Law is written locally. Business happens everywhere.
Every jurisdiction writes its own rules, in its own language, in its own structure. The obligations behind them are frequently the same obligation. Nothing in the market connects them at that level.
Homolog does. We build living knowledge layers where each jurisdiction keeps its own graph in its own language, and the graphs are linked at the level of what a rule actually does.
Ask a good legal AI system what the German equivalent of a Swedish provision is, and it will find you German text on the same subject. That is not the same question. The subject is the topic; the equivalent is the provision that does the same work, often filed under a different heading, in a different act, with a different threshold and a different consequence.
Three things break at the border, and all three are structural rather than a matter of model quality:
Retrieval matches topic, not function. Similarity search puts the data-protection-officer rule next to the health-data rule because both are about health data in the workplace. They are not the same obligation. One tells you who must appoint someone; the other tells you what you may process. In our measurements this confusion accounts for the large majority of retrieval failures, and it is spread evenly across every source language; it is not a translation error.
Citations do not travel. “Chapter 2, Section 4 of the Swedish Data Protection Act” carries no semantic resemblance to the German provision that does the same job. No embedding model makes a section number look like foreign statutory text, so the question a lawyer actually asks, what is the equivalent of this provision over there?, falls close to guessing. We measured it: 17–25 % on the industry-standard approach.
Nothing knows what changed. A court ruling lands. Guidance is reissued. A national implementation is amended. Every assessment that depended on the old position is now stale, and no system tells you which ones, in which countries, or how badly. Teams pay for fifteen feeds that all report the same event and none of them says what it means for your position in Portugal.
The result is answers that read well and cannot be relied on outside the jurisdiction they were written for. The gap is not in the reasoning. It is in the absence of a layer that holds the relationship between rules.
/
Same rule. Nothing alike.
DK · Databeskyttelsesloven § 6, stk. 2–3
Finder databeskyttelsesforordningens artikel 6, stk. 1, litra a, anvendelse i forbindelse med udbud af informationssamfundstjenester direkte til børn, er behandling af personoplysninger om et barn lovlig, hvis barnet er mindst 13 år. Er barnet under 13 år, er behandling kun lovlig, hvis og i det omfang samtykke gives eller godkendes af indehaveren af forældremyndigheden over barnet.
Same function
FI · Tietosuojalaki (1050/2018) 5 §
Kun henkilötietoja käsitellään tietosuoja-asetuksen 6 artiklan 1 kohdan a alakohdassa tarkoitetun suostumuksen perusteella ja kyseessä on tietosuoja-asetuksen 4 artiklan 25 kohdassa tarkoitettujen tietoyhteiskunnan palvelujen tarjoaminen suoraan lapselle, lapsen henkilötietojen käsittely on lainmukaista, jos lapsi on vähintään 13-vuotias.
Nearly identical. Not the same rule.
SE · Undantag — journalistik samt akademiskt, konstnärligt och litterärt skapande
Sverige har en långtgående och konstitutionellt förankrad lösning. Undantaget är tvådelat. Först en absolut grundlagsspärr: förordningen och dataskyddslagen ska över huvud taget inte tillämpas i den utsträckning det skulle strida mot tryckfrihetsförordningen eller yttrandefrihetsgrundlagen. Därefter ett brett materiellt undantag i vanlig lag vid behandling för journalistiska ändamål eller för akademiskt, konstnärligt eller litterärt skapande.
Different function
SE · Undantag — arkivändamål, forskning och statistik
Sverige har byggt sin lösning kring en särskild logik. I stället för att i den generella dataskyddslagen skriva in breda undantag från de registrerades rättigheter har lagstiftaren gjort tre saker: infört en användningsbegränsning som förbjuder att uppgifter behandlade för arkiv-, statistik- eller forskningsändamål används för åtgärder mot den enskilde annat än vid synnerliga skäl; lämnat själva rättighetsundantagen till regeringen genom ett bemyndigande; och lagt de operativa reglerna i sektorslag.
How it works
A graph per jurisdiction, linked at the level of function
Homolog is biology’s word for same function, different form. A bat’s wing and a human hand share a skeleton and do entirely different work, and knowing that is what lets you reason from one to the other. Legal systems are built the same way. Article 8 of a regulation lands as a paragraph in a Swedish act, a section in a German one, and a decree in a French one. Different form. Same job. Different consequences.
Homolog is a technology, not a dataset. It builds and maintains the layer. Four things define it.
National forms differ. The links carry what actually separates them.
Each jurisdiction keeps its own graph, in its own language. No pivot language, no translation into a lingua franca that quietly discards the categories the source system actually uses. Swedish law stays Swedish. German law stays German. Nothing is flattened to make matching easier, because the things that get flattened are exactly the things a lawyer needs.
The graphs are linked through shared anchors. An EU regulation or directive, an OECD model rule, a standard: wherever legal systems already share a common origin, that origin becomes the anchor the national graphs hang from. This is why the layer works provision-to-provision rather than document-to-document: the anchor tells you which national rules are answering the same question, before you compare a single word.
The links carry the derived differences. A link is not a similarity score. It carries what actually separates the two provisions: thresholds, conditions, legal consequence, procedure, derived rather than described, each statement carrying a source chain back to primary law. Where two rules are genuinely identical, the link says so. Where they differ, it says how, in which direction, and on what authority.
Change propagates. When something moves, a judgment, new guidance or an amendment, the layer knows every assessment that touched the affected rule and flags them. Not “here is a news item about a ruling”, but: these are the countries where you are exposed, these are the ones to check, these are untouched, with a reason for each.
That is the whole shape of it. One rule, every market, every change.
What we measured
What we measured
Everything below is an end-to-end measurement of the running system, not a benchmark on a curated sample. Two legal domains, one engine.
Matching, blind
96–99 %
96–99 % reconstruction of rule correspondences across 24 languages. Nearly every test pair is cross-lingual. The system never sees the answer key.
The question lawyers actually ask
80–98 %
What is the equivalent of this provision in that country?: 80–98 % through Homolog, against 17–25 % for embedding search, the industry standard. The second number is close to chance.
Nothing invented
0 / 2 079
0 fabricated statements out of 2 079 independently reviewed under adversarial conditions, across two areas of law. Every sentence carries a source chain to primary material.
Change, propagated
Recall 1.0
Recall 1.0 against real events, including gaps human reviewers had missed. Deterministic, microseconds. One CJEU judgment, played back through the layer: all twelve national regimes flagged and graded: 3 high exposure, 4 to check, 4 unaffected, with reasoning per country.
CJEU · C-34/21 · 30 MAR 2023A judgment on national employment-data rules.Art. 88 — employment data
High exposure
DKDenmark
Section 12 of the Data Protection Act is a short permissive rule made under Art. 88 without the safeguards Art. 88(2) requires. That is the construction the judgment strikes down.
Section 12 of the Data Protection Act is Denmark's exercise of Art. 88: a short permissive rule covering employment processing that contains none of the Art. 88(2) safeguards on transparency, intra-group transfer or monitoring systems. That is the exact construction the judgment holds inapplicable, and subsections 1 and 2 would need to fall back on Art. 6(3) and Art. 9(2)(b) to survive; subsection 3 rests on consent under Art. 6(1)(a) and is less exposed.
Databeskyttelsesloven § 12
PTPortugal
The supervisory authority has already disapplied an employment provision of Lei 58/2019 for failing Art. 88(2), the same ground the judgment later confirmed.
Portugal is the one jurisdiction outside Germany where the supervisory authority had already disapplied an employment provision on the judgment's exact ground: article 28(3)(a) of Lei n.º 58/2019 was set aside for failing the Art. 88(2) safeguards test. The remaining restrictions of article 28 stand, with surveillance footage usable only in criminal proceedings and biometrics limited to attendance and access control, but the provision's history makes Portugal a confirmed high-exposure regime.
Lei n.º 58/2019, art. 28.º · CNPD, Deliberação/2019/494
SESweden
Swedish law makes collective agreements a free-standing basis for employment processing without enacting the Art. 88(2) safeguards anywhere in statute.
Sweden enacted no employment-data statute, but chapter 2, sections 1 and 2 of the Data Protection Act make collective agreements a free-standing basis for legal-obligation and public-interest processing, without the Art. 88(2) safeguards enacted anywhere. If that construction is treated as an exercise of Art. 88(1), the judgment's test applies to it, and the parallel collective-agreement track is now in question.
Dataskyddslagen (2018:218), 2 kap. 1–2 §§
Check
ESSpain
A detailed digital-rights regime whose content sits close to the Art. 88(2) safeguards. Flagged for review, with low risk of inapplicability.
Spain's Título X of the LOPDGDD frames employment data as a catalogue of digital rights: privacy in digital devices, an absolute ban on cameras in changing rooms, thresholds for sound recording, union involvement. Its content sits close to the safeguards Art. 88(2) lists. Flagged as a checkpoint, particularly for the provision modulating the information duty; the risk of inapplicability is low.
LOPDGDD, arts. 87–91
FIFinland
One of the EU's most developed employment-data acts, enacted before the Regulation and never rewritten against Art. 88(2). Flagged for review, with low risk.
Finland's Act on the Protection of Privacy in Working Life (759/2004) is one of the EU's most developed employment-data laws: a non-derogable necessity requirement, separate storage of health data, camera-surveillance limits and a formal procedure for opening employee e-mail. Its substance is what Art. 88(2) asks for, but the Act predates the Regulation and was never rewritten against Art. 88(2), so it needs a read against the new standard. Low risk.
Laki yksityisyyden suojasta työelämässä (759/2004)
ITItaly
Art. 88 exercised by reference to the Workers' Statute, whose guarantees are substantive but were never framed as Art. 88(2) safeguards. Needs a read against the new standard.
Italy exercised Art. 88 by reference to the Workers' Statute: article 4 on remote monitoring (union agreement or authority authorisation) and article 8 banning opinion surveys, criminally sanctioned through the data-protection code. The guarantees are substantive, but they were never framed as Art. 88(2) safeguards, so the regime needs verification against the judgment's reading.
Statuto dei lavoratori, artt. 4 e 8 · Codice privacy, art. 171
PLPoland
An extensive Labour Code regime with its own guarantees; whether they satisfy Art. 88(2) as framed by the judgment needs verification.
Poland's Labour Code carries its own guarantees: a closed catalogue of data an employer may demand, protection against discrimination where consent is refused or withdrawn, an initiative requirement for sensitive data, and written authorisation and confidentiality duties. Whether that set satisfies Art. 88(2) as the judgment frames it needs verification.
Kodeks pracy, art. 22¹–22¹ᵇ
Not affected
ATAustria
No general Art. 88 clause exists to be struck down. The Regulation applies directly, and the national rules are collective-labour-law consent requirements.
Austria has no general Art. 88 clause that could be struck down: the Regulation applies directly, and the national rules on workplace monitoring are collective-labour-law consent requirements under the Works Constitution Act rather than permissive processing norms. The judgment touches no Austrian provision. One question remains open: whether a works agreement invoked as a collective agreement under Art. 88(1) must itself satisfy Art. 88(2).
ArbVG, §§ 96–96a
FRFrance
Art. 88 was never exercised. Employment-data rules rest on the Labour Code and CNIL doctrine, which do not depend on the opening clause the judgment concerns.
France never exercised Art. 88. Employment-data protection rests on the Labour Code's proportionality rule and prior-information duty, works-council consultation and CNIL doctrine, none of which takes the opening clause as its legal basis. Nothing for the judgment to strike.
Code du travail, L. 1121-1 et L. 1222-4
IEIreland
No Art. 88 legislation; the relevant DPA 2018 sections implement other bases and are untouched by the judgment.
Ireland has no Art. 88 legislation: section 46 of the Data Protection Act 2018 implements Art. 9(2)(b), and section 4 protects the employee's access right with criminal sanction. Neither is a general employment-processing clause, so the judgment reaches no Irish norm.
Data Protection Act 2018, ss. 4 and 46
NLNetherlands
Art. 88 was never exercised; the two relevant UAVG provisions rest on Art. 9(2) and Art. 10 and carry their own safeguards.
The Netherlands never exercised Art. 88. The two relevant UAVG provisions, health data in employment and criminal-record data on own personnel, rest textually on Art. 9(2) and Art. 10 and carry their own exhaustive-purpose safeguards. Affirmatively unaffected.
UAVG, art. 30(1) en art. 33(3)
DE The member state the judgment names: its provision merely restating Art. 88(1), without the Art. 88(2) safeguards, was held inapplicable.
One engine, many domains. Pillar Two: 66 jurisdictions, 24 languages. GDPR’s opening clauses: 12 jurisdictions, 10 languages: built, validated and measured in under an hour, with the core pipeline unchanged. That hour is the number that matters most, and we return to it below.
The market has already written the specification. Thomson Reuters’ 2026 survey of tax professionals: 96 % require data protection, 94 % require answers grounded in authoritative content, 90 % require reasoning that is explainable and defensible. The four blocks above answer those three requirements point for point.
Partner and client data is never used to train models. The layer is retrieval and reference, with verifiable sources.
The foundry model
We operate the machine. You get the layer.
Pillar Two
66 jurisdictions24 languages
Blind reconstruction
96.4%
Measured across 66 jurisdictions in 24 languages.
GDPR opening clauses
12 jurisdictions10 languages
Blind reconstruction
99.35%
Measured across 12 jurisdictions in 10 languages.
Same engine
Different area of law. Different languages. Same result.
Homolog is not sold as a dataset and not licensed as a database. Partners point us at their content and their domains; we run the whole process, extraction, ontology, linking, validation, propagation, and the partner hosts and uses the finished layer under their own name. The process never leaves this house. The layer stays alive because the machine keeps it alive, which makes this a standing relationship rather than a delivery.
This started in tax. Pillar Two is a single OECD model rule implemented separately by sixty-six jurisdictions in twenty-four languages, each with its own thresholds, elections and timing. The hardest possible case, and a real one, with money attached. Building the layer for it forced every part of the machine into existence: the per-jurisdiction graphs, the anchors, the derived differences, the propagation. Then we pointed the same machine at a completely different area of law: data protection, a different legal family entirely, non-computational, ten languages, almost every test pair cross-lingual, and it produced higher numbers than the domain it was built for, with no change to the graph, the matching, the difference layer or the ontology.
That is the economics of the model. The first domain is expensive because the machine has to be built. Every domain after it costs a fraction of the first, and the fraction keeps shrinking, because anchors, ontology and propagation are shared infrastructure. The GDPR layer took under an hour. Each domain added makes the next one cheaper and the whole layer more valuable. Coverage compounds, and validated legal relationships across jurisdictions are not something a competitor reproduces by spending more on models.
Nothing in the machinery is legal-specific, either. It applies wherever a shared pattern is implemented locally with variations: law is simply where the stakes made it worth building first.
Delivery is phased by default. Start with one anchor family, one jurisdiction pair, one domain. Prove it against your own experts’ judgment, then widen. Scoped exclusivity is available. Pricing is set per engagement; there is no list.
Homolog is built end to end by Henrik Hallengren: one person, operating a machine designed so that one person can operate it. That is not a disclaimer, it is the point. The measurements exist because the process is automated end to end and instrumented at every step; there is no large internal team whose output has to be trusted on reputation.
Validation sits where it belongs, with the partner’s own experts, against a source chain they can check line by line. The same hand built pillartwo.hallengrens.com, the tax vertical running on this technology, live and in production.
Mon to Fri, mornings and late afternoons. Pick a day, then a slot — shown in your own timezone. No pitch: bring the problem, leave with a straight read on it.
