontrolle durch Betreiber"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 26 Abs. 4 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 26 Abs. 4 AI Act"
+        }
       ],
       "category": "Technisch",
       "responsible": "IT-Leitung",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Eingabedaten-Qualitaetspruefung",
         "Datenvalidierungsprotokolle",
         "Repraesentativitaets-Analyse"
       ],
       "priority": "hoch",
-      "tom_control_ids": ["TOM.DATA.07", "TOM.DATA.08"],
+      "tom_control_ids": [
+        "TOM.DATA.07",
+        "TOM.DATA.08"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -878,26 +1436,47 @@
       "applies_when": "high_risk_deployer",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.is_ai_deployer", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.is_ai_deployer",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 26 Abs. 5", "title": "Monitoring-Pflicht der Betreiber"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 26 Abs. 5",
+          "title": "Monitoring-Pflicht der Betreiber"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 26 Abs. 5 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 26 Abs. 5 AI Act"
+        }
       ],
       "category": "Technisch",
       "responsible": "IT-Leitung",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Monitoring-Dashboard",
         "Log-Aufbewahrungsnachweis",
         "Eskalationsprozess-Dokumentation"
       ],
       "priority": "hoch",
-      "tom_control_ids": ["TOM.LOG.04", "TOM.LOG.07", "TOM.OPS.07"],
+      "tom_control_ids": [
+        "TOM.LOG.04",
+        "TOM.LOG.07",
+        "TOM.OPS.07"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -909,27 +1488,51 @@
       "applies_when": "high_risk_deployer",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.is_ai_deployer", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.ai_makes_decisions", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.is_ai_deployer",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.ai_makes_decisions",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 26 Abs. 7", "title": "Informationspflicht gegenueber betroffenen Personen"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 26 Abs. 7",
+          "title": "Informationspflicht gegenueber betroffenen Personen"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 26 Abs. 7 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 26 Abs. 7 AI Act"
+        }
       ],
       "category": "Organisatorisch",
       "responsible": "KI-Verantwortlicher",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Informationsschreiben-Vorlagen",
         "Nachweis der Benachrichtigung",
         "Datenschutzerklaerung mit KI-Hinweis"
       ],
       "priority": "hoch",
-      "tom_control_ids": ["TOM.GOV.10", "TOM.OPS.05"],
+      "tom_control_ids": [
+        "TOM.GOV.10",
+        "TOM.OPS.05"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -941,28 +1544,55 @@
       "applies_when": "high_risk_deployer",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.is_ai_deployer", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.is_ai_deployer",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 26 Abs. 9", "title": "DSFA-Pflicht fuer Betreiber"},
-        {"norm": "DSGVO", "article": "Art. 35", "title": "Datenschutz-Folgenabschaetzung"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 26 Abs. 9",
+          "title": "DSFA-Pflicht fuer Betreiber"
+        },
+        {
+          "norm": "DSGVO",
+          "article": "Art. 35",
+          "title": "Datenschutz-Folgenabschaetzung"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 26 Abs. 9 AI Act"},
-        {"type": "article", "ref": "Art. 35 DSGVO"}
+        {
+          "type": "article",
+          "ref": "Art. 26 Abs. 9 AI Act"
+        },
+        {
+          "type": "article",
+          "ref": "Art. 35 DSGVO"
+        }
       ],
       "category": "Governance",
       "responsible": "Datenschutzbeauftragter",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "DSFA-Bericht",
         "FRIA-Integration",
         "Massnahmenplan"
       ],
       "priority": "kritisch",
-      "tom_control_ids": ["TOM.GOV.08", "TOM.GOV.09"],
+      "tom_control_ids": [
+        "TOM.GOV.08",
+        "TOM.GOV.09"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -974,26 +1604,46 @@
       "applies_when": "high_risk_deployer",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.is_ai_deployer", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.is_ai_deployer",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 26 Abs. 10", "title": "Betreiber als Anbieter"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 26 Abs. 10",
+          "title": "Betreiber als Anbieter"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 26 Abs. 10 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 26 Abs. 10 AI Act"
+        }
       ],
       "category": "Compliance",
       "responsible": "Geschaeftsfuehrung",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Pruefung Anbieter-Status",
         "Aenderungsprotokoll KI-System",
         "Umklassifizierungsentscheidung"
       ],
       "priority": "hoch",
-      "tom_control_ids": ["TOM.GOV.01", "TOM.GOV.03"],
+      "tom_control_ids": [
+        "TOM.GOV.01",
+        "TOM.GOV.03"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -1005,25 +1655,41 @@
       "applies_when": "high_risk",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 28", "title": "Pflichten der Haendler"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 28",
+          "title": "Pflichten der Haendler"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 28 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 28 AI Act"
+        }
       ],
       "category": "Compliance",
       "responsible": "Geschaeftsfuehrung",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Haendler-Checkliste",
         "Eingangs-Pruefprotokoll",
         "Lieferanten-Dokumentation"
       ],
       "priority": "mittel",
-      "tom_control_ids": ["TOM.VENDOR.04", "TOM.VENDOR.05"],
+      "tom_control_ids": [
+        "TOM.VENDOR.04",
+        "TOM.VENDOR.05"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -1035,26 +1701,46 @@
       "applies_when": "high_risk_provider",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.is_ai_provider", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.is_ai_provider",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 29", "title": "Pflichten von Dritten in der Wertschoepfungskette"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 29",
+          "title": "Pflichten von Dritten in der Wertschoepfungskette"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 29 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 29 AI Act"
+        }
       ],
       "category": "Organisatorisch",
       "responsible": "KI-Verantwortlicher",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Lieferantenvertraege",
         "Informationsaustausch-Protokolle",
         "Supply-Chain-Due-Diligence"
       ],
       "priority": "mittel",
-      "tom_control_ids": ["TOM.VENDOR.06", "TOM.VENDOR.07"],
+      "tom_control_ids": [
+        "TOM.VENDOR.06",
+        "TOM.VENDOR.07"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -1066,27 +1752,51 @@
       "applies_when": "high_risk_provider",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.is_ai_provider", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.uses_biometric_ai", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.is_ai_provider",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.uses_biometric_ai",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 43", "title": "Konformitaetsbewertungsstellen"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 43",
+          "title": "Konformitaetsbewertungsstellen"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 43 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 43 AI Act"
+        }
       ],
       "category": "Audit",
       "responsible": "KI-Verantwortlicher",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Notifizierte-Stelle-Beauftragung",
         "Akkreditierungsnachweis",
         "Bewertungsbericht der notifizierten Stelle"
       ],
       "priority": "kritisch",
-      "tom_control_ids": ["TOM.GOV.14", "TOM.GOV.15"],
+      "tom_control_ids": [
+        "TOM.GOV.14",
+        "TOM.GOV.15"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -1098,28 +1808,55 @@
       "applies_when": "high_risk_provider",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.is_ai_provider", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.is_ai_provider",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 47", "title": "EU-Konformitaetserklaerung"},
-        {"norm": "AI Act", "article": "Anhang V", "title": "Inhalt der EU-Konformitaetserklaerung"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 47",
+          "title": "EU-Konformitaetserklaerung"
+        },
+        {
+          "norm": "AI Act",
+          "article": "Anhang V",
+          "title": "Inhalt der EU-Konformitaetserklaerung"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 47 AI Act"},
-        {"type": "article", "ref": "Anhang V AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 47 AI Act"
+        },
+        {
+          "type": "article",
+          "ref": "Anhang V AI Act"
+        }
       ],
       "category": "Dokumentation",
       "responsible": "KI-Verantwortlicher",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "EU-Konformitaetserklaerung nach Anhang V",
         "Unterschriebene Erklaerung",
         "Verzeichnis der KI-Systeme mit Erklaerungen"
       ],
       "priority": "hoch",
-      "tom_control_ids": ["TOM.GOV.05", "TOM.GOV.14"],
+      "tom_control_ids": [
+        "TOM.GOV.05",
+        "TOM.GOV.14"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -1131,26 +1868,45 @@
       "applies_when": "high_risk_provider",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.is_ai_provider", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.is_ai_provider",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 48", "title": "CE-Kennzeichnung"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 48",
+          "title": "CE-Kennzeichnung"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 48 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 48 AI Act"
+        }
       ],
       "category": "Compliance",
       "responsible": "KI-Verantwortlicher",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "CE-Kennzeichnungsnachweis",
         "Screenshot digitale Schnittstelle",
         "Produktdokumentation"
       ],
       "priority": "hoch",
-      "tom_control_ids": ["TOM.GOV.05"],
+      "tom_control_ids": [
+        "TOM.GOV.05"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -1162,25 +1918,44 @@
       "applies_when": "high_risk_deployer",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.is_ai_deployer", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.is_ai_deployer",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 49 Abs. 3", "title": "Registrierungspflicht der Betreiber"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 49 Abs. 3",
+          "title": "Registrierungspflicht der Betreiber"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 49 Abs. 3 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 49 Abs. 3 AI Act"
+        }
       ],
       "category": "Meldepflicht",
       "responsible": "KI-Verantwortlicher",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Betreiber-Registrierungsbestaetigung",
         "EU-Datenbank-Eintrag"
       ],
       "priority": "hoch",
-      "tom_control_ids": ["TOM.GOV.13"],
+      "tom_control_ids": [
+        "TOM.GOV.13"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -1192,25 +1967,41 @@
       "applies_when": "limited_risk",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.uses_emotion_recognition", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.uses_emotion_recognition",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 50 Abs. 3", "title": "Transparenz bei Emotionserkennung"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 50 Abs. 3",
+          "title": "Transparenz bei Emotionserkennung"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 50 Abs. 3 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 50 Abs. 3 AI Act"
+        }
       ],
       "category": "Organisatorisch",
       "responsible": "KI-Verantwortlicher",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Informationshinweis Emotionserkennung",
         "Einwilligungsnachweis",
         "Aushang oder digitaler Hinweis"
       ],
       "priority": "kritisch",
-      "tom_control_ids": ["TOM.GOV.10", "TOM.OPS.05"],
+      "tom_control_ids": [
+        "TOM.GOV.10",
+        "TOM.OPS.05"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -1222,25 +2013,41 @@
       "applies_when": "limited_risk",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.uses_deepfakes", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.uses_deepfakes",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 50 Abs. 4", "title": "Kennzeichnung von Deep Fakes"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 50 Abs. 4",
+          "title": "Kennzeichnung von Deep Fakes"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 50 Abs. 4 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 50 Abs. 4 AI Act"
+        }
       ],
       "category": "Technisch",
       "responsible": "IT-Leitung",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Deep-Fake-Kennzeichnungssystem",
         "Maschinenlesbare Metadaten",
         "Wasserzeichen-Implementation"
       ],
       "priority": "hoch",
-      "tom_control_ids": ["TOM.SDLC.05", "TOM.OPS.08"],
+      "tom_control_ids": [
+        "TOM.SDLC.05",
+        "TOM.OPS.08"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -1252,25 +2059,41 @@
       "applies_when": "limited_risk",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.uses_generative_ai", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.uses_generative_ai",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 50 Abs. 2", "title": "Kennzeichnung KI-generierter Inhalte"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 50 Abs. 2",
+          "title": "Kennzeichnung KI-generierter Inhalte"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 50 Abs. 2 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 50 Abs. 2 AI Act"
+        }
       ],
       "category": "Technisch",
       "responsible": "IT-Leitung",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Content-Watermarking-System",
         "Metadaten-Standard (C2PA o.ae.)",
         "Kennzeichnungs-Testbericht"
       ],
       "priority": "hoch",
-      "tom_control_ids": ["TOM.SDLC.05", "TOM.SDLC.06"],
+      "tom_control_ids": [
+        "TOM.SDLC.05",
+        "TOM.SDLC.06"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -1282,25 +2105,41 @@
       "applies_when": "gpai_provider",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.is_gpai_provider", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.is_gpai_provider",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 53 Abs. 1 lit. b", "title": "Informationspflicht GPAI-Anbieter"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 53 Abs. 1 lit. b",
+          "title": "Informationspflicht GPAI-Anbieter"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 53 Abs. 1 lit. b AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 53 Abs. 1 lit. b AI Act"
+        }
       ],
       "category": "Dokumentation",
       "responsible": "KI-Verantwortlicher",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Downstream-Provider-Dokumentation",
         "Modellkarte (Model Card)",
         "API-Dokumentation mit Limitierungen"
       ],
       "priority": "hoch",
-      "tom_control_ids": ["TOM.GOV.11", "TOM.SDLC.07"],
+      "tom_control_ids": [
+        "TOM.GOV.11",
+        "TOM.SDLC.07"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -1312,25 +2151,41 @@
       "applies_when": "gpai_provider",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.is_gpai_provider", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.is_gpai_provider",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 53 Abs. 1 lit. c", "title": "Urheberrechtspolitik GPAI"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 53 Abs. 1 lit. c",
+          "title": "Urheberrechtspolitik GPAI"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 53 Abs. 1 lit. c AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 53 Abs. 1 lit. c AI Act"
+        }
       ],
       "category": "Governance",
       "responsible": "Rechtsabteilung",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Urheberrechts-Policy veroeffentlicht",
         "Opt-out-Mechanismus dokumentiert",
         "Trainingsdaten-Compliance-Bericht"
       ],
       "priority": "hoch",
-      "tom_control_ids": ["TOM.GOV.11", "TOM.DATA.09"],
+      "tom_control_ids": [
+        "TOM.GOV.11",
+        "TOM.DATA.09"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -1342,25 +2197,41 @@
       "applies_when": "gpai_provider",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.is_gpai_provider", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.is_gpai_provider",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 53 Abs. 1 lit. d", "title": "Trainingsdaten-Zusammenfassung"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 53 Abs. 1 lit. d",
+          "title": "Trainingsdaten-Zusammenfassung"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 53 Abs. 1 lit. d AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 53 Abs. 1 lit. d AI Act"
+        }
       ],
       "category": "Dokumentation",
       "responsible": "KI-Verantwortlicher",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Trainingsdaten-Zusammenfassung (AI Office Template)",
         "Veroeffentlichungsnachweis",
         "Datenquellen-Verzeichnis"
       ],
       "priority": "hoch",
-      "tom_control_ids": ["TOM.DATA.04", "TOM.DATA.10"],
+      "tom_control_ids": [
+        "TOM.DATA.04",
+        "TOM.DATA.10"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -1372,26 +2243,46 @@
       "applies_when": "gpai_systemic_risk",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.is_gpai_provider", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.gpai_systemic_risk", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.is_gpai_provider",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.gpai_systemic_risk",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 55 Abs. 1 lit. a", "title": "Modellbewertung bei systemischem Risiko"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 55 Abs. 1 lit. a",
+          "title": "Modellbewertung bei systemischem Risiko"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 55 Abs. 1 lit. a AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 55 Abs. 1 lit. a AI Act"
+        }
       ],
       "category": "Audit",
       "responsible": "KI-Verantwortlicher",
-      "sanctions": {"max_fine": "35 Mio. EUR oder 7% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "35 Mio. EUR oder 7% Jahresumsatz"
+      },
       "evidence": [
         "Modellbewertungsbericht",
         "Red-Teaming-Protokolle",
         "Benchmark-Ergebnisse"
       ],
       "priority": "kritisch",
-      "tom_control_ids": ["TOM.SDLC.08", "TOM.SDLC.09"],
+      "tom_control_ids": [
+        "TOM.SDLC.08",
+        "TOM.SDLC.09"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -1403,26 +2294,46 @@
       "applies_when": "gpai_systemic_risk",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.is_gpai_provider", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.gpai_systemic_risk", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.is_gpai_provider",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.gpai_systemic_risk",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 55 Abs. 1 lit. b", "title": "Bewertung systemischer Risiken"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 55 Abs. 1 lit. b",
+          "title": "Bewertung systemischer Risiken"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 55 Abs. 1 lit. b AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 55 Abs. 1 lit. b AI Act"
+        }
       ],
       "category": "Governance",
       "responsible": "Geschaeftsfuehrung",
-      "sanctions": {"max_fine": "35 Mio. EUR oder 7% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "35 Mio. EUR oder 7% Jahresumsatz"
+      },
       "evidence": [
         "Systemische Risikobewertung",
         "Minderungsmassnahmen-Plan",
         "Impact-Assessment EU-Ebene"
       ],
       "priority": "kritisch",
-      "tom_control_ids": ["TOM.GOV.03", "TOM.GOV.12"],
+      "tom_control_ids": [
+        "TOM.GOV.03",
+        "TOM.GOV.12"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -1434,26 +2345,47 @@
       "applies_when": "gpai_systemic_risk",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.is_gpai_provider", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.gpai_systemic_risk", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.is_gpai_provider",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.gpai_systemic_risk",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 55 Abs. 1 lit. d", "title": "Cybersicherheit GPAI"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 55 Abs. 1 lit. d",
+          "title": "Cybersicherheit GPAI"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 55 Abs. 1 lit. d AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 55 Abs. 1 lit. d AI Act"
+        }
       ],
       "category": "Technisch",
       "responsible": "IT-Leitung",
-      "sanctions": {"max_fine": "35 Mio. EUR oder 7% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "35 Mio. EUR oder 7% Jahresumsatz"
+      },
       "evidence": [
         "Cybersicherheits-Assessment",
         "Penetrationstest-Bericht",
         "Infrastruktur-Security-Audit"
       ],
       "priority": "kritisch",
-      "tom_control_ids": ["TOM.NET.02", "TOM.NET.03", "TOM.CRYPTO.02"],
+      "tom_control_ids": [
+        "TOM.NET.02",
+        "TOM.NET.03",
+        "TOM.CRYPTO.02"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -1465,26 +2397,46 @@
       "applies_when": "gpai_systemic_risk",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.is_gpai_provider", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.gpai_systemic_risk", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.is_gpai_provider",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.gpai_systemic_risk",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 55 Abs. 1 lit. c", "title": "Vorfallmeldung GPAI"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 55 Abs. 1 lit. c",
+          "title": "Vorfallmeldung GPAI"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 55 Abs. 1 lit. c AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 55 Abs. 1 lit. c AI Act"
+        }
       ],
       "category": "Meldepflicht",
       "responsible": "KI-Verantwortlicher",
-      "sanctions": {"max_fine": "35 Mio. EUR oder 7% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "35 Mio. EUR oder 7% Jahresumsatz"
+      },
       "evidence": [
         "Incident-Response-Plan GPAI",
         "Meldungen an AI Office",
         "Korrekturmassnahmen-Dokumentation"
       ],
       "priority": "kritisch",
-      "tom_control_ids": ["TOM.BCP.02", "TOM.BCP.03"],
+      "tom_control_ids": [
+        "TOM.BCP.02",
+        "TOM.BCP.03"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -1496,25 +2448,40 @@
       "applies_when": "uses_ai",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.uses_ai", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.uses_ai",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 57", "title": "KI-Reallabore (Regulatory Sandboxes)"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 57",
+          "title": "KI-Reallabore (Regulatory Sandboxes)"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 57 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 57 AI Act"
+        }
       ],
       "category": "Governance",
       "responsible": "Geschaeftsfuehrung",
-      "sanctions": {"max_fine": "7,5 Mio. EUR oder 1% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "7,5 Mio. EUR oder 1% Jahresumsatz"
+      },
       "evidence": [
         "Sandbox-Antrag (falls zutreffend)",
         "Sandbox-Plan",
         "Abschlussberichte"
       ],
       "priority": "niedrig",
-      "tom_control_ids": ["TOM.GOV.01"],
+      "tom_control_ids": [
+        "TOM.GOV.01"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -1526,26 +2493,46 @@
       "applies_when": "high_risk_provider",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.is_ai_provider", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.is_ai_provider",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 72", "title": "Post-Market-Monitoring durch Anbieter"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 72",
+          "title": "Post-Market-Monitoring durch Anbieter"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 72 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 72 AI Act"
+        }
       ],
       "category": "Technisch",
       "responsible": "KI-Verantwortlicher",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Post-Market-Monitoring-Plan",
         "Monitoring-Berichte",
         "Feedback-Erfassungssystem"
       ],
       "priority": "hoch",
-      "tom_control_ids": ["TOM.OPS.09", "TOM.OPS.10"],
+      "tom_control_ids": [
+        "TOM.OPS.09",
+        "TOM.OPS.10"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -1557,18 +2544,31 @@
       "applies_when": "high_risk",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 73", "title": "Meldung schwerwiegender Vorfaelle"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 73",
+          "title": "Meldung schwerwiegender Vorfaelle"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 73 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 73 AI Act"
+        }
       ],
       "category": "Meldepflicht",
       "responsible": "KI-Verantwortlicher",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Incident-Response-Plan",
         "Meldeprozess dokumentiert",
@@ -1576,7 +2576,11 @@
         "Meldeformulare vorbereitet"
       ],
       "priority": "kritisch",
-      "tom_control_ids": ["TOM.BCP.01", "TOM.BCP.02", "TOM.BCP.04"],
+      "tom_control_ids": [
+        "TOM.BCP.01",
+        "TOM.BCP.02",
+        "TOM.BCP.04"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -1588,25 +2592,42 @@
       "applies_when": "uses_ai",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.uses_ai", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.uses_ai",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 78", "title": "Vertraulichkeit"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 78",
+          "title": "Vertraulichkeit"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 78 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 78 AI Act"
+        }
       ],
       "category": "Organisatorisch",
       "responsible": "Geschaeftsfuehrung",
-      "sanctions": {"max_fine": "7,5 Mio. EUR oder 1% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "7,5 Mio. EUR oder 1% Jahresumsatz"
+      },
       "evidence": [
         "Vertraulichkeitsvereinbarungen (NDA)",
         "Informationsklassifizierung",
         "Zugriffskontrollen fuer KI-Dokumentation"
       ],
       "priority": "mittel",
-      "tom_control_ids": ["TOM.AC.01", "TOM.IAM.01", "TOM.CRYPTO.03"],
+      "tom_control_ids": [
+        "TOM.AC.01",
+        "TOM.IAM.01",
+        "TOM.CRYPTO.03"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -1618,25 +2639,41 @@
       "applies_when": "uses_ai",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.uses_ai", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.uses_ai",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 99", "title": "Inkrafttreten und Geltungsbeginn"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 99",
+          "title": "Inkrafttreten und Geltungsbeginn"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 99 AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 99 AI Act"
+        }
       ],
       "category": "Compliance",
       "responsible": "Geschaeftsfuehrung",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Umsetzungs-Roadmap",
         "Meilensteinplan AI Act",
         "Compliance-Fortschrittsbericht"
       ],
       "priority": "hoch",
-      "tom_control_ids": ["TOM.GOV.01", "TOM.GOV.02"],
+      "tom_control_ids": [
+        "TOM.GOV.01",
+        "TOM.GOV.02"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -1648,28 +2685,55 @@
       "applies_when": "high_risk_provider",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.is_ai_provider", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.is_ai_provider",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Art. 40", "title": "Harmonisierte Normen"},
-        {"norm": "AI Act", "article": "Anhang I", "title": "Harmonisierte Rechtsvorschriften der Union"}
+        {
+          "norm": "AI Act",
+          "article": "Art. 40",
+          "title": "Harmonisierte Normen"
+        },
+        {
+          "norm": "AI Act",
+          "article": "Anhang I",
+          "title": "Harmonisierte Rechtsvorschriften der Union"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Art. 40 AI Act"},
-        {"type": "article", "ref": "Anhang I AI Act"}
+        {
+          "type": "article",
+          "ref": "Art. 40 AI Act"
+        },
+        {
+          "type": "article",
+          "ref": "Anhang I AI Act"
+        }
       ],
       "category": "Compliance",
       "responsible": "KI-Verantwortlicher",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Normen-Anwendungsbericht",
         "Gap-Analyse harmonisierte Normen",
         "Konformitaetsvermutungs-Dokumentation"
       ],
       "priority": "mittel",
-      "tom_control_ids": ["TOM.GOV.04", "TOM.GOV.14"],
+      "tom_control_ids": [
+        "TOM.GOV.04",
+        "TOM.GOV.14"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -1681,26 +2745,47 @@
       "applies_when": "high_risk",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.uses_biometric_ai", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.uses_biometric_ai",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Anhang III Nr. 1", "title": "Biometrie und biometriebasierte Systeme"}
+        {
+          "norm": "AI Act",
+          "article": "Anhang III Nr. 1",
+          "title": "Biometrie und biometriebasierte Systeme"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Anhang III Nr. 1 AI Act"}
+        {
+          "type": "article",
+          "ref": "Anhang III Nr. 1 AI Act"
+        }
       ],
       "category": "Compliance",
       "responsible": "KI-Verantwortlicher",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Biometrie-Einsatz-Dokumentation",
         "Notifizierte-Stelle-Zertifikat",
         "Datenschutz-Folgenabschaetzung Biometrie"
       ],
       "priority": "kritisch",
-      "tom_control_ids": ["TOM.GOV.08", "TOM.DATA.11", "TOM.IAM.02"],
+      "tom_control_ids": [
+        "TOM.GOV.08",
+        "TOM.DATA.11",
+        "TOM.IAM.02"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -1712,26 +2797,47 @@
       "applies_when": "high_risk",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.ai_in_critical_infrastructure", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.ai_in_critical_infrastructure",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Anhang III Nr. 2", "title": "Kritische Infrastruktur"}
+        {
+          "norm": "AI Act",
+          "article": "Anhang III Nr. 2",
+          "title": "Kritische Infrastruktur"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Anhang III Nr. 2 AI Act"}
+        {
+          "type": "article",
+          "ref": "Anhang III Nr. 2 AI Act"
+        }
       ],
       "category": "Technisch",
       "responsible": "IT-Leitung",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Kritische-Infrastruktur-Assessment",
         "Redundanz-Nachweis",
         "Ausfallsicherheits-Tests"
       ],
       "priority": "kritisch",
-      "tom_control_ids": ["TOM.BCP.05", "TOM.BCP.06", "TOM.NET.04"],
+      "tom_control_ids": [
+        "TOM.BCP.05",
+        "TOM.BCP.06",
+        "TOM.NET.04"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -1743,26 +2849,47 @@
       "applies_when": "high_risk",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.ai_in_education", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.ai_in_education",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Anhang III Nr. 3", "title": "Allgemeine und berufliche Bildung"}
+        {
+          "norm": "AI Act",
+          "article": "Anhang III Nr. 3",
+          "title": "Allgemeine und berufliche Bildung"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Anhang III Nr. 3 AI Act"}
+        {
+          "type": "article",
+          "ref": "Anhang III Nr. 3 AI Act"
+        }
       ],
       "category": "Compliance",
       "responsible": "KI-Verantwortlicher",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Bildungs-KI-Einsatzkonzept",
         "Minderjaehrigenschutz-Nachweis",
         "Fairness-Analyse Bildungszugang"
       ],
       "priority": "kritisch",
-      "tom_control_ids": ["TOM.GOV.08", "TOM.DATA.12", "TOM.HR.04"],
+      "tom_control_ids": [
+        "TOM.GOV.08",
+        "TOM.DATA.12",
+        "TOM.HR.04"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -1774,26 +2901,47 @@
       "applies_when": "high_risk",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.ai_in_employment", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.ai_in_employment",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Anhang III Nr. 4", "title": "Beschaeftigung, Personalmanagement"}
+        {
+          "norm": "AI Act",
+          "article": "Anhang III Nr. 4",
+          "title": "Beschaeftigung, Personalmanagement"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Anhang III Nr. 4 AI Act"}
+        {
+          "type": "article",
+          "ref": "Anhang III Nr. 4 AI Act"
+        }
       ],
       "category": "Compliance",
       "responsible": "KI-Verantwortlicher",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Beschaeftigungs-KI-Assessment",
         "Diskriminierungsfreiheits-Analyse",
         "Betriebsrats-Beteiligung dokumentiert"
       ],
       "priority": "kritisch",
-      "tom_control_ids": ["TOM.GOV.08", "TOM.HR.05", "TOM.DATA.13"],
+      "tom_control_ids": [
+        "TOM.GOV.08",
+        "TOM.HR.05",
+        "TOM.DATA.13"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -1805,26 +2953,47 @@
       "applies_when": "high_risk",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.ai_in_law_enforcement", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.ai_in_law_enforcement",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Anhang III Nr. 6", "title": "Strafverfolgung"}
+        {
+          "norm": "AI Act",
+          "article": "Anhang III Nr. 6",
+          "title": "Strafverfolgung"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Anhang III Nr. 6 AI Act"}
+        {
+          "type": "article",
+          "ref": "Anhang III Nr. 6 AI Act"
+        }
       ],
       "category": "Compliance",
       "responsible": "KI-Verantwortlicher",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Grundrechts-Pruefung Strafverfolgung",
         "Verhältnismaessigkeits-Analyse",
         "Datenschutz-Richtlinie-Konformitaet"
       ],
       "priority": "kritisch",
-      "tom_control_ids": ["TOM.GOV.08", "TOM.GOV.09", "TOM.AC.02"],
+      "tom_control_ids": [
+        "TOM.GOV.08",
+        "TOM.GOV.09",
+        "TOM.AC.02"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
@@ -1836,29 +3005,792 @@
       "applies_when": "high_risk",
       "applies_when_condition": {
         "all_of": [
-          {"field": "ai_usage.high_risk_ai", "operator": "EQUALS", "value": true},
-          {"field": "ai_usage.ai_in_justice", "operator": "EQUALS", "value": true}
+          {
+            "field": "ai_usage.high_risk_ai",
+            "operator": "EQUALS",
+            "value": true
+          },
+          {
+            "field": "ai_usage.ai_in_justice",
+            "operator": "EQUALS",
+            "value": true
+          }
         ]
       },
       "legal_basis": [
-        {"norm": "AI Act", "article": "Anhang III Nr. 8", "title": "Rechtspflege und demokratische Prozesse"}
+        {
+          "norm": "AI Act",
+          "article": "Anhang III Nr. 8",
+          "title": "Rechtspflege und demokratische Prozesse"
+        }
       ],
       "sources": [
-        {"type": "article", "ref": "Anhang III Nr. 8 AI Act"}
+        {
+          "type": "article",
+          "ref": "Anhang III Nr. 8 AI Act"
+        }
       ],
       "category": "Compliance",
       "responsible": "KI-Verantwortlicher",
-      "sanctions": {"max_fine": "15 Mio. EUR oder 3% Jahresumsatz"},
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
       "evidence": [
         "Justiz-KI-Einsatzkonzept",
         "Human-Oversight-Nachweis",
         "Transparenzbericht Justiz-KI"
       ],
       "priority": "kritisch",
-      "tom_control_ids": ["TOM.GOV.07", "TOM.GOV.08", "TOM.GOV.10"],
+      "tom_control_ids": [
+        "TOM.GOV.07",
+        "TOM.GOV.08",
+        "TOM.GOV.10"
+      ],
       "valid_from": "2024-08-01",
       "valid_until": null,
       "version": "1.0"
+    },
+    {
+      "id": "AIACT-OBL-061",
+      "title": "Risikomanagementsystem etablieren und dokumentieren",
+      "description": "Ein Risikomanagementsystem ist einzurichten, umzusetzen, zu dokumentieren und aufrechtzuerhalten. Es muss den gesamten Lebenszyklus des KI-Systems abdecken.",
+      "applies_when": "high-risk AI system",
+      "applies_when_condition": {
+        "all_of": [
+          {
+            "field": "ai_usage.uses_ai",
+            "operator": "EQUALS",
+            "value": true
+          }
+        ]
+      },
+      "legal_basis": [
+        {
+          "norm": "AI Act",
+          "article": "Art. 9 Abs. 1"
+        }
+      ],
+      "sources": [
+        {
+          "type": "regulation",
+          "ref": "Art. 9 Abs. 1 AI Act"
+        }
+      ],
+      "category": "Governance",
+      "responsible": "KI-Verantwortlicher",
+      "priority": "kritisch",
+      "deadline": {
+        "type": "on_event",
+        "event": "Vor Inverkehrbringen"
+      },
+      "sanctions": {
+        "max_fine": "15 Mio. EUR oder 3% Jahresumsatz"
+      },
+      "evidence": [
+        {
+          "name": "RMS-Dokumentation",
+          "required": true
+        }
+      ],
+      "tom_control_ids": [
+        "TOM.GOV.01"
+      ],
+      "valid_from": "2025-08-02",
+      "version": "1.0"
+    },
+    {
+      "id": "AIACT-OBL-062",
+      "title": "Bekannte und vorhersehbare Risiken identifizieren und analysieren",
+      "description": "Identifikation und Analyse bekannter und vernuenftigerweise vorhersehbarer Risiken fuer Gesundheit, Sicherheit und Grundrechte.",
+      "applies_when": "high-risk AI system",
+      "applies_when_condition": {
+        "all_of": [
+          {
+            "field": "ai_usage.uses_ai",
+            "operator": "EQUALS",
+            "value": true
+          }
+        ]
+      },
+      "legal_basis": [
+        {
+          "norm": "AI Act",
+          "article": "Art. 9 Abs. 2 lit. a"
+        }
+      ],
+      "sources": [
+        {
+          "type": "regulation",
+          "ref": "Art. 9 Abs. 2 AI Act"
+        }
+      ],
+      "category": "Governance",
+      "responsible": "KI-Verantwortlicher",
+      "priority": "kritisch",
+      "evidence": [
+        {
+          "name": "Risikoregister",
+          "required": true
+        }
+      ],
+      "tom_control_ids": [],
+      "valid_from": "2025-08-02",
+      "version": "1.0"
+    },
+    {
+      "id": "AIACT-OBL-063",
+      "title": "Vorhersehbare Fehlanwendungen beruecksichtigen",
+      "description": "Risiken durch vernuenftigerweise vorhersehbare Fehlanwendungen (reasonably foreseeable misuse) muessen im RMS beruecksichtigt werden.",
+      "applies_when": "high-risk AI system",
+      "applies_when_condition": {
+        "all_of": [
+          {
+            "field": "ai_usage.uses_ai",
+            "operator": "EQUALS",
+            "value": true
+          }
+        ]
+      },
+      "legal_basis": [
+        {
+          "norm": "AI Act",
+          "article": "Art. 9 Abs. 2 lit. b"
+        }
+      ],
+      "sources": [
+        {
+          "type": "regulation",
+          "ref": "Art. 9 Abs. 2 AI Act"
+        }
+      ],
+      "category": "Governance",
+      "responsible": "KI-Verantwortlicher",
+      "priority": "hoch",
+      "evidence": [
+        {
+          "name": "Misuse-Analyse-Dokument",
+          "required": true
+        }
+      ],
+      "tom_control_ids": [],
+      "valid_from": "2025-08-02",
+      "version": "1.0"
+    },
+    {
+      "id": "AIACT-OBL-064",
+      "title": "Restrisiko bewerten und dokumentieren",
+      "description": "Nach Umsetzung von Risikominderungsmassnahmen ist das verbleibende Restrisiko zu bewerten und zu dokumentieren. Es muss akzeptabel sein.",
+      "applies_when": "high-risk AI system",
+      "applies_when_condition": {
+        "all_of": [
+          {
+            "field": "ai_usage.uses_ai",
+            "operator": "EQUALS",
+            "value": true
+          }
+        ]
+      },
+      "legal_basis": [
+        {
+          "norm": "AI Act",
+          "article": "Art. 9 Abs. 4"
+        }
+      ],
+      "sources": [
+        {
+          "type": "regulation",
+          "ref": "Art. 9 Abs. 4 AI Act"
+        }
+      ],
+      "category": "Governance",
+      "responsible": "KI-Verantwortlicher",
+      "priority": "hoch",
+      "evidence": [
+        {
+          "name": "Restrisiko-Bewertung",
+          "required": true
+        }
+      ],
+      "tom_control_ids": [],
+      "valid_from": "2025-08-02",
+      "version": "1.0"
+    },
+    {
+      "id": "AIACT-OBL-065",
+      "title": "Risikomanagement bei System-Updates wiederholen",
+      "description": "Bei wesentlichen Aenderungen des KI-Systems muss die Risikoanalyse erneut durchgefuehrt werden.",
+      "applies_when": "system update",
+      "applies_when_condition": {
+        "all_of": [
+          {
+            "field": "ai_usage.uses_ai",
+            "operator": "EQUALS",
+            "value": true
+          }
+        ]
+      },
+      "legal_basis": [
+        {
+          "norm": "AI Act",
+          "article": "Art. 9 Abs. 1"
+        }
+      ],
+      "category": "Governance",
+      "responsible": "KI-Verantwortlicher",
+      "priority": "hoch",
+      "evidence": [
+        {
+          "name": "Update-Risikoanalyse",
+          "required": true
+        }
+      ],
+      "tom_control_ids": [],
+      "valid_from": "2025-08-02",
+      "version": "1.0"
+    },
+    {
+      "id": "AIACT-OBL-066",
+      "title": "Trainingsdaten auf Bias pruefen",
+      "description": "Trainings-, Validierungs- und Testdatensaetze muessen auf moegliche Verzerrungen (Bias) geprueft werden, die zu Diskriminierung fuehren koennten.",
+      "applies_when": "AI system uses training data",
+      "applies_when_condition": {
+        "all_of": [
+          {
+            "field": "ai_usage.uses_ai",
+            "operator": "EQUALS",
+            "value": true
+          }
+        ]
+      },
+      "legal_basis": [
+        {
+          "norm": "AI Act",
+          "article": "Art. 10 Abs. 2 lit. f"
+        }
+      ],
+      "category": "Technisch",
+      "responsible": "Data Science Team",
+      "priority": "kritisch",
+      "evidence": [
+        {
+          "name": "Bias-Analyse-Bericht",
+          "required": true
+        }
+      ],
+      "tom_control_ids": [
+        "TOM.FAIR.01"
+      ],
+      "valid_from": "2025-08-02",
+      "version": "1.0"
+    },
+    {
+      "id": "AIACT-OBL-067",
+      "title": "Datenqualitaetskriterien definieren und einhalten",
+      "description": "Datensaetze muessen relevant, hinreichend repraesentativ, fehlerfrei und vollstaendig sein.",
+      "applies_when": "AI system uses training data",
+      "applies_when_condition": {
+        "all_of": [
+          {
+            "field": "ai_usage.uses_ai",
+            "operator": "EQUALS",
+            "value": true
+          }
+        ]
+      },
+      "legal_basis": [
+        {
+          "norm": "AI Act",
+          "article": "Art. 10 Abs. 3"
+        }
+      ],
+      "category": "Technisch",
+      "responsible": "Data Science Team",
+      "priority": "hoch",
+      "evidence": [
+        {
+          "name": "Datenqualitaets-Dokumentation",
+          "required": true
+        }
+      ],
+      "tom_control_ids": [],
+      "valid_from": "2025-08-02",
+      "version": "1.0"
+    },
+    {
+      "id": "AIACT-OBL-068",
+      "title": "Datenversionierung und Rueckverfolgbarkeit",
+      "description": "Trainings-, Validierungs- und Testdatensaetze muessen versioniert und rueckverfolgbar sein.",
+      "applies_when": "AI system uses training data",
+      "applies_when_condition": {
+        "all_of": [
+          {
+            "field": "ai_usage.uses_ai",
+            "operator": "EQUALS",
+            "value": true
+          }
+        ]
+      },
+      "legal_basis": [
+        {
+          "norm": "AI Act",
+          "article": "Art. 10 Abs. 4"
+        }
+      ],
+      "category": "Technisch",
+      "responsible": "Data Engineering",
+      "priority": "hoch",
+      "evidence": [
+        {
+          "name": "Daten-Versionierungskonzept",
+          "required": true
+        }
+      ],
+      "tom_control_ids": [],
+      "valid_from": "2025-08-02",
+      "version": "1.0"
+    },
+    {
+      "id": "AIACT-OBL-069",
+      "title": "Automatische Protokollierung von Eingaben und Ausgaben",
+      "description": "Hochrisiko-KI-Systeme muessen Eingaben, Ausgaben und Entscheidungen automatisch protokollieren, soweit technisch moeglich.",
+      "applies_when": "high-risk AI system",
+      "applies_when_condition": {
+        "all_of": [
+          {
+            "field": "ai_usage.uses_ai",
+            "operator": "EQUALS",
+            "value": true
+          }
+        ]
+      },
+      "legal_basis": [
+        {
+          "norm": "AI Act",
+          "article": "Art. 12 Abs. 1"
+        }
+      ],
+      "category": "Technisch",
+      "responsible": "Entwicklung",
+      "priority": "kritisch",
+      "evidence": [
+        {
+          "name": "Logging-Architektur-Dokumentation",
+          "required": true
+        }
+      ],
+      "tom_control_ids": [
+        "TOM.LOG.01"
+      ],
+      "valid_from": "2025-08-02",
+      "version": "1.0"
+    },
+    {
+      "id": "AIACT-OBL-070",
+      "title": "Logs manipulationssicher speichern",
+      "description": "Protokolldaten muessen gegen Manipulation geschuetzt und fuer die vorgeschriebene Dauer aufbewahrt werden.",
+      "applies_when": "high-risk AI system",
+      "applies_when_condition": {
+        "all_of": [
+          {
+            "field": "ai_usage.uses_ai",
+            "operator": "EQUALS",
+            "value": true
+          }
+        ]
+      },
+      "legal_basis": [
+        {
+          "norm": "AI Act",
+          "article": "Art. 12 Abs. 2"
+        }
+      ],
+      "category": "Technisch",
+      "responsible": "IT-Sicherheit",
+      "priority": "hoch",
+      "evidence": [
+        {
+          "name": "Log-Integritaets-Konzept",
+          "required": true
+        }
+      ],
+      "tom_control_ids": [
+        "TOM.LOG.01",
+        "TOM.CRY.01"
+      ],
+      "valid_from": "2025-08-02",
+      "version": "1.0"
+    },
+    {
+      "id": "AIACT-OBL-071",
+      "title": "Log-Aufbewahrungsfristen definieren",
+      "description": "Aufbewahrungsfristen fuer Protokolldaten muessen definiert und eingehalten werden. Mindestens 6 Monate, sofern nicht anders vorgeschrieben.",
+      "applies_when": "high-risk AI system",
+      "applies_when_condition": {
+        "all_of": [
+          {
+            "field": "ai_usage.uses_ai",
+            "operator": "EQUALS",
+            "value": true
+          }
+        ]
+      },
+      "legal_basis": [
+        {
+          "norm": "AI Act",
+          "article": "Art. 12 Abs. 3"
+        }
+      ],
+      "category": "Governance",
+      "responsible": "Compliance",
+      "priority": "hoch",
+      "evidence": [
+        {
+          "name": "Aufbewahrungsrichtlinie",
+          "required": true
+        }
+      ],
+      "tom_control_ids": [],
+      "valid_from": "2025-08-02",
+      "version": "1.0"
+    },
+    {
+      "id": "AIACT-OBL-072",
+      "title": "Override-Funktion fuer menschliche Uebersteuering",
+      "description": "Das System muss eine Funktion bereitstellen, mit der ein Mensch die KI-Entscheidung jederzeit uebersteuern oder das System stoppen kann.",
+      "applies_when": "high-risk AI system",
+      "applies_when_condition": {
+        "all_of": [
+          {
+            "field": "ai_usage.uses_ai",
+            "operator": "EQUALS",
+            "value": true
+          }
+        ]
+      },
+      "legal_basis": [
+        {
+          "norm": "AI Act",
+          "article": "Art. 14 Abs. 4 lit. d"
+        }
+      ],
+      "category": "Technisch",
+      "responsible": "Entwicklung",
+      "priority": "kritisch",
+      "evidence": [
+        {
+          "name": "Override-Funktionsdokumentation",
+          "required": true
+        }
+      ],
+      "tom_control_ids": [],
+      "valid_from": "2025-08-02",
+      "version": "1.0"
+    },
+    {
+      "id": "AIACT-OBL-073",
+      "title": "Schulung der Nutzer zu KI-Systemgrenzen",
+      "description": "Personen, die die menschliche Aufsicht ausueben, muessen ueber die Faehigkeiten und Grenzen des Systems geschult sein.",
+      "applies_when": "high-risk AI system",
+      "applies_when_condition": {
+        "all_of": [
+          {
+            "field": "ai_usage.uses_ai",
+            "operator": "EQUALS",
+            "value": true
+          }
+        ]
+      },
+      "legal_basis": [
+        {
+          "norm": "AI Act",
+          "article": "Art. 14 Abs. 4 lit. a"
+        }
+      ],
+      "category": "Organisatorisch",
+      "responsible": "HR / Training",
+      "priority": "hoch",
+      "evidence": [
+        {
+          "name": "Schulungsnachweis KI-Nutzer",
+          "required": true
+        }
+      ],
+      "tom_control_ids": [],
+      "valid_from": "2025-08-02",
+      "version": "1.0"
+    },
+    {
+      "id": "AIACT-OBL-074",
+      "title": "Automation Bias verhindern",
+      "description": "Massnahmen gegen uebermassiges Vertrauen in KI-Ausgaben (Automation Bias) muessen implementiert werden.",
+      "applies_when": "high-risk AI system",
+      "applies_when_condition": {
+        "all_of": [
+          {
+            "field": "ai_usage.uses_ai",
+            "operator": "EQUALS",
+            "value": true
+          }
+        ]
+      },
+      "legal_basis": [
+        {
+          "norm": "AI Act",
+          "article": "Art. 14 Abs. 4 lit. b"
+        }
+      ],
+      "category": "Organisatorisch",
+      "responsible": "UX / Compliance",
+      "priority": "hoch",
+      "evidence": [
+        {
+          "name": "Automation-Bias-Praeventionskonzept",
+          "required": true
+        }
+      ],
+      "tom_control_ids": [],
+      "valid_from": "2025-08-02",
+      "version": "1.0"
+    },
+    {
+      "id": "AIACT-OBL-075",
+      "title": "Genauigkeitsziele definieren und messen",
+      "description": "Fuer Hochrisiko-KI-Systeme muessen Genauigkeitsziele definiert, in der technischen Dokumentation angegeben und den Nutzern mitgeteilt werden.",
+      "applies_when": "high-risk AI system",
+      "applies_when_condition": {
+        "all_of": [
+          {
+            "field": "ai_usage.uses_ai",
+            "operator": "EQUALS",
+            "value": true
+          }
+        ]
+      },
+      "legal_basis": [
+        {
+          "norm": "AI Act",
+          "article": "Art. 15 Abs. 1"
+        }
+      ],
+      "category": "Technisch",
+      "responsible": "Data Science Team",
+      "priority": "hoch",
+      "evidence": [
+        {
+          "name": "Genauigkeits-Metriken-Dokumentation",
+          "required": true
+        }
+      ],
+      "tom_control_ids": [],
+      "valid_from": "2025-08-02",
+      "version": "1.0"
+    },
+    {
+      "id": "AIACT-OBL-076",
+      "title": "Robustheit gegen Fehler und Angriffe sicherstellen",
+      "description": "Das System muss robust sein gegen Fehler, Stoerungen und Versuche unbefugter Dritter, die Leistung zu manipulieren.",
+      "applies_when": "high-risk AI system",
+      "applies_when_condition": {
+        "all_of": [
+          {
+            "field": "ai_usage.uses_ai",
+            "operator": "EQUALS",
+            "value": true
+          }
+        ]
+      },
+      "legal_basis": [
+        {
+          "norm": "AI Act",
+          "article": "Art. 15 Abs. 4"
+        }
+      ],
+      "category": "Technisch",
+      "responsible": "IT-Sicherheit",
+      "priority": "kritisch",
+      "evidence": [
+        {
+          "name": "Adversarial-Test-Ergebnisse",
+          "required": true
+        }
+      ],
+      "tom_control_ids": [
+        "TOM.SEC.01"
+      ],
+      "valid_from": "2025-08-02",
+      "version": "1.0"
+    },
+    {
+      "id": "AIACT-OBL-077",
+      "title": "Cybersecurity-Massnahmen nach Stand der Technik",
+      "description": "Angemessene Cybersecurity-Massnahmen muessen implementiert werden, einschliesslich Schutz vor Data Poisoning und Adversarial Attacks.",
+      "applies_when": "high-risk AI system",
+      "applies_when_condition": {
+        "all_of": [
+          {
+            "field": "ai_usage.uses_ai",
+            "operator": "EQUALS",
+            "value": true
+          }
+        ]
+      },
+      "legal_basis": [
+        {
+          "norm": "AI Act",
+          "article": "Art. 15 Abs. 5"
+        }
+      ],
+      "category": "Technisch",
+      "responsible": "IT-Sicherheit",
+      "priority": "kritisch",
+      "evidence": [
+        {
+          "name": "AI-Cybersecurity-Konzept",
+          "required": true
+        }
+      ],
+      "tom_control_ids": [
+        "TOM.SEC.01",
+        "TOM.CRY.01"
+      ],
+      "valid_from": "2025-08-02",
+      "version": "1.0"
+    },
+    {
+      "id": "AIACT-OBL-078",
+      "title": "GPAI-Modell klassifizieren (normal vs. systemisch)",
+      "description": "Der Anbieter eines GPAI-Modells muss pruefen, ob das Modell als Modell mit systemischem Risiko einzustufen ist (>10^25 FLOP oder EU-Kommissions-Beschluss).",
+      "applies_when": "GPAI model provider",
+      "applies_when_condition": {
+        "all_of": [
+          {
+            "field": "ai_usage.is_gpai",
+            "operator": "EQUALS",
+            "value": true
+          }
+        ]
+      },
+      "legal_basis": [
+        {
+          "norm": "AI Act",
+          "article": "Art. 51 Abs. 2"
+        }
+      ],
+      "category": "Governance",
+      "responsible": "KI-Verantwortlicher",
+      "priority": "kritisch",
+      "evidence": [
+        {
+          "name": "GPAI-Klassifizierungsdokument",
+          "required": true
+        }
+      ],
+      "tom_control_ids": [],
+      "valid_from": "2025-08-02",
+      "version": "1.0"
+    },
+    {
+      "id": "AIACT-OBL-079",
+      "title": "KI-generierte Inhalte als solche kennzeichnen (GPAI Transparency)",
+      "description": "Anbieter von GPAI-Modellen, die synthetische Inhalte erzeugen koennen, muessen sicherstellen, dass Ausgaben maschinenlesbar als KI-generiert gekennzeichnet werden.",
+      "applies_when": "GPAI model generates content",
+      "applies_when_condition": {
+        "all_of": [
+          {
+            "field": "ai_usage.is_gpai",
+            "operator": "EQUALS",
+            "value": true
+          }
+        ]
+      },
+      "legal_basis": [
+        {
+          "norm": "AI Act",
+          "article": "Art. 50 Abs. 2"
+        },
+        {
+          "norm": "AI Act",
+          "article": "Art. 52"
+        }
+      ],
+      "category": "Technisch",
+      "responsible": "Entwicklung",
+      "priority": "hoch",
+      "evidence": [
+        {
+          "name": "Content-Marking-Implementierung",
+          "required": true
+        }
+      ],
+      "tom_control_ids": [],
+      "valid_from": "2025-08-02",
+      "version": "1.0"
+    },
+    {
+      "id": "AIACT-OBL-080",
+      "title": "EU-Repraesentant benennen (Non-EU Anbieter)",
+      "description": "GPAI-Modell-Anbieter mit Sitz ausserhalb der EU muessen einen bevollmaechtigten Vertreter in der EU benennen.",
+      "applies_when": "GPAI provider outside EU",
+      "applies_when_condition": {
+        "all_of": [
+          {
+            "field": "ai_usage.is_gpai",
+            "operator": "EQUALS",
+            "value": true
+          }
+        ]
+      },
+      "legal_basis": [
+        {
+          "norm": "AI Act",
+          "article": "Art. 54"
+        }
+      ],
+      "category": "Governance",
+      "responsible": "Legal",
+      "priority": "hoch",
+      "evidence": [
+        {
+          "name": "Bevollmaechtigungsvertrag EU-Repraesentant",
+          "required": false
+        }
+      ],
+      "tom_control_ids": [],
+      "valid_from": "2025-08-02",
+      "version": "1.0"
+    },
+    {
+      "id": "AIACT-OBL-081",
+      "title": "Codes of Practice einhalten oder alternative Massnahmen dokumentieren",
+      "description": "GPAI-Anbieter sollen sich an Codes of Practice halten. Wenn sie dies nicht tun, muessen sie alternative angemessene Massnahmen dokumentieren.",
+      "applies_when": "GPAI model provider",
+      "applies_when_condition": {
+        "all_of": [
+          {
+            "field": "ai_usage.is_gpai",
+            "operator": "EQUALS",
+            "value": true
+          }
+        ]
+      },
+      "legal_basis": [
+        {
+          "norm": "AI Act",
+          "article": "Art. 56"
+        }
+      ],
+      "category": "Governance",
+      "responsible": "Compliance",
+      "priority": "mittel",
+      "evidence": [
+        {
+          "name": "CoP-Teilnahme oder Alternative-Dokumentation",
+          "required": true
+        }
+      ],
+      "tom_control_ids": [],
+      "valid_from": "2025-08-02",
+      "version": "1.0"
     }
   ],
   "controls": [
@@ -1868,7 +3800,9 @@
       "description": "Fuehrung eines vollstaendigen Inventars aller KI-Systeme",
       "category": "Governance",
       "what_to_do": "Erfassung aller KI-Systeme mit Risikoeinstufung, Zweck, Anbieter, Betreiber",
-      "iso27001_mapping": ["A.8.1"],
+      "iso27001_mapping": [
+        "A.8.1"
+      ],
       "priority": "kritisch"
     },
     {
@@ -1919,7 +3853,9 @@
       "content": "Meldung schwerwiegender Vorfaelle bei Hochrisiko-KI-Systemen: Tod oder schwere Gesundheitsschaeden, schwerwiegende Grundrechtsverletzungen, schwere Schaeden an Eigentum oder Umwelt.",
       "recipient": "Zustaendige Marktaufsichtsbehoerde",
       "legal_basis": [
-        {"norm": "Art. 73 AI Act"}
+        {
+          "norm": "Art. 73 AI Act"
+        }
       ]
     },
     {
@@ -1928,7 +3864,9 @@
       "content": "Anbieter von Hochrisiko-KI melden Fehlfunktionen, die einen schwerwiegenden Vorfall darstellen koennten.",
       "recipient": "Marktaufsichtsbehoerde des Herkunftslandes",
       "legal_basis": [
-        {"norm": "Art. 73 Abs. 1 AI Act"}
+        {
+          "norm": "Art. 73 Abs. 1 AI Act"
+        }
       ]
     }
   ]
diff --git a/ai-compliance-sdk/policies/obligations/v2/betrvg_v2.json b/ai-compliance-sdk/policies/obligations/v2/betrvg_v2.json
new file mode 100644
index 0000000..678c207
--- /dev/null
+++ b/ai-compliance-sdk/policies/obligations/v2/betrvg_v2.json
@@ -0,0 +1,250 @@
+{
+  "regulation": "betrvg",
+  "regulation_full_name": "Betriebsverfassungsgesetz (BetrVG)",
+  "version": "1.0",
+  "obligations": [
+    {
+      "id": "BETRVG-OBL-001",
+      "title": "Mitbestimmung bei technischen Ueberwachungseinrichtungen",
+      "description": "Einfuehrung und Anwendung von technischen Einrichtungen, die dazu bestimmt sind, das Verhalten oder die Leistung der Arbeitnehmer zu ueberwachen, beduerfen der Zustimmung des Betriebsrats. Das BAG hat klargestellt, dass bereits die objektive Eignung zur Ueberwachung genuegt — eine tatsaechliche Nutzung zu diesem Zweck ist nicht erforderlich (BAG 1 ABR 20/21, 1 ABN 36/18).",
+      "applies_when": "technical system can monitor employee behavior or performance",
+      "applies_when_condition": { "all_of": [{ "field": "organization.country", "operator": "IN_ARRAY", "value": ["DE", "AT"] }, { "field": "data_types.employee_data", "operator": "EQUALS", "value": true }] },
+      "legal_basis": [{ "norm": "BetrVG", "article": "§ 87 Abs. 1 Nr. 6", "title": "Mitbestimmung bei technischen Ueberwachungseinrichtungen" }],
+      "sources": [{ "type": "national_law", "ref": "§ 87 Abs. 1 Nr. 6 BetrVG" }, { "type": "court_decision", "ref": "BAG 1 ABR 20/21 (Microsoft 365)" }, { "type": "court_decision", "ref": "BAG 1 ABN 36/18 (Standardsoftware)" }],
+      "category": "Mitbestimmung",
+      "responsible": "Arbeitgeber / HR",
+      "deadline": { "type": "on_event", "event": "Vor Einfuehrung des Systems" },
+      "sanctions": { "description": "Unterlassungsanspruch des Betriebsrats, einstweilige Verfuegung moeglich, Betriebsvereinbarung ueber Einigungsstelle erzwingbar (§ 87 Abs. 2 BetrVG)" },
+      "evidence": [{ "name": "Betriebsvereinbarung oder dokumentierte Zustimmung des Betriebsrats", "required": true }, "Protokoll der Betriebsratssitzung"],
+      "priority": "kritisch",
+      "tom_control_ids": ["TOM.GOV.01", "TOM.AC.01"],
+      "breakpilot_feature": "/sdk/betriebsvereinbarung",
+      "valid_from": "1972-01-19",
+      "valid_until": null,
+      "version": "1.0",
+      "how_to_implement": "Betriebsrat fruehzeitig informieren, gemeinsame Bewertung der Ueberwachungseignung durchfuehren, Betriebsvereinbarung mit Zweckbindung und verbotenen Nutzungen abschliessen."
+    },
+    {
+      "id": "BETRVG-OBL-002",
+      "title": "Keine Geringfuegigkeitsschwelle bei Standardsoftware",
+      "description": "Auch alltaegliche Standardsoftware (Excel, Word, E-Mail-Clients) unterliegt der Mitbestimmung, wenn sie objektiv geeignet ist, Verhaltens- oder Leistungsdaten zu erheben. Es gibt keine Geringfuegigkeitsschwelle (BAG 1 ABN 36/18).",
+      "applies_when": "any software used by employees that can log or track usage",
+      "applies_when_condition": { "all_of": [{ "field": "organization.country", "operator": "EQUALS", "value": "DE" }, { "field": "data_types.employee_data", "operator": "EQUALS", "value": true }] },
+      "legal_basis": [{ "norm": "BetrVG", "article": "§ 87 Abs. 1 Nr. 6", "title": "Mitbestimmung — keine Geringfuegigkeitsschwelle" }],
+      "sources": [{ "type": "court_decision", "ref": "BAG 1 ABN 36/18" }],
+      "category": "Mitbestimmung",
+      "responsible": "IT-Leitung / HR",
+      "deadline": { "type": "on_event", "event": "Vor Einfuehrung oder Aenderung" },
+      "sanctions": { "description": "Unterlassungsanspruch, einstweilige Verfuegung" },
+      "evidence": [{ "name": "Bestandsaufnahme aller IT-Systeme mit Ueberwachungseignung", "required": true }],
+      "priority": "hoch",
+      "tom_control_ids": [],
+      "breakpilot_feature": null,
+      "valid_from": "2018-10-23",
+      "valid_until": null,
+      "version": "1.0"
+    },
+    {
+      "id": "BETRVG-OBL-003",
+      "title": "Mitbestimmung bei Ueberwachung durch Drittsysteme (SaaS/Cloud)",
+      "description": "Auch wenn die Ueberwachung ueber ein Dritt-System (SaaS, Cloud, externer Anbieter) laeuft, bleibt der Betriebsrat zu beteiligen. Die Verantwortung des Arbeitgebers entfaellt nicht durch Auslagerung (BAG 1 ABR 68/13).",
+      "applies_when": "cloud or SaaS system processes employee data",
+      "applies_when_condition": { "all_of": [{ "field": "organization.country", "operator": "EQUALS", "value": "DE" }, { "field": "data_types.employee_data", "operator": "EQUALS", "value": true }] },
+      "legal_basis": [{ "norm": "BetrVG", "article": "§ 87 Abs. 1 Nr. 6", "title": "Mitbestimmung bei Drittsystemen" }],
+      "sources": [{ "type": "court_decision", "ref": "BAG 1 ABR 68/13" }],
+      "category": "Mitbestimmung",
+      "responsible": "IT-Leitung / Einkauf",
+      "deadline": { "type": "on_event", "event": "Vor Vertragsschluss mit SaaS-Anbieter" },
+      "sanctions": { "description": "Unterlassungsanspruch" },
+      "evidence": [{ "name": "Datenschutz-Folgenabschaetzung fuer Cloud-Dienst", "required": false }, "Betriebsvereinbarung"],
+      "priority": "hoch",
+      "tom_control_ids": ["TOM.PROC.01"],
+      "breakpilot_feature": null,
+      "valid_from": "2015-07-21",
+      "valid_until": null,
+      "version": "1.0"
+    },
+    {
+      "id": "BETRVG-OBL-004",
+      "title": "Mitbestimmung bei E-Mail- und Kommunikationssoftware",
+      "description": "Sowohl Einfuehrung als auch Nutzung softwarebasierter Anwendungen fuer die E-Mail-Kommunikation sind mitbestimmungspflichtig (BAG 1 ABR 31/19). Dies gilt auch fuer Teams, Slack und vergleichbare Messenger.",
+      "applies_when": "organization introduces or changes email or messaging systems",
+      "applies_when_condition": { "all_of": [{ "field": "organization.country", "operator": "EQUALS", "value": "DE" }, { "field": "data_types.employee_data", "operator": "EQUALS", "value": true }] },
+      "legal_basis": [{ "norm": "BetrVG", "article": "§ 87 Abs. 1 Nr. 6", "title": "Mitbestimmung bei Kommunikationssoftware" }],
+      "sources": [{ "type": "court_decision", "ref": "BAG 1 ABR 31/19" }, { "type": "court_decision", "ref": "BAG 1 ABR 46/10" }],
+      "category": "Mitbestimmung",
+      "responsible": "IT-Leitung / HR",
+      "deadline": { "type": "on_event", "event": "Vor Einfuehrung oder Funktionsaenderung" },
+      "sanctions": { "description": "Unterlassungsanspruch, einstweilige Verfuegung" },
+      "evidence": [{ "name": "Betriebsvereinbarung zu E-Mail-/Messaging-Nutzung", "required": true }],
+      "priority": "hoch",
+      "tom_control_ids": ["TOM.AC.01"],
+      "breakpilot_feature": null,
+      "valid_from": "2021-01-27",
+      "valid_until": null,
+      "version": "1.0"
+    },
+    {
+      "id": "BETRVG-OBL-005",
+      "title": "Verbot der dauerhaften Leistungsueberwachung",
+      "description": "Eine dauerhafte quantitative Erfassung und Auswertung einzelner Arbeitsschritte stellt einen schwerwiegenden Eingriff in das Persoenlichkeitsrecht dar (BAG 1 ABR 46/15). Belastungsstatistiken und KPI-Dashboards auf Personenebene beduerfen besonderer Rechtfertigung.",
+      "applies_when": "system provides individual performance metrics or KPIs",
+      "applies_when_condition": { "all_of": [{ "field": "organization.country", "operator": "EQUALS", "value": "DE" }, { "field": "purpose.profiling", "operator": "EQUALS", "value": true }] },
+      "legal_basis": [{ "norm": "BetrVG", "article": "§ 87 Abs. 1 Nr. 6", "title": "Persoenlichkeitsschutz bei Kennzahlenueberwachung" }, { "norm": "GG", "article": "Art. 2 Abs. 1 i.V.m. Art. 1 Abs. 1", "title": "Allgemeines Persoenlichkeitsrecht" }],
+      "sources": [{ "type": "court_decision", "ref": "BAG 1 ABR 46/15 (Belastungsstatistik)" }],
+      "category": "Mitbestimmung",
+      "responsible": "HR / Compliance",
+      "deadline": { "type": "recurring", "interval": "laufend" },
+      "sanctions": { "description": "Unterlassungsanspruch, Schadensersatz bei Persoenlichkeitsrechtsverletzung" },
+      "evidence": [{ "name": "Nachweis dass keine individuelle Leistungsueberwachung stattfindet", "required": true }],
+      "priority": "kritisch",
+      "tom_control_ids": ["TOM.GOV.03"],
+      "breakpilot_feature": null,
+      "valid_from": "2017-04-25",
+      "valid_until": null,
+      "version": "1.0"
+    },
+    {
+      "id": "BETRVG-OBL-006",
+      "title": "Unterrichtung bei Planung technischer Anlagen",
+      "description": "Der Arbeitgeber hat den Betriebsrat ueber die Planung von technischen Anlagen rechtzeitig unter Vorlage der erforderlichen Unterlagen zu unterrichten und mit ihm zu beraten.",
+      "applies_when": "organization plans new technical infrastructure",
+      "applies_when_condition": { "all_of": [{ "field": "organization.country", "operator": "EQUALS", "value": "DE" }] },
+      "legal_basis": [{ "norm": "BetrVG", "article": "§ 90 Abs. 1 Nr. 3", "title": "Unterrichtungs- und Beratungsrechte bei Planung" }],
+      "sources": [{ "type": "national_law", "ref": "§ 90 BetrVG" }],
+      "category": "Information",
+      "responsible": "IT-Leitung",
+      "deadline": { "type": "on_event", "event": "Rechtzeitig vor Umsetzung" },
+      "sanctions": { "description": "Beratungsanspruch, ggf. Aussetzung der Massnahme" },
+      "evidence": [{ "name": "Unterrichtungsschreiben an Betriebsrat mit technischer Dokumentation", "required": true }],
+      "priority": "hoch",
+      "tom_control_ids": [],
+      "breakpilot_feature": null,
+      "valid_from": "1972-01-19",
+      "valid_until": null,
+      "version": "1.0"
+    },
+    {
+      "id": "BETRVG-OBL-007",
+      "title": "Mitbestimmung bei Personalfrageboegen und Bewertungssystemen",
+      "description": "Personalfrageboegen und allgemeine Beurteilungsgrundsaetze beduerfen der Zustimmung des Betriebsrats. Dies umfasst auch KI-gestuetzte Bewertungssysteme fuer Mitarbeiterbeurteilungen (BAG 1 ABR 40/07).",
+      "applies_when": "AI or IT system supports employee evaluation or surveys",
+      "applies_when_condition": { "all_of": [{ "field": "organization.country", "operator": "EQUALS", "value": "DE" }, { "field": "purpose.profiling", "operator": "EQUALS", "value": true }] },
+      "legal_basis": [{ "norm": "BetrVG", "article": "§ 94", "title": "Personalfrageboegen, Beurteilungsgrundsaetze" }, { "norm": "BetrVG", "article": "§ 95", "title": "Auswahlrichtlinien" }],
+      "sources": [{ "type": "court_decision", "ref": "BAG 1 ABR 40/07" }, { "type": "court_decision", "ref": "BAG 1 ABR 16/07" }],
+      "category": "Mitbestimmung",
+      "responsible": "HR",
+      "deadline": { "type": "on_event", "event": "Vor Einfuehrung des Bewertungssystems" },
+      "sanctions": { "description": "Nichtigkeit der Bewertung, Unterlassungsanspruch" },
+      "evidence": [{ "name": "Betriebsvereinbarung zu Beurteilungsgrundsaetzen", "required": true }],
+      "priority": "kritisch",
+      "tom_control_ids": ["TOM.GOV.01"],
+      "breakpilot_feature": null,
+      "valid_from": "1972-01-19",
+      "valid_until": null,
+      "version": "1.0"
+    },
+    {
+      "id": "BETRVG-OBL-008",
+      "title": "Mitbestimmung bei KI-gestuetztem Recruiting",
+      "description": "KI-Systeme im Recruiting-Prozess (CV-Screening, Ranking, Vorselektion) beruehren die Mitbestimmung bei Auswahlrichtlinien (§ 95 BetrVG) und ggf. bei Einstellungen (§ 99 BetrVG). Zusaetzlich AI Act Hochrisiko-Klassifikation (Annex III Nr. 4).",
+      "applies_when": "AI system used in hiring, promotion or termination decisions",
+      "applies_when_condition": { "all_of": [{ "field": "organization.country", "operator": "EQUALS", "value": "DE" }, { "field": "purpose.automation", "operator": "EQUALS", "value": true }, { "field": "data_types.employee_data", "operator": "EQUALS", "value": true }] },
+      "legal_basis": [{ "norm": "BetrVG", "article": "§ 95", "title": "Auswahlrichtlinien" }, { "norm": "BetrVG", "article": "§ 99", "title": "Mitbestimmung bei personellen Einzelmassnahmen" }, { "norm": "EU AI Act", "article": "Annex III Nr. 4", "title": "Hochrisiko: Beschaeftigung" }],
+      "sources": [{ "type": "national_law", "ref": "§ 95, § 99 BetrVG" }],
+      "category": "Mitbestimmung",
+      "responsible": "HR / Legal",
+      "deadline": { "type": "on_event", "event": "Vor Einsatz im Recruiting" },
+      "sanctions": { "description": "Unterlassungsanspruch, Anfechtung der Einstellung, AI Act Bussgeld bei Hochrisiko-Verstoss" },
+      "evidence": [{ "name": "Betriebsvereinbarung KI im Recruiting", "required": true }, "DSFA", "AI Act Konformitaetsbewertung"],
+      "priority": "kritisch",
+      "tom_control_ids": ["TOM.GOV.01", "TOM.FAIR.01"],
+      "breakpilot_feature": "/sdk/ai-act",
+      "valid_from": "1972-01-19",
+      "valid_until": null,
+      "version": "1.0"
+    },
+    {
+      "id": "BETRVG-OBL-009",
+      "title": "Mitbestimmung bei Betriebsaenderungen durch KI",
+      "description": "Grundlegende Aenderung der Betriebsorganisation durch KI-Einfuehrung kann eine Betriebsaenderung darstellen. In Unternehmen mit mehr als 20 wahlberechtigten Arbeitnehmern ist ein Interessenausgleich zu versuchen und ein Sozialplan aufzustellen.",
+      "applies_when": "AI introduction fundamentally changes work organization",
+      "applies_when_condition": { "all_of": [{ "field": "organization.country", "operator": "EQUALS", "value": "DE" }, { "field": "organization.employee_count", "operator": "GREATER_THAN", "value": 20 }] },
+      "legal_basis": [{ "norm": "BetrVG", "article": "§ 111", "title": "Betriebsaenderungen" }, { "norm": "BetrVG", "article": "§ 112", "title": "Interessenausgleich, Sozialplan" }],
+      "sources": [{ "type": "national_law", "ref": "§§ 111-113 BetrVG" }],
+      "category": "Mitbestimmung",
+      "responsible": "Geschaeftsfuehrung / HR",
+      "deadline": { "type": "on_event", "event": "Rechtzeitig vor Umsetzung" },
+      "sanctions": { "description": "Nachteilsausgleich, Sozialplananspruch, Anfechtung der Massnahme" },
+      "evidence": [{ "name": "Interessenausgleich", "required": false }, "Sozialplan", "Unterrichtung des Betriebsrats"],
+      "priority": "hoch",
+      "tom_control_ids": [],
+      "breakpilot_feature": null,
+      "valid_from": "1972-01-19",
+      "valid_until": null,
+      "version": "1.0"
+    },
+    {
+      "id": "BETRVG-OBL-010",
+      "title": "Zustaendigkeit bei konzernweiten IT-Systemen",
+      "description": "Bei konzernweit eingesetzten IT-Systemen (z.B. M365, SAP) kann nicht der lokale Betriebsrat, sondern der Gesamt- oder Konzernbetriebsrat zustaendig sein (BAG 1 ABR 45/11). Die Zustaendigkeitsabgrenzung ist vor Einfuehrung zu klaeren.",
+      "applies_when": "IT system deployed across multiple establishments or companies",
+      "applies_when_condition": { "all_of": [{ "field": "organization.country", "operator": "EQUALS", "value": "DE" }] },
+      "legal_basis": [{ "norm": "BetrVG", "article": "§ 50 Abs. 1", "title": "Zustaendigkeit Gesamtbetriebsrat" }, { "norm": "BetrVG", "article": "§ 58 Abs. 1", "title": "Zustaendigkeit Konzernbetriebsrat" }],
+      "sources": [{ "type": "court_decision", "ref": "BAG 1 ABR 45/11 (SAP ERP)" }, { "type": "court_decision", "ref": "BAG 1 ABR 2/05" }],
+      "category": "Organisation",
+      "responsible": "HR / Legal",
+      "deadline": { "type": "on_event", "event": "Vor Einfuehrung" },
+      "sanctions": { "description": "Unwirksamkeit der Vereinbarung bei falschem Verhandlungspartner" },
+      "evidence": [{ "name": "Zustaendigkeitsbestimmung dokumentiert", "required": true }],
+      "priority": "hoch",
+      "tom_control_ids": [],
+      "breakpilot_feature": null,
+      "valid_from": "2012-09-25",
+      "valid_until": null,
+      "version": "1.0"
+    },
+    {
+      "id": "BETRVG-OBL-011",
+      "title": "Change-Management — erneute Mitbestimmung bei Funktionserweiterungen",
+      "description": "Neue Module, Funktionen oder Konnektoren in bestehenden IT-Systemen koennen eine erneute Mitbestimmung ausloesen, wenn sie die Ueberwachungseignung aendern oder erweitern (BAG 1 ABR 20/21 — Anwendung, nicht nur Einfuehrung).",
+      "applies_when": "existing IT system receives feature updates affecting monitoring capability",
+      "applies_when_condition": { "all_of": [{ "field": "organization.country", "operator": "EQUALS", "value": "DE" }, { "field": "data_types.employee_data", "operator": "EQUALS", "value": true }] },
+      "legal_basis": [{ "norm": "BetrVG", "article": "§ 87 Abs. 1 Nr. 6", "title": "Mitbestimmung bei Anwendung (nicht nur Einfuehrung)" }],
+      "sources": [{ "type": "court_decision", "ref": "BAG 1 ABR 20/21" }],
+      "category": "Mitbestimmung",
+      "responsible": "IT-Leitung / HR",
+      "deadline": { "type": "on_event", "event": "Vor Aktivierung neuer Funktionen" },
+      "sanctions": { "description": "Unterlassungsanspruch" },
+      "evidence": [{ "name": "Change-Management-Protokoll mit BR-Bewertung", "required": true }],
+      "priority": "hoch",
+      "tom_control_ids": [],
+      "breakpilot_feature": null,
+      "valid_from": "2022-03-08",
+      "valid_until": null,
+      "version": "1.0"
+    },
+    {
+      "id": "BETRVG-OBL-012",
+      "title": "Videoueberwachung — Mitbestimmung und Verhaeltnismaessigkeit",
+      "description": "Videoueberwachung am Arbeitsplatz ist grundsaetzlich mitbestimmungspflichtig. Die Regelungen ueber Einfuehrung und Ausgestaltung beduerfen der Zustimmung des Betriebsrats (BAG 1 ABR 78/11, 1 ABR 21/03).",
+      "applies_when": "organization uses video surveillance that may capture employees",
+      "applies_when_condition": { "all_of": [{ "field": "organization.country", "operator": "EQUALS", "value": "DE" }, { "field": "data_protection.video_surveillance", "operator": "EQUALS", "value": true }] },
+      "legal_basis": [{ "norm": "BetrVG", "article": "§ 87 Abs. 1 Nr. 6", "title": "Mitbestimmung bei Videoueberwachung" }],
+      "sources": [{ "type": "court_decision", "ref": "BAG 1 ABR 78/11" }, { "type": "court_decision", "ref": "BAG 1 ABR 21/03" }],
+      "category": "Mitbestimmung",
+      "responsible": "Facility Management / HR",
+      "deadline": { "type": "on_event", "event": "Vor Installation" },
+      "sanctions": { "description": "Unterlassungsanspruch, Beweisverwertungsverbot" },
+      "evidence": [{ "name": "Betriebsvereinbarung Videoueberwachung", "required": true }, "Beschilderung"],
+      "priority": "kritisch",
+      "tom_control_ids": ["TOM.PHY.01"],
+      "breakpilot_feature": null,
+      "valid_from": "2004-06-29",
+      "valid_until": null,
+      "version": "1.0"
+    }
+  ],
+  "controls": [],
+  "incident_deadlines": []
+}
diff --git a/ai-compliance-sdk/policies/obligations/v2/dsgvo_v2.json b/ai-compliance-sdk/policies/obligations/v2/dsgvo_v2.json
index ffef0b6..6891a57 100644
--- a/ai-compliance-sdk/policies/obligations/v2/dsgvo_v2.json
+++ b/ai-compliance-sdk/policies/obligations/v2/dsgvo_v2.json
@@ -4591,6 +4591,209 @@
       "valid_from": "2018-05-25",
       "valid_until": null,
       "version": "1.0"
+    },
+    {
+      "id": "DSGVO-OBL-081",
+      "title": "Drittlanduebermittlung nur mit geeigneten Garantien",
+      "description": "Die Uebermittlung personenbezogener Daten in Drittlaender (insbesondere USA) ist nur zulaessig, wenn ein Angemessenheitsbeschluss vorliegt oder geeignete Garantien (z.B. Standardvertragsklauseln) implementiert sind. Nach Schrems II (C-311/18) muessen zusaetzliche Massnahmen geprueft werden.",
+      "applies_when": "data transferred to third country or US provider used",
+      "applies_when_condition": {
+        "all_of": [
+          {
+            "field": "data_protection.processes_personal_data",
+            "operator": "EQUALS",
+            "value": true
+          }
+        ]
+      },
+      "legal_basis": [
+        {
+          "norm": "DSGVO",
+          "article": "Art. 44",
+          "title": "Allgemeine Grundsaetze der Datenuebermittlung"
+        },
+        {
+          "norm": "DSGVO",
+          "article": "Art. 46",
+          "title": "Datenuebermittlung vorbehaltlich geeigneter Garantien"
+        }
+      ],
+      "sources": [
+        {
+          "type": "regulation",
+          "ref": "Art. 44-49 DSGVO"
+        },
+        {
+          "type": "court_decision",
+          "ref": "EuGH C-311/18 (Schrems II)"
+        }
+      ],
+      "category": "Governance",
+      "responsible": "Datenschutzbeauftragter",
+      "deadline": {
+        "type": "on_event",
+        "event": "Vor Beginn der Datenuebermittlung"
+      },
+      "sanctions": {
+        "max_fine": "20 Mio. EUR oder 4% Jahresumsatz"
+      },
+      "evidence": [
+        {
+          "name": "Transfer Impact Assessment (TIA)",
+          "required": true
+        },
+        "Standardvertragsklauseln (SCC)",
+        "Dokumentation zusaetzlicher Massnahmen"
+      ],
+      "priority": "kritisch",
+      "tom_control_ids": [
+        "TOM.GOV.01",
+        "TOM.CRY.01"
+      ],
+      "valid_from": "2018-05-25",
+      "version": "1.0"
+    },
+    {
+      "id": "DSGVO-OBL-082",
+      "title": "Transfer Impact Assessment (TIA) bei US-Anbietern",
+      "description": "Bei Nutzung von US-Cloud-Anbietern (AWS, Azure, Google etc.) muss ein Transfer Impact Assessment durchgefuehrt werden, das FISA 702 und Cloud Act Risiken bewertet und dokumentiert, ob die Standardvertragsklauseln wirksam schuetzen.",
+      "applies_when": "US cloud provider used for personal data",
+      "applies_when_condition": {
+        "all_of": [
+          {
+            "field": "data_protection.processes_personal_data",
+            "operator": "EQUALS",
+            "value": true
+          }
+        ]
+      },
+      "legal_basis": [
+        {
+          "norm": "DSGVO",
+          "article": "Art. 46 Abs. 1",
+          "title": "Geeignete Garantien"
+        },
+        {
+          "norm": "EuGH",
+          "article": "C-311/18",
+          "title": "Schrems II — Wirksamkeit von SCCs pruefen"
+        }
+      ],
+      "sources": [
+        {
+          "type": "court_decision",
+          "ref": "EuGH C-311/18 (Schrems II)"
+        },
+        {
+          "type": "guidance",
+          "ref": "EDPB Recommendations 01/2020 Supplementary Measures"
+        }
+      ],
+      "category": "Governance",
+      "responsible": "Datenschutzbeauftragter / Legal",
+      "deadline": {
+        "type": "on_event",
+        "event": "Vor Vertragsschluss mit US-Anbieter"
+      },
+      "sanctions": {
+        "max_fine": "20 Mio. EUR oder 4% Jahresumsatz"
+      },
+      "evidence": [
+        {
+          "name": "Transfer Impact Assessment",
+          "required": true
+        },
+        "FISA 702 Risikobewertung"
+      ],
+      "priority": "kritisch",
+      "tom_control_ids": [
+        "TOM.GOV.01"
+      ],
+      "valid_from": "2020-07-16",
+      "version": "1.0"
+    },
+    {
+      "id": "DSGVO-OBL-083",
+      "title": "Zusaetzliche technische Massnahmen bei Drittlanduebermittlung",
+      "description": "Wenn Standardvertragsklauseln allein nicht ausreichen (z.B. bei FISA 702 Exposure), muessen zusaetzliche technische Massnahmen implementiert werden: E2EE mit eigener Schluesselhoheit, Pseudonymisierung vor Uebermittlung, oder Verzicht auf den US-Anbieter.",
+      "applies_when": "SCC alone insufficient due to surveillance laws",
+      "applies_when_condition": {
+        "all_of": [
+          {
+            "field": "data_protection.processes_personal_data",
+            "operator": "EQUALS",
+            "value": true
+          }
+        ]
+      },
+      "legal_basis": [
+        {
+          "norm": "DSGVO",
+          "article": "Art. 46 Abs. 1",
+          "title": "Zusaetzliche Massnahmen"
+        },
+        {
+          "norm": "EDPB",
+          "article": "Recommendations 01/2020",
+          "title": "Supplementary Measures"
+        }
+      ],
+      "sources": [
+        {
+          "type": "guidance",
+          "ref": "EDPB Recommendations 01/2020"
+        }
+      ],
+      "category": "Technisch",
+      "responsible": "IT-Sicherheit / Datenschutzbeauftragter",
+      "priority": "hoch",
+      "evidence": [
+        {
+          "name": "Nachweis zusaetzlicher Schutzmassnahmen",
+          "required": true
+        },
+        "E2EE Dokumentation oder Pseudonymisierungskonzept"
+      ],
+      "tom_control_ids": [
+        "TOM.CRY.01",
+        "TOM.GOV.01"
+      ],
+      "valid_from": "2020-07-16",
+      "version": "1.0"
+    },
+    {
+      "id": "DSGVO-OBL-084",
+      "title": "Informationspflicht bei Drittlanduebermittlung",
+      "description": "Betroffene Personen muessen darueber informiert werden, dass ihre Daten in ein Drittland uebermittelt werden, einschliesslich der Angabe des Drittlands und der genutzten Garantien (Art. 13 Abs. 1 lit. f DSGVO).",
+      "applies_when": "personal data transferred to third country",
+      "applies_when_condition": {
+        "all_of": [
+          {
+            "field": "data_protection.processes_personal_data",
+            "operator": "EQUALS",
+            "value": true
+          }
+        ]
+      },
+      "legal_basis": [
+        {
+          "norm": "DSGVO",
+          "article": "Art. 13 Abs. 1 lit. f",
+          "title": "Informationspflicht bei Drittlanduebermittlung"
+        }
+      ],
+      "category": "Organisatorisch",
+      "responsible": "Datenschutzbeauftragter",
+      "priority": "hoch",
+      "evidence": [
+        {
+          "name": "Datenschutzerklaerung mit Drittland-Hinweis",
+          "required": true
+        }
+      ],
+      "tom_control_ids": [],
+      "valid_from": "2018-05-25",
+      "version": "1.0"
     }
   ],
   "controls": [
diff --git a/ai-compliance-sdk/policies/payment_controls_v1.json b/ai-compliance-sdk/policies/payment_controls_v1.json
new file mode 100644
index 0000000..9e54bf2
--- /dev/null
+++ b/ai-compliance-sdk/policies/payment_controls_v1.json
@@ -0,0 +1,5553 @@
+{
+  "schema": "payment_controls",
+  "version": "1.0",
+  "description": "Technische Pruefbibliothek fuer Payment-Terminal-Systeme. Eigene Controls, keine Normkopie.",
+  "domains": [
+    {
+      "id": "PAY",
+      "name": "Payment Flow & Transaction Integrity",
+      "description": "Zahlungsablauf, Zustandslogik, Idempotenz, Betragsvalidierung"
+    },
+    {
+      "id": "LOG",
+      "name": "Logging & Audit",
+      "description": "Protokollierung, Audit Trail, Datenmaskierung"
+    },
+    {
+      "id": "CRYPTO",
+      "name": "Secrets & Cryptography",
+      "description": "Schluesselmanagement, Verschluesselung, Secure Storage"
+    },
+    {
+      "id": "API",
+      "name": "API & Backend Security",
+      "description": "Authentifizierung, Autorisierung, Input Validation"
+    },
+    {
+      "id": "TERM",
+      "name": "Terminal Communication",
+      "description": "ZVT/OPI Protokolle, Sequenzen, Fehlercodes"
+    },
+    {
+      "id": "FW",
+      "name": "Firmware & Device Integrity",
+      "description": "Signierung, Update-Schutz, Manipulationserkennung"
+    },
+    {
+      "id": "REP",
+      "name": "Reporting & Reconciliation",
+      "description": "Transaktionsberichte, Abgleich, Exportdaten"
+    },
+    {
+      "id": "ACC",
+      "name": "Access Control & Administration",
+      "description": "Rollenkonzept, Privilegien, Session-Management"
+    },
+    {
+      "id": "ERR",
+      "name": "Error Handling & Resilience",
+      "description": "Fehlerbehandlung, Recovery, Offline-Szenarien"
+    },
+    {
+      "id": "BLD",
+      "name": "Build, Deployment & Supply Chain",
+      "description": "CI/CD Sicherheit, Abhaengigkeiten, Release-Integritaet"
+    },
+    {
+      "id": "AUTH",
+      "name": "Authentication & Authorization",
+      "description": "Authentifizierung, Autorisierung, Rollen, Privilegien"
+    },
+    {
+      "id": "SESSION",
+      "name": "Session Management",
+      "description": "Sitzungsverwaltung, Token, Cookies, Timeout"
+    },
+    {
+      "id": "KEYMGMT",
+      "name": "Key Management",
+      "description": "Schluessellebenszyklen, Rotation, Provisioning"
+    },
+    {
+      "id": "DEVICE",
+      "name": "Device Identity & Integrity",
+      "description": "Geraeteidentitaet, Provisioning, Tamper Detection"
+    },
+    {
+      "id": "TRANS",
+      "name": "Transaction Integrity",
+      "description": "Transaktionslogik, State Machine, Idempotenz"
+    },
+    {
+      "id": "DATA",
+      "name": "Data Minimization & Protection",
+      "description": "Datenminimierung, Maskierung, Klassifikation"
+    },
+    {
+      "id": "ERROR",
+      "name": "Error Handling & Resilience",
+      "description": "Fehlerbehandlung, Retry, Fallback, Monitoring"
+    },
+    {
+      "id": "REPORT",
+      "name": "Reporting & Reconciliation",
+      "description": "Berichte, Abgleich, Export, Audit Trail"
+    },
+    {
+      "id": "BUILD",
+      "name": "Build Pipeline Security",
+      "description": "CI/CD Sicherheit, Artefakt-Integritaet, Abhaengigkeiten"
+    },
+    {
+      "id": "DEPLOY",
+      "name": "Deployment Security",
+      "description": "Release-Management, Rollback, Umgebungstrennung"
+    },
+    {
+      "id": "QUEUE",
+      "name": "Message Queue & Async",
+      "description": "Warteschlangen, Idempotenz, Dead-Letter, Reihenfolge"
+    },
+    {
+      "id": "TENANT",
+      "name": "Multi-Tenancy Isolation",
+      "description": "Mandantentrennung, Cross-Tenant-Schutz, Cache-Isolation"
+    },
+    {
+      "id": "TELEMETRY",
+      "name": "Telemetry & Observability",
+      "description": "Metriken, Tracing, Datenmaskierung in Observability"
+    },
+    {
+      "id": "CONFIG",
+      "name": "Configuration Security",
+      "description": "Defaults, Validierung, Feature Flags, Laufzeitaenderungen"
+    },
+    {
+      "id": "NETWORK",
+      "name": "Network Security",
+      "description": "Segmentierung, Firewall, TLS, Egress-Kontrolle"
+    },
+    {
+      "id": "STORAGE",
+      "name": "Data Storage Security",
+      "description": "Persistenz, Backup, Schema-Integritaet, Zugriffskontrolle"
+    },
+    {
+      "id": "MONITOR",
+      "name": "Monitoring & Alerting",
+      "description": "Alarmierung, Heartbeats, Schwellwerte, Incident Detection"
+    },
+    {
+      "id": "OPS",
+      "name": "Operations & Runbooks",
+      "description": "Betriebsprozesse, Runbooks, Wartung, Recovery"
+    },
+    {
+      "id": "ZVTCORE",
+      "name": "ZVT Core Protocol",
+      "description": "ZVT-Rahmenstruktur, Parser, Feldvalidierung, Kodierung"
+    },
+    {
+      "id": "ZVTFLOW",
+      "name": "ZVT Protocol Flow",
+      "description": "ZVT-Kommandosequenzen, Zustandsuebergaenge, Sitzungslogik"
+    },
+    {
+      "id": "ZVTERROR",
+      "name": "ZVT Error Handling",
+      "description": "ZVT-Fehlercodes, Fehlerklassifikation, Eskalation"
+    },
+    {
+      "id": "ZVTTIME",
+      "name": "ZVT Timing & Timeout",
+      "description": "ZVT-Timeouts, Retry, Busy-States, Zeitsteuerung"
+    },
+    {
+      "id": "OPICORE",
+      "name": "OPI Core Protocol",
+      "description": "OPI-Nachrichtenstruktur, Schema, Validierung, Parser"
+    },
+    {
+      "id": "OPIFLOW",
+      "name": "OPI Protocol Flow",
+      "description": "OPI-Ablaufsteuerung, Korrelation, Storno, Recovery"
+    },
+    {
+      "id": "PROTOINT",
+      "name": "Protocol Integration",
+      "description": "Protokollkonverter, Mapping, Serialisierung, Adapter"
+    },
+    {
+      "id": "TERMSTATE",
+      "name": "Terminal State Management",
+      "description": "Terminalzustaende, Busy, Reconnect, Sicherheitsflags"
+    },
+    {
+      "id": "TERMREC",
+      "name": "Terminal Receipt & Records",
+      "description": "Belegdaten, Validierung, Zuordnung, Datenschutz"
+    },
+    {
+      "id": "TERMSYNC",
+      "name": "Terminal Synchronization",
+      "description": "Abgleich, Settlement, Offline-Sync, Konsistenz"
+    },
+    {
+      "id": "ZVT-CMD",
+      "name": "ZVT Command Flow",
+      "description": "ZVT-Kommandoreihenfolge, Parameter, Antwortverarbeitung"
+    },
+    {
+      "id": "ZVT-RT",
+      "name": "ZVT Retry & Timeout",
+      "description": "Timeout-Definitionen, Retry-Strategien, Backoff"
+    },
+    {
+      "id": "ZVT-STATE",
+      "name": "ZVT State Machine",
+      "description": "Zustandsmodell, Uebergaenge, Recovery, Deadlock-Vermeidung"
+    },
+    {
+      "id": "ZVT-COM",
+      "name": "ZVT Communication Integrity",
+      "description": "Nachrichtenlaenge, Checksummen, Encoding, Fragmentierung"
+    },
+    {
+      "id": "ZVT-REV",
+      "name": "ZVT Reversal & Cancellation",
+      "description": "Storno, Reversal, Zuordnung, Mehrfachschutz"
+    },
+    {
+      "id": "ZVT-RESP",
+      "name": "ZVT Response Handling",
+      "description": "Response-Codes, Fehlerinterpretation, Statusupdate"
+    },
+    {
+      "id": "ZVT-SESSION",
+      "name": "ZVT Session Management",
+      "description": "Session-Lifecycle, Timeout, Wiederaufnahme, Parallelitaet"
+    }
+  ],
+  "controls": [
+    {
+      "control_id": "PAY-001",
+      "domain": "PAY",
+      "title": "Eindeutige Transaktions-ID pro Zahlungsvorgang",
+      "objective": "Verhindert Vermischung und Mehrfachverarbeitung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "PAY-002",
+      "domain": "PAY",
+      "title": "Idempotente Verarbeitung wiederholter Zahlungsanfragen",
+      "objective": "Verhindert doppelte Buchungen bei Retries",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "PAY-003",
+      "domain": "PAY",
+      "title": "Verhinderung doppelter Verbuchung bei Netzwerk-Retry",
+      "objective": "Stellt konsistente Zahlungszustaende sicher",
+      "check_target": "system",
+      "evidence": [
+        "integration_test",
+        "architecture_doc"
+      ],
+      "automation": "partial"
+    },
+    {
+      "control_id": "PAY-004",
+      "domain": "PAY",
+      "title": "Definierter Initialzustand jeder Transaktion",
+      "objective": "Verhindert undefinierte Startbedingungen",
+      "check_target": "code",
+      "evidence": [
+        "source_code"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "PAY-005",
+      "domain": "PAY",
+      "title": "Definierte erlaubte Zustandsuebergaenge in der Transaktionslogik",
+      "objective": "Verhindert ungueltige State Transitions",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "unit_test"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "PAY-006",
+      "domain": "PAY",
+      "title": "Keine direkte Transition in terminalen Erfolgszustand ohne Autorisierung",
+      "objective": "Verhindert vorzeitige Freigabe",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "unit_test"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "PAY-007",
+      "domain": "PAY",
+      "title": "Abbruchpfade fuehren in definierten Endzustand",
+      "objective": "Sichert sauberes Cancel-Handling",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "PAY-008",
+      "domain": "PAY",
+      "title": "Timeout fuehrt in nachvollziehbaren und sicheren Zustand",
+      "objective": "Verhindert haengende Transaktionen",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "PAY-009",
+      "domain": "PAY",
+      "title": "Rollback oder Reversal-Handling bei Teilfehlschlag",
+      "objective": "Reduziert Inkonsistenzen",
+      "check_target": "system",
+      "evidence": [
+        "integration_test",
+        "architecture_doc"
+      ],
+      "automation": "partial"
+    },
+    {
+      "control_id": "PAY-010",
+      "domain": "PAY",
+      "title": "Fehlerhafte Antworten werden nicht als Erfolg interpretiert",
+      "objective": "Verhindert False Positive bei Zahlungsstatus",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "unit_test"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "PAY-011",
+      "domain": "PAY",
+      "title": "Betragsvalidierung bei jeder Zahlungsanfrage",
+      "objective": "Verhindert Betragmanipulation und negative Werte",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "unit_test"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "PAY-012",
+      "domain": "PAY",
+      "title": "Waehrungsfeld wird validiert und konsistent verarbeitet",
+      "objective": "Verhindert Fehlverarbeitung bei Mehrwaehrung",
+      "check_target": "code",
+      "evidence": [
+        "source_code"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "PAY-013",
+      "domain": "PAY",
+      "title": "Betragsrundung erfolgt deterministisch und dokumentiert",
+      "objective": "Verhindert Abweichungen Frontend/Terminal/Backend",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "unit_test"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "PAY-014",
+      "domain": "PAY",
+      "title": "Keine lokale Manipulation des autorisierten Betrags nach Freigabe",
+      "objective": "Schuetzt Integritaet der Zahlung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "unit_test"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "PAY-015",
+      "domain": "PAY",
+      "title": "Transaktionskontext bleibt ueber Retry-Versuche konsistent",
+      "objective": "Verhindert Kontextverlust",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "PAY-016",
+      "domain": "PAY",
+      "title": "Antworten ohne Referenz-ID werden nicht akzeptiert",
+      "objective": "Verhindert verwaiste Zuordnungen",
+      "check_target": "code",
+      "evidence": [
+        "source_code"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "PAY-017",
+      "domain": "PAY",
+      "title": "Doppelte Callback-Verarbeitung wird unterdrueckt",
+      "objective": "Verhindert doppelte Statusupdates",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "PAY-018",
+      "domain": "PAY",
+      "title": "Asynchrone Statusmeldungen werden korreliert und sequenziell verarbeitet",
+      "objective": "Sichert korrekte Reihenfolge",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "PAY-019",
+      "domain": "PAY",
+      "title": "Geschaeftsvorfall wird erst nach bestaetigtem Zahlungsstatus finalisiert",
+      "objective": "Verhindert Business Success ohne Payment Success",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "PAY-020",
+      "domain": "PAY",
+      "title": "Offline-Zahlungen werden explizit gekennzeichnet",
+      "objective": "Verhindert Verwechslung mit final autorisierten Zahlungen",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "reporting_output"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "LOG-001",
+      "domain": "LOG",
+      "title": "Keine sensitiven Zahlungsdaten im Anwendungslog",
+      "objective": "Verhindert Offenlegung sensitiver Daten",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "log_config"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "LOG-002",
+      "domain": "LOG",
+      "title": "PAN wird in Logs maskiert",
+      "objective": "Reduziert Risiko bei Log-Einsicht",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "log_output_sample"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "LOG-003",
+      "domain": "LOG",
+      "title": "CVV/CVC wird niemals geloggt",
+      "objective": "Verhindert Protokollierung sensitiver Authentifizierungsdaten",
+      "check_target": "code",
+      "evidence": [
+        "source_code"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "LOG-004",
+      "domain": "LOG",
+      "title": "Kryptographische Schluessel werden nicht geloggt",
+      "objective": "Verhindert Kompromittierung durch Logging",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "log_output_sample"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "LOG-005",
+      "domain": "LOG",
+      "title": "Admin-Aktionen werden auditierbar protokolliert",
+      "objective": "Ermoeglicht Nachvollziehbarkeit privilegierter Handlungen",
+      "check_target": "system",
+      "evidence": [
+        "source_code",
+        "audit_log_sample"
+      ],
+      "automation": "partial"
+    },
+    {
+      "control_id": "LOG-006",
+      "domain": "LOG",
+      "title": "Konfigurationsaenderungen werden protokolliert",
+      "objective": "Ermoeglicht Nachweis kritischer Aenderungen",
+      "check_target": "system",
+      "evidence": [
+        "source_code",
+        "audit_log_sample"
+      ],
+      "automation": "partial"
+    },
+    {
+      "control_id": "LOG-007",
+      "domain": "LOG",
+      "title": "Fehlgeschlagene Authentifizierungsversuche werden geloggt",
+      "objective": "Unterstuetzt Erkennung von Missbrauch",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "audit_log_sample"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "LOG-008",
+      "domain": "LOG",
+      "title": "Sicherheitsrelevante Ereignisse erhalten eindeutige Event-Typen",
+      "objective": "Erleichtert Korrelation und Monitoring",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "log_schema"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "LOG-009",
+      "domain": "LOG",
+      "title": "Audit-Events enthalten konsistenten Zeitstempel",
+      "objective": "Ermoeglicht zeitliche Rekonstruktion",
+      "check_target": "system",
+      "evidence": [
+        "audit_log_sample",
+        "config"
+      ],
+      "automation": "partial"
+    },
+    {
+      "control_id": "LOG-010",
+      "domain": "LOG",
+      "title": "Audit-Events enthalten eindeutige Terminalkennung",
+      "objective": "Ermoeglicht Zuordnung zur Quelle",
+      "check_target": "code",
+      "evidence": [
+        "log_schema",
+        "audit_log_sample"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "LOG-011",
+      "domain": "LOG",
+      "title": "Debug-Logging in Produktion deaktiviert",
+      "objective": "Verhindert Leaks in produktiven Systemen",
+      "check_target": "config",
+      "evidence": [
+        "deployment_config"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "LOG-012",
+      "domain": "LOG",
+      "title": "Manipulation von Audit-Logs technisch erschwert",
+      "objective": "Schuetzt Integritaet des Audit Trails",
+      "check_target": "system",
+      "evidence": [
+        "architecture_doc",
+        "storage_config"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "LOG-013",
+      "domain": "LOG",
+      "title": "Fehlermeldungen enthalten keine Stacktraces mit sensitiven Payloads",
+      "objective": "Verhindert indirekten Datenabfluss",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "log_output_sample"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "LOG-014",
+      "domain": "LOG",
+      "title": "Jede Zahlungsentscheidung erzeugt Audit-Eintrag",
+      "objective": "Verbindet Business Outcome mit technischer Evidenz",
+      "check_target": "system",
+      "evidence": [
+        "audit_log_sample",
+        "integration_test"
+      ],
+      "automation": "partial"
+    },
+    {
+      "control_id": "LOG-015",
+      "domain": "LOG",
+      "title": "Log-Retention konfiguriert und dokumentiert",
+      "objective": "Sichert Verfuegbarkeit relevanter Ereignishistorie",
+      "check_target": "config",
+      "evidence": [
+        "retention_policy",
+        "deployment_config"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "CRYPTO-001",
+      "domain": "CRYPTO",
+      "title": "Keine Secrets im Quellcode",
+      "objective": "Verhindert Offenlegung im Repository",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "secret_scan"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "CRYPTO-002",
+      "domain": "CRYPTO",
+      "title": "Keine Secrets in Commit-Historie",
+      "objective": "Reduziert Leak-Risiko ueber Entwicklungsartefakte",
+      "check_target": "repository",
+      "evidence": [
+        "secret_scan",
+        "build_scripts"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "CRYPTO-003",
+      "domain": "CRYPTO",
+      "title": "Keine Schluessel im Klartext in Konfigurationsdateien",
+      "objective": "Schuetzt ruhende Geheimnisse",
+      "check_target": "config",
+      "evidence": [
+        "config",
+        "secret_scan"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "CRYPTO-004",
+      "domain": "CRYPTO",
+      "title": "Secrets aus sicherem Secret Store bezogen",
+      "objective": "Verhindert lokale Persistenz",
+      "check_target": "system",
+      "evidence": [
+        "architecture_doc",
+        "deployment_config"
+      ],
+      "automation": "partial"
+    },
+    {
+      "control_id": "CRYPTO-005",
+      "domain": "CRYPTO",
+      "title": "Zugriff auf Secrets rollen-/servicebezogen eingeschraenkt",
+      "objective": "Begrenzt Blast Radius",
+      "check_target": "system",
+      "evidence": [
+        "iam_config",
+        "architecture_doc"
+      ],
+      "automation": "partial"
+    },
+    {
+      "control_id": "CRYPTO-006",
+      "domain": "CRYPTO",
+      "title": "Zentrale und freigegebene Krypto-Bibliotheken verwendet",
+      "objective": "Verhindert unsichere Eigenimplementierungen",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "dependency_list"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "CRYPTO-007",
+      "domain": "CRYPTO",
+      "title": "Keine veralteten kryptographischen Primitive (MD5, SHA1, DES)",
+      "objective": "Verhindert Einsatz schwacher Verfahren",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "dependency_scan"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "CRYPTO-008",
+      "domain": "CRYPTO",
+      "title": "TLS 1.2+ fuer alle externen Verbindungen",
+      "objective": "Schuetzt Daten bei Uebertragung",
+      "check_target": "config",
+      "evidence": [
+        "config",
+        "network_scan"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "CRYPTO-009",
+      "domain": "CRYPTO",
+      "title": "Schluesselrotation implementiert und dokumentiert",
+      "objective": "Reduziert Kompromittierungszeitraum",
+      "check_target": "process",
+      "evidence": [
+        "key_mgmt_doc",
+        "config"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "CRYPTO-010",
+      "domain": "CRYPTO",
+      "title": "HSM oder Secure Enclave fuer kryptographische Operationen",
+      "objective": "Hardwarebasierter Schluesselschutz",
+      "check_target": "system",
+      "evidence": [
+        "architecture_doc"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "CRYPTO-011",
+      "domain": "CRYPTO",
+      "title": "Zertifikats-Pinning fuer kritische Verbindungen",
+      "objective": "Schuetzt gegen MITM",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "config"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "CRYPTO-012",
+      "domain": "CRYPTO",
+      "title": "Kryptographische Zufallszahlen aus sicherem Generator",
+      "objective": "Verhindert vorhersagbare Tokens/Nonces",
+      "check_target": "code",
+      "evidence": [
+        "source_code"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "CRYPTO-013",
+      "domain": "CRYPTO",
+      "title": "PIN-Eingabe nur ueber Secure PIN Entry Device",
+      "objective": "Schuetzt PIN vor Abgriff",
+      "check_target": "system",
+      "evidence": [
+        "architecture_doc",
+        "certification"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "CRYPTO-014",
+      "domain": "CRYPTO",
+      "title": "Kartendaten werden verschluesselt uebertragen (P2PE)",
+      "objective": "End-to-End Schutz der Kartendaten",
+      "check_target": "system",
+      "evidence": [
+        "architecture_doc",
+        "network_config"
+      ],
+      "automation": "partial"
+    },
+    {
+      "control_id": "CRYPTO-015",
+      "domain": "CRYPTO",
+      "title": "Keine persistente Speicherung vollstaendiger Kartendaten",
+      "objective": "Minimiert Daten bei Kompromittierung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "db_schema"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "API-001",
+      "domain": "API",
+      "title": "Authentifizierung fuer alle Admin-Endpunkte",
+      "objective": "Verhindert unautorisierten Zugriff",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "api_spec"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "API-002",
+      "domain": "API",
+      "title": "Rollenbasierte Autorisierung",
+      "objective": "Least-Privilege Prinzip",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "rbac_config"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "API-003",
+      "domain": "API",
+      "title": "Rate Limiting implementiert",
+      "objective": "Schuetzt gegen Brute Force und DoS",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "config"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "API-004",
+      "domain": "API",
+      "title": "Keine sensiblen Daten in Fehlermeldungen",
+      "objective": "Verhindert Information Leakage",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "api_test"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "API-005",
+      "domain": "API",
+      "title": "Input Validation gegen Injection",
+      "objective": "Schuetzt gegen SQL/Command Injection",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "security_test"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "API-006",
+      "domain": "API",
+      "title": "CORS korrekt konfiguriert",
+      "objective": "Verhindert Cross-Origin Angriffe",
+      "check_target": "config",
+      "evidence": [
+        "config",
+        "security_test"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "API-007",
+      "domain": "API",
+      "title": "Session-Timeout fuer Admin-Sessions",
+      "objective": "Reduziert Risiko bei verlassenen Sessions",
+      "check_target": "config",
+      "evidence": [
+        "config",
+        "source_code"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "API-008",
+      "domain": "API",
+      "title": "API-Versionierung implementiert",
+      "objective": "Ermoeglicht kontrollierte Aenderungen",
+      "check_target": "code",
+      "evidence": [
+        "api_spec",
+        "source_code"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "API-009",
+      "domain": "API",
+      "title": "Webhook-Callbacks werden authentifiziert",
+      "objective": "Verhindert gefaelschte Callbacks",
+      "check_target": "code",
+      "evidence": [
+        "source_code"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "API-010",
+      "domain": "API",
+      "title": "Idempotenz-Keys fuer kritische POST-Operationen",
+      "objective": "Verhindert doppelte Ausfuehrung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "api_spec"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "API-011",
+      "domain": "API",
+      "title": "Request-Signierung fuer sicherheitskritische Operationen",
+      "objective": "Integritaetsschutz der Anfrage",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "api_spec"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "API-012",
+      "domain": "API",
+      "title": "Keine sensiblen Daten in URL-Parametern",
+      "objective": "Verhindert Leakage ueber Logs und Browser-History",
+      "check_target": "code",
+      "evidence": [
+        "source_code"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "API-013",
+      "domain": "API",
+      "title": "Content-Type Validierung bei allen Endpunkten",
+      "objective": "Verhindert Content-Type Confusion",
+      "check_target": "code",
+      "evidence": [
+        "source_code"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "API-014",
+      "domain": "API",
+      "title": "Health- und Status-Endpunkte exponieren keine sensitiven Details",
+      "objective": "Verhindert Reconnaissance",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "api_test"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "API-015",
+      "domain": "API",
+      "title": "Batch-Operationen sind groessenbeschraenkt",
+      "objective": "Verhindert Ressourcenerschoepfung",
+      "check_target": "code",
+      "evidence": [
+        "source_code"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TERM-001",
+      "domain": "TERM",
+      "title": "Korrekte Sequenz von Zahlungsbefehlen",
+      "objective": "Protokollkonformitaet",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TERM-002",
+      "domain": "TERM",
+      "title": "Retry-Mechanismus bei Verbindungsabbruch",
+      "objective": "Sichert Transaktionsabschluss",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TERM-003",
+      "domain": "TERM",
+      "title": "Timeout Handling Terminal-Backend",
+      "objective": "Verhindert Blockierung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "config"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TERM-004",
+      "domain": "TERM",
+      "title": "Fehlercodes korrekt interpretiert",
+      "objective": "Verhindert Fehlinterpretation",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "unit_test"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TERM-005",
+      "domain": "TERM",
+      "title": "Status-Synchronisation zwischen Terminal und Backend",
+      "objective": "Konsistente Zustaende",
+      "check_target": "system",
+      "evidence": [
+        "integration_test",
+        "architecture_doc"
+      ],
+      "automation": "partial"
+    },
+    {
+      "control_id": "TERM-006",
+      "domain": "TERM",
+      "title": "Verbindungsaufbau zum Terminal authentifiziert",
+      "objective": "Verhindert Rogue-Terminal",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "config"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TERM-007",
+      "domain": "TERM",
+      "title": "Terminal-Registrierung mit eindeutiger Kennung",
+      "objective": "Ermoeglicht Asset-Tracking",
+      "check_target": "system",
+      "evidence": [
+        "db_schema",
+        "admin_ui"
+      ],
+      "automation": "partial"
+    },
+    {
+      "control_id": "TERM-008",
+      "domain": "TERM",
+      "title": "Heartbeat / Keep-Alive fuer Terminal-Verbindung",
+      "objective": "Erkennt Verbindungsabbruch frueh",
+      "check_target": "code",
+      "evidence": [
+        "source_code"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TERM-009",
+      "domain": "TERM",
+      "title": "Protokollversion wird geprueft und erzwungen",
+      "objective": "Verhindert Downgrade-Angriffe",
+      "check_target": "code",
+      "evidence": [
+        "source_code"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TERM-010",
+      "domain": "TERM",
+      "title": "Kontaktlos-Transaktionen nur ueber zugelassene Kernel",
+      "objective": "Sichert NFC-Konformitaet",
+      "check_target": "system",
+      "evidence": [
+        "certification",
+        "config"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "TERM-011",
+      "domain": "TERM",
+      "title": "Terminal meldet Tamper-Events an Backend",
+      "objective": "Zentrales Monitoring von Manipulationsversuchen",
+      "check_target": "system",
+      "evidence": [
+        "integration_test",
+        "architecture_doc"
+      ],
+      "automation": "partial"
+    },
+    {
+      "control_id": "TERM-012",
+      "domain": "TERM",
+      "title": "Offline-Queue bei Verbindungsunterbrechung",
+      "objective": "Sichert Transaktionsdaten bei Netzausfall",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TERM-013",
+      "domain": "TERM",
+      "title": "Maximale Queue-Groesse definiert",
+      "objective": "Verhindert unkontrollierten Speicherverbrauch",
+      "check_target": "config",
+      "evidence": [
+        "config",
+        "source_code"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TERM-014",
+      "domain": "TERM",
+      "title": "End-of-Day / Settlement-Prozess implementiert",
+      "objective": "Sichert taeglichen Transaktionsabschluss",
+      "check_target": "system",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "partial"
+    },
+    {
+      "control_id": "TERM-015",
+      "domain": "TERM",
+      "title": "Terminal-Display zeigt korrekten Zahlungsstatus",
+      "objective": "Verhindert Fehlkommunikation an Nutzer",
+      "check_target": "system",
+      "evidence": [
+        "integration_test"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "FW-001",
+      "domain": "FW",
+      "title": "Firmware signiert",
+      "objective": "Verhindert Installation manipulierter Firmware",
+      "check_target": "system",
+      "evidence": [
+        "build_pipeline",
+        "signing_config"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "FW-002",
+      "domain": "FW",
+      "title": "Signaturpruefung vor Firmware-Update",
+      "objective": "Blockiert unsignierte Updates",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "update_process"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "FW-003",
+      "domain": "FW",
+      "title": "Rollback-Mechanismus vorhanden",
+      "objective": "Ermoeglicht Recovery nach fehlerhaftem Update",
+      "check_target": "system",
+      "evidence": [
+        "architecture_doc",
+        "test_report"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "FW-004",
+      "domain": "FW",
+      "title": "Debug-Interfaces in Produktion deaktiviert",
+      "objective": "Verhindert unautorisierten Zugriff",
+      "check_target": "config",
+      "evidence": [
+        "deployment_config",
+        "security_test"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "FW-005",
+      "domain": "FW",
+      "title": "Manipulationserkennung loest Alarm/Sperre aus",
+      "objective": "Reaktion auf physische Angriffe",
+      "check_target": "system",
+      "evidence": [
+        "architecture_doc",
+        "test_report"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "FW-006",
+      "domain": "FW",
+      "title": "Secure Boot implementiert",
+      "objective": "Verhindert Ausfuehrung manipulierter Boot-Images",
+      "check_target": "system",
+      "evidence": [
+        "architecture_doc"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "FW-007",
+      "domain": "FW",
+      "title": "Firmware-Version ist remote abfragbar",
+      "objective": "Ermoeglicht Fleet-Management und Compliance-Nachweis",
+      "check_target": "system",
+      "evidence": [
+        "api_spec",
+        "admin_ui"
+      ],
+      "automation": "partial"
+    },
+    {
+      "control_id": "FW-008",
+      "domain": "FW",
+      "title": "Automatische Update-Benachrichtigung bei kritischen Patches",
+      "objective": "Sichert zeitnahe Reaktion auf Schwachstellen",
+      "check_target": "system",
+      "evidence": [
+        "architecture_doc"
+      ],
+      "automation": "partial"
+    },
+    {
+      "control_id": "FW-009",
+      "domain": "FW",
+      "title": "Keine Persistenz von Zahlungsdaten ueber Neustart hinaus",
+      "objective": "Schuetzt Daten bei physischem Zugriff",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "architecture_doc"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "FW-010",
+      "domain": "FW",
+      "title": "Physischer Speicher wird bei Tamper-Detection geloescht",
+      "objective": "Zerstoert Schluessel bei Manipulation",
+      "check_target": "system",
+      "evidence": [
+        "architecture_doc",
+        "certification"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "REP-001",
+      "domain": "REP",
+      "title": "Transaktionsstatus vollstaendig dokumentiert",
+      "objective": "Ermoeglicht Nachvollziehbarkeit jeder Zahlung",
+      "check_target": "system",
+      "evidence": [
+        "reporting_output",
+        "db_schema"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "REP-002",
+      "domain": "REP",
+      "title": "Audit-Trail verknuepft mit Transaktionen",
+      "objective": "Sichert End-to-End Traceability",
+      "check_target": "system",
+      "evidence": [
+        "reporting_output",
+        "audit_log_sample"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "REP-003",
+      "domain": "REP",
+      "title": "Exportdaten plausibel und vollstaendig",
+      "objective": "Sichert korrekte Weitergabe",
+      "check_target": "system",
+      "evidence": [
+        "export_sample",
+        "integration_test"
+      ],
+      "automation": "partial"
+    },
+    {
+      "control_id": "REP-004",
+      "domain": "REP",
+      "title": "Fehlercodes nachvollziehbar dokumentiert",
+      "objective": "Ermoeglicht Fehleranalyse",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "documentation"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "REP-005",
+      "domain": "REP",
+      "title": "Revisionssichere Speicherung von Transaktionsdaten",
+      "objective": "GoBD/GDPdU-konforme Aufbewahrung",
+      "check_target": "system",
+      "evidence": [
+        "architecture_doc",
+        "storage_config"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "REP-006",
+      "domain": "REP",
+      "title": "Tagesabschluss-Report vollstaendig und konsistent",
+      "objective": "Sichert taeglichen Abgleich",
+      "check_target": "system",
+      "evidence": [
+        "reporting_output",
+        "integration_test"
+      ],
+      "automation": "partial"
+    },
+    {
+      "control_id": "REP-007",
+      "domain": "REP",
+      "title": "Summenabgleich Terminal vs. Backend",
+      "objective": "Erkennt Differenzen",
+      "check_target": "system",
+      "evidence": [
+        "reconciliation_report",
+        "integration_test"
+      ],
+      "automation": "partial"
+    },
+    {
+      "control_id": "REP-008",
+      "domain": "REP",
+      "title": "Stornierte Transaktionen korrekt ausgewiesen",
+      "objective": "Sichert korrekte Buchhaltungsgrundlage",
+      "check_target": "system",
+      "evidence": [
+        "reporting_output"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "REP-009",
+      "domain": "REP",
+      "title": "Historische Reports nicht nachtraeglich aenderbar",
+      "objective": "Schuetzt Integritaet der Berichterstattung",
+      "check_target": "system",
+      "evidence": [
+        "architecture_doc",
+        "db_config"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "REP-010",
+      "domain": "REP",
+      "title": "Abrechnungsdaten enthalten keine vollstaendigen Kartennummern",
+      "objective": "Minimiert Datenexposition in Reports",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "export_sample"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "ACC-001",
+      "domain": "ACC",
+      "title": "Individuelle Benutzerkonten fuer alle Administratoren",
+      "objective": "Verhindert geteilte Accounts",
+      "check_target": "system",
+      "evidence": [
+        "admin_ui",
+        "iam_config"
+      ],
+      "automation": "partial"
+    },
+    {
+      "control_id": "ACC-002",
+      "domain": "ACC",
+      "title": "Standard-Passwoerter werden bei Ersteinrichtung erzwungen zu aendern",
+      "objective": "Verhindert Default-Credential-Angriffe",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "deployment_doc"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ACC-003",
+      "domain": "ACC",
+      "title": "Multi-Faktor-Authentifizierung fuer Admin-Zugang",
+      "objective": "Erhoehter Schutz privilegierter Konten",
+      "check_target": "system",
+      "evidence": [
+        "iam_config",
+        "admin_ui"
+      ],
+      "automation": "partial"
+    },
+    {
+      "control_id": "ACC-004",
+      "domain": "ACC",
+      "title": "Passwort-Komplexitaetsanforderungen implementiert",
+      "objective": "Verhindert schwache Passwoerter",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "config"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "ACC-005",
+      "domain": "ACC",
+      "title": "Account-Sperrung nach fehlgeschlagenen Anmeldeversuchen",
+      "objective": "Schuetzt gegen Brute Force",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "config"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "ACC-006",
+      "domain": "ACC",
+      "title": "Privilegierte Aktionen erfordern erneute Authentifizierung",
+      "objective": "Step-Up Authentication",
+      "check_target": "code",
+      "evidence": [
+        "source_code"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ACC-007",
+      "domain": "ACC",
+      "title": "Inaktive Sessions werden automatisch beendet",
+      "objective": "Reduziert Angriffsflaeche bei verlassenen Sessions",
+      "check_target": "config",
+      "evidence": [
+        "config",
+        "source_code"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "ACC-008",
+      "domain": "ACC",
+      "title": "Berechtigungsaenderungen werden auditiert",
+      "objective": "Nachvollziehbarkeit von Rechteaenderungen",
+      "check_target": "system",
+      "evidence": [
+        "audit_log_sample",
+        "source_code"
+      ],
+      "automation": "partial"
+    },
+    {
+      "control_id": "ACC-009",
+      "domain": "ACC",
+      "title": "Least-Privilege Prinzip fuer alle Rollen",
+      "objective": "Minimiert Rechte auf das Notwendige",
+      "check_target": "system",
+      "evidence": [
+        "rbac_config",
+        "architecture_doc"
+      ],
+      "automation": "partial"
+    },
+    {
+      "control_id": "ACC-010",
+      "domain": "ACC",
+      "title": "Service-Accounts haben keine interaktive Login-Moeglichkeit",
+      "objective": "Verhindert Missbrauch technischer Konten",
+      "check_target": "config",
+      "evidence": [
+        "iam_config"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ERR-001",
+      "domain": "ERR",
+      "title": "Definierte Fehlerbehandlung fuer alle externen Aufrufe",
+      "objective": "Verhindert unkontrollierte Abbrueche",
+      "check_target": "code",
+      "evidence": [
+        "source_code"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ERR-002",
+      "domain": "ERR",
+      "title": "Graceful Degradation bei Teilausfall",
+      "objective": "Sichert Basisfunktionalitaet",
+      "check_target": "system",
+      "evidence": [
+        "architecture_doc",
+        "integration_test"
+      ],
+      "automation": "partial"
+    },
+    {
+      "control_id": "ERR-003",
+      "domain": "ERR",
+      "title": "Recovery nach Stromausfall ohne Datenverlust",
+      "objective": "Transaktionskonsistenz bei Hardwareausfall",
+      "check_target": "system",
+      "evidence": [
+        "integration_test",
+        "architecture_doc"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "ERR-004",
+      "domain": "ERR",
+      "title": "Offline-Modus mit definiertem Funktionsumfang",
+      "objective": "Klare Grenzen bei fehlender Konnektivitaet",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "documentation"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ERR-005",
+      "domain": "ERR",
+      "title": "Automatische Wiederverbindung nach Netzwerkunterbrechung",
+      "objective": "Minimiert manuelle Intervention",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ERR-006",
+      "domain": "ERR",
+      "title": "Circuit Breaker bei Backend-Ueberlast",
+      "objective": "Verhindert Kaskadenausfall",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "config"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ERR-007",
+      "domain": "ERR",
+      "title": "Fehlerhafte Datenpakete werden verworfen, nicht verarbeitet",
+      "objective": "Verhindert Fehlverarbeitung korrupter Daten",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "unit_test"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "ERR-008",
+      "domain": "ERR",
+      "title": "Health-Check-Endpunkt fuer Terminal-Monitoring",
+      "objective": "Ermoeglicht proaktive Fehlererkennung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "api_spec"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "ERR-009",
+      "domain": "ERR",
+      "title": "Eskalationsprozess bei kritischen Fehlern definiert",
+      "objective": "Sichert schnelle Reaktion bei Systemausfall",
+      "check_target": "process",
+      "evidence": [
+        "documentation",
+        "runbook"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "ERR-010",
+      "domain": "ERR",
+      "title": "Wartungsmodus ohne Transaktionsverlust aktivierbar",
+      "objective": "Ermoeglicht geplante Wartung ohne Datenverlust",
+      "check_target": "system",
+      "evidence": [
+        "admin_ui",
+        "integration_test"
+      ],
+      "automation": "partial"
+    },
+    {
+      "control_id": "BLD-001",
+      "domain": "BLD",
+      "title": "Build-Pipeline reproduzierbar",
+      "objective": "Sichert Nachvollziehbarkeit der Artefakte",
+      "check_target": "system",
+      "evidence": [
+        "ci_config",
+        "build_log"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "BLD-002",
+      "domain": "BLD",
+      "title": "Abhaengigkeiten werden auf bekannte Schwachstellen geprueft",
+      "objective": "Verhindert vulnerable Dependencies",
+      "check_target": "system",
+      "evidence": [
+        "dependency_scan",
+        "ci_config"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "BLD-003",
+      "domain": "BLD",
+      "title": "Release-Artefakte sind signiert",
+      "objective": "Integritaetsschutz der Auslieferung",
+      "check_target": "system",
+      "evidence": [
+        "signing_config",
+        "release_process"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "BLD-004",
+      "domain": "BLD",
+      "title": "Keine Test-Credentials in Release-Konfiguration",
+      "objective": "Verhindert Produktions-Leaks",
+      "check_target": "config",
+      "evidence": [
+        "deployment_config",
+        "secret_scan"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "BLD-005",
+      "domain": "BLD",
+      "title": "Container-Images werden auf Schwachstellen gescannt",
+      "objective": "Sichert Basis-Image Integritaet",
+      "check_target": "system",
+      "evidence": [
+        "container_scan",
+        "ci_config"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "BLD-006",
+      "domain": "BLD",
+      "title": "SBOM (Software Bill of Materials) wird generiert",
+      "objective": "Transparenz ueber verwendete Komponenten",
+      "check_target": "system",
+      "evidence": [
+        "sbom_output",
+        "ci_config"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "BLD-007",
+      "domain": "BLD",
+      "title": "Deployment nur ueber autorisierte Pipeline",
+      "objective": "Verhindert manuelle, unkontrollierte Deployments",
+      "check_target": "system",
+      "evidence": [
+        "ci_config",
+        "access_control"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "BLD-008",
+      "domain": "BLD",
+      "title": "Rollback-Prozedur fuer Deployments definiert und getestet",
+      "objective": "Ermoeglicht schnelle Recovery",
+      "check_target": "process",
+      "evidence": [
+        "runbook",
+        "deployment_doc"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "BLD-009",
+      "domain": "BLD",
+      "title": "Code-Review vor Merge in Release-Branch",
+      "objective": "Vier-Augen-Prinzip",
+      "check_target": "process",
+      "evidence": [
+        "git_config",
+        "pr_policy"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "BLD-010",
+      "domain": "BLD",
+      "title": "Automatisierte Tests vor jedem Release",
+      "objective": "Sichert Qualitaet vor Auslieferung",
+      "check_target": "system",
+      "evidence": [
+        "ci_config",
+        "test_results"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "CRYPTO-016",
+      "domain": "CRYPTO",
+      "title": "Unsichere Betriebsmodi wie ECB werden nicht verwendet",
+      "objective": "Verhindert Musterlecks und schwache Verschluesselung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "crypto_config"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "CRYPTO-017",
+      "domain": "CRYPTO",
+      "title": "Feste IVs oder Nonces werden nicht wiederverwendet",
+      "objective": "Verhindert kryptographische Schwaechung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "unit_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "CRYPTO-018",
+      "domain": "CRYPTO",
+      "title": "Klartextvergleich geheimer Werte ohne Timing-sichere Funktion",
+      "objective": "Verhindert Timing-Angriffe",
+      "check_target": "code",
+      "evidence": [
+        "source_code"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "CRYPTO-019",
+      "domain": "CRYPTO",
+      "title": "Schluessel im Speicher nur so lange wie erforderlich",
+      "objective": "Reduziert Exposition im Prozessspeicher",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "code_review"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "CRYPTO-020",
+      "domain": "CRYPTO",
+      "title": "Kryptographische Fehler fuehren nicht zu stillen Fallbacks",
+      "objective": "Verhindert unbemerkte Deaktivierung von Sicherheit",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "unit_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "AUTH-001",
+      "domain": "AUTH",
+      "title": "Admin-Schnittstellen erfordern starke Authentifizierung",
+      "objective": "Verhindert unbefugten Zugriff",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "route_config"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "AUTH-002",
+      "domain": "AUTH",
+      "title": "Standardpasswoerter in Produktivpfaden ausgeschlossen",
+      "objective": "Verhindert triviale Kompromittierung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "secret_scan"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "AUTH-003",
+      "domain": "AUTH",
+      "title": "Fehlgeschlagene Anmeldeversuche begrenzt oder verzoegert",
+      "objective": "Erschwert Brute-Force",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "AUTH-004",
+      "domain": "AUTH",
+      "title": "Rollen explizit modelliert, nicht aus UI abgeleitet",
+      "objective": "Verhindert Autorisierungsfehler",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "policy_definitions"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "AUTH-005",
+      "domain": "AUTH",
+      "title": "Privilegierte Aktionen erfordern serverseitige Pruefung",
+      "objective": "Verhindert Umgehung clientseitiger Schutz",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "AUTH-006",
+      "domain": "AUTH",
+      "title": "Autorisierung zentral implementiert",
+      "objective": "Reduziert Inkonsistenzen",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "architecture_doc"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "AUTH-007",
+      "domain": "AUTH",
+      "title": "Service-zu-Service Auth ohne eingebettete Credentials",
+      "objective": "Verhindert Missbrauch statischer Geheimnisse",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "secret_scan"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "AUTH-008",
+      "domain": "AUTH",
+      "title": "Deaktivierte Nutzer/Geraete koennen nicht mehr authentifizieren",
+      "objective": "Wirksame Entzug von Zugriffsrechten",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "AUTH-009",
+      "domain": "AUTH",
+      "title": "MFA fuer besonders privilegierte Zugaenge",
+      "objective": "Erhoehter Schutz Hochrisiko-Funktionen",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "auth_config"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "AUTH-010",
+      "domain": "AUTH",
+      "title": "Token auf Ablauf und Integritaet geprueft",
+      "objective": "Verhindert manipuliertes Auth-Material",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "AUTH-011",
+      "domain": "AUTH",
+      "title": "Autorisierung basiert auf Serverzustand, nicht Client-Rollen",
+      "objective": "Verhindert Privilege Escalation",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "AUTH-012",
+      "domain": "AUTH",
+      "title": "Admin-Funktionen logisch von Transaktionsfunktionen getrennt",
+      "objective": "Reduziert Angriffsflaeche",
+      "check_target": "architecture",
+      "evidence": [
+        "source_code",
+        "route_maps"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "AUTH-013",
+      "domain": "AUTH",
+      "title": "Authentifizierungsereignisse werden protokolliert",
+      "objective": "Nachvollziehbarkeit",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "audit_log_sample"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "AUTH-014",
+      "domain": "AUTH",
+      "title": "Passwort-Reset umgeht keine Autorisierungsschranken",
+      "objective": "Verhindert Missbrauch Recovery-Flows",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "AUTH-015",
+      "domain": "AUTH",
+      "title": "Maschinen- und Personenidentitaeten getrennt verwaltet",
+      "objective": "Verhindert Vermischung",
+      "check_target": "config",
+      "evidence": [
+        "iam_config",
+        "architecture_doc"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "AUTH-016",
+      "domain": "AUTH",
+      "title": "Cross-Tenant-Zugriffe geschuetzt",
+      "objective": "Verhindert Zugriff auf fremde Mandanten",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "tenant_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "AUTH-017",
+      "domain": "AUTH",
+      "title": "Berechtigungsfehler liefern generische Meldungen",
+      "objective": "Reduziert Informationsleckage",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "AUTH-018",
+      "domain": "AUTH",
+      "title": "Autorisierungsregeln durch Tests abgedeckt",
+      "objective": "Beweisbarkeit der Zugriffskontrollen",
+      "check_target": "test",
+      "evidence": [
+        "unit_test",
+        "integration_test"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "AUTH-019",
+      "domain": "AUTH",
+      "title": "Fallback-Modi umgehen keine Authentifizierung",
+      "objective": "Verhindert Sicherheitsverlust in Ausnahmezustaenden",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "error_mode_tests"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "AUTH-020",
+      "domain": "AUTH",
+      "title": "Temporaere Berechtigungen verfallen automatisch",
+      "objective": "Reduziert dauerhafte Ueberprivilegierung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "policy_definitions"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "SESSION-001",
+      "domain": "SESSION",
+      "title": "Sitzungstoken werden nicht im Klartext geloggt",
+      "objective": "Verhindert Missbrauch gestohlener Sitzungen",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "log_output"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "SESSION-002",
+      "domain": "SESSION",
+      "title": "Sitzungs-IDs ausreichend zufaellig",
+      "objective": "Verhindert Session Guessing",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "auth_config"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "SESSION-003",
+      "domain": "SESSION",
+      "title": "Sessions verfallen nach Inaktivitaet",
+      "objective": "Begrenzt Missbrauch",
+      "check_target": "config",
+      "evidence": [
+        "session_config",
+        "source_code"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "SESSION-004",
+      "domain": "SESSION",
+      "title": "Sessions nach Rollenwechsel rotiert",
+      "objective": "Verhindert Session Fixation",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "SESSION-005",
+      "domain": "SESSION",
+      "title": "Logout invalidiert serverseitig alle Token",
+      "objective": "Verhindert weitere Nutzung nach Logout",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "SESSION-006",
+      "domain": "SESSION",
+      "title": "Cookies mit Secure und HttpOnly Attributen",
+      "objective": "Reduziert Diebstahl ueber unsichere Kanaele",
+      "check_target": "config",
+      "evidence": [
+        "http_config",
+        "integration_test"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "SESSION-007",
+      "domain": "SESSION",
+      "title": "SameSite-Richtlinien explizit gesetzt",
+      "objective": "Reduziert CSRF-Angriffe",
+      "check_target": "config",
+      "evidence": [
+        "http_config",
+        "integration_test"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "SESSION-008",
+      "domain": "SESSION",
+      "title": "Token-Pruefung validiert Audience, Issuer, Gueltigkeit",
+      "objective": "Verhindert Akzeptanz fremder Token",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "SESSION-009",
+      "domain": "SESSION",
+      "title": "Geraete-Sessions eindeutig einer Instanz zugeordnet",
+      "objective": "Verhindert Sitzungsuebernahme",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "device_registry"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "SESSION-010",
+      "domain": "SESSION",
+      "title": "Sitzungsspeicher trennt Mandanten zuverlaessig",
+      "objective": "Verhindert Cross-Tenant Missbrauch",
+      "check_target": "architecture",
+      "evidence": [
+        "session_config",
+        "architecture_doc"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "KEYMGMT-001",
+      "domain": "KEYMGMT",
+      "title": "Schluessel ausserhalb des Quellcodes erzeugt und verwaltet",
+      "objective": "Verhindert Offenlegung durch Codezugriff",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "secret_scan"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "KEYMGMT-002",
+      "domain": "KEYMGMT",
+      "title": "Produktions- und Testschluessel strikt getrennt",
+      "objective": "Verhindert unsichere Testkonfigurationen in Produktion",
+      "check_target": "config",
+      "evidence": [
+        "config",
+        "deployment_config"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "KEYMGMT-003",
+      "domain": "KEYMGMT",
+      "title": "Schluesselrotation technisch vorgesehen",
+      "objective": "Begrenzt Auswirkungen kompromittierter Schluessel",
+      "check_target": "system",
+      "evidence": [
+        "key_rotation_jobs",
+        "source_code"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "KEYMGMT-004",
+      "domain": "KEYMGMT",
+      "title": "Abgelaufene Schluessel werden nicht mehr akzeptiert",
+      "objective": "Verhindert Nutzung veralteten Materials",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "KEYMGMT-005",
+      "domain": "KEYMGMT",
+      "title": "Schluesselzugriffe rollenbasiert und protokolliert",
+      "objective": "Nachvollziehbarkeit",
+      "check_target": "system",
+      "evidence": [
+        "iam_config",
+        "audit_log_sample"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "KEYMGMT-006",
+      "domain": "KEYMGMT",
+      "title": "Schluessel nicht zwischen Komponenten unnoetig repliziert",
+      "objective": "Reduziert Verbreitung",
+      "check_target": "architecture",
+      "evidence": [
+        "architecture_doc",
+        "source_code"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "KEYMGMT-007",
+      "domain": "KEYMGMT",
+      "title": "Kompromittierte Schluessel koennen deaktiviert werden",
+      "objective": "Wirksame Reaktion auf Vorfaelle",
+      "check_target": "system",
+      "evidence": [
+        "key_registry",
+        "incident_runbook"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "KEYMGMT-008",
+      "domain": "KEYMGMT",
+      "title": "Terminal-Geraete nutzen eindeutiges Schluesselmaterial",
+      "objective": "Verhindert laterale Ausbreitung",
+      "check_target": "architecture",
+      "evidence": [
+        "provisioning_docs",
+        "device_inventory"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "KEYMGMT-009",
+      "domain": "KEYMGMT",
+      "title": "Schluessel nicht in Client-/Frontend-Artefakte eingebettet",
+      "objective": "Verhindert Extraktion",
+      "check_target": "build",
+      "evidence": [
+        "artifact_scan",
+        "secret_scan"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "KEYMGMT-010",
+      "domain": "KEYMGMT",
+      "title": "Schluessellebenszyklen versioniert und dokumentiert",
+      "objective": "Belastbare Pruef- und Rotationsnachweise",
+      "check_target": "process",
+      "evidence": [
+        "key_registry",
+        "audit_log_sample"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "DEVICE-001",
+      "domain": "DEVICE",
+      "title": "Geraeteidentitaeten eindeutig und nicht wiederverwendbar",
+      "objective": "Klare Zuordnung",
+      "check_target": "system",
+      "evidence": [
+        "device_registry",
+        "provisioning_logic"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "DEVICE-002",
+      "domain": "DEVICE",
+      "title": "Unregistrierte Geraete koennen keine Verbindung aufbauen",
+      "objective": "Verhindert unautorisierte Hardware",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "device_registry"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "DEVICE-003",
+      "domain": "DEVICE",
+      "title": "Provisioning prueft Identitaet und Sicherheitszustand",
+      "objective": "Verhindert Aufnahme kompromittierter Geraete",
+      "check_target": "system",
+      "evidence": [
+        "provisioning_workflows",
+        "source_code"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "DEVICE-004",
+      "domain": "DEVICE",
+      "title": "Geraetekonfigurationen versioniert und geschuetzt",
+      "objective": "Integritaet betrieblicher Einstellungen",
+      "check_target": "system",
+      "evidence": [
+        "config_registry",
+        "audit_log_sample"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "DEVICE-005",
+      "domain": "DEVICE",
+      "title": "Geraete-IDs serverseitig validiert",
+      "objective": "Verhindert Spoofing",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "DEVICE-006",
+      "domain": "DEVICE",
+      "title": "Tamper-Events systemseitig ausgewertet",
+      "objective": "Reaktion auf physische Eingriffe",
+      "check_target": "system",
+      "evidence": [
+        "event_handlers",
+        "monitoring_rules"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "DEVICE-007",
+      "domain": "DEVICE",
+      "title": "Geraetewechsel fuehrt zu Neuvalidierung",
+      "objective": "Verhindert Uebernahme alter Vertrauensstellungen",
+      "check_target": "process",
+      "evidence": [
+        "provisioning_docs",
+        "device_registry"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "DEVICE-008",
+      "domain": "DEVICE",
+      "title": "Geraete melden Zustandsaenderungen an Backend",
+      "objective": "Zentrale Sichtbarkeit",
+      "check_target": "system",
+      "evidence": [
+        "source_code",
+        "message_schema"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "DEVICE-009",
+      "domain": "DEVICE",
+      "title": "Nicht vertrauenswuerdiger Zustand blockiert Kommunikation",
+      "objective": "Verhindert Betrieb kompromittierter Geraete",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "tamper_tests"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "DEVICE-010",
+      "domain": "DEVICE",
+      "title": "Zustandsuebergaenge explizit modelliert und getestet",
+      "objective": "Verhindert inkonsistente Betriebszustaende",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "state_machine_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "DEVICE-011",
+      "domain": "DEVICE",
+      "title": "Fehlzustaende fuehren zu definierten Safe States",
+      "objective": "Verhindert unsicheren Weiterbetrieb",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "error_mode_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "DEVICE-012",
+      "domain": "DEVICE",
+      "title": "Diagnose-/Wartungsmodi getrennt und zugriffsbeschraenkt",
+      "objective": "Reduziert Missbrauch",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "auth_config"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "DEVICE-013",
+      "domain": "DEVICE",
+      "title": "Sicherheitsflags nicht unautorisiert ruecksetzbar",
+      "objective": "Verhindert Umgehung kritischer Schutzmechanismen",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "DEVICE-014",
+      "domain": "DEVICE",
+      "title": "Geraete-Registrierung und -Deregistrierung auditierbar",
+      "objective": "Nachvollziehbarkeit Geraetebestand",
+      "check_target": "system",
+      "evidence": [
+        "audit_log_sample",
+        "device_registry"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "DEVICE-015",
+      "domain": "DEVICE",
+      "title": "Offlinemodus funktional und sicherheitlich klar begrenzt",
+      "objective": "Verhindert unkontrollierte Zustaende",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "offline_tests"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "TRANS-001",
+      "domain": "TRANS",
+      "title": "Transaktionsstatus als explizite Zustandsmaschine modelliert",
+      "objective": "Verhindert ungueltige Statusuebergaenge",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "state_machine_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TRANS-002",
+      "domain": "TRANS",
+      "title": "Nur definierte Statusuebergaenge technisch zulaessig",
+      "objective": "Verhindert inkonsistente Verlaeufe",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TRANS-003",
+      "domain": "TRANS",
+      "title": "Abgebrochene Transaktionen konsistent zurueckgerollt",
+      "objective": "Verhindert schwebende Zustaende",
+      "check_target": "system",
+      "evidence": [
+        "integration_test",
+        "error_mode_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TRANS-004",
+      "domain": "TRANS",
+      "title": "Asynchrone Rueckmeldungen korrekt zugeordnet",
+      "objective": "Verhindert Vermischung paralleler Ablaeufe",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TRANS-005",
+      "domain": "TRANS",
+      "title": "Doppelte Nachrichten erkannt und sicher behandelt",
+      "objective": "Verhindert Mehrfachverarbeitung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TRANS-006",
+      "domain": "TRANS",
+      "title": "Unvollstaendige Transaktionen periodisch erkannt",
+      "objective": "Kontrollierte Bereinigung",
+      "check_target": "system",
+      "evidence": [
+        "scheduler_jobs",
+        "source_code"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "TRANS-007",
+      "domain": "TRANS",
+      "title": "Fehlende Antworten erzeugen keinen stillen Erfolg",
+      "objective": "Verhindert irreführende Erfolgsmeldungen",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "timeout_tests"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "TRANS-008",
+      "domain": "TRANS",
+      "title": "Stornierungen an berechtigte Rollen gebunden",
+      "objective": "Verhindert unautorisierte Manipulation",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "authorization_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TRANS-009",
+      "domain": "TRANS",
+      "title": "Race Conditions durch Sperrmechanismen reduziert",
+      "objective": "Verhindert konkurrierende Verarbeitung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "concurrency_tests"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "TRANS-010",
+      "domain": "TRANS",
+      "title": "Betragsrelevante Felder gegen Rundungsfehler abgesichert",
+      "objective": "Verhindert finanzielle Abweichungen",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "unit_test"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "DATA-001",
+      "domain": "DATA",
+      "title": "Sensitive Daten nur bei fachlicher Erforderlichkeit verarbeitet",
+      "objective": "Reduziert unnoetige Exposition",
+      "check_target": "architecture",
+      "evidence": [
+        "data_flow_docs",
+        "source_code"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "DATA-002",
+      "domain": "DATA",
+      "title": "Felder mit erhoehtem Schutzbedarf im Code identifizierbar",
+      "objective": "Erleichtert gezielte Schutzmassnahmen",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "data_catalog"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "DATA-003",
+      "domain": "DATA",
+      "title": "Persistierte Daten auf notwendige Felder minimiert",
+      "objective": "Verhindert unnoetige Speicherung",
+      "check_target": "database",
+      "evidence": [
+        "db_schema",
+        "source_code"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "DATA-004",
+      "domain": "DATA",
+      "title": "Testdaten enthalten keine produktiven Zahlungsdaten",
+      "objective": "Verhindert Offenlegung in Testumgebungen",
+      "check_target": "process",
+      "evidence": [
+        "test_fixtures",
+        "secret_scan"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "DATA-005",
+      "domain": "DATA",
+      "title": "Sensitive Daten in Telemetrie/Tracing nicht offengelegt",
+      "objective": "Verhindert Abfluss ueber Observability",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "telemetry_config"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "DATA-006",
+      "domain": "DATA",
+      "title": "Export-/Reporting-Pfade geben Daten nur maskiert aus",
+      "objective": "Verhindert Abfluss ueber Nebenausgaben",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "report_samples"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "DATA-007",
+      "domain": "DATA",
+      "title": "Datentypen fuer zahlungsrelevante Felder begrenzt",
+      "objective": "Verhindert fehlerhafte Eingaben",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "db_schema"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "DATA-008",
+      "domain": "DATA",
+      "title": "Datei-Uploads vor Verarbeitung validiert",
+      "objective": "Verhindert Einschleusen manipulierten Inhalts",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "validation_tests"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "ERROR-001",
+      "domain": "ERR",
+      "title": "Sicherheitsrelevante Fehler nicht stillschweigend unterdrueckt",
+      "objective": "Verhindert verdeckte Sicherheitsverluste",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "error_paths"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ERROR-002",
+      "domain": "ERR",
+      "title": "Retry unterscheidet transiente von fachlichen Fehlern",
+      "objective": "Verhindert falsche Wiederholungen",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "retry_logic"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ERROR-003",
+      "domain": "ERR",
+      "title": "Fehlercodes konsistent gemappt und dokumentiert",
+      "objective": "Verbessert Diagnose und Audit",
+      "check_target": "system",
+      "evidence": [
+        "error_mapping",
+        "source_code"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ERROR-004",
+      "domain": "ERR",
+      "title": "Fehlerbehandlung durch Negativtests abgedeckt",
+      "objective": "Beweisbarkeit robuster Fehlerpfade",
+      "check_target": "test",
+      "evidence": [
+        "negative_tests",
+        "coverage_reports"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ERROR-005",
+      "domain": "ERR",
+      "title": "Dead-letter-Queues fuer asynchrone Fehlerfaelle",
+      "objective": "Verhindert Verlust problematischer Nachrichten",
+      "check_target": "system",
+      "evidence": [
+        "queue_config",
+        "ops_docs"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "REPORT-001",
+      "domain": "REP",
+      "title": "Ablehnungen und Fehler nachvollziehbar im Reporting",
+      "objective": "Verhindert beschoenigte Sicht",
+      "check_target": "system",
+      "evidence": [
+        "report_samples",
+        "error_mapping"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "REPORT-002",
+      "domain": "REP",
+      "title": "Reportgenerierung veraendert keine Ursprungsdaten",
+      "objective": "Schuetzt primaeren Datenbestand",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "db_permissions"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "REPORT-003",
+      "domain": "REP",
+      "title": "Reports offenbaren nur rollenerforderliche Daten",
+      "objective": "Reduziert Datenabfluss",
+      "check_target": "code",
+      "evidence": [
+        "authorization_tests",
+        "report_samples"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "REPORT-004",
+      "domain": "REP",
+      "title": "Reconciliation-Reports determininstisch reproduzierbar",
+      "objective": "Belastbare Nachweise bei Abweichungen",
+      "check_target": "process",
+      "evidence": [
+        "reporting_docs",
+        "integration_test"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "REPORT-005",
+      "domain": "REP",
+      "title": "Berichte beruecksichtigen Zeitzonen konsistent",
+      "objective": "Verhindert Abstimmungsfehler",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "report_samples"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "BUILD-001",
+      "domain": "BUILD",
+      "title": "Build-Pipelines versioniert und nachvollziehbar",
+      "objective": "Auditierbarkeit des Entstehungsprozesses",
+      "check_target": "build",
+      "evidence": [
+        "pipeline_config",
+        "version_control"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "BUILD-002",
+      "domain": "BUILD",
+      "title": "Build-Artefakte reproduzierbar erzeugt",
+      "objective": "Reduziert Risiko unerkannter Unterschiede",
+      "check_target": "build",
+      "evidence": [
+        "build_pipeline",
+        "artifact_hashes"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "BUILD-003",
+      "domain": "BUILD",
+      "title": "Abhaengigkeiten auf bekannte Schwachstellen geprueft",
+      "objective": "Reduziert verwundbare Komponenten",
+      "check_target": "dependency",
+      "evidence": [
+        "dependency_scan",
+        "sbom"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "BUILD-004",
+      "domain": "BUILD",
+      "title": "Keine nicht freigegebenen externen Quellen eingebunden",
+      "objective": "Reduziert Supply-Chain-Risiken",
+      "check_target": "build",
+      "evidence": [
+        "pipeline_config",
+        "dependency_policy"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "BUILD-005",
+      "domain": "BUILD",
+      "title": "Kein Klartextzugriff auf produktive Geheimnisse in CI/CD",
+      "objective": "Verhindert Offenlegung im Build-Prozess",
+      "check_target": "build",
+      "evidence": [
+        "pipeline_config",
+        "secret_scan"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "BUILD-006",
+      "domain": "BUILD",
+      "title": "Build-Trigger fuer Produktionsartefakte autorisiert",
+      "objective": "Verhindert unautorisierte Releases",
+      "check_target": "build",
+      "evidence": [
+        "pipeline_permissions",
+        "iam_config"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "BUILD-007",
+      "domain": "BUILD",
+      "title": "Signierte Artefakte eindeutig gekennzeichnet",
+      "objective": "Erleichtert Zuordnung gepruefter Artefakte",
+      "check_target": "build",
+      "evidence": [
+        "artifact_metadata",
+        "release_docs"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "BUILD-008",
+      "domain": "BUILD",
+      "title": "Sicherheitstests zwingend im Release-Build",
+      "objective": "Erhoet Wahrscheinlichkeit dass Pruefungen nicht umgangen werden",
+      "check_target": "build",
+      "evidence": [
+        "pipeline_config",
+        "quality_gates"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "BUILD-009",
+      "domain": "BUILD",
+      "title": "Artefakte auf Konfigurationsfehler geprueft vor Veroeffentlichung",
+      "objective": "Verhindert Auslieferung unsicherer Defaults",
+      "check_target": "build",
+      "evidence": [
+        "artifact_scan",
+        "config_scan"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "BUILD-010",
+      "domain": "BUILD",
+      "title": "Sicherheitskritische Build-Schritte getrennt und nachvollziehbar",
+      "objective": "Erhoeht Transparenz bei sensitiven Artefakten",
+      "check_target": "build",
+      "evidence": [
+        "pipeline_config",
+        "release_docs"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "DEPLOY-001",
+      "domain": "DEPLOY",
+      "title": "Deployment-Konfigurationen versioniert",
+      "objective": "Auditierbarkeit produktiver Aenderungen",
+      "check_target": "config",
+      "evidence": [
+        "deployment_manifests",
+        "version_control"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "DEPLOY-002",
+      "domain": "DEPLOY",
+      "title": "Produktionsdeployments erfordern Freigaben",
+      "objective": "Verhindert unautorisierte Aenderungen",
+      "check_target": "process",
+      "evidence": [
+        "pipeline_permissions",
+        "release_workflows"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "DEPLOY-003",
+      "domain": "DEPLOY",
+      "title": "Produktive und nichtproduktive Ziele strikt getrennt",
+      "objective": "Verhindert Umgebungsvermischung",
+      "check_target": "config",
+      "evidence": [
+        "deployment_manifests",
+        "environment_config"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "DEPLOY-004",
+      "domain": "DEPLOY",
+      "title": "Secrets beim Deployment sicher injiziert",
+      "objective": "Verhindert Offenlegung in Images/Paketen",
+      "check_target": "config",
+      "evidence": [
+        "deployment_manifests",
+        "secret_store_config"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "DEPLOY-005",
+      "domain": "DEPLOY",
+      "title": "Rollback-Verfahren definiert und getestet",
+      "objective": "Kontrollierte Wiederherstellung",
+      "check_target": "process",
+      "evidence": [
+        "release_docs",
+        "ops_runbooks"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "DEPLOY-006",
+      "domain": "DEPLOY",
+      "title": "Konfigurationsaenderungen auditierbar",
+      "objective": "Nachvollziehbarkeit von Schutzwirkungsaenderungen",
+      "check_target": "system",
+      "evidence": [
+        "audit_log_sample",
+        "config_registry"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "DEPLOY-007",
+      "domain": "DEPLOY",
+      "title": "Kompatibilitaet mit abhaengigen Schnittstellen validiert",
+      "objective": "Verhindert Betriebsstoerungen",
+      "check_target": "system",
+      "evidence": [
+        "integration_test",
+        "contract_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "DEPLOY-008",
+      "domain": "DEPLOY",
+      "title": "Zahlungsparameter vor Aktivierung plausibilisiert",
+      "objective": "Verhindert fehlerhafte produktive Einstellungen",
+      "check_target": "config",
+      "evidence": [
+        "config_validation",
+        "deployment_checks"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "DEPLOY-009",
+      "domain": "DEPLOY",
+      "title": "Post-Deployment Smoke-Checks",
+      "objective": "Erkennt Fehlzustaende nach Inbetriebnahme",
+      "check_target": "system",
+      "evidence": [
+        "smoke_tests",
+        "pipeline_config"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "DEPLOY-010",
+      "domain": "DEPLOY",
+      "title": "Canary/gestufte Rollouts fuer risikoreiche Aenderungen",
+      "objective": "Reduziert grossflaechige Auswirkungen",
+      "check_target": "process",
+      "evidence": [
+        "deployment_strategy",
+        "ops_docs"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "QUEUE-001",
+      "domain": "QUEUE",
+      "title": "Nachrichten in Warteschlangen eindeutig identifizierbar",
+      "objective": "Nachverfolgung und Duplikaterkennung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "message_schema"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "QUEUE-002",
+      "domain": "QUEUE",
+      "title": "Nachrichtenverarbeitung idempotent",
+      "objective": "Verhindert Mehrfachverarbeitung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "queue_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "QUEUE-003",
+      "domain": "QUEUE",
+      "title": "Fehlerhafte Nachrichten kontrolliert isoliert (Dead Letter)",
+      "objective": "Verhindert Stau durch Poison Messages",
+      "check_target": "system",
+      "evidence": [
+        "queue_config",
+        "dead_letter_config"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "QUEUE-004",
+      "domain": "QUEUE",
+      "title": "Nachrichten enthalten keine unnoetig sensitiven Daten",
+      "objective": "Reduziert Exposition in async Pfaden",
+      "check_target": "code",
+      "evidence": [
+        "message_schema",
+        "source_code"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "QUEUE-005",
+      "domain": "QUEUE",
+      "title": "Nachrichtenreihenfolge fuer kritische Ablaeufe beruecksichtigt",
+      "objective": "Verhindert inkonsistente Zustaende",
+      "check_target": "architecture",
+      "evidence": [
+        "design_docs",
+        "source_code"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "QUEUE-006",
+      "domain": "QUEUE",
+      "title": "Veraltete Nachrichten nicht unkontrolliert verarbeitet",
+      "objective": "Verhindert spaete Ausfuehrung ueberholter Aktionen",
+      "check_target": "code",
+      "evidence": [
+        "message_schema",
+        "source_code"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "QUEUE-007",
+      "domain": "QUEUE",
+      "title": "Consumer validieren Schema und Pflichtfelder",
+      "objective": "Verhindert Verarbeitung manipulierten Inhalts",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "schema_tests"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "QUEUE-008",
+      "domain": "QUEUE",
+      "title": "Mandantenbezug in async Pfaden erhalten",
+      "objective": "Verhindert Cross-Tenant-Verarbeitung",
+      "check_target": "code",
+      "evidence": [
+        "message_schema",
+        "tenant_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "QUEUE-009",
+      "domain": "QUEUE",
+      "title": "Queue-Berechtigungen auf notwendige Rollen beschraenkt",
+      "objective": "Reduziert Missbrauch",
+      "check_target": "config",
+      "evidence": [
+        "iam_config",
+        "queue_config"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "QUEUE-010",
+      "domain": "QUEUE",
+      "title": "Retry unterscheidet technische von fachlichen Fehlern",
+      "objective": "Verhindert Wiederholung irreversibler Vorgaenge",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "retry_logic"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TENANT-001",
+      "domain": "TENANT",
+      "title": "Mandantenkontext serverseitig gesetzt und validiert",
+      "objective": "Verhindert Client-seitige Manipulation",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "tenant_tests"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "TENANT-002",
+      "domain": "TENANT",
+      "title": "Datenabfragen mandantenbeschraenkt und gefiltert",
+      "objective": "Verhindert Cross-Tenant-Datenzugriff",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "tenant_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TENANT-003",
+      "domain": "TENANT",
+      "title": "Mandantenuebergreifende Verwaltung besonders geschuetzt",
+      "objective": "Reduziert Risiko privilegierter Fehlzugriffe",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "authorization_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TENANT-004",
+      "domain": "TENANT",
+      "title": "Mandantenkontext in Logs und Queues konsistent",
+      "objective": "Belastbare Zuordnung",
+      "check_target": "system",
+      "evidence": [
+        "log_samples",
+        "queue_samples"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TENANT-005",
+      "domain": "TENANT",
+      "title": "Mandanten-Konfigurationen gegenseitig geschuetzt",
+      "objective": "Verhindert Ueberschreibungen",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "tenant_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TENANT-006",
+      "domain": "TENANT",
+      "title": "Caching beruecksichtigt Mandantenkontext",
+      "objective": "Verhindert Datenlecks durch geteilte Caches",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "cache_config"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TENANT-007",
+      "domain": "TENANT",
+      "title": "Mandantenbezogene Schluessel logisch getrennt",
+      "objective": "Reduziert laterale Auswirkungen",
+      "check_target": "architecture",
+      "evidence": [
+        "key_registry",
+        "architecture_doc"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "TENANT-008",
+      "domain": "TENANT",
+      "title": "Datenexporte erzwingen Mandantenisolation",
+      "objective": "Verhindert Cross-Tenant-Exporte",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "tenant_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TENANT-009",
+      "domain": "TENANT",
+      "title": "Loeschvorgaenge ohne Seiteneffekte auf andere Mandanten",
+      "objective": "Verhindert Fremdbeeintraechtigung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "tenant_tests"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "TENANT-010",
+      "domain": "TENANT",
+      "title": "Isolationstests automatisiert abgedeckt",
+      "objective": "Beweisbarkeit korrekter Trennung",
+      "check_target": "test",
+      "evidence": [
+        "tenant_tests",
+        "coverage_reports"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TELEMETRY-001",
+      "domain": "TELEMETRY",
+      "title": "Telemetriedaten ohne sensitive Zahlungsdaten",
+      "objective": "Verhindert Abfluss ueber Monitoring",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "telemetry_samples"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TELEMETRY-002",
+      "domain": "TELEMETRY",
+      "title": "Tracing maskiert identifizierende Felder",
+      "objective": "Beobachtbarkeit ohne Offenlegung",
+      "check_target": "code",
+      "evidence": [
+        "trace_config",
+        "trace_samples"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TELEMETRY-003",
+      "domain": "TELEMETRY",
+      "title": "Metriken ohne hochkartesische sensitive Labels",
+      "objective": "Verhindert indirekte Offenlegung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "metrics_config"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TELEMETRY-004",
+      "domain": "TELEMETRY",
+      "title": "Telemetrie-Endpunkte abgesichert",
+      "objective": "Reduziert Angriffsflaeche",
+      "check_target": "config",
+      "evidence": [
+        "gateway_config",
+        "auth_config"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TELEMETRY-005",
+      "domain": "TELEMETRY",
+      "title": "Debug-Telemetrie in Produktion begrenzt",
+      "objective": "Verhindert exzessive Datenerhebung",
+      "check_target": "config",
+      "evidence": [
+        "telemetry_config",
+        "ops_docs"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TELEMETRY-006",
+      "domain": "TELEMETRY",
+      "title": "Fehlertelemetrie nach Prioritaet klassifiziert",
+      "objective": "Zielgerichtete Reaktion",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "alert_rules"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "TELEMETRY-007",
+      "domain": "TELEMETRY",
+      "title": "Export externer Telemetrie explizit freigegeben",
+      "objective": "Verhindert unbeabsichtigten Abfluss",
+      "check_target": "process",
+      "evidence": [
+        "ops_docs",
+        "telemetry_config"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "TELEMETRY-008",
+      "domain": "TELEMETRY",
+      "title": "Telemetrie-Pipelines gegen Manipulation geschuetzt",
+      "objective": "Vertrauenswuerdigkeit operativer Signale",
+      "check_target": "system",
+      "evidence": [
+        "iam_config",
+        "pipeline_config"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "TELEMETRY-009",
+      "domain": "TELEMETRY",
+      "title": "Telemetrie-Ausfall beeintraechtigt Zahlungsbetrieb nicht",
+      "objective": "Verhindert uebermaessige Kopplung",
+      "check_target": "architecture",
+      "evidence": [
+        "design_docs",
+        "chaos_tests"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "TELEMETRY-010",
+      "domain": "TELEMETRY",
+      "title": "Kontextanreicherung nur soweit erforderlich",
+      "objective": "Reduziert unnoetige Anreicherung sensitiver Systeme",
+      "check_target": "architecture",
+      "evidence": [
+        "telemetry_schema",
+        "data_flow_docs"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "CONFIG-001",
+      "domain": "CONFIG",
+      "title": "Sichere Standardwerte fuer sicherheitsrelevante Konfigurationen",
+      "objective": "Reduziert unsichere Default-Betriebsmodi",
+      "check_target": "config",
+      "evidence": [
+        "config",
+        "source_code"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "CONFIG-002",
+      "domain": "CONFIG",
+      "title": "Konfigurationswerte auf Typ und Plausibilitaet geprueft",
+      "objective": "Verhindert Fehlverhalten durch ungueltige Einstellungen",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "config_validation"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "CONFIG-003",
+      "domain": "CONFIG",
+      "title": "Unbekannte Konfigurationsschluessel nicht stillschweigend ignoriert",
+      "objective": "Verhindert Fehlannahmen",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "config_validation"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "CONFIG-004",
+      "domain": "CONFIG",
+      "title": "Keine Test-/Demoendpunkte in Produktionskonfiguration",
+      "objective": "Verhindert versehentliche Kommunikation",
+      "check_target": "config",
+      "evidence": [
+        "config",
+        "deployment_manifests"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "CONFIG-005",
+      "domain": "CONFIG",
+      "title": "Dynamische Aenderungen autorisiert und auditierbar",
+      "objective": "Kontrolle ueber Laufzeitaenderungen",
+      "check_target": "system",
+      "evidence": [
+        "audit_log_sample",
+        "config_registry"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "CONFIG-006",
+      "domain": "CONFIG",
+      "title": "Sicherheitsconfig nicht ueber APIs ueberschreibbar",
+      "objective": "Verhindert Manipulation ueber Verwaltungspfade",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "authorization_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "CONFIG-007",
+      "domain": "CONFIG",
+      "title": "Feature-Flags fuer Sicherheit restriktiv verwaltet",
+      "objective": "Verhindert unbeabsichtigte Deaktivierung",
+      "check_target": "process",
+      "evidence": [
+        "feature_flag_config",
+        "ops_docs"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "CONFIG-008",
+      "domain": "CONFIG",
+      "title": "Konfigurationsquellen und Prioritaeten eindeutig",
+      "objective": "Verhindert unerwartete Ueberschreibungen",
+      "check_target": "architecture",
+      "evidence": [
+        "design_docs",
+        "config_docs"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "CONFIG-009",
+      "domain": "CONFIG",
+      "title": "Schwellwerte und Timeouts explizit konfiguriert",
+      "objective": "Nachvollziehbare Parametrisierung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "config"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "CONFIG-010",
+      "domain": "CONFIG",
+      "title": "Zahlungslogik-Config vor Aktivierung fachlich validiert",
+      "objective": "Verhindert betriebsgefaehrdende Einstellungen",
+      "check_target": "system",
+      "evidence": [
+        "validation_rules",
+        "ops_docs"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "NETWORK-001",
+      "domain": "NETWORK",
+      "title": "Netzwerkverbindungen auf notwendige Ziele begrenzt",
+      "objective": "Reduziert Angriffsflaeche",
+      "check_target": "network",
+      "evidence": [
+        "network_policies",
+        "firewall_rules"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "NETWORK-002",
+      "domain": "NETWORK",
+      "title": "Ausgehende Verbindungen auf erlaubte Protokolle beschraenkt",
+      "objective": "Verhindert Datenabfluss",
+      "check_target": "network",
+      "evidence": [
+        "firewall_rules",
+        "egress_policies"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "NETWORK-003",
+      "domain": "NETWORK",
+      "title": "Verwaltungsdienste nicht ungeschuetzt aus Produktivnetzen erreichbar",
+      "objective": "Reduziert seitliche Bewegungen",
+      "check_target": "network",
+      "evidence": [
+        "network_policies",
+        "gateway_config"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "NETWORK-004",
+      "domain": "NETWORK",
+      "title": "Kein stiller Fallback auf unverschluesselte Pfade",
+      "objective": "Verhindert Schutzverlust",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "network_config"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "NETWORK-005",
+      "domain": "NETWORK",
+      "title": "Timeouts fuer kritische Kommunikationspfade definiert",
+      "objective": "Verhindert unklare Zustaende",
+      "check_target": "config",
+      "evidence": [
+        "network_config",
+        "source_code"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "NETWORK-006",
+      "domain": "NETWORK",
+      "title": "Vertrauensanker konfigurierbar, nicht hartkodiert",
+      "objective": "Kontrollierte Vertrauensverwaltung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "tls_config"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "NETWORK-007",
+      "domain": "NETWORK",
+      "title": "Interne Ports minimiert und dokumentiert",
+      "objective": "Reduziert unnoetige Offenheit",
+      "check_target": "network",
+      "evidence": [
+        "network_policies",
+        "port_inventory"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "NETWORK-008",
+      "domain": "NETWORK",
+      "title": "Netzwerksegmente logisch getrennt",
+      "objective": "Reduziert seitliche Ausbreitung",
+      "check_target": "architecture",
+      "evidence": [
+        "network_diagrams",
+        "firewall_rules"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "NETWORK-009",
+      "domain": "NETWORK",
+      "title": "Kritische Netzwerkfehler an Monitoring weitergegeben",
+      "objective": "Schnelle Reaktion auf Kommunikationsprobleme",
+      "check_target": "system",
+      "evidence": [
+        "alert_rules",
+        "log_samples"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "NETWORK-010",
+      "domain": "NETWORK",
+      "title": "DNS/Service Discovery fuer kritische Komponenten kontrolliert",
+      "objective": "Verhindert Fehlroutung",
+      "check_target": "system",
+      "evidence": [
+        "dns_config",
+        "service_registry"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "STORAGE-001",
+      "domain": "STORAGE",
+      "title": "Persistente Speicherorte dokumentiert",
+      "objective": "Gezielte Schutz- und Pruefmassnahmen",
+      "check_target": "architecture",
+      "evidence": [
+        "data_flow_docs",
+        "storage_inventory"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "STORAGE-002",
+      "domain": "STORAGE",
+      "title": "Schreibzugriffe rollenbasiert begrenzt",
+      "objective": "Reduziert unautorisierte Manipulation",
+      "check_target": "config",
+      "evidence": [
+        "iam_config",
+        "db_permissions"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "STORAGE-003",
+      "domain": "STORAGE",
+      "title": "Temporaere Dateien ohne sensitive Daten",
+      "objective": "Verhindert Schattenpersistenz",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "artifact_scan"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "STORAGE-004",
+      "domain": "STORAGE",
+      "title": "Datenbankschemata erzwingen Integritaetsbedingungen",
+      "objective": "Reduziert inkonsistente Datensaetze",
+      "check_target": "database",
+      "evidence": [
+        "db_schema",
+        "migration_scripts"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "STORAGE-005",
+      "domain": "STORAGE",
+      "title": "Aenderungen an Zahlungszustaenden nachvollziehbar",
+      "objective": "Auditierbarkeit",
+      "check_target": "system",
+      "evidence": [
+        "audit_log_sample",
+        "db_schema"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "STORAGE-006",
+      "domain": "STORAGE",
+      "title": "Backups folgen selben Schutzanforderungen wie Primaerdaten",
+      "objective": "Verhindert Schutzluecken in Sekundaerspeichern",
+      "check_target": "process",
+      "evidence": [
+        "backup_config",
+        "storage_policy"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "STORAGE-007",
+      "domain": "STORAGE",
+      "title": "Persistenzlogik behandelt Teilfehler kontrolliert",
+      "objective": "Robustheit bei DB-Fehlern",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "error_mode_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "STORAGE-008",
+      "domain": "STORAGE",
+      "title": "Storage-Migrationen getestet und reversibel bewertet",
+      "objective": "Reduziert fehlerhafte Schemaenderungen",
+      "check_target": "database",
+      "evidence": [
+        "migration_scripts",
+        "test_reports"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "STORAGE-009",
+      "domain": "STORAGE",
+      "title": "Lesezugriffe fuer Reporting umgehen keine Filterlogik",
+      "objective": "Verhindert Datenabfluss ueber Sekundaerzugriffe",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "authorization_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "STORAGE-010",
+      "domain": "STORAGE",
+      "title": "Dateibasierte Speicher gegen unautorisierte Aenderung geschuetzt",
+      "objective": "Reduziert Manipulationsrisiko",
+      "check_target": "system",
+      "evidence": [
+        "filesystem_permissions",
+        "integrity_checks"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "MONITOR-001",
+      "domain": "MONITOR",
+      "title": "Sicherheitskritische Ereignisse haben Alarmierungsregeln",
+      "objective": "Zeitnahe Reaktion auf Vorfaelle",
+      "check_target": "system",
+      "evidence": [
+        "alert_rules",
+        "monitoring_config"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "MONITOR-002",
+      "domain": "MONITOR",
+      "title": "Ausfaelle von Zahlungspfaden werden entdeckt",
+      "objective": "Reduziert unbemerkte Stoerungen",
+      "check_target": "system",
+      "evidence": [
+        "monitoring_config",
+        "synthetic_checks"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "MONITOR-003",
+      "domain": "MONITOR",
+      "title": "Monitoring differenziert Verfuegbarkeit/Sicherheit/Fachfehler",
+      "objective": "Bessere Priorisierung",
+      "check_target": "system",
+      "evidence": [
+        "alert_rules",
+        "metric_samples"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "MONITOR-004",
+      "domain": "MONITOR",
+      "title": "Schwellenwerte fuer kritische Funktionen definiert",
+      "objective": "Verhindert ad-hoc Ereigniserkennung",
+      "check_target": "process",
+      "evidence": [
+        "ops_docs",
+        "monitoring_config"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "MONITOR-005",
+      "domain": "MONITOR",
+      "title": "Alarmierungswege dokumentiert und wirksam",
+      "objective": "Reaktionsfaehigkeit im Vorfall",
+      "check_target": "process",
+      "evidence": [
+        "incident_docs",
+        "alert_config"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "MONITOR-006",
+      "domain": "MONITOR",
+      "title": "Wiederkehrende Fehler aggregiert und als Muster erkennbar",
+      "objective": "Fruehwarnung bei systemischen Problemen",
+      "check_target": "system",
+      "evidence": [
+        "monitoring_dashboards",
+        "alert_rules"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "MONITOR-007",
+      "domain": "MONITOR",
+      "title": "Queue-Monitoring erfasst Stau, Alter, Fehlerquoten",
+      "objective": "Kontrolle verteilter Verarbeitungswege",
+      "check_target": "system",
+      "evidence": [
+        "queue_metrics",
+        "monitoring_dashboards"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "MONITOR-008",
+      "domain": "MONITOR",
+      "title": "Monitoring gegen triviale Deaktivierung geschuetzt",
+      "objective": "Vertrauenswuerdigkeit betrieblicher Kontrollen",
+      "check_target": "system",
+      "evidence": [
+        "iam_config",
+        "audit_log_sample"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "MONITOR-009",
+      "domain": "MONITOR",
+      "title": "Stille Fehlzustaende durch Heartbeats/Synthetic Checks adressiert",
+      "objective": "Verhindert truegerischen Anschein",
+      "check_target": "system",
+      "evidence": [
+        "synthetic_checks",
+        "heartbeat_config"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "MONITOR-010",
+      "domain": "MONITOR",
+      "title": "Monitoring-Nachweise reproduzierbar abrufbar",
+      "objective": "Belastbare Betriebsnachweise",
+      "check_target": "process",
+      "evidence": [
+        "dashboard_exports",
+        "ops_docs"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "OPS-001",
+      "domain": "OPS",
+      "title": "Betriebsrollen und Verantwortlichkeiten dokumentiert",
+      "objective": "Klare Zustaendigkeit",
+      "check_target": "process",
+      "evidence": [
+        "ops_docs",
+        "role_model"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "OPS-002",
+      "domain": "OPS",
+      "title": "Runbooks fuer typische Stoerungen vorhanden",
+      "objective": "Reaktionsgeschwindigkeit und Konsistenz",
+      "check_target": "process",
+      "evidence": [
+        "runbooks",
+        "incident_docs"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "OPS-003",
+      "domain": "OPS",
+      "title": "Sicherheitsmassnahmen nicht an Einzelpersonen gebunden",
+      "objective": "Reduziert Abhaengigkeit von implizitem Wissen",
+      "check_target": "process",
+      "evidence": [
+        "ops_docs",
+        "training_records"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "OPS-004",
+      "domain": "OPS",
+      "title": "Notfallzugriffe zeitlich begrenzt und auditierbar",
+      "objective": "Reduziert Missbrauch von Sonderzugaengen",
+      "check_target": "system",
+      "evidence": [
+        "audit_log_sample",
+        "iam_config"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "OPS-005",
+      "domain": "OPS",
+      "title": "Schluessel-/Zertifikats-/Geraetewechsel-Prozesse definiert",
+      "objective": "Verhindert ungeordnete Sicherheitsuebergaenge",
+      "check_target": "process",
+      "evidence": [
+        "ops_docs",
+        "runbooks"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "OPS-006",
+      "domain": "OPS",
+      "title": "Wartungsfenster fachlich und technisch abgestimmt",
+      "objective": "Verhindert ueberraschende Auswirkungen",
+      "check_target": "process",
+      "evidence": [
+        "ops_docs",
+        "change_docs"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "OPS-007",
+      "domain": "OPS",
+      "title": "Betriebsparameter regelmaessig auf Sollzustand geprueft",
+      "objective": "Erkennt schleichende Drift",
+      "check_target": "system",
+      "evidence": [
+        "ops_checks",
+        "config_registry"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "OPS-008",
+      "domain": "OPS",
+      "title": "Wiederanlauf nach Ausfall folgt definierten Prioritaeten",
+      "objective": "Verhindert ungeordnete Recovery",
+      "check_target": "process",
+      "evidence": [
+        "runbooks",
+        "recovery_tests"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "OPS-009",
+      "domain": "OPS",
+      "title": "Drittabhaengigkeiten dokumentiert und ueberwacht",
+      "objective": "Transparenz ueber externe Ausfallrisiken",
+      "check_target": "process",
+      "evidence": [
+        "vendor_inventory",
+        "monitoring_docs"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "OPS-010",
+      "domain": "OPS",
+      "title": "Betriebsnachweise fuer Ausschreibungen strukturiert abrufbar",
+      "objective": "Belastbare Compliance-Antworten",
+      "check_target": "process",
+      "evidence": [
+        "evidence_registry",
+        "reporting_docs"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "ZVTCORE-001",
+      "domain": "ZVTCORE",
+      "title": "ZVT-Nachrichten auf vollstaendige Rahmenstruktur geprueft",
+      "objective": "Verhindert Verarbeitung beschaedigter Frames",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "protocol_tests"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "ZVTCORE-002",
+      "domain": "ZVTCORE",
+      "title": "Unbekannte ZVT-Kommandos definiert abgewiesen",
+      "objective": "Verhindert undefiniertes Verhalten",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "protocol_tests"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "ZVTCORE-003",
+      "domain": "ZVTCORE",
+      "title": "ZVT-Nachrichtenlaengen vor Verarbeitung validiert",
+      "objective": "Verhindert Parser-Ueberlaeufe",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "fuzz_tests"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "ZVTCORE-004",
+      "domain": "ZVTCORE",
+      "title": "Feldgrenzen in ZVT-Datenstrukturen strikt eingehalten",
+      "objective": "Verhindert Fehlinterpretation",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "schema_tests"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "ZVTCORE-005",
+      "domain": "ZVTCORE",
+      "title": "Optionale ZVT-Felder nur bei formaler Korrektheit verarbeitet",
+      "objective": "Verhindert Fehlannahmen",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "negative_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVTCORE-006",
+      "domain": "ZVTCORE",
+      "title": "Unerwartete Feldreihenfolgen kontrolliert behandelt",
+      "objective": "Verhindert Parserdrift",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "protocol_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVTCORE-007",
+      "domain": "ZVTCORE",
+      "title": "Parser trennt Transport- von fachlichen Zahlungsfehlern",
+      "objective": "Korrekte Fehlerbehandlung und Retry",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "error_mapping"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVTCORE-008",
+      "domain": "ZVTCORE",
+      "title": "Reservierte/verbotene Werte in ZVT-Frames erkannt",
+      "objective": "Verhindert unsaubere Verarbeitung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "negative_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVTCORE-009",
+      "domain": "ZVTCORE",
+      "title": "Definierte Zeichensaetze und Kodierungen verwendet",
+      "objective": "Verhindert Fehlinterpretation von Belegdaten",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "protocol_docs"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVTCORE-010",
+      "domain": "ZVTCORE",
+      "title": "ZVT-Nachrichten vor Fachlogik normalisiert und typisiert",
+      "objective": "Reduziert Parserkomplexitaet",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "unit_test"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVTFLOW-001",
+      "domain": "ZVTFLOW",
+      "title": "Zahlung erst nach Protokollinitialisierung gesendet",
+      "objective": "Verhindert fehlerhafte Sequenzen",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "state_machine_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVTFLOW-002",
+      "domain": "ZVTFLOW",
+      "title": "Kommandos nur in zulaessigen Zustaenden ausgeloest",
+      "objective": "Verhindert ungueltige Kommandofolgen",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "state_machine_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVTFLOW-003",
+      "domain": "ZVTFLOW",
+      "title": "Parallele Zahlungen auf gleicher Verbindung serialisiert",
+      "objective": "Verhindert kollidierende Ablaeufe",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "concurrency_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVTFLOW-004",
+      "domain": "ZVTFLOW",
+      "title": "Statusabfragen veraendern Zahlungszustand nicht",
+      "objective": "Verhindert Seiteneffekte diagnostischer Ops",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "protocol_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVTFLOW-005",
+      "domain": "ZVTFLOW",
+      "title": "Abbruchkommandos nur in zulaessigen Phasen",
+      "objective": "Verhindert inkonsistente Abbruchzustaende",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "state_machine_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVTFLOW-006",
+      "domain": "ZVTFLOW",
+      "title": "Storno referenziert eindeutig Ursprungstransaktion",
+      "objective": "Verhindert falsche Zuordnung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "db_schema"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVTFLOW-007",
+      "domain": "ZVTFLOW",
+      "title": "Wiederanlauf nur mit eindeutigem Transaktionskontext",
+      "objective": "Verhindert doppelte Fortsetzung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "reconnect_tests"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "ZVTFLOW-008",
+      "domain": "ZVTFLOW",
+      "title": "Terminalseitige Zwischenzustaende vor Folgebefehlen beruecksichtigt",
+      "objective": "Verhindert vorschnelle Kommandos",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "state_machine_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVTFLOW-009",
+      "domain": "ZVTFLOW",
+      "title": "Async Rueckmeldungen korrekt zugeordnet",
+      "objective": "Verhindert Vermischung paralleler Sitzungen",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVTFLOW-010",
+      "domain": "ZVTFLOW",
+      "title": "Nach Transaktionsende expliziter Idle-Zustand",
+      "objective": "Verhindert haengende Sitzungskontexte",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "state_machine_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVTERROR-001",
+      "domain": "ZVTERROR",
+      "title": "ZVT-Fehlercodes vollstaendig auf interne Klassen gemappt",
+      "objective": "Konsistente Fehlerbehandlung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "error_mapping"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVTERROR-002",
+      "domain": "ZVTERROR",
+      "title": "Unbekannte Fehlercodes fuehren nicht zu Erfolgsbewertung",
+      "objective": "Verhindert False Positives",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "negative_tests"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "ZVTERROR-003",
+      "domain": "ZVTERROR",
+      "title": "Transport- und Terminalablehnungen erzeugen unterschiedliche Folgeaktionen",
+      "objective": "Korrekte Retry-Entscheidungen",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "error_mode_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVTERROR-004",
+      "domain": "ZVTERROR",
+      "title": "Fehler ohne Transaktionskontext als unvollstaendig markiert",
+      "objective": "Verhindert unpruefbare Abschluesse",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "db_schema"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVTERROR-005",
+      "domain": "ZVTERROR",
+      "title": "Wiederholte Protokollfehler fuehren zu Eskalation/Reset",
+      "objective": "Verhindert korrupte Kommunikation",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "reliability_tests"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "ZVTERROR-006",
+      "domain": "ZVTERROR",
+      "title": "Belegdruckfehler ueberschreiben nicht Zahlungsstatus",
+      "objective": "Trennt Zahlungs- von Nebenfehlern",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "protocol_tests"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "ZVTERROR-007",
+      "domain": "ZVTERROR",
+      "title": "Bediener- und technischer Abbruch getrennt ausgewiesen",
+      "objective": "Aussagekraft im Audit/Support",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "error_mapping"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVTERROR-008",
+      "domain": "ZVTERROR",
+      "title": "Fehler in optionalen Erweiterungen beeintraechtigen Kernablauf nicht",
+      "objective": "Begrenzt Seiteneffekte",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "negative_tests"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "ZVTERROR-009",
+      "domain": "ZVTERROR",
+      "title": "Mehrdeutige Antworten als inkonsistenter Fehlerzustand behandelt",
+      "objective": "Verhindert unsichere Interpretation",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "negative_tests"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "ZVTERROR-010",
+      "domain": "ZVTERROR",
+      "title": "Fehlerzustaende erzeugen auditierbare Ereignisse",
+      "objective": "Nachvollziehbarkeit bei Protokollproblemen",
+      "check_target": "system",
+      "evidence": [
+        "audit_log_sample",
+        "source_code"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVTTIME-001",
+      "domain": "ZVTTIME",
+      "title": "Antwort-Timeouts je ZVT-Kommando explizit definiert",
+      "objective": "Verhindert unkontrollierte Haenger",
+      "check_target": "config",
+      "evidence": [
+        "source_code",
+        "config"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVTTIME-002",
+      "domain": "ZVTTIME",
+      "title": "Timeouts differenziert nach Protokollphase",
+      "objective": "Realistische Zeitsteuerung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "timeout_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVTTIME-003",
+      "domain": "ZVTTIME",
+      "title": "Nach Timeout Protokollzustand explizit bereinigt",
+      "objective": "Verhindert haengende Sitzungen",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "state_machine_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVTTIME-004",
+      "domain": "ZVTTIME",
+      "title": "Zeitkritische Nachrichten nicht durch Anwendungslogik verzoegert",
+      "objective": "Verhindert selbstverursachte Abbrueche",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "performance_tests"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "ZVTTIME-005",
+      "domain": "ZVTTIME",
+      "title": "Retry-Intervalle definiert und begrenzt",
+      "objective": "Verhindert aggressives Wiederholen",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "retry_logic"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVTTIME-006",
+      "domain": "ZVTTIME",
+      "title": "Verspaetete Antworten nach Timeout nicht als aktuell akzeptiert",
+      "objective": "Verhindert Fehlzuordnung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVTTIME-007",
+      "domain": "ZVTTIME",
+      "title": "Konfigurierbare Zeitwerte mit Mindest-/Hoechstgrenzen",
+      "objective": "Verhindert riskante Einstellungen",
+      "check_target": "config",
+      "evidence": [
+        "config_validation",
+        "source_code"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVTTIME-008",
+      "domain": "ZVTTIME",
+      "title": "Busy-Zustaende zeitlich ueberwacht",
+      "objective": "Verhindert endloses Warten",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "state_machine_tests"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "ZVTTIME-009",
+      "domain": "ZVTTIME",
+      "title": "Zeitbezogene Events mit korrelierbarem Zeitstempel",
+      "objective": "Diagnose von Latenzproblemen",
+      "check_target": "system",
+      "evidence": [
+        "log_samples",
+        "source_code"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVTTIME-010",
+      "domain": "ZVTTIME",
+      "title": "Timeout-Abbrueche fuehren nicht automatisch zu Stornierung",
+      "objective": "Verhindert falsche Schlussfolgerungen",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "OPICORE-001",
+      "domain": "OPICORE",
+      "title": "OPI-Nachrichten auf Schema- und Pflichtfeldkonformitaet geprueft",
+      "objective": "Verhindert ungueltige Anfragen/Antworten",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "schema_tests"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "OPICORE-002",
+      "domain": "OPICORE",
+      "title": "OPI-Nachrichtentypen eindeutig klassifiziert und geroutet",
+      "objective": "Verhindert Fehlbehandlung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "protocol_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "OPICORE-003",
+      "domain": "OPICORE",
+      "title": "Unbekannte OPI-Felder/Erweiterungen kontrolliert behandelt",
+      "objective": "Robustheit gegenueber Versionen",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "compatibility_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "OPICORE-004",
+      "domain": "OPICORE",
+      "title": "OPI-Korrelationskennungen strikt validiert",
+      "objective": "Verhindert Kontextvermischung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "OPICORE-005",
+      "domain": "OPICORE",
+      "title": "Widerspruechliche Pflichtinfos abgewiesen",
+      "objective": "Verhindert inkonsistente Verarbeitung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "negative_tests"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "OPICORE-006",
+      "domain": "OPICORE",
+      "title": "Datum/Betrag/Waehrung typisiert und semantisch validiert",
+      "objective": "Verhindert manipulative Nutzlasten",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "validation_tests"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "OPICORE-007",
+      "domain": "OPICORE",
+      "title": "Protokollfehler und Geschaeftsantworten sauber getrennt",
+      "objective": "Korrekte Folgeentscheidungen",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "error_mapping"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "OPICORE-008",
+      "domain": "OPICORE",
+      "title": "OPI-Payloads vor Logging/Persistenz maskiert",
+      "objective": "Verhindert Datenabfluss aus Nachrichten",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "log_samples"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "OPICORE-009",
+      "domain": "OPICORE",
+      "title": "Protokollversion und Kompatibilitaet explizit geprueft",
+      "objective": "Verhindert verdeckte Inkompatibilitaeten",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "compatibility_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "OPICORE-010",
+      "domain": "OPICORE",
+      "title": "Parser schuetzt gegen uebergrosse/verschachtelte Nutzlasten",
+      "objective": "Reduziert DoS-Risiko",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "fuzz_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "OPIFLOW-001",
+      "domain": "OPIFLOW",
+      "title": "OPI-Anfragen nur in zulaessiger Reihenfolge gesendet",
+      "objective": "Verhindert Protokollverletzungen",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "state_machine_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "OPIFLOW-002",
+      "domain": "OPIFLOW",
+      "title": "Antworten eindeutig der Anforderung zugeordnet",
+      "objective": "Verhindert Vermischung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "OPIFLOW-003",
+      "domain": "OPIFLOW",
+      "title": "Doppelte Responses dedupliziert",
+      "objective": "Verhindert Mehrfachverarbeitung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "OPIFLOW-004",
+      "domain": "OPIFLOW",
+      "title": "Stornierungen referenzieren korrekte Ursprungstransaktion",
+      "objective": "Verhindert falsche Folgeaktionen",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "db_schema"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "OPIFLOW-005",
+      "domain": "OPIFLOW",
+      "title": "Async Events nur ueber definierte Zustandsuebergaenge",
+      "objective": "Verhindert inkonsistente Statusspruenge",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "state_machine_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "OPIFLOW-006",
+      "domain": "OPIFLOW",
+      "title": "OPI-Timeouts fuehren zu expliziten Pending/Fehler-Zustaenden",
+      "objective": "Verhindert unklare Bewertung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "timeout_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "OPIFLOW-007",
+      "domain": "OPIFLOW",
+      "title": "Keine Folgeanfragen auf Basis unvollstaendiger Antworten",
+      "objective": "Verhindert Kettenfehler",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "validation_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "OPIFLOW-008",
+      "domain": "OPIFLOW",
+      "title": "Wiederanlaeufe unterscheiden idempotente von nicht-idempotenten Aktionen",
+      "objective": "Verhindert doppelte Wirkung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "retry_logic"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "OPIFLOW-009",
+      "domain": "OPIFLOW",
+      "title": "Dialogbeendigung hinterlaesst keinen offenen fachlichen Status",
+      "objective": "Verhindert haengende Kontexte",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "state_machine_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "OPIFLOW-010",
+      "domain": "OPIFLOW",
+      "title": "Workflows gegen parallele Statusaenderungen abgesichert",
+      "objective": "Verhindert Race Conditions",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "concurrency_tests"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "PROTOINT-001",
+      "domain": "PROTOINT",
+      "title": "Protokollkonverter erhalten alle Informationen verlustfrei",
+      "objective": "Verhindert semantischen Informationsverlust",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "mapping_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "PROTOINT-002",
+      "domain": "PROTOINT",
+      "title": "Keine unmoeglichen Mischzustaende aus verschiedenen Protokollen",
+      "objective": "Verhindert inkonsistente Aggregation",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "state_machine_tests"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "PROTOINT-003",
+      "domain": "PROTOINT",
+      "title": "Korrelationskennungen beim Protokolluebergang erhalten",
+      "objective": "End-to-End Nachverfolgung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "message_schema"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "PROTOINT-004",
+      "domain": "PROTOINT",
+      "title": "Protokollfehler in normierte interne Semantik ueberfuehrt",
+      "objective": "Konsistente Behandlung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "error_mapping"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "PROTOINT-005",
+      "domain": "PROTOINT",
+      "title": "Nicht mappbare Infos explizit kenntlich, nicht still verworfen",
+      "objective": "Verhindert unsichtbaren Informationsverlust",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "mapping_tests"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "PROTOINT-006",
+      "domain": "PROTOINT",
+      "title": "Interne Modelle erzwingen zulaessige Wertebereiche vor Serialisierung",
+      "objective": "Verhindert ungueltige Protokollnachrichten",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "validation_tests"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "PROTOINT-007",
+      "domain": "PROTOINT",
+      "title": "Serialisierung deterministisch und testbar",
+      "objective": "Reproduzierbarkeit",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "golden_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "PROTOINT-008",
+      "domain": "PROTOINT",
+      "title": "Parser und Serializer verwenden gleiche Feldsemantik",
+      "objective": "Verhindert Drift",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "roundtrip_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "PROTOINT-009",
+      "domain": "PROTOINT",
+      "title": "Protokolladapter logisch von Geschaeftsregeln getrennt",
+      "objective": "Reduziert Seiteneffekte",
+      "check_target": "architecture",
+      "evidence": [
+        "source_code",
+        "design_docs"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "PROTOINT-010",
+      "domain": "PROTOINT",
+      "title": "Protokollmapping-Aenderungen durch Regressionstests abgesichert",
+      "objective": "Verhindert Integrationsbrueche",
+      "check_target": "test",
+      "evidence": [
+        "regression_tests",
+        "protocol_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TERMSTATE-001",
+      "domain": "TERMSTATE",
+      "title": "Terminalzustaende als explizites Modell repraesentiert",
+      "objective": "Klarheit und Pruefbarkeit",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "state_machine_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TERMSTATE-002",
+      "domain": "TERMSTATE",
+      "title": "Busy-Status blockiert unzulaessige Folgekommandos",
+      "objective": "Verhindert Kollisionen",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "state_machine_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TERMSTATE-003",
+      "domain": "TERMSTATE",
+      "title": "Nach Reconnect aktive Neusynchronisation",
+      "objective": "Verhindert veraltetes Verbindungswissen",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "reconnect_tests"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "TERMSTATE-004",
+      "domain": "TERMSTATE",
+      "title": "Ungueltige Terminal+Transaktionsstatus-Kombinationen erkannt",
+      "objective": "Verhindert widerspruechliche Entscheidungen",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "negative_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TERMSTATE-005",
+      "domain": "TERMSTATE",
+      "title": "Service-/Wartungszustaende vom Zahlungsbetrieb getrennt",
+      "objective": "Reduziert Seiteneffekte",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "auth_tests"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "TERMSTATE-006",
+      "domain": "TERMSTATE",
+      "title": "Statusaenderungen erzeugen nachvollziehbare Backend-Events",
+      "objective": "Sichtbarkeit kritischer Aenderungen",
+      "check_target": "system",
+      "evidence": [
+        "audit_log_sample",
+        "source_code"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TERMSTATE-007",
+      "domain": "TERMSTATE",
+      "title": "Unklare Zustaende fuehren zu konservativem Verhalten",
+      "objective": "Verhindert unsichere Annahmen",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "error_mode_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TERMSTATE-008",
+      "domain": "TERMSTATE",
+      "title": "Verfuegbarkeit nicht mit fachlichem Zahlungserfolg verwechselt",
+      "objective": "Verhindert falsche Geschaeftsentscheidungen",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TERMSTATE-009",
+      "domain": "TERMSTATE",
+      "title": "Lokale Statuscaches verfallen kontrolliert",
+      "objective": "Verhindert veraltete Zustandsinformationen",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "cache_tests"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "TERMSTATE-010",
+      "domain": "TERMSTATE",
+      "title": "Sicherheitszustaende nicht durch Nutzeraktionen ruecksetzbar",
+      "objective": "Schuetzt kritische Geraetezustaende",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "authorization_tests"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "TERMREC-001",
+      "domain": "TERMREC",
+      "title": "Belegdaten vor Persistenz/Ausgabe formal validiert",
+      "objective": "Verhindert fehlerhafte Belegverarbeitung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "validation_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TERMREC-002",
+      "domain": "TERMREC",
+      "title": "Doppelte Belegmeldungen erkannt und nicht mehrfach verarbeitet",
+      "objective": "Verhindert Mehrfachablage",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "dedup_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TERMREC-003",
+      "domain": "TERMREC",
+      "title": "Belegdaten dem korrekten Transaktionskontext zugeordnet",
+      "objective": "Verhindert Vermischung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "db_schema"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TERMREC-004",
+      "domain": "TERMREC",
+      "title": "Fehlgeschlagener Belegdruck veraendert nicht Zahlungsstatus",
+      "objective": "Trennt Zahlungsabschluss von Druckproblemen",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "protocol_tests"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "TERMREC-005",
+      "domain": "TERMREC",
+      "title": "Belegtexte vor Logging auf sensitive Inhalte geprueft",
+      "objective": "Verhindert Datenabfluss ueber Ausgabepfade",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "log_samples"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TERMREC-006",
+      "domain": "TERMREC",
+      "title": "Belegereignisse auditierbar und zeitlich korrelierbar",
+      "objective": "Nachweis ueber Ausgabeverhalten",
+      "check_target": "system",
+      "evidence": [
+        "audit_log_sample",
+        "report_samples"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TERMREC-007",
+      "domain": "TERMREC",
+      "title": "Mehrteilige Belegdaten vollstaendig und korrekt zusammengefuehrt",
+      "objective": "Verhindert Datenverlust",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "golden_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TERMREC-008",
+      "domain": "TERMREC",
+      "title": "Beschaedigte Belegsegmente als unvollstaendig markiert",
+      "objective": "Verhindert Nutzung defekter Daten",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "negative_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TERMREC-009",
+      "domain": "TERMREC",
+      "title": "Belegformate zwischen Terminal und Backend kompatibel",
+      "objective": "Verhindert Zeichensatz-/Layoutfehler",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "compatibility_tests"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "TERMREC-010",
+      "domain": "TERMREC",
+      "title": "Belegdaten auf erforderliche Inhalte minimiert",
+      "objective": "Reduziert unnoetige Speicherung",
+      "check_target": "architecture",
+      "evidence": [
+        "data_flow_docs",
+        "db_schema"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "TERMSYNC-009",
+      "domain": "TERMSYNC",
+      "title": "Sync unterscheidet fachliche Klaerung von technischer Wiederholung",
+      "objective": "Verhindert Wiederholung finaler Zustaende",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "state_machine_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "TERMSYNC-010",
+      "domain": "TERMSYNC",
+      "title": "Terminal/Backend-Zustaende regelmaessig auf Divergenzen geprueft",
+      "objective": "Erkennt Inkonsistenzen fruehzeitig",
+      "check_target": "system",
+      "evidence": [
+        "reconciliation_jobs",
+        "audit_log_sample"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVT-CMD-001",
+      "domain": "ZVT-CMD",
+      "title": "ZVT-Kommandos nur in zulaessiger Reihenfolge",
+      "objective": "Verhindert Protokollverletzungen",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "state_machine_tests"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "ZVT-CMD-002",
+      "domain": "ZVT-CMD",
+      "title": "Ungueltige Kommandos sicher zurueckgewiesen",
+      "objective": "Verhindert undefined behavior",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "negative_tests"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "ZVT-CMD-003",
+      "domain": "ZVT-CMD",
+      "title": "Verpflichtende Parameter vorhanden",
+      "objective": "Sichert korrekte Kommunikation",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "protocol_tests"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "ZVT-CMD-004",
+      "domain": "ZVT-CMD",
+      "title": "Optionalfelder korrekt interpretiert und validiert",
+      "objective": "Verhindert Fehlinterpretation",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "protocol_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVT-CMD-005",
+      "domain": "ZVT-CMD",
+      "title": "Terminalantworten vollstaendig gelesen und verarbeitet",
+      "objective": "Verhindert Zustandsverlust",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVT-RT-001",
+      "domain": "ZVT-RT",
+      "title": "Timeouts fuer Terminalkommunikation definiert",
+      "objective": "Verhindert blockierende Prozesse",
+      "check_target": "config",
+      "evidence": [
+        "config",
+        "source_code"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "ZVT-RT-002",
+      "domain": "ZVT-RT",
+      "title": "Retries unterscheiden idempotent/nicht-idempotent",
+      "objective": "Verhindert doppelte Buchungen",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "retry_logic"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVT-RT-003",
+      "domain": "ZVT-RT",
+      "title": "Retry-Anzahl begrenzt",
+      "objective": "Verhindert Endlosschleifen",
+      "check_target": "config",
+      "evidence": [
+        "config",
+        "source_code"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "ZVT-RT-004",
+      "domain": "ZVT-RT",
+      "title": "Backoff-Strategien implementiert",
+      "objective": "Verhindert Ueberlastung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "retry_logic"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVT-RT-005",
+      "domain": "ZVT-RT",
+      "title": "Abgebrochene Transaktionen eindeutig markiert",
+      "objective": "Erleichtert Recovery",
+      "check_target": "system",
+      "evidence": [
+        "db_schema",
+        "source_code"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVT-STATE-001",
+      "domain": "ZVT-STATE",
+      "title": "Zahlungszustaende als explizite State Machine",
+      "objective": "Verhindert implizite Zustaende",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "state_machine_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVT-STATE-002",
+      "domain": "ZVT-STATE",
+      "title": "Ungueltige Zustandsuebergaenge nicht moeglich",
+      "objective": "Verhindert inkonsistente Zustaende",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "state_machine_tests"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "ZVT-STATE-003",
+      "domain": "ZVT-STATE",
+      "title": "Jeder Zustand hat definierten Exit-Pfad",
+      "objective": "Verhindert Deadlocks",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "state_machine_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVT-STATE-004",
+      "domain": "ZVT-STATE",
+      "title": "Terminal- und Backendzustand abgeglichen",
+      "objective": "Verhindert Divergenzen",
+      "check_target": "system",
+      "evidence": [
+        "integration_test",
+        "reconciliation_jobs"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVT-STATE-005",
+      "domain": "ZVT-STATE",
+      "title": "Recovery-Zustaende explizit modelliert",
+      "objective": "Erhoeht Robustheit",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "state_machine_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVT-COM-001",
+      "domain": "ZVT-COM",
+      "title": "Nachrichtenlaengen validiert",
+      "objective": "Verhindert Parsing-Fehler",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "protocol_tests"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "ZVT-COM-002",
+      "domain": "ZVT-COM",
+      "title": "Checksummen/Integritaet geprueft",
+      "objective": "Verhindert manipulierte Daten",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "protocol_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVT-COM-003",
+      "domain": "ZVT-COM",
+      "title": "Teilweise empfangene Nachrichten nicht verarbeitet",
+      "objective": "Verhindert inkonsistente Verarbeitung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "negative_tests"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "ZVT-COM-004",
+      "domain": "ZVT-COM",
+      "title": "Nachrichten in korrektem Encoding interpretiert",
+      "objective": "Verhindert Datenfehler",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "protocol_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVT-COM-005",
+      "domain": "ZVT-COM",
+      "title": "Protokollverletzungen erkannt und geloggt",
+      "objective": "Erhoeht Diagnosefaehigkeit",
+      "check_target": "system",
+      "evidence": [
+        "source_code",
+        "log_samples"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVT-REV-001",
+      "domain": "ZVT-REV",
+      "title": "Reversal nur fuer geeignete Transaktionen",
+      "objective": "Verhindert unzulaessige Rueckabwicklung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "authorization_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVT-REV-002",
+      "domain": "ZVT-REV",
+      "title": "Reversal eindeutig einer Transaktion zugeordnet",
+      "objective": "Verhindert falsche Zuordnung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "db_schema"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "ZVT-REV-003",
+      "domain": "ZVT-REV",
+      "title": "Mehrfach-Reversal verhindert",
+      "objective": "Verhindert doppelte Rueckbuchung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "ZVT-REV-004",
+      "domain": "ZVT-REV",
+      "title": "Reversal vollstaendig dokumentiert",
+      "objective": "Ermoeglicht Audit",
+      "check_target": "system",
+      "evidence": [
+        "audit_log_sample",
+        "db_schema"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVT-REV-005",
+      "domain": "ZVT-REV",
+      "title": "Fehlgeschlagene Reversals erneut geprueft oder eskaliert",
+      "objective": "Verhindert offene Transaktionen",
+      "check_target": "system",
+      "evidence": [
+        "source_code",
+        "ops_docs"
+      ],
+      "automation": "low"
+    },
+    {
+      "control_id": "ZVT-RESP-001",
+      "domain": "ZVT-RESP",
+      "title": "Alle Terminal-Response-Codes vollstaendig abgedeckt",
+      "objective": "Verhindert unhandled states",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "error_mapping"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "ZVT-RESP-002",
+      "domain": "ZVT-RESP",
+      "title": "Fehlercodes korrekt interpretiert",
+      "objective": "Verhindert falsche Verarbeitung",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "protocol_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVT-RESP-003",
+      "domain": "ZVT-RESP",
+      "title": "Unbekannte Response-Codes sicher behandelt",
+      "objective": "Erhoeht Robustheit",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "negative_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVT-RESP-004",
+      "domain": "ZVT-RESP",
+      "title": "Response-Daten validiert",
+      "objective": "Verhindert Inkonsistenzen",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "validation_tests"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "ZVT-RESP-005",
+      "domain": "ZVT-RESP",
+      "title": "Terminalstatus nach Response aktualisiert",
+      "objective": "Synchronisiert Zustaende",
+      "check_target": "system",
+      "evidence": [
+        "source_code",
+        "state_machine_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVT-SESSION-001",
+      "domain": "ZVT-SESSION",
+      "title": "Terminal-Sessions explizit geoeffnet und geschlossen",
+      "objective": "Verhindert Zombie-Sessions",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "integration_test"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVT-SESSION-002",
+      "domain": "ZVT-SESSION",
+      "title": "Session-Timeouts definiert",
+      "objective": "Verhindert haengende Sessions",
+      "check_target": "config",
+      "evidence": [
+        "config",
+        "source_code"
+      ],
+      "automation": "high"
+    },
+    {
+      "control_id": "ZVT-SESSION-003",
+      "domain": "ZVT-SESSION",
+      "title": "Session-Abbrueche erkannt",
+      "objective": "Erhoeht Stabilitaet",
+      "check_target": "system",
+      "evidence": [
+        "source_code",
+        "monitoring_config"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVT-SESSION-004",
+      "domain": "ZVT-SESSION",
+      "title": "Session-Wiederaufnahme kontrolliert",
+      "objective": "Verhindert Inkonsistenzen",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "reconnect_tests"
+      ],
+      "automation": "medium"
+    },
+    {
+      "control_id": "ZVT-SESSION-005",
+      "domain": "ZVT-SESSION",
+      "title": "Parallele Sessions kontrolliert",
+      "objective": "Verhindert Race Conditions",
+      "check_target": "code",
+      "evidence": [
+        "source_code",
+        "concurrency_tests"
+      ],
+      "automation": "medium"
+    }
+  ]
+}
\ No newline at end of file
diff --git a/ai-compliance-sdk/policies/ucca_policy_v1.yaml b/ai-compliance-sdk/policies/ucca_policy_v1.yaml
index aadce89..c124fb5 100644
--- a/ai-compliance-sdk/policies/ucca_policy_v1.yaml
+++ b/ai-compliance-sdk/policies/ucca_policy_v1.yaml
@@ -941,6 +941,676 @@ rules:
     gdpr_ref: "Art. 9(2)(h) DSGVO"
     rationale: "Gesundheitsdaten nur mit besonderen Schutzmaßnahmen"
 
+  # ---------------------------------------------------------------------------
+  # J. Drittlandtransfer / FISA 702
+  # ---------------------------------------------------------------------------
+
+  - id: R-FISA-001
+    category: "J. Drittlandrisiko"
+    title: "US-Cloud-Provider: FISA 702 Exposure"
+    description: "Der Hosting-Provider unterliegt US-Recht (FISA 702, Cloud Act). Ein Zugriff durch US-Behoerden auf EU-Daten ist nicht ausschliessbar, unabhaengig vom Serverstandort."
+    condition:
+      field: "hosting.provider"
+      operator: "in"
+      value: ["aws", "azure", "google", "microsoft", "amazon", "openai", "anthropic", "oracle"]
+    effect:
+      risk_add: 20
+      dsfa_recommended: true
+    severity: WARN
+    gdpr_ref: "Art. 44-49 DSGVO, Schrems II (C-311/18)"
+    rationale: "FISA 702 erlaubt US-Behoerden Zugriff auf Daten von Nicht-US-Personen ohne richterlichen Beschluss. EU-Serverstandort schuetzt nicht."
+
+  - id: R-FISA-002
+    category: "J. Drittlandrisiko"
+    title: "Personenbezogene Daten bei US-Provider ohne E2EE"
+    description: "Personenbezogene Daten werden bei einem US-Provider verarbeitet ohne dass eine Ende-zu-Ende-Verschluesselung mit kundenseitiger Schluesselhoheit vorliegt."
+    condition:
+      all_of:
+        - field: "hosting.provider"
+          operator: "in"
+          value: ["aws", "azure", "google", "microsoft", "amazon", "openai", "anthropic", "oracle"]
+        - field: "data_types.personal_data"
+          operator: "equals"
+          value: true
+    effect:
+      risk_add: 15
+      controls_add: [C_ENCRYPTION]
+    severity: WARN
+    gdpr_ref: "Art. 32 DSGVO i.V.m. Art. 44 ff. DSGVO"
+    rationale: "Ohne E2EE mit eigener Schluesselhoheit kann der Provider technisch auf Daten zugreifen und muss sie bei US-Anordnung herausgeben."
+
+  - id: R-FISA-003
+    category: "J. Drittlandrisiko"
+    title: "Besondere Datenkategorien bei US-Provider"
+    description: "Besondere Kategorien personenbezogener Daten (Art. 9 DSGVO) werden bei einem US-Provider verarbeitet."
+    condition:
+      all_of:
+        - field: "hosting.provider"
+          operator: "in"
+          value: ["aws", "azure", "google", "microsoft", "amazon", "openai", "anthropic", "oracle"]
+        - field: "data_types.article_9_data"
+          operator: "equals"
+          value: true
+    effect:
+      risk_add: 25
+      feasibility: CONDITIONAL
+      dsfa_recommended: true
+    severity: WARN
+    gdpr_ref: "Art. 9 DSGVO i.V.m. Art. 49 DSGVO"
+    rationale: "Besondere Kategorien bei FISA-exponierten Anbietern sind hochriskant. DSFA ist Pflicht."
+
+  # ---------------------------------------------------------------------------
+  # K. Domain-spezifische Hochrisiko-Fragen (Annex III)
+  # ---------------------------------------------------------------------------
+
+  # HR / Recruiting (Annex III Nr. 4)
+  - id: R-HR-001
+    category: "K. HR Hochrisiko"
+    title: "Automatisches Bewerber-Screening ohne Human Review"
+    description: "KI sortiert Bewerber vor ohne dass ein Mensch jede Empfehlung tatsaechlich prueft"
+    condition:
+      all_of:
+        - field: "hr_context.automated_screening"
+          operator: "equals"
+          value: true
+        - field: "hr_context.human_review_enforced"
+          operator: "equals"
+          value: false
+    effect:
+      risk_add: 20
+      feasibility: CONDITIONAL
+      controls_add: [C_HUMAN_OVERSIGHT]
+    severity: WARN
+    gdpr_ref: "Art. 22 DSGVO + Annex III Nr. 4 AI Act"
+    rationale: "Ohne echtes Human Review droht Art. 22 DSGVO Verstoss"
+
+  - id: R-HR-002
+    category: "K. HR Hochrisiko"
+    title: "Automatisierte Absagen — Art. 22 DSGVO Risiko"
+    description: "KI generiert und versendet Absagen automatisch ohne menschliche Freigabe"
+    condition:
+      field: "hr_context.automated_rejection"
+      operator: "equals"
+      value: true
+    effect:
+      risk_add: 25
+      feasibility: NO
+      art22_risk: true
+    severity: BLOCK
+    gdpr_ref: "Art. 22 Abs. 1 DSGVO"
+    rationale: "Vollautomatische Ablehnung = ausschliesslich automatisierte Entscheidung mit rechtlicher Wirkung"
+
+  - id: R-HR-003
+    category: "K. HR Hochrisiko"
+    title: "AGG-relevante Merkmale fuer KI erkennbar"
+    description: "System kann Merkmale nach § 1 AGG erkennen (Name, Foto, Alter → Proxy-Diskriminierung)"
+    condition:
+      field: "hr_context.agg_categories_visible"
+      operator: "equals"
+      value: true
+    effect:
+      risk_add: 15
+      controls_add: [C_BIAS_AUDIT]
+    severity: WARN
+    gdpr_ref: "§ 1, § 3 Abs. 2 AGG"
+    rationale: "Proxy-Merkmale koennen indirekte Diskriminierung verursachen"
+
+  - id: R-HR-004
+    category: "K. HR Hochrisiko"
+    title: "Bewerber-Ranking ohne Bias-Audit"
+    description: "KI erstellt Bewerber-Rankings ohne regelmaessige Bias-Pruefung"
+    condition:
+      all_of:
+        - field: "hr_context.candidate_ranking"
+          operator: "equals"
+          value: true
+        - field: "hr_context.bias_audits_done"
+          operator: "equals"
+          value: false
+    effect:
+      risk_add: 15
+      controls_add: [C_BIAS_AUDIT]
+    severity: WARN
+    gdpr_ref: "§ 22 AGG (Beweislastumkehr)"
+    rationale: "Ohne Bias-Audit keine Verteidigung bei AGG-Klage"
+
+  - id: R-HR-005
+    category: "K. HR Hochrisiko"
+    title: "KI-gestuetzte Mitarbeiterbewertung"
+    description: "KI bewertet Mitarbeiterleistung (Performance Review, KPI-Tracking)"
+    condition:
+      field: "hr_context.performance_evaluation"
+      operator: "equals"
+      value: true
+    effect:
+      risk_add: 20
+    severity: WARN
+    gdpr_ref: "§ 87 Abs. 1 Nr. 6 BetrVG + § 94 BetrVG"
+    rationale: "Leistungsbewertung durch KI ist mitbestimmungspflichtig und diskriminierungsriskant"
+
+  # Education (Annex III Nr. 3)
+  - id: R-EDU-001
+    category: "K. Bildung Hochrisiko"
+    title: "KI beeinflusst Notenvergabe"
+    description: "KI erstellt Notenvorschlaege oder beeinflusst Bewertungen"
+    condition:
+      field: "education_context.grade_influence"
+      operator: "equals"
+      value: true
+    effect:
+      risk_add: 20
+      controls_add: [C_HUMAN_OVERSIGHT]
+      dsfa_recommended: true
+    severity: WARN
+    gdpr_ref: "Annex III Nr. 3 AI Act"
+    rationale: "Notenvergabe hat erhebliche Auswirkungen auf Bildungschancen"
+
+  - id: R-EDU-002
+    category: "K. Bildung Hochrisiko"
+    title: "Minderjaehrige betroffen ohne Lehrkraft-Review"
+    description: "KI-System betrifft Minderjaehrige und Lehrkraft prueft nicht jedes Ergebnis"
+    condition:
+      all_of:
+        - field: "education_context.minors_involved"
+          operator: "equals"
+          value: true
+        - field: "education_context.teacher_review_required"
+          operator: "equals"
+          value: false
+    effect:
+      risk_add: 25
+      feasibility: NO
+    severity: BLOCK
+    gdpr_ref: "Art. 24 EU-Grundrechtecharta + Annex III Nr. 3 AI Act"
+    rationale: "KI-Entscheidungen ueber Minderjaehrige ohne Lehrkraft-Kontrolle sind unzulaessig"
+
+  - id: R-EDU-003
+    category: "K. Bildung Hochrisiko"
+    title: "KI steuert Zugang zu Bildungsangeboten"
+    description: "KI beeinflusst Zulassung, Kursempfehlungen oder Einstufungen"
+    condition:
+      field: "education_context.student_selection"
+      operator: "equals"
+      value: true
+    effect:
+      risk_add: 20
+      dsfa_recommended: true
+    severity: WARN
+    gdpr_ref: "Art. 14 EU-Grundrechtecharta (Recht auf Bildung)"
+    rationale: "Zugangssteuerung zu Bildung ist hochrisiko nach AI Act"
+
+  # Healthcare (Annex III Nr. 5)
+  - id: R-HC-001
+    category: "K. Gesundheit Hochrisiko"
+    title: "KI unterstuetzt Diagnosen"
+    description: "KI erstellt Diagnosevorschlaege oder wertet Bildgebung aus"
+    condition:
+      field: "healthcare_context.diagnosis_support"
+      operator: "equals"
+      value: true
+    effect:
+      risk_add: 20
+      dsfa_recommended: true
+      controls_add: [C_HUMAN_OVERSIGHT]
+    severity: WARN
+    gdpr_ref: "Annex III Nr. 5 AI Act + MDR (EU) 2017/745"
+    rationale: "Diagnoseunterstuetzung erfordert hoechste Genauigkeit und Human Oversight"
+
+  - id: R-HC-002
+    category: "K. Gesundheit Hochrisiko"
+    title: "Triage-Entscheidung durch KI"
+    description: "KI priorisiert Patienten nach Dringlichkeit"
+    condition:
+      field: "healthcare_context.triage_decision"
+      operator: "equals"
+      value: true
+    effect:
+      risk_add: 30
+      feasibility: CONDITIONAL
+      controls_add: [C_HUMAN_OVERSIGHT]
+      dsfa_recommended: true
+    severity: WARN
+    gdpr_ref: "Annex III Nr. 5 AI Act"
+    rationale: "Lebenskritische Priorisierung erfordert maximale Sicherheit"
+
+  - id: R-HC-003
+    category: "K. Gesundheit Hochrisiko"
+    title: "Medizinprodukt ohne klinische Validierung"
+    description: "System ist als Medizinprodukt eingestuft aber nicht klinisch validiert"
+    condition:
+      all_of:
+        - field: "healthcare_context.medical_device"
+          operator: "equals"
+          value: true
+        - field: "healthcare_context.clinical_validation"
+          operator: "equals"
+          value: false
+    effect:
+      risk_add: 30
+      feasibility: NO
+    severity: BLOCK
+    gdpr_ref: "MDR (EU) 2017/745 Art. 61"
+    rationale: "Medizinprodukte ohne klinische Validierung duerfen nicht in Verkehr gebracht werden"
+
+  - id: R-HC-004
+    category: "K. Gesundheit Hochrisiko"
+    title: "Gesundheitsdaten ohne besondere Schutzmassnahmen"
+    description: "Gesundheitsdaten (Art. 9 DSGVO) werden verarbeitet"
+    condition:
+      field: "healthcare_context.patient_data_processed"
+      operator: "equals"
+      value: true
+    effect:
+      risk_add: 15
+      dsfa_recommended: true
+      controls_add: [C_DSFA]
+    severity: WARN
+    gdpr_ref: "Art. 9 DSGVO"
+    rationale: "Gesundheitsdaten sind besondere Kategorien mit erhoehtem Schutzbedarf"
+
+  # Legal / Justice (Annex III Nr. 8)
+  - id: R-LEG-001
+    category: "K. Legal Hochrisiko"
+    title: "KI gibt Rechtsberatung"
+    description: "KI generiert rechtliche Empfehlungen oder Einschaetzungen"
+    condition: { field: "legal_context.legal_advice", operator: "equals", value: true }
+    effect: { risk_add: 15, controls_add: [C_HUMAN_OVERSIGHT] }
+    severity: WARN
+    gdpr_ref: "Annex III Nr. 8 AI Act"
+    rationale: "Rechtsberatung durch KI kann Zugang zur Justiz beeintraechtigen"
+
+  - id: R-LEG-002
+    category: "K. Legal Hochrisiko"
+    title: "KI prognostiziert Gerichtsurteile"
+    description: "System erstellt Prognosen ueber Verfahrensausgaenge"
+    condition: { field: "legal_context.court_prediction", operator: "equals", value: true }
+    effect: { risk_add: 20, dsfa_recommended: true }
+    severity: WARN
+    rationale: "Urteilsprognosen koennen rechtliches Verhalten verzerren"
+
+  - id: R-LEG-003
+    category: "K. Legal Hochrisiko"
+    title: "Mandantengeheimnis bei KI-Verarbeitung"
+    description: "Vertrauliche Mandantendaten werden durch KI verarbeitet"
+    condition: { field: "legal_context.client_confidential", operator: "equals", value: true }
+    effect: { risk_add: 15, controls_add: [C_ENCRYPTION] }
+    severity: WARN
+    rationale: "Mandantengeheimnis erfordert besonderen Schutz (§ 203 StGB)"
+
+  # Public Sector (Art. 27 FRIA)
+  - id: R-PUB-001
+    category: "K. Oeffentlicher Sektor"
+    title: "KI in Verwaltungsentscheidungen"
+    description: "KI beeinflusst Verwaltungsakte oder Bescheide"
+    condition: { field: "public_sector_context.admin_decision", operator: "equals", value: true }
+    effect: { risk_add: 25, dsfa_recommended: true, controls_add: [C_FRIA, C_HUMAN_OVERSIGHT] }
+    severity: WARN
+    rationale: "Verwaltungsentscheidungen erfordern FRIA (Art. 27 AI Act)"
+
+  - id: R-PUB-002
+    category: "K. Oeffentlicher Sektor"
+    title: "KI verteilt oeffentliche Leistungen"
+    description: "KI entscheidet ueber Zuteilung von Sozialleistungen oder Foerderung"
+    condition: { field: "public_sector_context.benefit_allocation", operator: "equals", value: true }
+    effect: { risk_add: 25, feasibility: CONDITIONAL }
+    severity: WARN
+    rationale: "Leistungszuteilung betrifft Grundrecht auf soziale Sicherheit"
+
+  - id: R-PUB-003
+    category: "K. Oeffentlicher Sektor"
+    title: "Fehlende Transparenz gegenueber Buergern"
+    condition:
+      all_of:
+        - field: "public_sector_context.citizen_service"
+          operator: "equals"
+          value: true
+        - field: "public_sector_context.transparency_ensured"
+          operator: "equals"
+          value: false
+    effect: { risk_add: 15, controls_add: [C_TRANSPARENCY] }
+    severity: WARN
+    rationale: "Oeffentliche Stellen haben erhoehte Transparenzpflicht"
+
+  # Critical Infrastructure (NIS2 + Annex III Nr. 2)
+  - id: R-CRIT-001
+    category: "K. Kritische Infrastruktur"
+    title: "Sicherheitskritische KI-Steuerung ohne Redundanz"
+    condition:
+      all_of:
+        - field: "critical_infra_context.safety_critical"
+          operator: "equals"
+          value: true
+        - field: "critical_infra_context.redundancy_exists"
+          operator: "equals"
+          value: false
+    effect: { risk_add: 30, feasibility: NO }
+    severity: BLOCK
+    rationale: "Sicherheitskritische Steuerung ohne Redundanz ist unzulaessig"
+
+  - id: R-CRIT-002
+    category: "K. Kritische Infrastruktur"
+    title: "KI steuert Netz-/Infrastruktur"
+    condition: { field: "critical_infra_context.grid_control", operator: "equals", value: true }
+    effect: { risk_add: 20, controls_add: [C_INCIDENT_RESPONSE, C_HUMAN_OVERSIGHT] }
+    severity: WARN
+    rationale: "Netzsteuerung durch KI erfordert NIS2-konforme Absicherung"
+
+  # Automotive / Aerospace
+  - id: R-AUTO-001
+    category: "K. Automotive Hochrisiko"
+    title: "Autonomes Fahren / ADAS"
+    condition: { field: "automotive_context.autonomous_driving", operator: "equals", value: true }
+    effect: { risk_add: 30, controls_add: [C_HUMAN_OVERSIGHT, C_FRIA] }
+    severity: WARN
+    rationale: "Autonomes Fahren ist sicherheitskritisch und hochreguliert"
+
+  - id: R-AUTO-002
+    category: "K. Automotive Hochrisiko"
+    title: "Sicherheitsrelevant ohne Functional Safety"
+    condition:
+      all_of:
+        - field: "automotive_context.safety_relevant"
+          operator: "equals"
+          value: true
+        - field: "automotive_context.functional_safety"
+          operator: "equals"
+          value: false
+    effect: { risk_add: 25, feasibility: CONDITIONAL }
+    severity: WARN
+    rationale: "Sicherheitsrelevante Systeme erfordern ISO 26262 Konformitaet"
+
+  # Retail / E-Commerce
+  - id: R-RET-001
+    category: "K. Retail"
+    title: "Personalisierte Preise durch KI"
+    condition: { field: "retail_context.pricing_personalized", operator: "equals", value: true }
+    effect: { risk_add: 15, controls_add: [C_TRANSPARENCY] }
+    severity: WARN
+    rationale: "Personalisierte Preise koennen Verbraucher benachteiligen (DSA Art. 25)"
+
+  - id: R-RET-002
+    category: "K. Retail"
+    title: "Bonitaetspruefung bei Kauf"
+    condition: { field: "retail_context.credit_scoring", operator: "equals", value: true }
+    effect: { risk_add: 20, dsfa_recommended: true, art22_risk: true }
+    severity: WARN
+    rationale: "Kredit-Scoring ist Annex III Nr. 5 AI Act (Zugang zu Diensten)"
+
+  - id: R-RET-003
+    category: "K. Retail"
+    title: "Dark Patterns moeglich"
+    condition: { field: "retail_context.dark_patterns", operator: "equals", value: true }
+    effect: { risk_add: 15 }
+    severity: WARN
+    rationale: "Manipulative UI-Muster verstossen gegen DSA und Verbraucherrecht"
+
+  # IT / Cybersecurity / Telecom
+  - id: R-ITS-001
+    category: "K. IT-Sicherheit"
+    title: "KI-gestuetzte Mitarbeiterueberwachung"
+    condition: { field: "it_security_context.employee_surveillance", operator: "equals", value: true }
+    effect: { risk_add: 20, dsfa_recommended: true }
+    severity: WARN
+    rationale: "Mitarbeiterueberwachung ist §87 BetrVG + DSGVO relevant"
+
+  - id: R-ITS-002
+    category: "K. IT-Sicherheit"
+    title: "Umfangreiche Log-Speicherung"
+    condition: { field: "it_security_context.data_retention_logs", operator: "equals", value: true }
+    effect: { risk_add: 10, controls_add: [C_DATA_MINIMIZATION] }
+    severity: INFO
+    rationale: "Datenminimierung beachten auch bei Security-Logs"
+
+  # Logistics
+  - id: R-LOG-001
+    category: "K. Logistik"
+    title: "Fahrer-/Kurier-Tracking"
+    condition: { field: "logistics_context.driver_tracking", operator: "equals", value: true }
+    effect: { risk_add: 20 }
+    severity: WARN
+    rationale: "GPS-Tracking ist Verhaltenskontrolle (§87 BetrVG)"
+
+  - id: R-LOG-002
+    category: "K. Logistik"
+    title: "Leistungsbewertung Lagerarbeiter"
+    condition: { field: "logistics_context.workload_scoring", operator: "equals", value: true }
+    effect: { risk_add: 20, art22_risk: true }
+    severity: WARN
+    rationale: "Leistungs-Scoring ist Annex III Nr. 4 (Employment)"
+
+  # Construction / Real Estate
+  - id: R-CON-001
+    category: "K. Bau/Immobilien"
+    title: "KI-gestuetzte Mieterauswahl"
+    condition: { field: "construction_context.tenant_screening", operator: "equals", value: true }
+    effect: { risk_add: 20, dsfa_recommended: true }
+    severity: WARN
+    rationale: "Mieterauswahl betrifft Zugang zu Wohnraum (Grundrecht)"
+
+  - id: R-CON-002
+    category: "K. Bau/Immobilien"
+    title: "KI-Arbeitsschutzueberwachung"
+    condition: { field: "construction_context.worker_safety", operator: "equals", value: true }
+    effect: { risk_add: 15 }
+    severity: WARN
+    rationale: "Arbeitsschutzueberwachung kann Verhaltenskontrolle sein"
+
+  # Marketing / Media
+  - id: R-MKT-001
+    category: "K. Marketing/Medien"
+    title: "Deepfake-Inhalte ohne Kennzeichnung"
+    condition:
+      all_of:
+        - field: "marketing_context.deepfake_content"
+          operator: "equals"
+          value: true
+        - field: "marketing_context.ai_content_labeled"
+          operator: "equals"
+          value: false
+    effect: { risk_add: 20, feasibility: NO }
+    severity: BLOCK
+    rationale: "Art. 50 Abs. 4 AI Act: Deepfakes muessen gekennzeichnet werden"
+
+  - id: R-MKT-002
+    category: "K. Marketing/Medien"
+    title: "Minderjaehrige als Zielgruppe"
+    condition: { field: "marketing_context.minors_targeted", operator: "equals", value: true }
+    effect: { risk_add: 20, controls_add: [C_DSFA] }
+    severity: WARN
+    rationale: "Besonderer Schutz Minderjaehriger (DSA + DSGVO)"
+
+  - id: R-MKT-003
+    category: "K. Marketing/Medien"
+    title: "Verhaltensbasiertes Targeting"
+    condition: { field: "marketing_context.behavioral_targeting", operator: "equals", value: true }
+    effect: { risk_add: 15, dsfa_recommended: true }
+    severity: WARN
+    rationale: "Behavioral Targeting ist Profiling (Art. 22 DSGVO)"
+
+  # Manufacturing / CE
+  - id: R-MFG-001
+    category: "K. Fertigung"
+    title: "KI in Maschinensicherheit ohne Validierung"
+    condition:
+      all_of:
+        - field: "manufacturing_context.machine_safety"
+          operator: "equals"
+          value: true
+        - field: "manufacturing_context.safety_validated"
+          operator: "equals"
+          value: false
+    effect: { risk_add: 30, feasibility: NO }
+    severity: BLOCK
+    rationale: "Maschinenverordnung (EU) 2023/1230 erfordert Sicherheitsvalidierung"
+
+  - id: R-MFG-002
+    category: "K. Fertigung"
+    title: "CE-Kennzeichnung erforderlich"
+    condition: { field: "manufacturing_context.ce_marking_required", operator: "equals", value: true }
+    effect: { risk_add: 15, controls_add: [C_CE_CONFORMITY] }
+    severity: WARN
+    rationale: "CE-Kennzeichnung ist Pflicht fuer Maschinenprodukte mit KI"
+
+  # Agriculture
+  - id: R-AGR-001
+    category: "K. Landwirtschaft"
+    title: "KI steuert Pestizideinsatz"
+    condition: { field: "agriculture_context.pesticide_ai", operator: "equals", value: true }
+    effect: { risk_add: 15 }
+    severity: WARN
+    rationale: "Umwelt- und Gesundheitsrisiken bei KI-gesteuertem Pflanzenschutz"
+
+  - id: R-AGR-002
+    category: "K. Landwirtschaft"
+    title: "KI beeinflusst Tierhaltung"
+    condition: { field: "agriculture_context.animal_welfare", operator: "equals", value: true }
+    effect: { risk_add: 10 }
+    severity: INFO
+    rationale: "Tierschutzrelevanz bei automatisierter Haltungsentscheidung"
+
+  # Social Services
+  - id: R-SOC-001
+    category: "K. Soziales"
+    title: "KI trifft Leistungsentscheidungen fuer schutzbeduerftiger Gruppen"
+    condition:
+      all_of:
+        - field: "social_services_context.vulnerable_groups"
+          operator: "equals"
+          value: true
+        - field: "social_services_context.benefit_decision"
+          operator: "equals"
+          value: true
+    effect: { risk_add: 25, dsfa_recommended: true, controls_add: [C_FRIA, C_HUMAN_OVERSIGHT] }
+    severity: WARN
+    rationale: "Leistungsentscheidungen fuer Schutzbeduerftiger erfordern FRIA"
+
+  - id: R-SOC-002
+    category: "K. Soziales"
+    title: "KI in Fallmanagement"
+    condition: { field: "social_services_context.case_management", operator: "equals", value: true }
+    effect: { risk_add: 15 }
+    severity: WARN
+    rationale: "Fallmanagement betrifft Grundrechte der Betroffenen"
+
+  # Hospitality / Tourism
+  - id: R-HOS-001
+    category: "K. Tourismus"
+    title: "Dynamische Preisgestaltung"
+    condition: { field: "hospitality_context.dynamic_pricing", operator: "equals", value: true }
+    effect: { risk_add: 10, controls_add: [C_TRANSPARENCY] }
+    severity: INFO
+    rationale: "Personalisierte Preise erfordern Transparenz"
+
+  - id: R-HOS-002
+    category: "K. Tourismus"
+    title: "KI manipuliert Bewertungen"
+    condition: { field: "hospitality_context.review_manipulation", operator: "equals", value: true }
+    effect: { risk_add: 20, feasibility: NO }
+    severity: BLOCK
+    rationale: "Bewertungsmanipulation verstoesst gegen UWG und DSA"
+
+  # Insurance
+  - id: R-INS-001
+    category: "K. Versicherung"
+    title: "KI-gestuetzte Praemienberechnung"
+    condition: { field: "insurance_context.premium_calculation", operator: "equals", value: true }
+    effect: { risk_add: 20, dsfa_recommended: true }
+    severity: WARN
+    rationale: "Individuelle Praemien koennen diskriminierend wirken (AGG, Annex III Nr. 5)"
+
+  - id: R-INS-002
+    category: "K. Versicherung"
+    title: "Automatisierte Schadenbearbeitung"
+    condition: { field: "insurance_context.claims_automation", operator: "equals", value: true }
+    effect: { risk_add: 15, art22_risk: true }
+    severity: WARN
+    rationale: "Automatische Schadensablehnung kann Art. 22 DSGVO ausloesen"
+
+  # Investment
+  - id: R-INV-001
+    category: "K. Investment"
+    title: "Algorithmischer Handel"
+    condition: { field: "investment_context.algo_trading", operator: "equals", value: true }
+    effect: { risk_add: 15 }
+    severity: WARN
+    rationale: "MiFID II Anforderungen an algorithmischen Handel"
+
+  - id: R-INV-002
+    category: "K. Investment"
+    title: "KI-gestuetzte Anlageberatung (Robo Advisor)"
+    condition: { field: "investment_context.robo_advisor", operator: "equals", value: true }
+    effect: { risk_add: 20, controls_add: [C_HUMAN_OVERSIGHT, C_TRANSPARENCY] }
+    severity: WARN
+    rationale: "Anlageberatung ist reguliert (WpHG, MiFID II) — Haftungsrisiko"
+
+  # Defense
+  - id: R-DEF-001
+    category: "K. Verteidigung"
+    title: "Dual-Use KI-Technologie"
+    condition: { field: "defense_context.dual_use", operator: "equals", value: true }
+    effect: { risk_add: 25 }
+    severity: WARN
+    rationale: "Dual-Use Technologie unterliegt Exportkontrolle (EU VO 2021/821)"
+
+  - id: R-DEF-002
+    category: "K. Verteidigung"
+    title: "Verschlusssachen in KI verarbeitet"
+    condition: { field: "defense_context.classified_data", operator: "equals", value: true }
+    effect: { risk_add: 20, controls_add: [C_ENCRYPTION] }
+    severity: WARN
+    rationale: "VS-NfD und hoeher erfordert besondere Schutzmassnahmen"
+
+  # Supply Chain (LkSG)
+  - id: R-SCH-001
+    category: "K. Lieferkette"
+    title: "KI-Menschenrechtspruefung in Lieferkette"
+    condition: { field: "supply_chain_context.human_rights_check", operator: "equals", value: true }
+    effect: { risk_add: 10 }
+    severity: INFO
+    rationale: "LkSG-relevante KI-Analyse — Bias bei Laenderrisiko-Bewertung beachten"
+
+  - id: R-SCH-002
+    category: "K. Lieferkette"
+    title: "KI ueberwacht Lieferanten"
+    condition: { field: "supply_chain_context.supplier_monitoring", operator: "equals", value: true }
+    effect: { risk_add: 10 }
+    severity: INFO
+    rationale: "Lieferantenbewertung durch KI kann indirekt Personen betreffen"
+
+  # Facility Management
+  - id: R-FAC-001
+    category: "K. Facility"
+    title: "KI-Zutrittskontrolle"
+    condition: { field: "facility_context.access_control_ai", operator: "equals", value: true }
+    effect: { risk_add: 15, dsfa_recommended: true }
+    severity: WARN
+    rationale: "Biometrische oder verhaltensbasierte Zutrittskontrolle ist DSGVO-relevant"
+
+  - id: R-FAC-002
+    category: "K. Facility"
+    title: "Belegungsueberwachung"
+    condition: { field: "facility_context.occupancy_tracking", operator: "equals", value: true }
+    effect: { risk_add: 10 }
+    severity: INFO
+    rationale: "Belegungsdaten koennen Rueckschluesse auf Verhalten erlauben"
+
+  # Sports
+  - id: R-SPO-001
+    category: "K. Sport"
+    title: "Athleten-Performance-Tracking"
+    condition: { field: "sports_context.athlete_tracking", operator: "equals", value: true }
+    effect: { risk_add: 15 }
+    severity: WARN
+    rationale: "Leistungsdaten von Athleten sind besonders schuetzenswert"
+
+  - id: R-SPO-002
+    category: "K. Sport"
+    title: "Fan-/Zuschauer-Profilbildung"
+    condition: { field: "sports_context.fan_profiling", operator: "equals", value: true }
+    effect: { risk_add: 15, dsfa_recommended: true }
+    severity: WARN
+    rationale: "Massen-Profiling bei Sportevents erfordert DSFA"
+
   # ---------------------------------------------------------------------------
   # G. Aggregation & Ergebnis
   # ---------------------------------------------------------------------------
diff --git a/backend-compliance/migrations/083_ai_act_decision_tree.sql b/backend-compliance/migrations/083_ai_act_decision_tree.sql
new file mode 100644
index 0000000..2bee705
--- /dev/null
+++ b/backend-compliance/migrations/083_ai_act_decision_tree.sql
@@ -0,0 +1,20 @@
+-- Migration 083: AI Act Decision Tree Results
+-- Stores results from the two-axis AI Act classification (High-Risk + GPAI)
+
+CREATE TABLE IF NOT EXISTS ai_act_decision_tree_results (
+    id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+    tenant_id UUID NOT NULL,
+    project_id UUID,
+    system_name VARCHAR(500) NOT NULL,
+    system_description TEXT,
+    answers JSONB NOT NULL DEFAULT '{}',
+    high_risk_level VARCHAR(50) NOT NULL DEFAULT 'not_applicable',
+    gpai_result JSONB NOT NULL DEFAULT '{}',
+    combined_obligations JSONB DEFAULT '[]',
+    applicable_articles JSONB DEFAULT '[]',
+    created_at TIMESTAMPTZ DEFAULT NOW(),
+    updated_at TIMESTAMPTZ DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS idx_ai_act_dt_tenant ON ai_act_decision_tree_results(tenant_id);
+CREATE INDEX IF NOT EXISTS idx_ai_act_dt_project ON ai_act_decision_tree_results(project_id) WHERE project_id IS NOT NULL;