{"territory":"eu","dispatchable_model_tiers":"all","capabilities":{"diagnostic_output":{"allowed":true},"risk_scoring":{"allowed":true},"treatment_recommendation":{"allowed":true},"patient_triage":{"allowed":true},"vocal_tone":{"allowed":false,"kind":"regulatory","why":"Acoustic emotion inference. The EU AI Act treats it as biometric categorisation; the US non-device CDS carve-out at §520(o)(1)(E)(i) is unavailable to software analysing a signal from a signal acquisition system. Two regimes, one answer. Already hard-disabled in code at server/utils/serClient.js (SER_DISABLED_PENDING_AI_ACT_REVIEW).","reinstate":"Not by agreement. See compliance/AI_ACT_SER_REVIEW.md."},"telephony":{"allowed":false,"kind":"no_baa","why":"AI phone interviews and SMS interviews route the patient's voice and message content through Twilio. No agreement with Twilio is on file: no HIPAA BAA for the US, and no identified Article 28 processing agreement for the EU, where the same content is Article 9 personal data leaving for a US processor.","reinstate":"Twilio support ticket open since 2026-09-17, asking which regions support HIPAA-eligible workloads, whether recording retention can be zero, and what the account must be configured for. On their answer: execute a BAA covering Programmable Voice and Programmable Messaging specifically, confirm the EU processing position, record both in TTA-REG-BAA-001, then set eu/us here — each on its own evidence, not together."},"phi_in_email":{"allowed":true},"phi_in_push":{"allowed":true},"mailbox_ingestion":{"allowed":true}}}