Section IV-B of the paper, executable · computed live by three engines as you read this

Compliance-washing and the language boundary

The obvious real-world attack on a tier classifier is to describe a consequential system in minimising language. Twenty genuinely prohibited or high-risk systems, each written as a provider might phrase it to dodge classification. These are not a held-out test set: the paper reports them as the measured limit of lexical matching, and Cycle 2's hardening was evaluated against them across both cycles. A system is caught if it is tiered prohibited/high or routed to the human gate; it slips only if it is silently under-tiered.

…
slip silently past the naive keyword baseline (never abstains, never gates)
…
slip past Cycle 1 (rules + gate + protective default)
…
slip past Cycle 2 (synonym normalisation + persons-net) — the evaluated engine
Euphemised descriptions. The persons-net recovers only those that still mention a decision about people — the lexical dependence, shown plainly.
DescriptionTrue tierBaselineCycle 1Cycle 2

Off English, exact agreement collapses

The rule set is English-keyword-based, while a real EU inventory is described in the Union's 24 official languages. Twelve systems, each rendered faithfully in English, German, French and Arabic, through the evaluated engine. The expected, honest finding: on non-English text the engine falls toward the keyword baseline. The remedy the paper names is per-language rule sets or a machine-translation front end — future work, not a feature.