Audit Report
drhus/ai-auditor
46479044bd8e · ran in 28.8s · bundle e75bef04
Deterministic · 12 ambiguous skipped
Overall score
2.0 /4
Partial
Risk class
HIGH
1
Code passed
12 / 31
Attestation Yes
0
Outstanding ext.
1
Overall completion status
Code findings on the left; user-attested external evidence on the right.
CODE-CHECKED CLAUSES
- Strong6
- Adequate6
- Partial8
- Inadequate5
- Absent6
ATTESTATION QUESTIONS
- Yes0
- No0
- Not Applicable0
- Outstanding0
Harm
Don't hurt people
1.4/4
Inadequate
Truth
Don't deceive people
1.9/4
Partial
Responsibility
Don't abuse power
2.1/4
Partial
Order
Don't destabilize society
2.8/4
Adequate
⚠ 1 outstanding external confirmations — required for a complete Annex IV dossier. Complete now →
Safety
Don't harm people2.0/4Partial3 clauses▸
Safety
Don't harm peoplePARTIALRisk management system established, implemented, documented EU AI Act, Art 9 skip2/3 rules2/4
▸
PARTIAL
Risk management system established, implemented, documented EU AI Act, Art 9
skip
2/3 rules
2/4
Why we flagged it
Composite raw score 0.55 (2/3 rules matched). Supporting docs may exist outside the repo.
Confidence
100%
▸Evidence · 2 hits— click to view code
RISK_REGISTER.md
presence_of_risk_register
View on GitHub →SECURITY.md
presence_of_threat_model
View on GitHub →Suggested fix · we looked for these and found none
- ci_eval_gates
INADEQUATEResilience to errors, faults, inconsistencies EU AI Act, Art 15(4)0/3 rules1/4
▸
INADEQUATE
Resilience to errors, faults, inconsistencies EU AI Act, Art 15(4)
0/3 rules
1/4
Why we flagged it
Composite raw score 0.16 (0/3 rules matched).
Confidence
81%
▸Evidence · 2 hits— click to view code
src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json:90
langchain_import
View on GitHub →nippet": "import os from langchain.callbacks.streaming_stdout import StreamingStdOutCallbackHandler from langchain_openai import ChatOpenAI"
src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json:90
langchain_import
View on GitHub →dOutCallbackHandler from langchain_openai import ChatOpenAI", "rule": "langchain_import" }, { "fSuggested fix · we looked for these and found none
- error_handling_at_tool_boundaries
- retry_logic
- fallback_behaviour
ADEQUATERisks and benefits to people identified NIST AI RMF, Art MAP 3.42/2 rules3/4
▸
ADEQUATE
Risks and benefits to people identified NIST AI RMF, Art MAP 3.4
2/2 rules
3/4
Why we flagged it
Composite raw score 0.80 (2/2 rules matched). Supporting docs may exist outside the repo.
Confidence
80%
▸Evidence · 2 hits— click to view code
RISK_REGISTER.md
presence_of_risk_register
View on GitHub →SECURITY.md
presence_of_threat_model
View on GitHub →Privacy
Respect boundaries1.0/4Inadequate5 clauses▸
Privacy
Respect boundariesABSENTUntargeted facial image scraping for face databases EU AI Act, Art 5(1)(e)1/1 rules0/4
▸
ABSENT
Untargeted facial image scraping for face databases EU AI Act, Art 5(1)(e)
1/1 rules
0/4
Why we flagged it
Composite raw score 1.00 (1/1 rules matched).
Confidence
55%
▸Evidence · 6 hits— click to view code
regulations/eu-ai-act-2024-08.yaml:32
biometric_terms
View on GitHub →" description: "Biometric ID, categorisation, emotion recognition" - signal: critical_infra_signals category: "2" description:
regulations/eu-ai-act-2024-08.yaml:62
biometric_terms
View on GitHub →otion recognition / biometric categorisation" - signal: agent_framework # any interactive AI is in scope paragraph: "50(1)"
regulations/eu-ai-act-2024-08.yaml:231
biometric_terms
View on GitHub →calls (mediapipe, face_recognition, dlib, opencv haar cascade). score_mapping: { pass_default: 4, fail_on_match: 0 } remediation_hpackage-lock.json:3913
scraping_pattern
View on GitHub →"^1.1.0", "@playwright/test": "^1.51.1", "babel-plugin-react-compiler": "*", "react": "^18.2.0 || 19.0.0-rc-de68d2f4
package-lock.json:3923
scraping_pattern
View on GitHub →}, "@playwright/test": { "optional": true }, "babel-plugin-react-compiler": { "optional":…and 1 more.
ABSENTEmotion recognition in workplace and education EU AI Act, Art 5(1)(f)1/1 rules0/4
▸
ABSENT
Emotion recognition in workplace and education EU AI Act, Art 5(1)(f)
1/1 rules
0/4
Why we flagged it
Composite raw score 1.00 (1/1 rules matched).
Confidence
55%
▸Evidence · 6 hits— click to view code
src/pipeline/stages/recon.ts:348
emotion_terms
View on GitHub →ms", pattern: /\b(?:emotion_detect|emotion_recognition|sentiment_score|affect_recognition|facial_emotion|micro_expression)\b/gi }, // ---
src/pipeline/stages/recon.ts:348
emotion_terms
View on GitHub →\b(?:emotion_detect|emotion_recognition|sentiment_score|affect_recognition|facial_emotion|micro_expression)\b/gi }, // ----- data_io ----
src/pipeline/stages/recon.ts:348
emotion_terms
View on GitHub →emotion_recognition|sentiment_score|affect_recognition|facial_emotion|micro_expression)\b/gi }, // ----- data_io ----- { signal: "data_src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json:1001
employment_terms
View on GitHub →ppet": "OMMANDS for candidate in tokens[index + 1:]: if candidate in {\"|\", \";\", \"&&\", \"||\"}: break f", "rule": "employmesrc/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json:1001
employment_terms
View on GitHub →ens[index + 1:]: if candidate in {\"|\", \";\", \"&&\", \"||\"}: break f", "rule": "employment_terms" }, {…and 1 more.
EXTERNALReal-time remote biometric identification in public spaces EU AI Act, Art 5(1)(h)EXT▸
EXTERNAL
Real-time remote biometric identification in public spaces EU AI Act, Art 5(1)(h)
EXT
Why we flagged it
Deployment context (public space, real-time, law enforcement use, judicial authorisation) is operational, not knowable from code. Always external.
Confidence
100%
ABSENTData and data governance practices documented EU AI Act, Art 100/3 rules0/4
▸
ABSENT
Data and data governance practices documented EU AI Act, Art 10
0/3 rules
0/4
Why we flagged it
Composite raw score 0.10 (0/3 rules matched). Supporting docs may exist outside the repo.
Confidence
75%
▸Evidence · 2 hits— click to view code
package-lock.json:3913
scraping_pattern
View on GitHub →"^1.1.0", "@playwright/test": "^1.51.1", "babel-plugin-react-compiler": "*", "react": "^18.2.0 || 19.0.0-rc-de68d2f4
package-lock.json:3923
scraping_pattern
View on GitHub →}, "@playwright/test": { "optional": true }, "babel-plugin-react-compiler": { "optional":Suggested fix · we looked for these and found none
- presence_of_data_card
- data_loading_code_quality
- bias_evaluation_present
STRONGPrivacy risk of the AI system evaluated NIST AI RMF, Art MEASURE 2.82/2 rules4/4
▸
STRONG
Privacy risk of the AI system evaluated NIST AI RMF, Art MEASURE 2.8
2/2 rules
4/4
Why we flagged it
Composite raw score 1.00 (2/2 rules matched).
Confidence
60%
▸Evidence · 7 hits— click to view code
regulations/nist-ai-rmf-1.0.yaml:290
pii_redaction_present
View on GitHub →description: "Code redacts or hashes PII before logging or sending to external models" - rule: privacy_documentation weig
src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json:817
pii_redaction_present
View on GitHub →p \"$SCRIPT_DIR/mcp/redaction.js\" \"$TARGET_ABS/mcp/\" cp \"$SCRIPT_DIR/mcp/lib/\"*.js \"$TARGET_ABS/mcp/lib/\" rm -rf \"$TARGET_ABS/mcp/li
src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json:826
pii_redaction_present
View on GitHub →t the proof needed, redact sensitive data, and report responsibly.</p></div> </div> </div> <div class=\"foot\"><span", "rule": "
src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json:835
pii_redaction_present
View on GitHub →h MCP, which writes redacted audit metadata and egress information.</p> </div> <div class=\"code-card\"> <div", "rule": "pii_red
src/data/seed-audits/aud_01KRQE8M7ZDZ6TDM5MTGT9.json:844
pii_redaction_present
View on GitHub →n>Audited requests, redacted URLs, visible egress</span></div> </section> <section class=\"slide\" data-title=\"Egress\"> <", "r
…and 2 more.
Transparency
Don't deceive people2.0/4Partial6 clauses▸
Transparency
Don't deceive peopleSTRONGSubliminal techniques distorting behaviour EU AI Act, Art 5(1)(a)0/1 rules4/4
▸
STRONG
Subliminal techniques distorting behaviour EU AI Act, Art 5(1)(a)
0/1 rules
4/4
Why we flagged it
Composite raw score 0.00 (0/1 rules matched).
Confidence
55%
Suggested fix · we looked for these and found none
- detect_manipulative_prompt_patterns
INADEQUATETransparent operation and instructions for use EU AI Act, Art 131/3 rules1/4
▸
INADEQUATE
Transparent operation and instructions for use EU AI Act, Art 13
1/3 rules
1/4
Why we flagged it
Composite raw score 0.25 (1/3 rules matched). Supporting docs may exist outside the repo.
Confidence
90%
▸Evidence · 3 hits— click to view code
README.md
readme_quality
View on GitHub →2 required sections present
README.md
output_interpretation_guidance
View on GitHub →README.md
limitations_section_present
View on GitHub →Suggested fix · we looked for these and found none
- output_interpretation_guidance
- limitations_section_present
INADEQUATEUsers informed they are interacting with an AI EU AI Act, Art 50(1)1/2 rules1/4
▸
INADEQUATE
Users informed they are interacting with an AI EU AI Act, Art 50(1)
1/2 rules
1/4
Why we flagged it
Composite raw score 0.20 (1/2 rules matched).
Confidence
80%
▸Evidence · 1 hit— click to view code
README.md
ai_disclosure_in_user_facing_strings
View on GitHub →Suggested fix · we looked for these and found none
- ai_disclosure_in_user_facing_strings
ADEQUATEAI-generated content marked as such, machine-readable EU AI Act, Art 50(2)2/2 rules3/4
▸
ADEQUATE
AI-generated content marked as such, machine-readable EU AI Act, Art 50(2)
2/2 rules
3/4
Why we flagged it
Composite raw score 0.82 (2/2 rules matched).
Confidence
78%
▸Evidence · 8 hits— click to view code
.agent/docs/analysis-tiers.md:102
c2pa_or_watermark
View on GitHub →ent provenance | no c2pa imports → ABSENT | "API response contains `aiGenerated:true` / C2PA header" | | GDPR Art 5(1)(c) — PII in logs | gr
.agent/docs/analysis-tiers.md:102
c2pa_or_watermark
View on GitHub →aiGenerated:true` / C2PA header" | | GDPR Art 5(1)(c) — PII in logs | grep `user.email` near `logger.info` | "fake PII sent → grep all captu
.agent/docs/llm-judge-policy.md:78
c2pa_or_watermark
View on GitHub →` | 50(2) | **1** | C2PA / watermark library imports | | `art-50/p3-emotion-biometric-disclosure` | 50(3) | **1** | Deterministic disclosure
.agent/docs/pipeline-design.md:75
c2pa_or_watermark
View on GitHub →ovenance_hooks` | C2PA, watermarking, content labelling | Article 50(2) synthetic content disclosure
.agent/docs/regulations-matrix.md:63
c2pa_or_watermark
View on GitHub →o/text) | C | C2PA / watermarking libraries; metadata writers; output post-processing. | | 50(3) | Emotion-recognition / biometri
…and 3 more.
ABSENTEmotion recognition / biometric categorisation disclosure EU AI Act, Art 50(3)0/1 rules0/4
▸
ABSENT
Emotion recognition / biometric categorisation disclosure EU AI Act, Art 50(3)
0/1 rules
0/4
Why we flagged it
Composite raw score 0.00 (0/1 rules matched).
Confidence
55%
▸Evidence · 1 hit— click to view code
README.md
emotion_or_biometric_disclosure_string
View on GitHub →Suggested fix · we looked for these and found none
- emotion_or_biometric_disclosure_string
ADEQUATEDeepfake content labelled as artificially generated EU AI Act, Art 50(4) skip1/1 rules3/4
▸
ADEQUATE
Deepfake content labelled as artificially generated EU AI Act, Art 50(4)
skip
1/1 rules
3/4
Why we flagged it
Composite raw score 0.70 (1/1 rules matched).
Confidence
85%
▸Evidence · 2 hits— click to view code
.agent/docs/analysis-tiers.md:102
c2pa_or_watermark
View on GitHub →ent provenance | no c2pa imports → ABSENT | "API response contains `aiGenerated:true` / C2PA header" | | GDPR Art 5(1)(c) — PII in logs | gr
.agent/docs/analysis-tiers.md:102
c2pa_or_watermark
View on GitHub →aiGenerated:true` / C2PA header" | | GDPR Art 5(1)(c) — PII in logs | grep `user.email` near `logger.info` | "fake PII sent → grep all captu
Auditability
Actions must be traceable1.8/4Partial5 clauses▸
Auditability
Actions must be traceableINADEQUATETechnical documentation drawn up before placing on market EU AI Act, Art 111/3 rules1/4
▸
INADEQUATE
Technical documentation drawn up before placing on market EU AI Act, Art 11
1/3 rules
1/4
Why we flagged it
Composite raw score 0.15 (1/3 rules matched). Supporting docs may exist outside the repo.
Confidence
80%
▸Evidence · 1 hit— click to view code
README.md
readme_quality
View on GitHub →2 required sections present
Suggested fix · we looked for these and found none
- presence_of_model_card
- architecture_docs
PARTIALAutomatic recording of events over the lifetime EU AI Act, Art 12(1) skip1/3 rules2/4
▸
PARTIAL
Automatic recording of events over the lifetime EU AI Act, Art 12(1)
skip
1/3 rules
2/4
Why we flagged it
Composite raw score 0.58 (1/3 rules matched).
Confidence
100%
▸Evidence · 8 hits— click to view code
scripts/seed-audit.ts:38
log_at_tool_boundary
View on GitHub →x.ts"), content); console.log(` rewrote index.ts (${entries.length} seeds)`); } async function main() { const args = process.argv.slicscripts/seed-audit.ts:64
log_at_tool_boundary
View on GitHub →-1.0"], }; console.log(`\n=== ${owner}/${repo} (id=${input.auditId}) ===`); const t0 = Date.now(); try { const reportscripts/seed-audit.ts:68
log_at_tool_boundary
View on GitHub →evt.kind === "log") console.log(` [${evt.stage}] ${evt.text}`); else if (evt.kind === "stage") console.log(` [${evt.stage}] phase=scripts/seed-audit.ts:69
log_at_tool_boundary
View on GitHub →t.kind === "stage") console.log(` [${evt.stage}] phase=${evt.phase}${evt.durationMs ? ` (${evt.durationMs}ms)` : ""}`); else if (evscripts/seed-audit.ts:70
log_at_tool_boundary
View on GitHub →= "classification") console.log(` ✦ risk=${evt.classification} annex=${evt.annexIii.join("/")} art50=${evt.art50.join("/")}`); else…and 3 more.
Suggested fix · we looked for these and found none
- structured_logging_imported
- logging_persistent_sink
ADEQUATELogging ensures traceability appropriate to risk EU AI Act, Art 12(2) skip2/3 rules3/4
▸
ADEQUATE
Logging ensures traceability appropriate to risk EU AI Act, Art 12(2)
skip
2/3 rules
3/4
Why we flagged it
Composite raw score 0.68 (2/3 rules matched). Supporting docs may exist outside the repo.
Confidence
98%
▸Evidence · 8 hits— click to view code
scripts/seed-audit.ts:38
log_at_tool_boundary
View on GitHub →x.ts"), content); console.log(` rewrote index.ts (${entries.length} seeds)`); } async function main() { const args = process.argv.slicscripts/seed-audit.ts:64
log_at_tool_boundary
View on GitHub →-1.0"], }; console.log(`\n=== ${owner}/${repo} (id=${input.auditId}) ===`); const t0 = Date.now(); try { const reportscripts/seed-audit.ts:68
log_at_tool_boundary
View on GitHub →evt.kind === "log") console.log(` [${evt.stage}] ${evt.text}`); else if (evt.kind === "stage") console.log(` [${evt.stage}] phase=scripts/seed-audit.ts:69
log_at_tool_boundary
View on GitHub →t.kind === "stage") console.log(` [${evt.stage}] phase=${evt.phase}${evt.durationMs ? ` (${evt.durationMs}ms)` : ""}`); else if (evscripts/seed-audit.ts:70
log_at_tool_boundary
View on GitHub →= "classification") console.log(` ✦ risk=${evt.classification} annex=${evt.annexIii.join("/")} art50=${evt.art50.join("/")}`); else…and 3 more.
Suggested fix · we looked for these and found none
- logs_include_request_id
INADEQUATEContext of use established and understood NIST AI RMF, Art MAP 1.1 skip1/2 rules1/4
▸
INADEQUATE
Context of use established and understood NIST AI RMF, Art MAP 1.1
skip
1/2 rules
1/4
Why we flagged it
Composite raw score 0.30 (1/2 rules matched). Supporting docs may exist outside the repo.
Confidence
90%
▸Evidence · 2 hits— click to view code
README.md
readme_quality
View on GitHub →2 required sections present
README.md
output_interpretation_guidance
View on GitHub →Suggested fix · we looked for these and found none
- deployment_context_documented
PARTIALPost-deployment monitoring, appeal and override, change management NIST AI RMF, Art MANAGE 4.1 skip2/4 rules2/4
▸
PARTIAL
Post-deployment monitoring, appeal and override, change management NIST AI RMF, Art MANAGE 4.1
skip
2/4 rules
2/4
Why we flagged it
Composite raw score 0.50 (2/4 rules matched).
Confidence
100%
▸Evidence · 7 hits— click to view code
regulations/eu-ai-act-2024-08.yaml:817
human_in_loop
View on GitHub →in-the-loop hooks: `human_input()`, interrupt nodes in LangGraph, approval-gate functions, manual- review flags, con
regulations/eu-ai-act-2024-08.yaml:838
human_in_loop
View on GitHub →For LangGraph: use `interrupt()` nodes. For custom flows: build an approval-queue pattern. Document where humans can intervene i
regulations/eu-ai-act-2024-08.yaml:902
kill_switch
View on GitHub →ic: - rule: kill_switch_present weight: 0.7 description: | Code contains a documented kill-switch /
regulations/eu-ai-act-2024-08.yaml:906
kill_switch
View on GitHub →sm (function named `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin
regulations/eu-ai-act-2024-08.yaml:906
kill_switch
View on GitHub →med `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that h
…and 2 more.
Suggested fix · we looked for these and found none
- feedback_capture_present
- structured_logging_imported
Accountability
Don't abuse power2.0/4Partial3 clauses▸
Accountability
Don't abuse powerPARTIALDeployer log-retention capability supported EU AI Act, Art 26(6) skip1/1 rules2/4
▸
PARTIAL
Deployer log-retention capability supported EU AI Act, Art 26(6)
skip
1/1 rules
2/4
Why we flagged it
Composite raw score 0.50 (1/1 rules matched). Supporting docs may exist outside the repo.
Confidence
100%
▸Evidence · 2 hits— click to view code
scripts/seed-audit.ts:38
log_at_tool_boundary
View on GitHub →x.ts"), content); console.log(` rewrote index.ts (${entries.length} seeds)`); } async function main() { const args = process.argv.slicscripts/seed-audit.ts:64
log_at_tool_boundary
View on GitHub →-1.0"], }; console.log(`\n=== ${owner}/${repo} (id=${input.auditId}) ===`); const t0 = Date.now(); try { const reportSTRONGRisk management process documented and accountable NIST AI RMF, Art GOVERN 1.42/2 rules4/4
▸
STRONG
Risk management process documented and accountable NIST AI RMF, Art GOVERN 1.4
2/2 rules
4/4
Why we flagged it
Composite raw score 1.00 (2/2 rules matched). Supporting docs may exist outside the repo.
Confidence
60%
▸Evidence · 2 hits— click to view code
RISK_REGISTER.md
presence_of_risk_register
View on GitHub →RISK_REGISTER.md
risk_owner_assignment
View on GitHub →ABSENTOngoing monitoring and periodic review of risk management NIST AI RMF, Art GOVERN 1.50/2 rules0/4
▸
ABSENT
Ongoing monitoring and periodic review of risk management NIST AI RMF, Art GOVERN 1.5
0/2 rules
0/4
Why we flagged it
Composite raw score 0.00 (0/2 rules matched). Supporting docs may exist outside the repo.
Confidence
60%
Suggested fix · we looked for these and found none
- ci_eval_gates
- drift_monitoring_present
Human Oversight
Humans stay in control2.3/4Partial4 clauses▸
Human Oversight
Humans stay in controlPARTIALEffective human oversight designed and built-in EU AI Act, Art 14(1) skip1/3 rules2/4
▸
PARTIAL
Effective human oversight designed and built-in EU AI Act, Art 14(1)
skip
1/3 rules
2/4
Why we flagged it
Composite raw score 0.50 (1/3 rules matched).
Confidence
100%
▸Evidence · 6 hits— click to view code
regulations/eu-ai-act-2024-08.yaml:817
human_in_loop
View on GitHub →in-the-loop hooks: `human_input()`, interrupt nodes in LangGraph, approval-gate functions, manual- review flags, con
regulations/eu-ai-act-2024-08.yaml:838
human_in_loop
View on GitHub →For LangGraph: use `interrupt()` nodes. For custom flows: build an approval-queue pattern. Document where humans can intervene i
src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json:162
human_in_loop
View on GitHub →import ( AIMessage, HumanMessage,", "rule": "langchain_import" }, { "file": "gpt_engineer/core/asrc/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json:171
human_in_loop
View on GitHub →import ( AIMessage, HumanMessage, SystemMessage, messages_from_dict, messages_", "rule": "langchain_import" },
src/data/seed-audits/aud_01KRQE8QXXNMC85QQY8RV5.json:198
human_in_loop
View on GitHub →chain.schema import HumanMessage, SystemMessage from termcolor import colored from gpt_engineer.core.ai import", "rule": "langch
…and 1 more.
Suggested fix · we looked for these and found none
- oversight_ui_present
- tool_calls_have_dry_run
ADEQUATEInterrupt / stop function reachable by overseer EU AI Act, Art 14(4)(d) skip1/2 rules3/4
▸
ADEQUATE
Interrupt / stop function reachable by overseer EU AI Act, Art 14(4)(d)
skip
1/2 rules
3/4
Why we flagged it
Composite raw score 0.70 (1/2 rules matched).
Confidence
90%
▸Evidence · 6 hits— click to view code
regulations/eu-ai-act-2024-08.yaml:902
kill_switch
View on GitHub →ic: - rule: kill_switch_present weight: 0.7 description: | Code contains a documented kill-switch /
regulations/eu-ai-act-2024-08.yaml:906
kill_switch
View on GitHub →sm (function named `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin
regulations/eu-ai-act-2024-08.yaml:906
kill_switch
View on GitHub →med `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that h
regulations/eu-ai-act-2024-08.yaml:907
kill_switch
View on GitHub →stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that halts processing). - ru
regulations/nist-ai-rmf-1.0.yaml:342
kill_switch
View on GitHub →ic: - rule: kill_switch_present weight: 0.6 - rule: feature_flag_for_disable weight: 0.4 descr
…and 1 more.
Suggested fix · we looked for these and found none
- graceful_shutdown_handler
PARTIALAbility to override / reverse the system's output EU AI Act, Art 14(4)(e) skip1/2 rules2/4
▸
PARTIAL
Ability to override / reverse the system's output EU AI Act, Art 14(4)(e)
skip
1/2 rules
2/4
Why we flagged it
Composite raw score 0.60 (1/2 rules matched).
Confidence
100%
▸Evidence · 6 hits— click to view code
regulations/eu-ai-act-2024-08.yaml:817
human_in_loop
View on GitHub →in-the-loop hooks: `human_input()`, interrupt nodes in LangGraph, approval-gate functions, manual- review flags, con
regulations/eu-ai-act-2024-08.yaml:838
human_in_loop
View on GitHub →For LangGraph: use `interrupt()` nodes. For custom flows: build an approval-queue pattern. Document where humans can intervene i
regulations/eu-ai-act-2024-08.yaml:902
kill_switch
View on GitHub →ic: - rule: kill_switch_present weight: 0.7 description: | Code contains a documented kill-switch /
regulations/eu-ai-act-2024-08.yaml:906
kill_switch
View on GitHub →sm (function named `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin
regulations/eu-ai-act-2024-08.yaml:906
kill_switch
View on GitHub →med `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that h
…and 1 more.
Suggested fix · we looked for these and found none
- decisions_are_addressable
PARTIALMechanisms to supersede or deactivate AI systems NIST AI RMF, Art MANAGE 2.3 skip1/2 rules2/4
▸
PARTIAL
Mechanisms to supersede or deactivate AI systems NIST AI RMF, Art MANAGE 2.3
skip
1/2 rules
2/4
Why we flagged it
Composite raw score 0.60 (1/2 rules matched).
Confidence
100%
▸Evidence · 6 hits— click to view code
regulations/eu-ai-act-2024-08.yaml:902
kill_switch
View on GitHub →ic: - rule: kill_switch_present weight: 0.7 description: | Code contains a documented kill-switch /
regulations/eu-ai-act-2024-08.yaml:906
kill_switch
View on GitHub →sm (function named `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin
regulations/eu-ai-act-2024-08.yaml:906
kill_switch
View on GitHub →med `kill_switch`, `emergency_stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that h
regulations/eu-ai-act-2024-08.yaml:907
kill_switch
View on GitHub →stop`, `disable_agent`, a feature flag with explicit disable, an admin endpoint that halts processing). - ru
regulations/nist-ai-rmf-1.0.yaml:342
kill_switch
View on GitHub →ic: - rule: kill_switch_present weight: 0.6 - rule: feature_flag_for_disable weight: 0.4 descr
…and 1 more.
Suggested fix · we looked for these and found none
- feature_flag_for_disable
Fairness
Treat people fairly3.0/4Adequate4 clauses▸
Fairness
Treat people fairlySTRONGExploiting vulnerabilities (age, disability, socio-economic) EU AI Act, Art 5(1)(b)0/1 rules4/4
▸
STRONG
Exploiting vulnerabilities (age, disability, socio-economic) EU AI Act, Art 5(1)(b)
0/1 rules
4/4
Why we flagged it
Composite raw score 0.00 (0/1 rules matched).
Confidence
55%
Suggested fix · we looked for these and found none
- detect_protected_attribute_targeting
STRONGSocial scoring leading to detrimental treatment EU AI Act, Art 5(1)(c)0/1 rules4/4
▸
STRONG
Social scoring leading to detrimental treatment EU AI Act, Art 5(1)(c)
0/1 rules
4/4
Why we flagged it
Composite raw score 0.00 (0/1 rules matched). Supporting docs may exist outside the repo.
Confidence
55%
Suggested fix · we looked for these and found none
- detect_scoring_with_persistent_user_state
ABSENTPredictive policing solely from profiling EU AI Act, Art 5(1)(d)1/1 rules0/4
▸
ABSENT
Predictive policing solely from profiling EU AI Act, Art 5(1)(d)
1/1 rules
0/4
Why we flagged it
Composite raw score 0.76 (1/1 rules matched).
Confidence
79%
▸Evidence · 6 hits— click to view code
regulations/eu-ai-act-2024-08.yaml:199
law_enf_terms
View on GitHub →crime-likelihood / recidivism / "risk to commit X" scores when the input contains only person profile data (no obje
regulations/eu-ai-act-2024-08.yaml:202
law_enf_terms
View on GitHub →names like `crime_risk`, `recidivism_score`, `offender_likelihood` combined with profile inputs. score_mapping: { paregulations/eu-ai-act-2024-08.yaml:202
law_enf_terms
View on GitHub →recidivism_score`, `offender_likelihood` combined with profile inputs. score_mapping: { pass_default: 4, fail_on_match: 0 }src/pipeline/stages/recon.ts:330
law_enf_terms
View on GitHub →ms", pattern: /\b(?:crime_risk|recidivism|offender_likelihood|police_dispatch|criminal_record|sentencing_recommend)\b/gi }, // ----- migr
src/pipeline/stages/recon.ts:330
law_enf_terms
View on GitHub →n: /\b(?:crime_risk|recidivism|offender_likelihood|police_dispatch|criminal_record|sentencing_recommend)\b/gi }, // ----- migration_signa
…and 1 more.
STRONGBiometric categorisation by protected attributes EU AI Act, Art 5(1)(g)0/1 rules4/4
▸
STRONG
Biometric categorisation by protected attributes EU AI Act, Art 5(1)(g)
0/1 rules
4/4
Why we flagged it
Composite raw score 0.00 (0/1 rules matched).
Confidence
55%
Suggested fix · we looked for these and found none
- detect_biometric_categorisation_by_protected_attrs
Security & Governance
Don't destabilize society2.5/4Adequate2 clauses▸
Security & Governance
Don't destabilize societyADEQUATECybersecurity measures appropriate to circumstances EU AI Act, Art 15(5)3/4 rules3/4
▸
ADEQUATE
Cybersecurity measures appropriate to circumstances EU AI Act, Art 15(5)
3/4 rules
3/4
Why we flagged it
Composite raw score 0.80 (3/4 rules matched).
Confidence
90%
▸Evidence · 12 hits— click to view code
regulations/eu-ai-act-2024-08.yaml:344
prompt_injection_defence
View on GitHub →(hallucination, prompt injection, output bias, leakage, capability escalation), mitigation owner, status. Wire eval suite into CI
regulations/eu-ai-act-2024-08.yaml:1121
prompt_injection_defence
View on GitHub →ic: - rule: prompt_injection_defences weight: 0.4 description: | Code includes prompt-injection miti
regulations/eu-ai-act-2024-08.yaml:1124
prompt_injection_defence
View on GitHub →Code includes prompt-injection mitigations: output filters, input sanitisation, instruction-data segregation, system-promp
regulations/eu-ai-act-2024-08.yaml:1135
prompt_injection_defence
View on GitHub →Eval suite includes prompt-injection / adversarial cases" score_mapping: ">=0.85": 4 ">=0.65": 3 ">=0.40": 2 ">=
regulations/eu-ai-act-2024-08.yaml:1143
prompt_injection_defence
View on GitHub →hint: | Add a prompt-injection eval set (e.g. from `promptbench`, `garak`, or your own canonical injection prompts). Sanitise to
…and 7 more.
Suggested fix · we looked for these and found none
- adversarial_eval_present
PARTIALSecurity and resilience evaluated NIST AI RMF, Art MEASURE 2.7 skip2/3 rules2/4
▸
PARTIAL
Security and resilience evaluated NIST AI RMF, Art MEASURE 2.7
skip
2/3 rules
2/4
Why we flagged it
Composite raw score 0.60 (2/3 rules matched).
Confidence
100%
▸Evidence · 12 hits— click to view code
regulations/eu-ai-act-2024-08.yaml:344
prompt_injection_defence
View on GitHub →(hallucination, prompt injection, output bias, leakage, capability escalation), mitigation owner, status. Wire eval suite into CI
regulations/eu-ai-act-2024-08.yaml:1121
prompt_injection_defence
View on GitHub →ic: - rule: prompt_injection_defences weight: 0.4 description: | Code includes prompt-injection miti
regulations/eu-ai-act-2024-08.yaml:1124
prompt_injection_defence
View on GitHub →Code includes prompt-injection mitigations: output filters, input sanitisation, instruction-data segregation, system-promp
regulations/eu-ai-act-2024-08.yaml:1135
prompt_injection_defence
View on GitHub →Eval suite includes prompt-injection / adversarial cases" score_mapping: ">=0.85": 4 ">=0.65": 3 ">=0.40": 2 ">=
regulations/eu-ai-act-2024-08.yaml:1143
prompt_injection_defence
View on GitHub →hint: | Add a prompt-injection eval set (e.g. from `promptbench`, `garak`, or your own canonical injection prompts). Sanitise to
…and 7 more.
Suggested fix · we looked for these and found none
- adversarial_eval_present