Nothing leaves the machine. No exceptions by default.

Skarn processes data exclusively on the local machine. No personal data is transferred to Skarn or any third party - there is no Skarn cloud service, no telemetry, and no vendor access. Because no personal data goes to an external processor, no Article 28 Data Processing Agreement is required. Local reports contain masked credentials only and stay on your own infrastructure.

Article 21 requires active cybersecurity risk management and documented evidence of its effectiveness; Skarn's SARIF and JSON output provides that audit trail. Article 20 places direct personal accountability on management-body members for approving and overseeing these measures.

Enforceable since 17 January 2025. Article 5 makes the management body's ownership of the ICT risk framework non-delegable; Article 8 requires identification of ICT vulnerabilities - AI session credential exposure is squarely in scope.

Skarn uses rule-based, pattern-matching detection. It is not an AI system under the Act's definition, makes no consequential decisions, and falls in no prohibited or high-risk category. It monitors AI tools used by humans; it is not itself in scope, and no obligations apply to it.

From 11 September 2026 (Art 69(3), Art 71(2)), a software manufacturer must report severe incidents and actively-exploited vulnerabilities on a 24-hour early-warning and 72-hour notification cadence (Article 14), exercise due diligence over third-party components (Article 13(5)), and compile technical documentation (Annex VII). Skarn supplies development-process evidence supporting these duties: redacted AI-session credential and behavioural findings for the confidentiality and secure-development requirements (Art 13(2); Annex I Part I), session-observed dependency and malicious-package context for third-party due diligence (Art 13(5)), and a hash-chained audit record (when audit logging is enabled) as possible supporting evidence within the technical documentation (Annex VII) - not a conformity assessment and not a claim that a product is compliant.