{ "schema_version": 1, "framework": "EU_AI_ACT", "report_id": "eu-ai-act-demo", "generated_at": 1777808239944, "bundle_artifacts": { "compare_report_href": "compare-report.json", "primary_report_html_href": "report.html", "manifest_href": "artifacts/manifest.json", "annex_iv_href": "compliance/eu-ai-act-annex-iv.json", "article_10_data_governance_href": "compliance/article-10-data-governance.json", "article_13_instructions_href": "compliance/article-13-instructions.json", "article_16_provider_obligations_href": "compliance/article-16-provider-obligations.json", "article_43_conformity_assessment_href": "compliance/article-43-conformity-assessment.json", "article_47_declaration_of_conformity_href": "compliance/article-47-declaration-of-conformity.json", "article_9_risk_register_href": "compliance/article-9-risk-register.json", "article_72_monitoring_plan_href": "compliance/article-72-monitoring-plan.json", "article_17_qms_lite_href": "compliance/article-17-qms-lite.json", "annex_v_declaration_content_href": "compliance/annex-v-declaration-content.json", "human_oversight_summary_href": "compliance/human-oversight-summary.json", "post_market_monitoring_href": "compliance/post-market-monitoring.json", "article_50_transparency_marking_href": "compliance/article-50-transparency-marking.json", "release_review_href": "compliance/release-review.json", "coverage_href": "compliance/eu-ai-act-coverage.json", "report_html_href": "compliance/eu-ai-act-report.html", "reviewer_html_href": "compliance/eu-ai-act-reviewer.html", "reviewer_markdown_href": "compliance/eu-ai-act-reviewer.md", "evidence_index_href": "compliance/evidence-index.json", "article_73_serious_incident_pack_href": "compliance/article-73-serious-incident-pack.json", "package_completion_href": "compliance/package-completion.json", "section_completion_href": "compliance/section-completion.json", "legal_record_register_href": "compliance/legal-record-register.json", "legal_artifact_manifest_href": "compliance/legal-artifact-manifest.json", "sign_off_record_href": "compliance/sign-off-record.json" }, "clauses": [ { "clause": "Art_9", "title": "Risk management system", "status": "covered", "selectors": [ { "selector": "compare-report.json.summary.risk_summary", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.items[].gate_recommendation", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.items[].security", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.summary.execution_quality.admissibility_kpi", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "artifacts/manifest.json", "role": "supporting", "presence": "present", "source_rel_path": "artifacts/manifest.json" } ], "manifest_keys": [ "c-approval/baseline/case_response", "c-approval/new/case_response", "c-approval/baseline/final_output", "c-approval/new/final_output", "c-block/baseline/case_response", "c-block/new/case_response", "c-block/baseline/final_output", "c-block/new/final_output" ], "residual_gaps": [ "Operator-owned risk governance still sits outside the evaluator.", "Annex III classification and legal interpretation still require counsel." ], "notes": [ "This clause is scored as runtime evidence coverage, not full legal conformity." ] }, { "clause": "Art_10", "title": "Data governance and data quality", "status": "covered", "selectors": [ { "selector": "eu-package-input.json.article_10.mode", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "eu-package-input.json.article_10.provider_non_training_statement_ref", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "eu-package-input.json.article_10.testing_data_provenance_ref", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "eu-package-input.json.article_10.evaluation_scope_record_ref", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "eu-package-input.json.article_10.data_preparation_record_ref", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "eu-package-input.json.article_10.bias_review_record_ref", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.summary.data_coverage", "role": "supporting", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.quality_flags", "role": "supporting", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "eu-package-input.json.sections[]", "role": "supporting", "presence": "present", "source_rel_path": "compare-report.json" } ], "manifest_keys": [ "c-approval/baseline/case_response", "c-approval/new/case_response", "c-block/baseline/case_response", "c-block/new/case_response" ], "residual_gaps": [ "Dataset provenance, representativeness review, bias review, and preparation records remain provider-authored legal inputs." ], "notes": [ "Article 10(6) path: the package declares that the provider does not train or fine-tune the model, so Article 10(2) to 10(5) are evidenced through testing datasets and evaluation inputs." ] }, { "clause": "Art_11", "title": "Technical documentation", "status": "covered", "selectors": [ { "selector": "compare-report.json.summary", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.environment", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "artifacts/manifest.json", "role": "required", "presence": "present", "source_rel_path": "artifacts/manifest.json" }, { "selector": "compare-report.json.items[]", "role": "supporting", "presence": "present", "source_rel_path": "compare-report.json" } ], "manifest_keys": [ "c-approval/baseline/case_response", "c-approval/new/case_response", "c-approval/baseline/tool_telemetry", "c-approval/new/tool_telemetry", "c-approval/baseline/final_output", "c-approval/new/final_output", "c-block/baseline/case_response", "c-block/new/case_response", "c-block/baseline/tool_telemetry", "c-block/new/tool_result_call-1", "c-block/new/tool_telemetry", "c-block/baseline/final_output", "c-block/new/final_output", "viewer/c-approval/replay_diff", "viewer/c-block/replay_diff", "bundle/retention_archive_controls", "compliance/eu_ai_act/coverage", "compliance/eu_ai_act/annex_iv", "compliance/eu_ai_act/article_10_data_governance", "compliance/eu_ai_act/report_html", "compliance/eu_ai_act/reviewer_html", "compliance/eu_ai_act/reviewer_markdown", "compliance/eu_ai_act/evidence_index", "compliance/eu_ai_act/article_13_instructions", "compliance/eu_ai_act/article_50_transparency_marking", "compliance/eu_ai_act/article_16_provider_obligations", "compliance/eu_ai_act/article_43_conformity_assessment", "compliance/eu_ai_act/article_47_declaration_of_conformity", "compliance/eu_ai_act/article_9_risk_register", "compliance/eu_ai_act/article_72_monitoring_plan", "compliance/eu_ai_act/article_17_qms_lite", "compliance/eu_ai_act/annex_v_declaration_content", "compliance/eu_ai_act/article_73_serious_incident_pack", "compliance/eu_ai_act/human_oversight_summary", "compliance/eu_ai_act/release_review", "compliance/eu_ai_act/post_market_monitoring" ], "residual_gaps": [ "Annex IV technical documentation is referenced in the package record, but document completeness, currency, and final operator approval still need to be maintained outside the evaluator for Art_11." ], "notes": [ "Use this output as an annex to a broader technical documentation package.", "Package record references Annex IV technical documentation: compliance/eu-ai-act-annex-iv.json." ] }, { "clause": "Annex_IV", "title": "Technical documentation dossier structure", "status": "covered", "selectors": [ { "selector": "compare-report.json.summary", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.items[]", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "artifacts/manifest.json", "role": "required", "presence": "present", "source_rel_path": "artifacts/manifest.json" } ], "manifest_keys": [ "c-approval/baseline/case_response", "c-approval/new/case_response", "c-approval/baseline/tool_telemetry", "c-approval/new/tool_telemetry", "c-approval/baseline/final_output", "c-approval/new/final_output", "c-block/baseline/case_response", "c-block/new/case_response", "c-block/baseline/tool_telemetry", "c-block/new/tool_result_call-1", "c-block/new/tool_telemetry", "c-block/baseline/final_output", "c-block/new/final_output", "viewer/c-approval/replay_diff", "viewer/c-block/replay_diff", "bundle/retention_archive_controls", "compliance/eu_ai_act/coverage", "compliance/eu_ai_act/annex_iv", "compliance/eu_ai_act/article_10_data_governance", "compliance/eu_ai_act/report_html", "compliance/eu_ai_act/reviewer_html", "compliance/eu_ai_act/reviewer_markdown", "compliance/eu_ai_act/evidence_index", "compliance/eu_ai_act/article_13_instructions", "compliance/eu_ai_act/article_50_transparency_marking", "compliance/eu_ai_act/article_16_provider_obligations", "compliance/eu_ai_act/article_43_conformity_assessment", "compliance/eu_ai_act/article_47_declaration_of_conformity", "compliance/eu_ai_act/article_9_risk_register", "compliance/eu_ai_act/article_72_monitoring_plan", "compliance/eu_ai_act/article_17_qms_lite", "compliance/eu_ai_act/annex_v_declaration_content", "compliance/eu_ai_act/article_73_serious_incident_pack", "compliance/eu_ai_act/human_oversight_summary", "compliance/eu_ai_act/release_review", "compliance/eu_ai_act/post_market_monitoring" ], "residual_gaps": [ "Annex IV technical documentation is referenced in the package record, but document completeness, currency, and final operator approval still need to be maintained outside the evaluator for Annex_IV." ], "notes": [ "Package record references Annex IV technical documentation: compliance/eu-ai-act-annex-iv.json." ] }, { "clause": "Art_12", "title": "Record-keeping and logging", "status": "covered", "selectors": [ { "selector": "compare-report.json.items[].trace_integrity", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.items[].artifacts", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "artifacts/manifest.json", "role": "required", "presence": "present", "source_rel_path": "artifacts/manifest.json" } ], "manifest_keys": [ "c-approval/baseline/case_response", "c-approval/new/case_response", "c-block/baseline/case_response", "c-block/new/case_response" ], "residual_gaps": [ "Provider logging-retention periods, production log controls, and system-specific logging scope remain provider-owned." ], "notes": [ "This clause is scored as a logging and record-keeping evidence scaffold, not as a complete provider logging program." ] }, { "clause": "Art_13", "title": "Transparency and instructions for use", "status": "covered", "selectors": [ { "selector": "compare-report.json.summary.execution_quality", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.summary.cases_requiring_approval", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.quality_flags", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.environment", "role": "supporting", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.items[].gate_recommendation", "role": "supporting", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "report.html", "role": "supporting", "presence": "present", "source_rel_path": "report.html" } ], "manifest_keys": [ "c-approval/baseline/case_response", "c-approval/new/case_response", "c-approval/baseline/final_output", "c-approval/new/final_output", "c-block/baseline/case_response", "c-block/new/case_response", "c-block/baseline/final_output", "c-block/new/final_output" ], "residual_gaps": [ "Operator-authored intended-use, deployer-facing instructions, and operating constraints remain required.", "Human oversight procedures for deployers still require operator-authored narrative." ], "notes": [ "This clause is scored as a technical instructions scaffold, not a finished instructions-for-use document." ] }, { "clause": "Art_17", "title": "Quality management system", "status": "covered", "selectors": [ { "selector": "compare-report.json.summary.execution_quality", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.summary.cases_requiring_approval", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.summary.cases_block_recommended", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.quality_flags", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.summary_by_suite", "role": "supporting", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "report.html", "role": "supporting", "presence": "present", "source_rel_path": "report.html" } ], "manifest_keys": [ "c-approval/baseline/case_response", "c-approval/new/case_response", "c-approval/baseline/tool_telemetry", "c-approval/new/tool_telemetry", "c-approval/baseline/final_output", "c-approval/new/final_output", "c-block/baseline/case_response", "c-block/new/case_response", "c-block/baseline/tool_telemetry", "c-block/new/tool_result_call-1", "c-block/new/tool_telemetry", "c-block/baseline/final_output", "c-block/new/final_output", "viewer/c-approval/replay_diff", "viewer/c-block/replay_diff", "bundle/retention_archive_controls", "compliance/eu_ai_act/coverage", "compliance/eu_ai_act/annex_iv", "compliance/eu_ai_act/article_10_data_governance", "compliance/eu_ai_act/report_html", "compliance/eu_ai_act/reviewer_html", "compliance/eu_ai_act/reviewer_markdown", "compliance/eu_ai_act/evidence_index", "compliance/eu_ai_act/article_13_instructions", "compliance/eu_ai_act/article_50_transparency_marking", "compliance/eu_ai_act/article_16_provider_obligations", "compliance/eu_ai_act/article_43_conformity_assessment", "compliance/eu_ai_act/article_47_declaration_of_conformity", "compliance/eu_ai_act/article_9_risk_register", "compliance/eu_ai_act/article_72_monitoring_plan", "compliance/eu_ai_act/article_17_qms_lite", "compliance/eu_ai_act/annex_v_declaration_content", "compliance/eu_ai_act/article_73_serious_incident_pack", "compliance/eu_ai_act/human_oversight_summary", "compliance/eu_ai_act/release_review", "compliance/eu_ai_act/post_market_monitoring" ], "residual_gaps": [ "Article 17 QMS record is referenced in the package record, but document completeness, currency, and final operator approval still need to be maintained outside the evaluator for Art_17." ], "notes": [ "This clause is scored as a technical QMS scaffold, not a complete quality management system.", "Package record references Article 17 QMS record: compliance/article-17-qms-lite.json." ] }, { "clause": "Art_50", "title": "Article 50 transparency obligations", "status": "partial", "selectors": [ { "selector": "compare-report.json.summary.synthetic_content_marking", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "artifacts/manifest.json", "role": "supporting", "presence": "present", "source_rel_path": "artifacts/manifest.json" } ], "manifest_keys": [ "c-approval/baseline/case_response", "c-approval/new/case_response", "c-approval/baseline/tool_telemetry", "c-approval/new/tool_telemetry", "c-approval/baseline/final_output", "c-approval/new/final_output", "c-block/baseline/case_response", "c-block/new/case_response", "c-block/baseline/tool_telemetry", "c-block/new/tool_result_call-1", "c-block/new/tool_telemetry", "c-block/baseline/final_output", "c-block/new/final_output", "viewer/c-approval/replay_diff", "viewer/c-block/replay_diff", "bundle/retention_archive_controls", "compliance/eu_ai_act/coverage", "compliance/eu_ai_act/annex_iv", "compliance/eu_ai_act/article_10_data_governance", "compliance/eu_ai_act/report_html", "compliance/eu_ai_act/reviewer_html", "compliance/eu_ai_act/reviewer_markdown", "compliance/eu_ai_act/evidence_index", "compliance/eu_ai_act/article_13_instructions", "compliance/eu_ai_act/article_50_transparency_marking", "compliance/eu_ai_act/article_16_provider_obligations", "compliance/eu_ai_act/article_43_conformity_assessment", "compliance/eu_ai_act/article_47_declaration_of_conformity", "compliance/eu_ai_act/article_9_risk_register", "compliance/eu_ai_act/article_72_monitoring_plan", "compliance/eu_ai_act/article_17_qms_lite", "compliance/eu_ai_act/annex_v_declaration_content", "compliance/eu_ai_act/article_73_serious_incident_pack", "compliance/eu_ai_act/human_oversight_summary", "compliance/eu_ai_act/release_review", "compliance/eu_ai_act/post_market_monitoring" ], "residual_gaps": [ "Machine-readable marker robustness and downstream preservation remain provider-owned.", "Article 50 legal applicability, deployer disclosure wording, and production-channel preservation tests remain operator/provider-authored." ], "notes": [ "This clause is scored as Article 50 transparency evidence, with the strongest technical verification focused on machine-readable synthetic-content marking, not as proof that every Article 50 obligation is fully satisfied." ] }, { "clause": "Art_14", "title": "Human oversight", "status": "covered", "selectors": [ { "selector": "compare-report.json.summary.cases_requiring_approval", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.items[].gate_recommendation", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.items[].policy_evaluation", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" } ], "manifest_keys": [ "c-approval/baseline/case_response", "c-approval/new/case_response", "c-approval/baseline/final_output", "c-approval/new/final_output", "c-block/baseline/case_response", "c-block/new/case_response", "c-block/baseline/final_output", "c-block/new/final_output" ], "residual_gaps": [ "Deployer-facing oversight procedures, staffing, escalation rules, and operating playbooks remain operator-authored." ], "notes": [ "This clause is scored as a technical oversight scaffold, not as a finished human-oversight operating model." ] }, { "clause": "Art_15", "title": "Accuracy, robustness, and cybersecurity", "status": "covered", "selectors": [ { "selector": "compare-report.json.summary.execution_quality", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.summary.security", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.items[].risk_level", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.items[].security", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "artifacts/manifest.json", "role": "supporting", "presence": "present", "source_rel_path": "artifacts/manifest.json" } ], "manifest_keys": [ "c-approval/baseline/case_response", "c-approval/new/case_response", "c-approval/baseline/final_output", "c-approval/new/final_output", "c-block/baseline/case_response", "c-block/new/case_response", "c-block/baseline/final_output", "c-block/new/final_output" ], "residual_gaps": [ "Sector-specific validation thresholds, production robustness targets, cybersecurity controls, and acceptance criteria remain provider-owned." ], "notes": [ "This clause is scored as an evidence scaffold for robustness and cybersecurity, not as a completed assurance program." ] }, { "clause": "Art_72", "title": "Post-market monitoring", "status": "covered", "selectors": [ { "selector": "compare-report.json.summary.execution_quality", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.summary_by_suite", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "report.html", "role": "supporting", "presence": "present", "source_rel_path": "report.html" } ], "manifest_keys": [ "c-approval/baseline/case_response", "c-approval/new/case_response", "c-approval/baseline/tool_telemetry", "c-approval/new/tool_telemetry", "c-approval/baseline/final_output", "c-approval/new/final_output", "c-block/baseline/case_response", "c-block/new/case_response", "c-block/baseline/tool_telemetry", "c-block/new/tool_result_call-1", "c-block/new/tool_telemetry", "c-block/baseline/final_output", "c-block/new/final_output", "viewer/c-approval/replay_diff", "viewer/c-block/replay_diff", "bundle/retention_archive_controls", "compliance/eu_ai_act/coverage", "compliance/eu_ai_act/annex_iv", "compliance/eu_ai_act/article_10_data_governance", "compliance/eu_ai_act/report_html", "compliance/eu_ai_act/reviewer_html", "compliance/eu_ai_act/reviewer_markdown", "compliance/eu_ai_act/evidence_index", "compliance/eu_ai_act/article_13_instructions", "compliance/eu_ai_act/article_50_transparency_marking", "compliance/eu_ai_act/article_16_provider_obligations", "compliance/eu_ai_act/article_43_conformity_assessment", "compliance/eu_ai_act/article_47_declaration_of_conformity", "compliance/eu_ai_act/article_9_risk_register", "compliance/eu_ai_act/article_72_monitoring_plan", "compliance/eu_ai_act/article_17_qms_lite", "compliance/eu_ai_act/annex_v_declaration_content", "compliance/eu_ai_act/article_73_serious_incident_pack", "compliance/eu_ai_act/human_oversight_summary", "compliance/eu_ai_act/release_review", "compliance/eu_ai_act/post_market_monitoring" ], "residual_gaps": [ "Recurring monitoring cadence, escalation workflow, and regulator-facing reporting remain operator responsibilities." ] }, { "clause": "Art_73", "title": "Serious incident reporting", "status": "covered", "selectors": [ { "selector": "compare-report.json.summary.execution_quality", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "artifacts/manifest.json", "role": "required", "presence": "present", "source_rel_path": "artifacts/manifest.json" }, { "selector": "compare-report.json.summary_by_suite", "role": "supporting", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "report.html", "role": "supporting", "presence": "present", "source_rel_path": "report.html" } ], "manifest_keys": [ "c-approval/baseline/case_response", "c-approval/new/case_response", "c-approval/baseline/tool_telemetry", "c-approval/new/tool_telemetry", "c-approval/baseline/final_output", "c-approval/new/final_output", "c-block/baseline/case_response", "c-block/new/case_response", "c-block/baseline/tool_telemetry", "c-block/new/tool_result_call-1", "c-block/new/tool_telemetry", "c-block/baseline/final_output", "c-block/new/final_output", "viewer/c-approval/replay_diff", "viewer/c-block/replay_diff", "bundle/retention_archive_controls", "compliance/eu_ai_act/coverage", "compliance/eu_ai_act/annex_iv", "compliance/eu_ai_act/article_10_data_governance", "compliance/eu_ai_act/report_html", "compliance/eu_ai_act/reviewer_html", "compliance/eu_ai_act/reviewer_markdown", "compliance/eu_ai_act/evidence_index", "compliance/eu_ai_act/article_13_instructions", "compliance/eu_ai_act/article_50_transparency_marking", "compliance/eu_ai_act/article_16_provider_obligations", "compliance/eu_ai_act/article_43_conformity_assessment", "compliance/eu_ai_act/article_47_declaration_of_conformity", "compliance/eu_ai_act/article_9_risk_register", "compliance/eu_ai_act/article_72_monitoring_plan", "compliance/eu_ai_act/article_17_qms_lite", "compliance/eu_ai_act/annex_v_declaration_content", "compliance/eu_ai_act/article_73_serious_incident_pack", "compliance/eu_ai_act/human_oversight_summary", "compliance/eu_ai_act/release_review", "compliance/eu_ai_act/post_market_monitoring" ], "residual_gaps": [ "Provider-owned incident classification, authority notification timing, and production escalation records remain required." ], "notes": [ "This clause is scored as a serious-incident reporting scaffold, not a completed Article 73 authority filing." ] }, { "clause": "Art_16", "title": "Provider obligations", "status": "covered", "selectors": [ { "selector": "compare-report.json.environment", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.summary.execution_quality", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.quality_flags", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "report.html", "role": "supporting", "presence": "present", "source_rel_path": "report.html" } ], "manifest_keys": [ "c-approval/baseline/case_response", "c-approval/new/case_response", "c-approval/baseline/tool_telemetry", "c-approval/new/tool_telemetry", "c-approval/baseline/final_output", "c-approval/new/final_output", "c-block/baseline/case_response", "c-block/new/case_response", "c-block/baseline/tool_telemetry", "c-block/new/tool_result_call-1", "c-block/new/tool_telemetry", "c-block/baseline/final_output", "c-block/new/final_output", "viewer/c-approval/replay_diff", "viewer/c-block/replay_diff", "bundle/retention_archive_controls", "compliance/eu_ai_act/coverage", "compliance/eu_ai_act/annex_iv", "compliance/eu_ai_act/article_10_data_governance", "compliance/eu_ai_act/report_html", "compliance/eu_ai_act/reviewer_html", "compliance/eu_ai_act/reviewer_markdown", "compliance/eu_ai_act/evidence_index", "compliance/eu_ai_act/article_13_instructions", "compliance/eu_ai_act/article_50_transparency_marking", "compliance/eu_ai_act/article_16_provider_obligations", "compliance/eu_ai_act/article_43_conformity_assessment", "compliance/eu_ai_act/article_47_declaration_of_conformity", "compliance/eu_ai_act/article_9_risk_register", "compliance/eu_ai_act/article_72_monitoring_plan", "compliance/eu_ai_act/article_17_qms_lite", "compliance/eu_ai_act/annex_v_declaration_content", "compliance/eu_ai_act/article_73_serious_incident_pack", "compliance/eu_ai_act/human_oversight_summary", "compliance/eu_ai_act/release_review", "compliance/eu_ai_act/post_market_monitoring" ], "residual_gaps": [ "Provider-owned records for Section 2 compliance, declaration, marking, registration, and authority-facing obligations remain required." ], "notes": [ "This clause is scored as a provider-obligations scaffold, not a finished provider obligations record." ] }, { "clause": "Art_18", "title": "Documentation keeping", "status": "covered", "selectors": [ { "selector": "compare-report.json.environment", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.meta", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "artifacts/manifest.json", "role": "required", "presence": "present", "source_rel_path": "artifacts/manifest.json" }, { "selector": "compare-report.json.quality_flags", "role": "supporting", "presence": "present", "source_rel_path": "compare-report.json" } ], "manifest_keys": [ "c-approval/baseline/case_response", "c-approval/new/case_response", "c-approval/baseline/tool_telemetry", "c-approval/new/tool_telemetry", "c-approval/baseline/final_output", "c-approval/new/final_output", "c-block/baseline/case_response", "c-block/new/case_response", "c-block/baseline/tool_telemetry", "c-block/new/tool_result_call-1", "c-block/new/tool_telemetry", "c-block/baseline/final_output", "c-block/new/final_output", "viewer/c-approval/replay_diff", "viewer/c-block/replay_diff", "bundle/retention_archive_controls", "compliance/eu_ai_act/coverage", "compliance/eu_ai_act/annex_iv", "compliance/eu_ai_act/article_10_data_governance", "compliance/eu_ai_act/report_html", "compliance/eu_ai_act/reviewer_html", "compliance/eu_ai_act/reviewer_markdown", "compliance/eu_ai_act/evidence_index", "compliance/eu_ai_act/article_13_instructions", "compliance/eu_ai_act/article_50_transparency_marking", "compliance/eu_ai_act/article_16_provider_obligations", "compliance/eu_ai_act/article_43_conformity_assessment", "compliance/eu_ai_act/article_47_declaration_of_conformity", "compliance/eu_ai_act/article_9_risk_register", "compliance/eu_ai_act/article_72_monitoring_plan", "compliance/eu_ai_act/article_17_qms_lite", "compliance/eu_ai_act/annex_v_declaration_content", "compliance/eu_ai_act/article_73_serious_incident_pack", "compliance/eu_ai_act/human_oversight_summary", "compliance/eu_ai_act/release_review", "compliance/eu_ai_act/post_market_monitoring" ], "residual_gaps": [ "Article 18 documentation-keeping record is referenced in the package record, but document completeness, currency, and final operator approval still need to be maintained outside the evaluator for Art_18." ], "notes": [ "This clause is scored as a documentation-keeping scaffold, not a completed retention and authority-availability record.", "Package record references Article 18 documentation-keeping record: compliance/evidence-index.json." ] }, { "clause": "Art_19", "title": "Automatically generated logs", "status": "covered", "selectors": [ { "selector": "compare-report.json.items[].trace_integrity", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.items[].artifacts", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "artifacts/manifest.json", "role": "required", "presence": "present", "source_rel_path": "artifacts/manifest.json" } ], "manifest_keys": [ "c-approval/baseline/case_response", "c-approval/new/case_response", "c-approval/baseline/tool_telemetry", "c-approval/new/tool_telemetry", "c-approval/baseline/final_output", "c-approval/new/final_output", "c-block/baseline/case_response", "c-block/new/case_response", "c-block/baseline/tool_telemetry", "c-block/new/tool_result_call-1", "c-block/new/tool_telemetry", "c-block/baseline/final_output", "c-block/new/final_output", "viewer/c-approval/replay_diff", "viewer/c-block/replay_diff", "bundle/retention_archive_controls", "compliance/eu_ai_act/coverage", "compliance/eu_ai_act/annex_iv", "compliance/eu_ai_act/article_10_data_governance", "compliance/eu_ai_act/report_html", "compliance/eu_ai_act/reviewer_html", "compliance/eu_ai_act/reviewer_markdown", "compliance/eu_ai_act/evidence_index", "compliance/eu_ai_act/article_13_instructions", "compliance/eu_ai_act/article_50_transparency_marking", "compliance/eu_ai_act/article_16_provider_obligations", "compliance/eu_ai_act/article_43_conformity_assessment", "compliance/eu_ai_act/article_47_declaration_of_conformity", "compliance/eu_ai_act/article_9_risk_register", "compliance/eu_ai_act/article_72_monitoring_plan", "compliance/eu_ai_act/article_17_qms_lite", "compliance/eu_ai_act/annex_v_declaration_content", "compliance/eu_ai_act/article_73_serious_incident_pack", "compliance/eu_ai_act/human_oversight_summary", "compliance/eu_ai_act/release_review", "compliance/eu_ai_act/post_market_monitoring" ], "residual_gaps": [ "Article 19 automatic-log retention record is referenced in the package record, but document completeness, currency, and final operator approval still need to be maintained outside the evaluator for Art_19." ], "notes": [ "This clause is scored as a logging scaffold, not a full provider log-retention record.", "Package record references Article 19 automatic-log retention record: archive/retention-controls.json." ] }, { "clause": "Art_20", "title": "Corrective actions and duty of information", "status": "covered", "selectors": [ { "selector": "compare-report.json.summary.execution_quality", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.summary.cases_block_recommended", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.items[].gate_recommendation", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "report.html", "role": "supporting", "presence": "present", "source_rel_path": "report.html" } ], "manifest_keys": [ "c-approval/baseline/case_response", "c-approval/new/case_response", "c-approval/baseline/tool_telemetry", "c-approval/new/tool_telemetry", "c-approval/baseline/final_output", "c-approval/new/final_output", "c-block/baseline/case_response", "c-block/new/case_response", "c-block/baseline/tool_telemetry", "c-block/new/tool_result_call-1", "c-block/new/tool_telemetry", "c-block/baseline/final_output", "c-block/new/final_output", "viewer/c-approval/replay_diff", "viewer/c-block/replay_diff", "bundle/retention_archive_controls", "compliance/eu_ai_act/coverage", "compliance/eu_ai_act/annex_iv", "compliance/eu_ai_act/article_10_data_governance", "compliance/eu_ai_act/report_html", "compliance/eu_ai_act/reviewer_html", "compliance/eu_ai_act/reviewer_markdown", "compliance/eu_ai_act/evidence_index", "compliance/eu_ai_act/article_13_instructions", "compliance/eu_ai_act/article_50_transparency_marking", "compliance/eu_ai_act/article_16_provider_obligations", "compliance/eu_ai_act/article_43_conformity_assessment", "compliance/eu_ai_act/article_47_declaration_of_conformity", "compliance/eu_ai_act/article_9_risk_register", "compliance/eu_ai_act/article_72_monitoring_plan", "compliance/eu_ai_act/article_17_qms_lite", "compliance/eu_ai_act/annex_v_declaration_content", "compliance/eu_ai_act/article_73_serious_incident_pack", "compliance/eu_ai_act/human_oversight_summary", "compliance/eu_ai_act/release_review", "compliance/eu_ai_act/post_market_monitoring" ], "residual_gaps": [ "Article 20 corrective-action and duty-of-information record is referenced in the package record, but document completeness, currency, and final operator approval still need to be maintained outside the evaluator for Art_20." ], "notes": [ "This clause is scored as a corrective-action scaffold, not a finished Article 20 response record.", "Package record references Article 20 corrective-action and duty-of-information record: compliance/release-review.json." ] }, { "clause": "Art_21", "title": "Cooperation with competent authorities", "status": "covered", "selectors": [ { "selector": "compare-report.json.environment", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "artifacts/manifest.json", "role": "required", "presence": "present", "source_rel_path": "artifacts/manifest.json" }, { "selector": "compare-report.json.quality_flags", "role": "supporting", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "report.html", "role": "supporting", "presence": "present", "source_rel_path": "report.html" } ], "manifest_keys": [ "c-approval/baseline/case_response", "c-approval/new/case_response", "c-approval/baseline/tool_telemetry", "c-approval/new/tool_telemetry", "c-approval/baseline/final_output", "c-approval/new/final_output", "c-block/baseline/case_response", "c-block/new/case_response", "c-block/baseline/tool_telemetry", "c-block/new/tool_result_call-1", "c-block/new/tool_telemetry", "c-block/baseline/final_output", "c-block/new/final_output", "viewer/c-approval/replay_diff", "viewer/c-block/replay_diff", "bundle/retention_archive_controls", "compliance/eu_ai_act/coverage", "compliance/eu_ai_act/annex_iv", "compliance/eu_ai_act/article_10_data_governance", "compliance/eu_ai_act/report_html", "compliance/eu_ai_act/reviewer_html", "compliance/eu_ai_act/reviewer_markdown", "compliance/eu_ai_act/evidence_index", "compliance/eu_ai_act/article_13_instructions", "compliance/eu_ai_act/article_50_transparency_marking", "compliance/eu_ai_act/article_16_provider_obligations", "compliance/eu_ai_act/article_43_conformity_assessment", "compliance/eu_ai_act/article_47_declaration_of_conformity", "compliance/eu_ai_act/article_9_risk_register", "compliance/eu_ai_act/article_72_monitoring_plan", "compliance/eu_ai_act/article_17_qms_lite", "compliance/eu_ai_act/annex_v_declaration_content", "compliance/eu_ai_act/article_73_serious_incident_pack", "compliance/eu_ai_act/human_oversight_summary", "compliance/eu_ai_act/release_review", "compliance/eu_ai_act/post_market_monitoring" ], "residual_gaps": [ "Article 21 authority-cooperation record is referenced in the package record, but document completeness, currency, and final operator approval still need to be maintained outside the evaluator for Art_21." ], "notes": [ "This clause is scored as an authority-cooperation scaffold, not a finished Article 21 cooperation record.", "Package record references Article 21 authority-cooperation record: compliance/eu-ai-act-reviewer.md." ] }, { "clause": "Art_22", "title": "Authorised representatives", "status": "covered", "selectors": [ { "selector": "compare-report.json.environment", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.meta", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "report.html", "role": "supporting", "presence": "present", "source_rel_path": "report.html" } ], "manifest_keys": [ "c-approval/baseline/case_response", "c-approval/new/case_response", "c-approval/baseline/tool_telemetry", "c-approval/new/tool_telemetry", "c-approval/baseline/final_output", "c-approval/new/final_output", "c-block/baseline/case_response", "c-block/new/case_response", "c-block/baseline/tool_telemetry", "c-block/new/tool_result_call-1", "c-block/new/tool_telemetry", "c-block/baseline/final_output", "c-block/new/final_output", "viewer/c-approval/replay_diff", "viewer/c-block/replay_diff", "bundle/retention_archive_controls", "compliance/eu_ai_act/coverage", "compliance/eu_ai_act/annex_iv", "compliance/eu_ai_act/article_10_data_governance", "compliance/eu_ai_act/report_html", "compliance/eu_ai_act/reviewer_html", "compliance/eu_ai_act/reviewer_markdown", "compliance/eu_ai_act/evidence_index", "compliance/eu_ai_act/article_13_instructions", "compliance/eu_ai_act/article_50_transparency_marking", "compliance/eu_ai_act/article_16_provider_obligations", "compliance/eu_ai_act/article_43_conformity_assessment", "compliance/eu_ai_act/article_47_declaration_of_conformity", "compliance/eu_ai_act/article_9_risk_register", "compliance/eu_ai_act/article_72_monitoring_plan", "compliance/eu_ai_act/article_17_qms_lite", "compliance/eu_ai_act/annex_v_declaration_content", "compliance/eu_ai_act/article_73_serious_incident_pack", "compliance/eu_ai_act/human_oversight_summary", "compliance/eu_ai_act/release_review", "compliance/eu_ai_act/post_market_monitoring" ], "residual_gaps": [ "For providers established outside the Union, the written mandate and named authorised representative record remain required." ], "notes": [ "This clause is scored as an authorised-representative scaffold, not a completed Article 22 mandate record." ] }, { "clause": "Art_26", "title": "Obligations of deployers of high-risk AI systems", "status": "covered", "selectors": [ { "selector": "compare-report.json.summary.execution_quality", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.summary.cases_requiring_approval", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.items[].gate_recommendation", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "report.html", "role": "supporting", "presence": "present", "source_rel_path": "report.html" } ], "manifest_keys": [ "c-approval/baseline/case_response", "c-approval/new/case_response", "c-approval/baseline/tool_telemetry", "c-approval/new/tool_telemetry", "c-approval/baseline/final_output", "c-approval/new/final_output", "c-block/baseline/case_response", "c-block/new/case_response", "c-block/baseline/tool_telemetry", "c-block/new/tool_result_call-1", "c-block/new/tool_telemetry", "c-block/baseline/final_output", "c-block/new/final_output", "viewer/c-approval/replay_diff", "viewer/c-block/replay_diff", "bundle/retention_archive_controls", "compliance/eu_ai_act/coverage", "compliance/eu_ai_act/annex_iv", "compliance/eu_ai_act/article_10_data_governance", "compliance/eu_ai_act/report_html", "compliance/eu_ai_act/reviewer_html", "compliance/eu_ai_act/reviewer_markdown", "compliance/eu_ai_act/evidence_index", "compliance/eu_ai_act/article_13_instructions", "compliance/eu_ai_act/article_50_transparency_marking", "compliance/eu_ai_act/article_16_provider_obligations", "compliance/eu_ai_act/article_43_conformity_assessment", "compliance/eu_ai_act/article_47_declaration_of_conformity", "compliance/eu_ai_act/article_9_risk_register", "compliance/eu_ai_act/article_72_monitoring_plan", "compliance/eu_ai_act/article_17_qms_lite", "compliance/eu_ai_act/annex_v_declaration_content", "compliance/eu_ai_act/article_73_serious_incident_pack", "compliance/eu_ai_act/human_oversight_summary", "compliance/eu_ai_act/release_review", "compliance/eu_ai_act/post_market_monitoring" ], "residual_gaps": [ "The deployer-owned operating record, instructions-of-use alignment, oversight assignment, log handling, and authority or provider notifications remain required where Article 26 applies." ], "notes": [ "This clause is scored as a deployer-obligations scaffold, not a completed Article 26 operating record." ] }, { "clause": "Art_27", "title": "Fundamental rights impact assessment for deployers", "status": "covered", "selectors": [ { "selector": "compare-report.json.summary.execution_quality", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.summary.cases_requiring_approval", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "report.html", "role": "supporting", "presence": "present", "source_rel_path": "report.html" } ], "manifest_keys": [ "c-approval/baseline/case_response", "c-approval/new/case_response", "c-approval/baseline/tool_telemetry", "c-approval/new/tool_telemetry", "c-approval/baseline/final_output", "c-approval/new/final_output", "c-block/baseline/case_response", "c-block/new/case_response", "c-block/baseline/tool_telemetry", "c-block/new/tool_result_call-1", "c-block/new/tool_telemetry", "c-block/baseline/final_output", "c-block/new/final_output", "viewer/c-approval/replay_diff", "viewer/c-block/replay_diff", "bundle/retention_archive_controls", "compliance/eu_ai_act/coverage", "compliance/eu_ai_act/annex_iv", "compliance/eu_ai_act/article_10_data_governance", "compliance/eu_ai_act/report_html", "compliance/eu_ai_act/reviewer_html", "compliance/eu_ai_act/reviewer_markdown", "compliance/eu_ai_act/evidence_index", "compliance/eu_ai_act/article_13_instructions", "compliance/eu_ai_act/article_50_transparency_marking", "compliance/eu_ai_act/article_16_provider_obligations", "compliance/eu_ai_act/article_43_conformity_assessment", "compliance/eu_ai_act/article_47_declaration_of_conformity", "compliance/eu_ai_act/article_9_risk_register", "compliance/eu_ai_act/article_72_monitoring_plan", "compliance/eu_ai_act/article_17_qms_lite", "compliance/eu_ai_act/annex_v_declaration_content", "compliance/eu_ai_act/article_73_serious_incident_pack", "compliance/eu_ai_act/human_oversight_summary", "compliance/eu_ai_act/release_review", "compliance/eu_ai_act/post_market_monitoring" ], "residual_gaps": [ "The deployer-owned FRIA, updates, consultation path, and any linked impact-assessment records remain required where Article 27 applies." ], "notes": [ "This clause is scored as a FRIA scaffold, not a completed Article 27 assessment record." ] }, { "clause": "Art_43", "title": "Conformity assessment", "status": "covered", "selectors": [ { "selector": "compare-report.json.environment", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.summary.execution_quality", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.quality_flags", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "report.html", "role": "supporting", "presence": "present", "source_rel_path": "report.html" } ], "manifest_keys": [ "c-approval/baseline/case_response", "c-approval/new/case_response", "c-approval/baseline/tool_telemetry", "c-approval/new/tool_telemetry", "c-approval/baseline/final_output", "c-approval/new/final_output", "c-block/baseline/case_response", "c-block/new/case_response", "c-block/baseline/tool_telemetry", "c-block/new/tool_result_call-1", "c-block/new/tool_telemetry", "c-block/baseline/final_output", "c-block/new/final_output", "viewer/c-approval/replay_diff", "viewer/c-block/replay_diff", "bundle/retention_archive_controls", "compliance/eu_ai_act/coverage", "compliance/eu_ai_act/annex_iv", "compliance/eu_ai_act/article_10_data_governance", "compliance/eu_ai_act/report_html", "compliance/eu_ai_act/reviewer_html", "compliance/eu_ai_act/reviewer_markdown", "compliance/eu_ai_act/evidence_index", "compliance/eu_ai_act/article_13_instructions", "compliance/eu_ai_act/article_50_transparency_marking", "compliance/eu_ai_act/article_16_provider_obligations", "compliance/eu_ai_act/article_43_conformity_assessment", "compliance/eu_ai_act/article_47_declaration_of_conformity", "compliance/eu_ai_act/article_9_risk_register", "compliance/eu_ai_act/article_72_monitoring_plan", "compliance/eu_ai_act/article_17_qms_lite", "compliance/eu_ai_act/annex_v_declaration_content", "compliance/eu_ai_act/article_73_serious_incident_pack", "compliance/eu_ai_act/human_oversight_summary", "compliance/eu_ai_act/release_review", "compliance/eu_ai_act/post_market_monitoring" ], "residual_gaps": [ "Article 43 conformity assessment record is referenced in the package record, but document completeness, currency, and final operator approval still need to be maintained outside the evaluator for Art_43." ], "notes": [ "This clause is scored as a conformity-assessment scaffold, not a completed Article 43 record.", "Package record references Article 43 conformity assessment record: compliance/article-43-conformity-assessment.json." ] }, { "clause": "Art_47", "title": "EU declaration of conformity", "status": "covered", "selectors": [ { "selector": "compare-report.json.environment", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.meta", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "report.html", "role": "supporting", "presence": "present", "source_rel_path": "report.html" } ], "manifest_keys": [ "c-approval/baseline/case_response", "c-approval/new/case_response", "c-approval/baseline/tool_telemetry", "c-approval/new/tool_telemetry", "c-approval/baseline/final_output", "c-approval/new/final_output", "c-block/baseline/case_response", "c-block/new/case_response", "c-block/baseline/tool_telemetry", "c-block/new/tool_result_call-1", "c-block/new/tool_telemetry", "c-block/baseline/final_output", "c-block/new/final_output", "viewer/c-approval/replay_diff", "viewer/c-block/replay_diff", "bundle/retention_archive_controls", "compliance/eu_ai_act/coverage", "compliance/eu_ai_act/annex_iv", "compliance/eu_ai_act/article_10_data_governance", "compliance/eu_ai_act/report_html", "compliance/eu_ai_act/reviewer_html", "compliance/eu_ai_act/reviewer_markdown", "compliance/eu_ai_act/evidence_index", "compliance/eu_ai_act/article_13_instructions", "compliance/eu_ai_act/article_50_transparency_marking", "compliance/eu_ai_act/article_16_provider_obligations", "compliance/eu_ai_act/article_43_conformity_assessment", "compliance/eu_ai_act/article_47_declaration_of_conformity", "compliance/eu_ai_act/article_9_risk_register", "compliance/eu_ai_act/article_72_monitoring_plan", "compliance/eu_ai_act/article_17_qms_lite", "compliance/eu_ai_act/annex_v_declaration_content", "compliance/eu_ai_act/article_73_serious_incident_pack", "compliance/eu_ai_act/human_oversight_summary", "compliance/eu_ai_act/release_review", "compliance/eu_ai_act/post_market_monitoring" ], "residual_gaps": [ "Article 47 declaration of conformity is referenced in the package record, but document completeness, currency, and final operator approval still need to be maintained outside the evaluator for Art_47." ], "notes": [ "This clause is scored as a declaration scaffold, not a completed Article 47 declaration.", "Package record references Article 47 declaration of conformity: compliance/article-47-declaration-of-conformity.json." ] }, { "clause": "Art_48", "title": "CE marking", "status": "covered", "selectors": [ { "selector": "compare-report.json.environment", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.meta", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "report.html", "role": "supporting", "presence": "present", "source_rel_path": "report.html" } ], "manifest_keys": [ "c-approval/baseline/case_response", "c-approval/new/case_response", "c-approval/baseline/tool_telemetry", "c-approval/new/tool_telemetry", "c-approval/baseline/final_output", "c-approval/new/final_output", "c-block/baseline/case_response", "c-block/new/case_response", "c-block/baseline/tool_telemetry", "c-block/new/tool_result_call-1", "c-block/new/tool_telemetry", "c-block/baseline/final_output", "c-block/new/final_output", "viewer/c-approval/replay_diff", "viewer/c-block/replay_diff", "bundle/retention_archive_controls", "compliance/eu_ai_act/coverage", "compliance/eu_ai_act/annex_iv", "compliance/eu_ai_act/article_10_data_governance", "compliance/eu_ai_act/report_html", "compliance/eu_ai_act/reviewer_html", "compliance/eu_ai_act/reviewer_markdown", "compliance/eu_ai_act/evidence_index", "compliance/eu_ai_act/article_13_instructions", "compliance/eu_ai_act/article_50_transparency_marking", "compliance/eu_ai_act/article_16_provider_obligations", "compliance/eu_ai_act/article_43_conformity_assessment", "compliance/eu_ai_act/article_47_declaration_of_conformity", "compliance/eu_ai_act/article_9_risk_register", "compliance/eu_ai_act/article_72_monitoring_plan", "compliance/eu_ai_act/article_17_qms_lite", "compliance/eu_ai_act/annex_v_declaration_content", "compliance/eu_ai_act/article_73_serious_incident_pack", "compliance/eu_ai_act/human_oversight_summary", "compliance/eu_ai_act/release_review", "compliance/eu_ai_act/post_market_monitoring" ], "residual_gaps": [ "The provider-owned CE marking record, including digital or physical placement and notified-body identification where applicable, remains required." ], "notes": [ "This clause is scored as a CE-marking scaffold, not a completed Article 48 record." ] }, { "clause": "Art_49", "title": "Registration", "status": "covered", "selectors": [ { "selector": "compare-report.json.environment", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.meta", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "report.html", "role": "supporting", "presence": "present", "source_rel_path": "report.html" } ], "manifest_keys": [ "c-approval/baseline/case_response", "c-approval/new/case_response", "c-approval/baseline/tool_telemetry", "c-approval/new/tool_telemetry", "c-approval/baseline/final_output", "c-approval/new/final_output", "c-block/baseline/case_response", "c-block/new/case_response", "c-block/baseline/tool_telemetry", "c-block/new/tool_result_call-1", "c-block/new/tool_telemetry", "c-block/baseline/final_output", "c-block/new/final_output", "viewer/c-approval/replay_diff", "viewer/c-block/replay_diff", "bundle/retention_archive_controls", "compliance/eu_ai_act/coverage", "compliance/eu_ai_act/annex_iv", "compliance/eu_ai_act/article_10_data_governance", "compliance/eu_ai_act/report_html", "compliance/eu_ai_act/reviewer_html", "compliance/eu_ai_act/reviewer_markdown", "compliance/eu_ai_act/evidence_index", "compliance/eu_ai_act/article_13_instructions", "compliance/eu_ai_act/article_50_transparency_marking", "compliance/eu_ai_act/article_16_provider_obligations", "compliance/eu_ai_act/article_43_conformity_assessment", "compliance/eu_ai_act/article_47_declaration_of_conformity", "compliance/eu_ai_act/article_9_risk_register", "compliance/eu_ai_act/article_72_monitoring_plan", "compliance/eu_ai_act/article_17_qms_lite", "compliance/eu_ai_act/annex_v_declaration_content", "compliance/eu_ai_act/article_73_serious_incident_pack", "compliance/eu_ai_act/human_oversight_summary", "compliance/eu_ai_act/release_review", "compliance/eu_ai_act/post_market_monitoring" ], "residual_gaps": [ "The provider-owned EU database or national registration record remains required where Article 49 applies." ], "notes": [ "This clause is scored as a registration scaffold, not a completed Article 49 record." ] }, { "clause": "Annex_V", "title": "Declaration content", "status": "covered", "selectors": [ { "selector": "compare-report.json.environment", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "compare-report.json.meta", "role": "required", "presence": "present", "source_rel_path": "compare-report.json" }, { "selector": "report.html", "role": "supporting", "presence": "present", "source_rel_path": "report.html" } ], "manifest_keys": [ "c-approval/baseline/case_response", "c-approval/new/case_response", "c-approval/baseline/tool_telemetry", "c-approval/new/tool_telemetry", "c-approval/baseline/final_output", "c-approval/new/final_output", "c-block/baseline/case_response", "c-block/new/case_response", "c-block/baseline/tool_telemetry", "c-block/new/tool_result_call-1", "c-block/new/tool_telemetry", "c-block/baseline/final_output", "c-block/new/final_output", "viewer/c-approval/replay_diff", "viewer/c-block/replay_diff", "bundle/retention_archive_controls", "compliance/eu_ai_act/coverage", "compliance/eu_ai_act/annex_iv", "compliance/eu_ai_act/article_10_data_governance", "compliance/eu_ai_act/report_html", "compliance/eu_ai_act/reviewer_html", "compliance/eu_ai_act/reviewer_markdown", "compliance/eu_ai_act/evidence_index", "compliance/eu_ai_act/article_13_instructions", "compliance/eu_ai_act/article_50_transparency_marking", "compliance/eu_ai_act/article_16_provider_obligations", "compliance/eu_ai_act/article_43_conformity_assessment", "compliance/eu_ai_act/article_47_declaration_of_conformity", "compliance/eu_ai_act/article_9_risk_register", "compliance/eu_ai_act/article_72_monitoring_plan", "compliance/eu_ai_act/article_17_qms_lite", "compliance/eu_ai_act/annex_v_declaration_content", "compliance/eu_ai_act/article_73_serious_incident_pack", "compliance/eu_ai_act/human_oversight_summary", "compliance/eu_ai_act/release_review", "compliance/eu_ai_act/post_market_monitoring" ], "residual_gaps": [ "Annex V declaration support record is referenced in the package record, but document completeness, currency, and final operator approval still need to be maintained outside the evaluator for Annex_V." ], "notes": [ "This clause is scored as an Annex V content scaffold, not a completed declaration content record.", "Package record references Annex V declaration support record: compliance/article-47-declaration-of-conformity.json." ] } ], "manifest_items": [ { "manifest_key": "c-approval/baseline/case_response", "rel_path": "assets/raw/case_responses/c-approval/baseline.json", "media_type": "application/json", "bytes": 832, "sha256": "d96f790a59ed2efe8a18fdd9ef71d6b6678dca785bbb9ac9e2ae5f810a7890e5" }, { "manifest_key": "c-approval/new/case_response", "rel_path": "assets/raw/case_responses/c-approval/new.json", "media_type": "application/json", "bytes": 1007, "sha256": "ff492ef379c3a3886279c9e8ae53b6d3ba830a499cfec013a174ea809b42c773" }, { "manifest_key": "c-approval/baseline/tool_telemetry", "rel_path": "assets/tool_telemetry/c-approval/baseline.json", "media_type": "application/json", "bytes": 380, "sha256": "7f71611fe2cfe6fa9f44ec9c97b49271ef736d89faf89d26e7b4f72587545199" }, { "manifest_key": "c-approval/new/tool_telemetry", "rel_path": "assets/tool_telemetry/c-approval/new.json", "media_type": "application/json", "bytes": 375, "sha256": "08839001686a7073d2c0b4ca71b9e4a5a9ed865e6825f366ab2cd2679aea16a3" }, { "manifest_key": "c-approval/baseline/final_output", "rel_path": "assets/final_output/c-approval/baseline.json", "media_type": "application/json", "bytes": 289, "sha256": "cf55170a7ba21b109f78d57734096557f2a71220feb84e25f49082dbfc098836" }, { "manifest_key": "c-approval/new/final_output", "rel_path": "assets/final_output/c-approval/new.json", "media_type": "application/json", "bytes": 376, "sha256": "8a0d7bcf8223efb2e9c1c5f9f92362c0a9be685e34aea6134ed017f4583663fb" }, { "manifest_key": "c-block/baseline/case_response", "rel_path": "assets/raw/case_responses/c-block/baseline.json", "media_type": "application/json", "bytes": 829, "sha256": "c9842135169f2ddda9ebffc7dfbd0f53aaff5be843e84ca87182ff1802f059f0" }, { "manifest_key": "c-block/new/case_response", "rel_path": "assets/raw/case_responses/c-block/new.json", "media_type": "application/json", "bytes": 1313, "sha256": "684b036d927c09afe3d12b8efc92395150fc476f4f82513929cf8d385369366f" }, { "manifest_key": "c-block/baseline/tool_telemetry", "rel_path": "assets/tool_telemetry/c-block/baseline.json", "media_type": "application/json", "bytes": 377, "sha256": "cd47b4c806c9d9575f8dd5045db2cb30ccb6749ea25130556c57c7662c406534" }, { "manifest_key": "c-block/new/tool_result_call-1", "rel_path": "assets/tool_telemetry/c-block/new/results/01-call-1.json", "media_type": "application/json", "bytes": 231, "sha256": "0dbf2d7bbdc0ffcbb4a1384d8fdf60a5de47907fc3a35a50706e0d6225e0e283" }, { "manifest_key": "c-block/new/tool_telemetry", "rel_path": "assets/tool_telemetry/c-block/new.json", "media_type": "application/json", "bytes": 975, "sha256": "51e9e02aba6e02fce46af9f49d3da7fc27b361af9891fdc9daec100a34156201" }, { "manifest_key": "c-block/baseline/final_output", "rel_path": "assets/final_output/c-block/baseline.json", "media_type": "application/json", "bytes": 289, "sha256": "cfb7fd187c43b09a0f8522e70250ec3c4bc1728914b720bcc275e03c69eb0a8d" }, { "manifest_key": "c-block/new/final_output", "rel_path": "assets/final_output/c-block/new.json", "media_type": "application/json", "bytes": 289, "sha256": "cfb7fd187c43b09a0f8522e70250ec3c4bc1728914b720bcc275e03c69eb0a8d" }, { "manifest_key": "viewer/c-approval/replay_diff", "rel_path": "case-c-approval.html", "media_type": "text/html", "bytes": 4886, "sha256": "f1259bbf62ad62c02720d6901efc37db24c2c0b0a336b5e78dd5c00d3248d99e" }, { "manifest_key": "viewer/c-block/replay_diff", "rel_path": "case-c-block.html", "media_type": "text/html", "bytes": 5649, "sha256": "df60e55642b0f3fd496105ec9d287e71ab49b0c16a214ff47f4673f03e067533" }, { "manifest_key": "bundle/retention_archive_controls", "rel_path": "archive/retention-controls.json", "media_type": "application/json", "bytes": 2261, "sha256": "d1dbf3d31f363a71b05c09cc0b7239c671f852ea390003e41b015bd12d228a29" }, { "manifest_key": "compliance/eu_ai_act/coverage", "rel_path": "compliance/eu-ai-act-coverage.json", "media_type": "application/json", "bytes": 29503, "sha256": "5fb8dbf49eda9846e26260ab8208bc696e45947c4e458412c45ea7e6515b2d2a" }, { "manifest_key": "compliance/eu_ai_act/annex_iv", "rel_path": "compliance/eu-ai-act-annex-iv.json", "media_type": "application/json", "bytes": 41596, "sha256": "51abd117c549cc64459dcad9ea823b1650d801aea7d7321bbdff8e2277bccf7d" }, { "manifest_key": "compliance/eu_ai_act/article_10_data_governance", "rel_path": "compliance/article-10-data-governance.json", "media_type": "application/json", "bytes": 5570, "sha256": "baddbe67162291f45503139d6dbad36ea051ec715d80dd763a75b546593406f3" }, { "manifest_key": "compliance/eu_ai_act/report_html", "rel_path": "compliance/eu-ai-act-report.html", "media_type": "text/html", "bytes": 39024, "sha256": "4e66999282da55b06f0aef59c11cdfe1b1feede0b0379d34e2075e32071623d0" }, { "manifest_key": "compliance/eu_ai_act/reviewer_html", "rel_path": "compliance/eu-ai-act-reviewer.html", "media_type": "text/html", "bytes": 61746, "sha256": "66f8db66d39dc55ae967e1ccce298fb72b7e3e13a89ee528500b5f0625de6dd0" }, { "manifest_key": "compliance/eu_ai_act/reviewer_markdown", "rel_path": "compliance/eu-ai-act-reviewer.md", "media_type": "text/markdown", "bytes": 47803, "sha256": "ad9b7903a9e0141dc16290ea76ed37862d063cad9ca1b0b47ac70ed6fbba1ddb" }, { "manifest_key": "compliance/eu_ai_act/evidence_index", "rel_path": "compliance/evidence-index.json", "media_type": "application/json", "bytes": 47318, "sha256": "b785747ee836f3043b7629dde4106975f99389c69148e4580b515c3eb57eb160" }, { "manifest_key": "compliance/eu_ai_act/article_13_instructions", "rel_path": "compliance/article-13-instructions.json", "media_type": "application/json", "bytes": 5436, "sha256": "40735e2c8c52bdadccc7bb11b12e3b84c2857bbaed691130f9af82bd1d1aa193" }, { "manifest_key": "compliance/eu_ai_act/article_50_transparency_marking", "rel_path": "compliance/article-50-transparency-marking.json", "media_type": "application/json", "bytes": 10819, "sha256": "91e93cc82631adb0f8b05e7310f52db673e6522e5b6aef32055245d14371291c" }, { "manifest_key": "compliance/eu_ai_act/article_16_provider_obligations", "rel_path": "compliance/article-16-provider-obligations.json", "media_type": "application/json", "bytes": 12651, "sha256": "5b0d6838c74abdcb815baf7d61754f3b3f6a33fcd5ed8b4987095552f552a794" }, { "manifest_key": "compliance/eu_ai_act/article_43_conformity_assessment", "rel_path": "compliance/article-43-conformity-assessment.json", "media_type": "application/json", "bytes": 5810, "sha256": "58c6205b8d0682fced7d923076d1b05a17650d0f256a5d5c065e84090552461a" }, { "manifest_key": "compliance/eu_ai_act/article_47_declaration_of_conformity", "rel_path": "compliance/article-47-declaration-of-conformity.json", "media_type": "application/json", "bytes": 5339, "sha256": "a580c4f0ac3c8cc9fc1c7c9b82212bde9558a83c6e078e3c31f607c46fb85130" }, { "manifest_key": "compliance/eu_ai_act/article_9_risk_register", "rel_path": "compliance/article-9-risk-register.json", "media_type": "application/json", "bytes": 7481, "sha256": "e6854f7477e2bf52d9ed5cfc45a79e5c9dc9e817fadda61fb622f7f438dc41ed" }, { "manifest_key": "compliance/eu_ai_act/article_72_monitoring_plan", "rel_path": "compliance/article-72-monitoring-plan.json", "media_type": "application/json", "bytes": 10306, "sha256": "89cfc69301d6d46798c2c88c377b4c6b65d326ca4d89bf9d28a3fa4eafd5952e" }, { "manifest_key": "compliance/eu_ai_act/article_17_qms_lite", "rel_path": "compliance/article-17-qms-lite.json", "media_type": "application/json", "bytes": 12477, "sha256": "2f2c5b71e3f7fa1d6291cd0cd35371c303c3ff0faf88af0ef5cae530a4e8f466" }, { "manifest_key": "compliance/eu_ai_act/annex_v_declaration_content", "rel_path": "compliance/annex-v-declaration-content.json", "media_type": "application/json", "bytes": 7080, "sha256": "3751dca9cf5e2033dd21ca271dd61d27823812425445b60e912a0253603aa503" }, { "manifest_key": "compliance/eu_ai_act/article_73_serious_incident_pack", "rel_path": "compliance/article-73-serious-incident-pack.json", "media_type": "application/json", "bytes": 8514, "sha256": "bae7db5903623256dccd59c3e9b3c873ad1292f483a10705babdfb207bab0451" }, { "manifest_key": "compliance/eu_ai_act/human_oversight_summary", "rel_path": "compliance/human-oversight-summary.json", "media_type": "application/json", "bytes": 6179, "sha256": "b2da3b0ba16542d267804bd7131c4f26d14074859a4799f0d147aeee011d8b36" }, { "manifest_key": "compliance/eu_ai_act/release_review", "rel_path": "compliance/release-review.json", "media_type": "application/json", "bytes": 6026, "sha256": "87bd2906126de8925edb646d1df8abb52d485442149aefbfb9d7da7c5f580d5c" }, { "manifest_key": "compliance/eu_ai_act/post_market_monitoring", "rel_path": "compliance/post-market-monitoring.json", "media_type": "application/json", "bytes": 8500, "sha256": "14aff32340a97caa8d45ef37e0903ae7a252dff8f648b4781875b8dff4ae0a9d" } ], "surface": { "id": "eu-ai-act", "label": "EU AI Act evidence report", "kind": "vertical", "base_contract": "report-contract-v5", "vertical_contract": "eu-ai-act-full" }, "surface_version": "eu-ai-act-full-v1" }