{
  "record": {
    "accepted_risk_count": 1,
    "demo": true,
    "jurisdictions": {
      "(prerequisite)": [
        {
          "citation_source": "prerequisite",
          "control_id": "CTRL-META-001",
          "exception": null,
          "output": "",
          "statement": "The project declares a valid applicability manifest (deployment regions, sector, risk tier per jurisdiction) before any other control runs. This is a prerequisite control, not a jurisdiction-specific one \u2014 its citations list is deliberately empty.",
          "status": "PASS"
        }
      ],
      "EU": [
        {
          "citation_source": "EU AI Act, Article 10 (data governance for high-risk systems)",
          "control_id": "CTRL-DOC-001",
          "exception": null,
          "output": "",
          "statement": "The project has a MODEL_CARD.md with a populated \"Bias Testing\" section (not missing, not a placeholder) before deployment.",
          "status": "PASS"
        },
        {
          "citation_source": "EU AI Act, Article 9 (risk management system)",
          "control_id": "CTRL-DOC-002",
          "exception": null,
          "output": "FAIL: [bundled-project]/fixtures/sample-project-docs-fail/RISK_MANAGEMENT.md does not exist",
          "statement": "The project has a RISK_MANAGEMENT.md with a populated \"Risk Management Process\" section describing the continuous risk-identification/ mitigation process for the system.",
          "status": "FAIL"
        },
        {
          "citation_source": "EU AI Act, Article 12 (record-keeping)",
          "control_id": "CTRL-DOC-003",
          "exception": {
            "control_id": "CTRL-DOC-003",
            "expires": "2027-01-01",
            "jurisdiction": "EU",
            "owner": "jane.doe@company.com",
            "reason": "Logging doc pending legal review, tracked in JIRA-1234"
          },
          "output": "FAIL: [bundled-project]/fixtures/sample-project-docs-fail/LOGGING.md does not exist",
          "statement": "The project has a LOGGING.md with a populated \"Log Retention\" section describing what events the system logs over its lifetime and for how long. This checks that logging is documented, not that it is correctly implemented in code \u2014 a known, stated limitation, same pattern as the security scanner's own documented blind spots.",
          "status": "ACCEPTED-RISK"
        },
        {
          "citation_source": "EU AI Act, Article 13 (transparency and provision of information to deployers)",
          "control_id": "CTRL-DOC-004",
          "exception": null,
          "output": "FAIL: [bundled-project]/fixtures/sample-project-docs-fail/INSTRUCTIONS_FOR_USE.md does not exist",
          "statement": "The project has an INSTRUCTIONS_FOR_USE.md with a populated \"Instructions for Use\" section giving deployers clear information about the system's capabilities, limitations, and intended use.",
          "status": "FAIL"
        },
        {
          "citation_source": "EU AI Act, Article 14 (human oversight)",
          "control_id": "CTRL-DOC-005",
          "exception": {
            "control_id": "CTRL-DOC-005",
            "expires": "2026-01-01",
            "jurisdiction": "EU",
            "owner": "jane.doe@company.com",
            "reason": "Human oversight doc was accepted last quarter, review lapsed"
          },
          "output": "FAIL: [bundled-project]/fixtures/sample-project-docs-fail/HUMAN_OVERSIGHT.md does not exist",
          "statement": "The project has a HUMAN_OVERSIGHT.md with a populated \"Oversight Mechanism\" section describing how a human can monitor, intervene in, or override the system's output. Checks documentation of the mechanism exists, not that it is correctly implemented \u2014 see CTRL-DOC-003's note on the same limitation.",
          "status": "FAIL (exception expired)"
        },
        {
          "citation_source": "EU AI Act, Article 15 (accuracy, robustness and cybersecurity)",
          "control_id": "CTRL-SEC-001",
          "exception": null,
          "output": "",
          "statement": "No hardcoded secrets, API keys, or credentials in source code; secrets come from a vault or environment at runtime.",
          "status": "PASS"
        }
      ],
      "UAE-Dubai": [
        {
          "citation_source": "Dubai AI Act, conformity assessment for high-risk AI",
          "control_id": "CTRL-DOC-001",
          "exception": null,
          "output": "",
          "statement": "The project has a MODEL_CARD.md with a populated \"Bias Testing\" section (not missing, not a placeholder) before deployment.",
          "status": "PASS"
        },
        {
          "citation_source": "Dubai AI Act, conformity assessment for high-risk AI",
          "control_id": "CTRL-DOC-002",
          "exception": null,
          "output": "FAIL: [bundled-project]/fixtures/sample-project-docs-fail/RISK_MANAGEMENT.md does not exist",
          "statement": "The project has a RISK_MANAGEMENT.md with a populated \"Risk Management Process\" section describing the continuous risk-identification/ mitigation process for the system.",
          "status": "FAIL"
        },
        {
          "citation_source": "Dubai AI Act, transparency requirements",
          "control_id": "CTRL-DOC-004",
          "exception": null,
          "output": "FAIL: [bundled-project]/fixtures/sample-project-docs-fail/INSTRUCTIONS_FOR_USE.md does not exist",
          "statement": "The project has an INSTRUCTIONS_FOR_USE.md with a populated \"Instructions for Use\" section giving deployers clear information about the system's capabilities, limitations, and intended use.",
          "status": "FAIL"
        },
        {
          "citation_source": "Dubai AI Act, cybersecurity requirements",
          "control_id": "CTRL-SEC-001",
          "exception": null,
          "output": "",
          "statement": "No hardcoded secrets, API keys, or credentials in source code; secrets come from a vault or environment at runtime.",
          "status": "PASS"
        }
      ]
    },
    "manifest": "[bundled-project]/fixtures/sample-project-docs-fail/policy-manifest.yaml",
    "manual_items": [
      {
        "control_id": "CTRL-PROHIBIT-001",
        "jurisdiction": "UAE-Dubai",
        "owner": "legal-team",
        "statement": "No feature performs real-time emotion recognition for workplace monitoring. Deliberately left as a manual control \u2014 \"does this feature do X\" is a product-review question, not something a static scan can answer reliably from code alone (a false \"no match\" is easy to get past a regex/pattern check). Marking this manual is honest; faking an automated check here would not be."
      },
      {
        "control_id": "CTRL-PROHIBIT-002",
        "jurisdiction": "UAE-Dubai",
        "owner": "legal-team",
        "statement": "No feature implements a social-scoring system (evaluating/classifying people over time based on social behaviour and using that score to their detriment in unrelated contexts). Manual for the same reason as CTRL-PROHIBIT-001 \u2014 \"is this feature a social-scoring system\" is a product-review question, not a reliable static-scan pattern."
      },
      {
        "control_id": "CTRL-PROHIBIT-002",
        "jurisdiction": "EU",
        "owner": "legal-team",
        "statement": "No feature implements a social-scoring system (evaluating/classifying people over time based on social behaviour and using that score to their detriment in unrelated contexts). Manual for the same reason as CTRL-PROHIBIT-001 \u2014 \"is this feature a social-scoring system\" is a product-review question, not a reliable static-scan pattern."
      }
    ],
    "overall_result": "FAIL",
    "registry_version": "0.1.0",
    "scanner_commit": "aa286a5339da0678f60a7196cdcd4ee0bdfff211",
    "source_description": "DEMO: bundled failure fixture (not your submitted project)",
    "target": "bundled sample-project-docs-fail fixture",
    "timestamp": "2026-10-21T02:46:57.411550+00:00"
  },
  "record_sha256": "58bec064c4fbd04df22747baf62d8758f5316aa34b403a8eeccba164085f622c"
}