Sample findings: FAIL
Results describe the configured checks, not a certification of legal compliance. Review exceptions and manual attestations below.
Passed jurisdiction checks
5
Other findings to review
6
Manual attestation items
3
EU
| Control | Status | Source |
|---|---|---|
| CTRL-DOC-001 The project has a MODEL_CARD.md with a populated "Bias Testing" section (not missing, not a placeholder) before deployment. |
PASS | EU AI Act, Article 10 (data governance for high-risk systems) |
| CTRL-DOC-002 The project has a RISK_MANAGEMENT.md with a populated "Risk Management Process" section describing the continuous risk-identification/ mitigation process for the system. |
FAIL | EU AI Act, Article 9 (risk management system) |
FAIL: [bundled-project]/fixtures/sample-project-docs-fail/RISK_MANAGEMENT.md does not exist | ||
| CTRL-DOC-003 The project has a LOGGING.md with a populated "Log Retention" section describing what events the system logs over its lifetime and for how long. This checks that logging is documented, not that it is correctly implemented in code — a known, stated limitation, same pattern as the security scanner's own documented blind spots. |
ACCEPTED-RISK | EU AI Act, Article 12 (record-keeping) |
| Exception: Logging doc pending legal review, tracked in JIRA-1234 (owner: jane.doe@company.com, expires: 2027-01-01) | ||
| CTRL-DOC-004 The project has an INSTRUCTIONS_FOR_USE.md with a populated "Instructions for Use" section giving deployers clear information about the system's capabilities, limitations, and intended use. |
FAIL | EU AI Act, Article 13 (transparency and provision of information to deployers) |
FAIL: [bundled-project]/fixtures/sample-project-docs-fail/INSTRUCTIONS_FOR_USE.md does not exist | ||
| CTRL-DOC-005 The project has a HUMAN_OVERSIGHT.md with a populated "Oversight Mechanism" section describing how a human can monitor, intervene in, or override the system's output. Checks documentation of the mechanism exists, not that it is correctly implemented — see CTRL-DOC-003's note on the same limitation. |
FAIL (exception expired) | EU AI Act, Article 14 (human oversight) |
FAIL: [bundled-project]/fixtures/sample-project-docs-fail/HUMAN_OVERSIGHT.md does not exist | ||
| CTRL-SEC-001 No hardcoded secrets, API keys, or credentials in source code; secrets come from a vault or environment at runtime. |
PASS | EU AI Act, Article 15 (accuracy, robustness and cybersecurity) |
UAE-Dubai
| Control | Status | Source |
|---|---|---|
| CTRL-DOC-001 The project has a MODEL_CARD.md with a populated "Bias Testing" section (not missing, not a placeholder) before deployment. |
PASS | Dubai AI Act, conformity assessment for high-risk AI |
| CTRL-DOC-002 The project has a RISK_MANAGEMENT.md with a populated "Risk Management Process" section describing the continuous risk-identification/ mitigation process for the system. |
FAIL | Dubai AI Act, conformity assessment for high-risk AI |
FAIL: [bundled-project]/fixtures/sample-project-docs-fail/RISK_MANAGEMENT.md does not exist | ||
| CTRL-DOC-004 The project has an INSTRUCTIONS_FOR_USE.md with a populated "Instructions for Use" section giving deployers clear information about the system's capabilities, limitations, and intended use. |
FAIL | Dubai AI Act, transparency requirements |
FAIL: [bundled-project]/fixtures/sample-project-docs-fail/INSTRUCTIONS_FOR_USE.md does not exist | ||
| CTRL-SEC-001 No hardcoded secrets, API keys, or credentials in source code; secrets come from a vault or environment at runtime. |
PASS | Dubai AI Act, cybersecurity requirements |
(prerequisite)
| Control | Status | Source |
|---|---|---|
| CTRL-META-001 The project declares a valid applicability manifest (deployment regions, sector, risk tier per jurisdiction) before any other control runs. This is a prerequisite control, not a jurisdiction-specific one — its citations list is deliberately empty. |
PASS | prerequisite |
Manual attestation required
| Control | Jurisdiction | Owner |
|---|---|---|
| CTRL-PROHIBIT-001 No feature performs real-time emotion recognition for workplace monitoring. Deliberately left as a manual control — "does this feature do X" is a product-review question, not something a static scan can answer reliably from code alone (a false "no match" is easy to get past a regex/pattern check). Marking this manual is honest; faking an automated check here would not be. |
UAE-Dubai | legal-team |
| CTRL-PROHIBIT-002 No feature implements a social-scoring system (evaluating/classifying people over time based on social behaviour and using that score to their detriment in unrelated contexts). Manual for the same reason as CTRL-PROHIBIT-001 — "is this feature a social-scoring system" is a product-review question, not a reliable static-scan pattern. |
UAE-Dubai | legal-team |
| CTRL-PROHIBIT-002 No feature implements a social-scoring system (evaluating/classifying people over time based on social behaviour and using that score to their detriment in unrelated contexts). Manual for the same reason as CTRL-PROHIBIT-001 — "is this feature a social-scoring system" is a product-review question, not a reliable static-scan pattern. |
EU | legal-team |
1 accepted exception(s) — see table above for reason/owner/expiry.