{"auditId":"aud_01KS3CZM2CQWN9W2PDK1F1","status":"completed","startedAt":"2026-05-20T19:14:44.940Z","updatedAt":"2026-05-20T19:15:00.827Z","progressNote":"Risk class: unknown — running clause checkers","report":{"auditId":"aud_01KS3CZM2CQWN9W2PDK1F1","source":{"kind":"repo","owner":"thejoven","repo":"awesome-eliza"},"input":{"auditId":"aud_01KS3CZM2CQWN9W2PDK1F1","source":{"kind":"repo","owner":"thejoven","repo":"awesome-eliza"},"repoUrl":"https://github.com/thejoven/awesome-eliza","regulations":["eu-ai-act-2024-08","nist-ai-rmf-1.0","gdpr-2016","iso-42001-2023"]},"fetch":{"repoUrl":"https://github.com/thejoven/awesome-eliza","owner":"thejoven","repo":"awesome-eliza","ref":"223af244192ce48699bd0ee5015317380b33ce59","commitSha":"223af244192ce48699bd0ee5015317380b33ce59","worktreeDir":"/tmp/ai-auditor/aud_01KS3CZM2CQWN9W2PDK1F1","fileCount":4,"totalBytes":908543,"languages":{"Markdown":29909},"inventory":{"hasReadme":true,"hasLicense":true,"hasModelCard":false,"hasDataCard":false,"hasRiskRegister":false,"hasThreatModel":false,"hasSecurityMd":false,"hasPrivacyMd":false,"hasCodeOfConduct":false,"hasContributing":false,"hasCiWorkflows":false,"hasEvalDir":false,"hasTestsDir":false,"governanceDocFiles":["LICENSE","README.md"],"configFiles":[]},"fetchedAt":"2026-05-20T19:14:46.574Z"},"recon":{"signals":{"agent_framework":{"signal":"agent_framework","fired":false,"strength":0,"evidence":[]},"model_usage":{"signal":"model_usage","fired":false,"strength":0,"evidence":[]},"logging_hooks":{"signal":"logging_hooks","fired":false,"strength":0,"evidence":[]},"oversight_hooks":{"signal":"oversight_hooks","fired":false,"strength":0,"evidence":[]},"eval_artefacts":{"signal":"eval_artefacts","fired":false,"strength":0,"evidence":[]},"governance_docs":{"signal":"governance_docs","fired":true,"strength":0.5204119982655925,"evidence":[{"file":"LICENSE","rule":"governance_doc_present"},{"file":"README.md","rule":"governance_doc_present"}]},"cybersec_hooks":{"signal":"cybersec_hooks","fired":false,"strength":0,"evidence":[]},"provenance_hooks":{"signal":"provenance_hooks","fired":false,"strength":0,"evidence":[]},"data_io":{"signal":"data_io","fired":false,"strength":0,"evidence":[]},"pii_signals":{"signal":"pii_signals","fired":false,"strength":0,"evidence":[]},"bio_health_signals":{"signal":"bio_health_signals","fired":false,"strength":0,"evidence":[]},"employment_signals":{"signal":"employment_signals","fired":false,"strength":0,"evidence":[]},"bio_metric_signals":{"signal":"bio_metric_signals","fired":false,"strength":0,"evidence":[]},"education_signals":{"signal":"education_signals","fired":false,"strength":0,"evidence":[]},"law_enforcement_signals":{"signal":"law_enforcement_signals","fired":false,"strength":0,"evidence":[]},"migration_signals":{"signal":"migration_signals","fired":false,"strength":0,"evidence":[]},"justice_signals":{"signal":"justice_signals","fired":false,"strength":0,"evidence":[]},"essential_services_signals":{"signal":"essential_services_signals","fired":false,"strength":0,"evidence":[]},"critical_infra_signals":{"signal":"critical_infra_signals","fired":false,"strength":0,"evidence":[]},"content_generation_signals":{"signal":"content_generation_signals","fired":false,"strength":0,"evidence":[]},"emotion_recognition_signals":{"signal":"emotion_recognition_signals","fired":false,"strength":0,"evidence":[]}}},"scope":{"regulationIds":["eu-ai-act-2024-08","nist-ai-rmf-1.0","gdpr-2016","iso-42001-2023"],"notes":["Auditing against packs: eu-ai-act-2024-08, nist-ai-rmf-1.0, gdpr-2016, iso-42001-2023"]},"map":{"classification":"unknown","annexIiiCategories":[],"art50Triggers":[],"drivingSignals":[],"rationale":["No AI system detected in this repository — no agent framework or LLM call sites found.","EU AI Act and NIST AI RMF do not apply: the regulations target AI systems and these signals are absent."]},"checks":[{"clauseId":"eu-ai-act/art-5/1a-subliminal","regulationId":"eu-ai-act-2024-08","article":"5(1)(a)","title":"Subliminal techniques distorting behaviour","principle":"transparency","verdict":"pass","score":4,"rawScore":0,"evidence":[],"rules":[{"rule":"detect_manipulative_prompt_patterns","matched":0,"weight":1}],"rationale":"Composite raw score 0.00 (0/1 rules matched).","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-5/1b-vulnerability","regulationId":"eu-ai-act-2024-08","article":"5(1)(b)","title":"Exploiting vulnerabilities (age, disability, socio-economic)","principle":"fairness","verdict":"pass","score":4,"rawScore":0,"evidence":[],"rules":[{"rule":"detect_protected_attribute_targeting","matched":0,"weight":1}],"rationale":"Composite raw score 0.00 (0/1 rules matched).","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-5/1c-social-scoring","regulationId":"eu-ai-act-2024-08","article":"5(1)(c)","title":"Social scoring leading to detrimental treatment","principle":"fairness","verdict":"pass","score":4,"rawScore":0,"evidence":[],"rules":[{"rule":"detect_scoring_with_persistent_user_state","matched":0,"weight":1}],"rationale":"Composite raw score 0.00 (0/1 rules matched). Supporting docs may exist outside the repo.","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-5/1d-predictive-policing","regulationId":"eu-ai-act-2024-08","article":"5(1)(d)","title":"Predictive policing solely from profiling","principle":"fairness","verdict":"pass","score":4,"rawScore":0,"evidence":[],"rules":[{"rule":"detect_crime_risk_scoring_from_profile","matched":0,"weight":1}],"rationale":"Composite raw score 0.00 (0/1 rules matched).","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-5/1e-facial-scraping","regulationId":"eu-ai-act-2024-08","article":"5(1)(e)","title":"Untargeted facial image scraping for face databases","principle":"privacy","verdict":"pass","score":4,"rawScore":0,"evidence":[],"rules":[{"rule":"detect_face_image_scraping","matched":0,"weight":1}],"rationale":"Composite raw score 0.00 (0/1 rules matched).","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-5/1f-emotion-workplace-edu","regulationId":"eu-ai-act-2024-08","article":"5(1)(f)","title":"Emotion recognition in workplace and education","principle":"privacy","verdict":"pass","score":4,"rawScore":0,"evidence":[],"rules":[{"rule":"detect_emotion_recognition_in_workplace_education","matched":0,"weight":1}],"rationale":"Composite raw score 0.00 (0/1 rules matched).","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-5/1g-biometric-categorisation","regulationId":"eu-ai-act-2024-08","article":"5(1)(g)","title":"Biometric categorisation by protected attributes","principle":"fairness","verdict":"pass","score":4,"rawScore":0,"evidence":[],"rules":[{"rule":"detect_biometric_categorisation_by_protected_attrs","matched":0,"weight":1}],"rationale":"Composite raw score 0.00 (0/1 rules matched).","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-5/1h-realtime-rbi","regulationId":"eu-ai-act-2024-08","article":"5(1)(h)","title":"Real-time remote biometric identification in public spaces","principle":"privacy","verdict":"external","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"Deployment context (public space, real-time, law enforcement use, judicial\nauthorisation) is operational, not knowable from code. Always external.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-9/risk-management","regulationId":"eu-ai-act-2024-08","article":"9","title":"Risk management system established, implemented, documented","principle":"safety","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-10/data-governance","regulationId":"eu-ai-act-2024-08","article":"10","title":"Data and data governance practices documented","principle":"privacy","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-11/technical-documentation","regulationId":"eu-ai-act-2024-08","article":"11","title":"Technical documentation drawn up before placing on market","principle":"auditability","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-12/p1-automatic-logs","regulationId":"eu-ai-act-2024-08","article":"12(1)","title":"Automatic recording of events over the lifetime","principle":"auditability","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-12/p2-traceability","regulationId":"eu-ai-act-2024-08","article":"12(2)","title":"Logging ensures traceability appropriate to risk","principle":"auditability","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-13/deployer-instructions","regulationId":"eu-ai-act-2024-08","article":"13","title":"Transparent operation and instructions for use","principle":"transparency","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-14/p1-oversight-measures","regulationId":"eu-ai-act-2024-08","article":"14(1)","title":"Effective human oversight designed and built-in","principle":"human-oversight","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-14/p4d-stop-button","regulationId":"eu-ai-act-2024-08","article":"14(4)(d)","title":"Interrupt / stop function reachable by overseer","principle":"human-oversight","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-14/p4e-override","regulationId":"eu-ai-act-2024-08","article":"14(4)(e)","title":"Ability to override / reverse the system's output","principle":"human-oversight","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-15/p1-accuracy","regulationId":"eu-ai-act-2024-08","article":"15(1)","title":"Appropriate level of accuracy declared and tested","principle":"safety","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-15/p4-robustness","regulationId":"eu-ai-act-2024-08","article":"15(4)","title":"Resilience to errors, faults, inconsistencies","principle":"safety","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-15/p5-cybersecurity","regulationId":"eu-ai-act-2024-08","article":"15(5)","title":"Cybersecurity measures appropriate to circumstances","principle":"security-governance","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-26/p6-keep-logs","regulationId":"eu-ai-act-2024-08","article":"26(6)","title":"Deployer log-retention capability supported","principle":"accountability","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-50/p1-ai-disclosure","regulationId":"eu-ai-act-2024-08","article":"50(1)","title":"Users informed they are interacting with an AI","principle":"transparency","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-50/p2-synthetic-content","regulationId":"eu-ai-act-2024-08","article":"50(2)","title":"AI-generated content marked as such, machine-readable","principle":"transparency","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-50/p3-emotion-biometric-disclosure","regulationId":"eu-ai-act-2024-08","article":"50(3)","title":"Emotion recognition / biometric categorisation disclosure","principle":"transparency","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"eu-ai-act/art-50/p4-deepfake-disclosure","regulationId":"eu-ai-act-2024-08","article":"50(4)","title":"Deepfake content labelled as artificially generated","principle":"transparency","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"nist-ai-rmf/govern-1.4","regulationId":"nist-ai-rmf-1.0","article":"GOVERN 1.4","title":"Risk management process documented and accountable","principle":"accountability","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"nist-ai-rmf/govern-1.5","regulationId":"nist-ai-rmf-1.0","article":"GOVERN 1.5","title":"Ongoing monitoring and periodic review of risk management","principle":"accountability","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"nist-ai-rmf/map-1.1","regulationId":"nist-ai-rmf-1.0","article":"MAP 1.1","title":"Context of use established and understood","principle":"auditability","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"nist-ai-rmf/map-3.4","regulationId":"nist-ai-rmf-1.0","article":"MAP 3.4","title":"Risks and benefits to people identified","principle":"safety","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"nist-ai-rmf/measure-2.3","regulationId":"nist-ai-rmf-1.0","article":"MEASURE 2.3","title":"AI system performance evaluated and documented","principle":"safety","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"nist-ai-rmf/measure-2.7","regulationId":"nist-ai-rmf-1.0","article":"MEASURE 2.7","title":"Security and resilience evaluated","principle":"security-governance","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"nist-ai-rmf/measure-2.8","regulationId":"nist-ai-rmf-1.0","article":"MEASURE 2.8","title":"Privacy risk of the AI system evaluated","principle":"privacy","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"nist-ai-rmf/measure-2.11","regulationId":"nist-ai-rmf-1.0","article":"MEASURE 2.11","title":"Fairness and bias evaluated","principle":"fairness","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"nist-ai-rmf/manage-2.3","regulationId":"nist-ai-rmf-1.0","article":"MANAGE 2.3","title":"Mechanisms to supersede or deactivate AI systems","principle":"human-oversight","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"nist-ai-rmf/manage-4.1","regulationId":"nist-ai-rmf-1.0","article":"MANAGE 4.1","title":"Post-deployment monitoring, appeal and override, change management","principle":"auditability","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"No AI system detected in this repository (no agent framework, no LLM call sites). Clause does not apply.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"gdpr/art-5-principles","regulationId":"gdpr-2016","article":"5","title":"Principles relating to processing of personal data","principle":"transparency","verdict":"fail","score":0,"rawScore":0,"evidence":[],"rules":[{"rule":"presence_of_privacy_policy","matched":0,"weight":0.5},{"rule":"purpose_limitation_documented","matched":0,"weight":0.5}],"rationale":"Composite raw score 0.00 (0/2 rules matched). Supporting docs may exist outside the repo.","confidence":0.6,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"gdpr/art-22-automated-decisions","regulationId":"gdpr-2016","article":"22","title":"Automated individual decision-making, including profiling","principle":"human-oversight","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"Clause subject matter not detected — required signals [oversight_hooks, agent_framework] did not fire in this repo.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"gdpr/art-25-by-design","regulationId":"gdpr-2016","article":"25","title":"Data protection by design and by default","principle":"privacy","verdict":"fail","score":0,"rawScore":0,"evidence":[],"rules":[{"rule":"pseudonymisation_or_anonymisation","matched":0,"weight":0.5},{"rule":"default_minimal_data_collection","matched":0,"weight":0.5}],"rationale":"Composite raw score 0.00 (0/2 rules matched). Supporting docs may exist outside the repo.","confidence":0.6,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"gdpr/art-30-records","regulationId":"gdpr-2016","article":"30","title":"Records of processing activities","principle":"auditability","verdict":"fail","score":0,"rawScore":0,"evidence":[],"rules":[{"rule":"presence_of_processing_register","matched":0,"weight":1}],"rationale":"Composite raw score 0.00 (0/1 rules matched). Supporting docs may exist outside the repo.","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"gdpr/art-32-security","regulationId":"gdpr-2016","article":"32","title":"Security of processing","principle":"security-governance","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"Clause subject matter not detected — required signals [cybersec_hooks] did not fire in this repo.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"gdpr/art-35-dpia","regulationId":"gdpr-2016","article":"35","title":"Data protection impact assessment (DPIA)","principle":"safety","verdict":"fail","score":0,"rawScore":0,"evidence":[],"rules":[{"rule":"presence_of_dpia","matched":0,"weight":1}],"rationale":"Composite raw score 0.00 (0/1 rules matched). Supporting docs may exist outside the repo.","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"iso-42001/clause-5.1-leadership","regulationId":"iso-42001-2023","article":"5.1","title":"Leadership and commitment for AI management","principle":"accountability","verdict":"fail","score":0,"rawScore":0,"evidence":[],"rules":[{"rule":"presence_of_ai_policy","matched":0,"weight":0.7},{"rule":"leadership_signoff_evidence","matched":0,"weight":0.3}],"rationale":"Composite raw score 0.00 (0/2 rules matched). Supporting docs may exist outside the repo.","confidence":0.6,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"iso-42001/clause-5.3-roles","regulationId":"iso-42001-2023","article":"5.3","title":"Roles, responsibilities and authorities","principle":"accountability","verdict":"fail","score":0,"rawScore":0,"evidence":[],"rules":[{"rule":"presence_of_raci_or_owners","matched":0,"weight":1}],"rationale":"Composite raw score 0.00 (0/1 rules matched). Supporting docs may exist outside the repo.","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"iso-42001/clause-6.1-risk-assessment","regulationId":"iso-42001-2023","article":"6.1","title":"AI risk assessment process","principle":"safety","verdict":"fail","score":0,"rawScore":0,"evidence":[],"rules":[{"rule":"presence_of_risk_register","matched":0,"weight":0.6},{"rule":"risk_assessment_methodology_documented","matched":0,"weight":0.4}],"rationale":"Composite raw score 0.00 (0/2 rules matched). Supporting docs may exist outside the repo.","confidence":0.6,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"iso-42001/clause-7.5-documented-information","regulationId":"iso-42001-2023","article":"7.5","title":"Documented information for the AI management system","principle":"auditability","verdict":"fail","score":1,"rawScore":0.2,"evidence":[{"file":"README.md","rule":"presence_of_versioned_docs"}],"rules":[{"rule":"presence_of_versioned_docs","matched":0.4,"weight":0.5},{"rule":"docs_changelog_present","matched":0,"weight":0.5}],"rationale":"Composite raw score 0.20 (0/2 rules matched). Supporting docs may exist outside the repo.","confidence":0.7999999999999999,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"iso-42001/clause-8.1-operational-planning","regulationId":"iso-42001-2023","article":"8.1","title":"Operational planning and control","principle":"safety","verdict":"fail","score":0,"rawScore":0,"evidence":[],"rules":[{"rule":"presence_of_runbook","matched":0,"weight":0.5},{"rule":"presence_of_ci_workflows","matched":0,"weight":0.5}],"rationale":"Composite raw score 0.00 (0/2 rules matched). Supporting docs may exist outside the repo.","confidence":0.6,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"iso-42001/clause-9.1-monitoring","regulationId":"iso-42001-2023","article":"9.1","title":"Monitoring, measurement, analysis and evaluation","principle":"auditability","verdict":"n/a","score":null,"rawScore":null,"evidence":[],"rules":[],"rationale":"Clause subject matter not detected — required signals [logging_hooks, eval_artefacts] did not fire in this repo.","confidence":1,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"iso-42001/annex-a5-internal-org","regulationId":"iso-42001-2023","article":"A.5","title":"Internal organization controls","principle":"accountability","verdict":"fail","score":0,"rawScore":0,"evidence":[],"rules":[{"rule":"presence_of_codeowners","matched":0,"weight":1}],"rationale":"Composite raw score 0.00 (0/1 rules matched). Supporting docs may exist outside the repo.","confidence":0.55,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"},{"clauseId":"iso-42001/annex-a7-resources","regulationId":"iso-42001-2023","article":"A.7","title":"Resources for AI systems","principle":"security-governance","verdict":"fail","score":0,"rawScore":0,"evidence":[],"rules":[{"rule":"presence_of_security_policy","matched":0,"weight":0.5},{"rule":"dependency_pinning","matched":0,"weight":0.5}],"rationale":"Composite raw score 0.00 (0/2 rules matched). Supporting docs may exist outside the repo.","confidence":0.6,"needsLlmJudge":false,"verified":true,"verifyMethod":"deterministic-only"}],"grade":{"overallScore":1.6111111111111112,"perRegulation":[{"regulationId":"eu-ai-act-2024-08","scoreAvg":4,"passCount":7,"partialCount":0,"failCount":0,"externalCount":1,"naCount":17},{"regulationId":"nist-ai-rmf-1.0","scoreAvg":null,"passCount":0,"partialCount":0,"failCount":0,"externalCount":0,"naCount":10},{"regulationId":"gdpr-2016","scoreAvg":0,"passCount":0,"partialCount":0,"failCount":4,"externalCount":0,"naCount":2},{"regulationId":"iso-42001-2023","scoreAvg":0.14285714285714285,"passCount":0,"partialCount":0,"failCount":7,"externalCount":0,"naCount":1}]},"bundleHash":"4e8954258574d5395ac565ac429f1f04a35d96dfd13bebe98ce17bc470544327","checkerVersion":"v0.1.0","regulationsVersions":{"eu-ai-act-2024-08":"ee8568c60676d1c60c00393077dc7b9753628a16bb96049d6caa384b93516239","nist-ai-rmf-1.0":"b36616651114a74e212e4416e72f3d320d3ea46e1c93d7d3919cd44b5f71f762","gdpr-2016":"a650813378c93140abcbda864a7248289096abec98d57667cb0c0e2cba1bfe3f","iso-42001-2023":"3855f297eea17980b71d32e9d8c9f113c153c68e07b01fd442392fba4567755d"},"startedAt":"2026-05-20T19:14:45.027Z","completedAt":"2026-05-20T19:15:00.820Z","durationMs":15793,"externalControls":[{"clauseId":"eu-ai-act/art-5/1h-realtime-rbi","article":"5(1)(h)","title":"Real-time remote biometric identification in public spaces","note":"Deployment context (public space, real-time, law enforcement use, judicial\nauthorisation) is operational, not knowable from code. Always external."}]}}