OmniCompliance-100K: A Multi-Domain, Rule-Grounded, Real-World Safety Compliance Dataset
Organizations: Hong Kong University of Science and Technology · ModeIO
Abstract
Ensuring the safety and compliance of large language models (LLMs) is of paramount importance. However, existing LLM safety datasets often rely on ad-hoc taxonomies for data generation and suffer from a significant shortage of rule-grounded, real-world cases that are essential for robustly protecting LLMs. In this work, we address this critical gap by constructing a comprehensive safety dataset from a compliance perspective. Using a powerful web-searching agent, we collect a rule-grounded, real-world case dataset OmniCompliance-100K, sourced from multi-domain authoritative references. The dataset spans 74 regulations and policies across a wide range of domains, including security and privacy regulations, content safety and user data privacy policies from leading AI companies and social media platforms, financial security requirements, medical device risk management standards, educational integrity guidelines, and protections of fundamental human rights. In total, our dataset contains 12,985 distinct rules and 106,009 associated real-world compliance cases. Our analysis confirms a strong alignment between the rules and their corresponding cases. We further conduct extensive benchmarking experiments to evaluate the safety and compliance capabilities of advanced LLMs across different model scales. Our experiments reveal several interesting findings that have great potential to offer valuable insights for future LLM safety research.
Figures & tables
| Data Source | # of Rules | # of Cases | Real Cases? |
| PrivaCI-Bench | 2,112 | 6,417 | Hybrid |
| Air-Bench | — | 5,694 | ✗ |
| GuardSet-X | 3,060 | 129,241 | ✗ |
| Ours | 12,985 | 106,009 | ✓ |
| Category | Subcategory | # Rules | # Cases |
| AI Safety Law | EU AI Act | 1,245 | 11,205 |
| SB 53 | 166 | 1,501 | |
| Data Privacy Law | GDPR | 667 | 6,065 |
| Data Act | 609 | 5,490 | |
| CCPA | 509 | 4,572 | |
| HIPAA | 1,436 | 12,913 |
| Rule A | Searched Case | Rule B |
| Categories | DeepSeek | GPT | Gemini | Human |
| AI Act | 95.33 | 97.50 | 98.17 | 92.78 |
| SB 53 | 87.00 | 90.00 | 94.33 | 92.22 |
| GDPR | 91.17 | 94.50 | 94.67 | 93.33 |
| Data Act | 95.00 | 97.33 | 97.67 | 92.78 |
| CCPA | 83.00 | 86.67 | 93.33 | 85.56 |
| HIPAA | 84.67 | 86.00 | 91.33 | 91.11 |
Appendix figures & tables5 assets
Supplementary material from the paper’s appendix.
Appendix
| You are an expert in compliance evaluation. Based on the following case background and rule, determine if the case represents PERMITTED or PROHIBITED behavior. |
| Case Background: |
| {case_background} |
| You are an expert in compliance and regulatory evaluation. Your task is to assess the relevance of a rule to a specific case. |
| Evaluate the following rule against the case background and determine the relevance score. |
| SCORING RUBRIC (respond with ONLY the score as a single number): |
| - 1 = No connection whatsoever: Completely unrelated to the case. |
| - 2 = Moderate relevance: Has some distant relationship to the case topic. |
| You are a compliance analyst. Find 8-10 real-world examples (such as company incidents, regulatory enforcement actions, fines, investigations, or case studies) related to this compliance rule or policy and return them as a JSON array. |
| COMPLIANCE RULE OR POLICY: |
| {rule} These examples can come from regulatory violations, compliance successes, corporate scandals, enforcement cases, or industry best/worst practices—not limited to formal court cases. |
| For each example, provide a JSON object with these fields: |
| - example_name: Name of the company, incident, or enforcement action (e.g., "Westpac AML Violations" or "Tesla Environmental Compliance") |
| - example_background: Background and context of the incident or practice. Please remain all the details. The description should be comprehensive and long. Should not appear words for easily distinguishing VIOLATE or COMPLIES, e.g. attack, malicious. Words should be neutral. |
| - process_and_outcome: Investigations, proceedings, decisions, or results. |
| Category | Subcategory | Link |
| AI Safety Law | EU AI Act | https:artificialintelligenceact.eu |
| SB 53 | https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260SB53 | |
| Data Privacy Law | GDPR | https://gdpr-info.eu/ |
| Data Act | https://data-act-law.eu/ | |
| CCPA | https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=3.&part=4.&lawCode=CIV&title=1.81.5 | |
| HIPAA | https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C |
Language Model Safety Evaluation
Language model safety evaluation measures harmful behavior, refusal, robustness, and over-refusal across realistic prompts, users, and deployment settings.
See all 542 papers