feat(content): regulatory catalogues for the declared target markets — Canada, Morocco, Belgium, France

[alex-dembele]

Problem

CLAUDE.md lists France, Belgium, the Maghreb, Canada, the USA and Sub-Saharan Africa as the market. On 2026-09-25, backend/pkg/compliance/ ships catalogues for the EU (GDPR, NIS2, DORA), the USA (NIST, SOC 2, HIPAA, SOX), ISO, and three Central/West African texts (COBAC, BCEAO, ANTIC). There is nothing for Canada, the Maghreb, or anything specific to Belgium or France. A compliance officer at a Québec firm, a Moroccan bank or a Belgian NIS2 entity finds no framework that is theirs.

Candidate catalogues — to verify against the official text before any row is written

These names come from the audit and are not yet verified. D-002 (cm-loi-2024-017) is the precedent: no article is modelled from memory.

Market	Candidates
Canada	Québec Law 25 (privacy modernisation, 2021, c. 25) · PIPEDA · OSFI Guideline B-13 (technology and cyber risk, federally regulated financial institutions)
Morocco	Law 09-08 (personal data, CNDP) · Law 05-20 (cybersecurity) · DNSSI (DGSSI)
Tunisia / Algeria	Organic Law 2004-63 · Law 18-07
Belgium	CyberFundamentals (CyFun) framework of the CCB, the reference scheme of the Belgian NIS2 law
France	ANSSI Guide d'hygiène informatique (42 measures)

Why this needs refinement

1. Owner of regulatory content: chore(content): responsable du contenu reglementaire et cadence de veille #493 (a named owner and a review cadence) is a precondition. Without them, a catalogue becomes stale content that the product presents as current.
2. Licence of each text or framework (for example, CyFun's terms of reuse), checked per source.
3. Priority order set by the pilots of chore(gtm): recruter 3 organisations pilotes #494. The first pilot's jurisdiction goes first.

Acceptance criteria (draft, to be completed in refinement)

1. Each catalogue added is generated from, or verified line by line against, the official text. The source URL and the date consulted are stored per row.
2. Its count is locked in TestExpectedControlCounts.
3. A qualified reviewer named in chore(content): responsable du contenu reglementaire et cadence de veille #493 signs it off, with the review recorded in docs/.
4. It appears in the import picker only once criteria 1-3 are met, and it is Withdrawn otherwise (as cm-loi-2024-017 is).

Definition of Done

At least the catalogue of the first pilot's jurisdiction is available, verified and locked by a test.

Blocked on: #493 · #494