The Method, In Public
Method 2.1 · Rule Set 74308a · 7 AI reading steps · 9 observation points · 4 jurisdictions · 3 business uses · 12 lifecycle stages
Printed from the rule tables that actually run. It is not maintained by hand and cannot describe a rule the code does not have. The rule tables themselves are not published — see the last section for what is held back and why.
1. What This Is, And What It Is Not
This method reads what a company has published about how it handles data, and records what was found. It is a reading of documents. It is not an audit, not a rating, and not an opinion about whether a company is safe to buy from.
Three things follow from that, and they hold everywhere:
- Silence is recorded as silence. A question with no published answer is Not Published. It is never recorded as a No, and never as a failure.
- An absence is only an absence where the document was read. Where a document was behind a request, or could not be read by a machine, the state is Not Determined with the reason named — never Not Published.
- No vocabulary here says Compliant, Pass or Fail. Those are legal conclusions about a company. This is a record of what is on its pages.
Every finding carries the source address, the words that matched, and the sentence around them. A reader who disagrees with a finding is looking at the same evidence it was made from.
2. The Five Words We Use
Five words, and they never change meaning — not between rules, not between countries, and not between a free check and a paid assessment.
| Shown As | Means |
|---|---|
| ▲ Not Published | Documents were read, and none of them says it. |
| ◐ Partly | Something is said, and it stops short of the question asked. |
| ● Published | The document says it, and the words are quotable. |
| ◆ Consistent | Nothing published contradicts what is claimed, or the question does not arise for this company. |
| ○ Not Determined | The document could not be read, and the reason is named. Never a polite way of saying we did not look. |
3. What Is Read
A company's own published pages, fetched from its own domain, and nothing else. No questionnaire, no interview, nothing bought from a third party, and nothing asked of the company itself.
The document kinds looked for: the AI page · the cookie notice · the processing terms · the privacy notice · the security position · the sub-processor list · the terms.
A page that cannot be found, is behind a login or a request form, or is assembled in the browser where a machine never sees the text, is recorded as exactly that. How the pages are found, and the guards that decide whether what came back is the document at all, are part of the engine and are not published.
4. The Twelve Steps Data Goes Through
Called the Data Usage Lifecycle Stages in a result. They are the order data moves through a company, from the moment it arrives to the moment it is deleted. Each step is reported Published where a document read says it, Not Published where documents were read and none of them does, and Not Determined where no document could be read at all.
- Purpose — The reason the data is held at all. Everything after this stage is bounded by it — a vague reason makes every later stage unbounded.
- Collection — What is taken in, and where it comes from. A promise cannot be made about data that has never been described.
- Classification — Whether data is sorted by how sensitive it is. Without that split, everything tends to get the weakest handling applied to anything.
- State — Where the data sits at each moment — kept still, moving between systems, or in use. Encryption only means something once it says which of those three it covers.
- Processing — What is actually done with the data day to day. This is what a delivery lead needs before they can plan around it.
- Transformation — Whether data is changed, combined, or stripped of names — and whether that can be undone. Anonymised and pseudonymised are read as the same word by most readers and they are not the same thing, so silence here is read as the weaker one.
- Storage — Where it is kept, and in which country. Where is the question every one of the four jurisdictions actually asks.
- Access — Who inside the company, and inside its suppliers, can see it. This is the stage that decides whether a breach is one person's problem or everyone's.
- Sharing — Who it is handed to outside the company. This is the stage a sub-processor list answers, and the one that most often cannot be read.
- AI Processing — Whether data goes into an AI system, and which one. A reader comparing marketing against documents finds either a supplier or a claim with no instrument behind it.
- Retention — How long it is kept before it is deleted. Partial retention reads as no retention to a lawyer, because they have to assume the worst case they were not told about.
- Deletion — What happens on deletion — and whether copies, backups and trained models are covered. Those are exactly what a deletion request has to reach.
5. The Nine Questions Every Reader Asks First
Called the Observation Points in a result. These are the nine questions a reader asks first, whichever country they are reading from. Each one is answered in one of the five words above, with the evidence attached.
- Transfer Mechanism Named
- Destinations Named
- Onward Transfers (Sub-Processors)
- Training On Customer Data
- Automated Decision-Making
- Security Position Published
- Retention Stated
- A Named Legal Route
- Claims Against Evidence
6. The Four Sets Of Rules We Read Against
Called the Prime Jurisdictions in a result. The same read, answered from four positions. The facts do not change between them; the question being asked of those facts does.
- 🇪🇺 European Union — GDPR · EU AI Act · DORA · NIS2
- 🇺🇸 United States — State Privacy Acts · Sectoral · FTC
- 🇬🇧 United Kingdom — UK GDPR · DPA 2018 · ICO
- 🇦🇺 Australia — Privacy Act · APPs · CPS 230
Each is read at nine observation points, and the result shows which points those are and how each was answered. Which of those questions a given set turns on, what a page has to say to answer it, and in what order they are asked, are part of the rule set and are not published.
A country card never says a law applies to a company. It records what that company's pages establish for a reader in that country. Whether the law actually applies is a legal question about the company, and this assessment does not answer it.
7. The Seven Steps To Reading A Document
Called the AI Reading Steps in a result. Reading a document is seven steps in a fixed order: find it, open it, get the words out, and so on. The steps are not a second opinion about the document. They are the record of how far the read actually got with it. A step is never marked Failed. A read that stops at the third step never tried the fourth, and never tried is reported as never tried — because "we could not read it" and "it is not there" are different findings that reach most readers as the same sentence.
| Step | Name |
|---|---|
| R1 | Discovery |
| R2 | Access |
| R3 | Render |
| R4 | Understanding |
| R5 | Canonical |
| R6 | Evidence |
| R7 | Qualification |
The seven names are the chain in the order it runs. What each step tests, and the order the tests inside it run in, are part of the rule set and are not published.
| Cell | Meaning |
|---|---|
| Passed | This document cleared this step. |
| Passed, With Difficulty | It cleared this step, but not the way a machine would normally get there. |
| Stopped Here | This is where the chain ended for this document. Any step after it was never attempted, so it is untested, not failed. |
| Untested — Never Reached | The chain stopped at an earlier step, so this one was never attempted. It is not a failure and it is not reported as one. |
| Not In Scope | Not In Scope means this step is deliberately left out of a Quick Review — it was not failed, and it was not missed. Deciding whether a document is the master copy means comparing it against another source, and this check reads one website, once. Nothing is concluded from it either way. The full assessment is where it gets tested. |
8. The Three People Who Read The Result
Called the Business Uses in a result. This is not three checks. It is one check, read by three different people. The facts do not change between them. Each person asks a different question of the same evidence; none of them gets a different answer.
- Sales And Procurement — Can this business be evaluated without contacting them?
- Operations And Delivery — Who actually delivers this, and where does the work happen?
- Risk, Legal And Compliance — What can a legal reviewer establish before signing?
9. The Three Companies We Compare You With
Called the Peers in a result. Three companies we have already assessed that publish the most similar answers at the points being compared. They are picked by a written rule, not chosen by hand, so the same company always draws the same three.
No name, no count, and no population figure is shown — only what each of the three publishes at the point being compared. How many companies have been assessed, who they are, and how they answered in aggregate are the research, and the research is not published. Naming a peer is part of the paid review.
10. What Every Result Carries
A result is meant to be argued with, so it is stamped:
- The rule set id (
74308atoday) — a six-character fingerprint of the exact rules that ran. Two results carrying the same id were produced by identical rules. A different id means something in the method moved, and it is meant to be visible. - The reference and the date — which run this was, and when the pages were fetched. Evidence is dated, because a website changes.
- The evidence behind each finding — the source address, the matched words and the sentence around them.
Right of reply. Anything recorded here was read off a public page, and pages change. A correction with evidence is made before anything else, free, and the record says it was corrected. Write to ror@blacksnowintel.com.
11. How We Track Changes To The Method
Two ids, published separately, because they move for different reasons.
- The rule set id changes when a judgement we wrote changes — a phrase, a country, the order the tests run in, how much a point counts, or the wording published beside one. Rules change when the judgement changes, never quietly.
- The corpus id changes when more companies are assessed. Its contents — which companies, and how they answered — are not published. A single headline count of companies assessed is, and is the only figure taken from it.
A result that cites an id can always be placed against the version that produced it, which is the part that makes an old finding auditable rather than deniable.
12. What Is Not Published Here, And Why
Held back, deliberately:
- The phrases the engine looks for, and the documents each phrase is legitimate on.
- The country list and the wording that decides what a country name on a page means.
- The order the tests inside each rule are run in.
- What each of the seven reading steps tests, and what counts as clearing it.
- Which of the nine questions each country reads, in what order, and what a page has to say to answer each one.
- How much each point counts for each of the three readers, and how that is decided.
- The research behind the assessments: which companies are in it, how they answered, and any rate drawn from them. One headline count of companies assessed is published, and nothing beneath it — no names, no breakdown, no base rate beside a result.
These are the method. Published in full, they would let anyone re-run the judgement without the work that produced it — and the work is the product. What is published instead is everything a reader needs to check a finding about themselves: the evidence it rests on, the vocabulary it uses, the id of the rules that produced it, and a free route to correct it.
Any company assessed can have the full method, applied to its own record, in the paid review.