Meridian Compliance Report

crewAI

Generated 21 July 2026, 18:10 UTC
Report a27e2d0762e6c24d8d38a9dd
Meridian provides automated compliance assessments and recommendations, not legal advice. Final compliance determinations should be reviewed by qualified legal, compliance, or security professionals where required.

Repository Summary

Applicable Controls
122
Controls determined to apply to this repository
Automatically Verified
6
Requires Documentation
46
Requires Operational Evidence
12
Requires Code Changes
58
Security Maturity
0.07
0.0 - 1.0 scale
Risk Score
0.38
Severity-weighted violations

Business Profile

In productionTrue
Stores personal dataTrue
Uses AITrue
Primary jurisdictionUnited States
Processes paymentsFalse
Regulated financial entityFalse

Compliance Scope

Applicable Regulations

EU AI ActAI Governance & Responsible AI
Your repository deploys AI models or AI-powered systems.
Required: matched on ai_usage.
SOC 2 Trust Services CriteriaTrust & Assurance
Your application is in production and handles customer data requiring independent assurance.
Optional: base condition met, but no additional signal beyond production.

Not Applicable Regulations

DPDPA 2023Privacy & Data Protection
Excluded: 'primary_jurisdiction' does not match the condition required for this framework.
DPDPA Rules, 2025Privacy & Data Protection
Excluded: 'primary_jurisdiction' does not match the condition required for this framework.
GDPRPrivacy & Data Protection
Excluded: 'primary_jurisdiction' does not match the condition required for this framework.
RBI FREE-AI FrameworkAI Governance & Responsible AI
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
SEBI AI/ML GuidelinesAI Governance & Responsible AI
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
RBI Digital Payment Security ControlsPayments & Financial Security
Excluded: 'processes_payments' does not match the condition required for this framework.
PCI DSSPayments & Financial Security
Excluded: 'processes_payments' does not match the condition required for this framework.
RBI IT Governance & Risk ControlsCybersecurity & Operational Security
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
RBI NBFC IT FrameworkFinancial Sector Regulations
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
RBI NBFC Outsourcing DirectionsFinancial Sector Regulations
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
RBI Outsourcing DirectionsFinancial Sector Regulations
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
RBI Payments Banks Outsourcing DirectionsFinancial Sector Regulations
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
RBI Small Finance Banks Outsourcing DirectionsFinancial Sector Regulations
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
SEBI Cybersecurity FrameworkCybersecurity & Operational Security
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
CERT-In DirectionsCybersecurity & Operational Security
Excluded: 'primary_jurisdiction' does not match the condition required for this framework.

What Meridian Detected

Authentication Cross Border Transfer Controls Data Classification

Top Priorities

  1. Access Control (CRITICAL) — Can the organization (as a third-country provider) demonstrate that it has appointed an authorised representative in the Union and that the representative fulfils all required tasks?
  2. Encryption At Rest (CRITICAL) — Can the organization demonstrate that it discontinues logical and physical protections over physical assets only after data and software are no longer recoverable?
  3. Encryption In Transit (CRITICAL) — Can the organization demonstrate that it discontinues logical and physical protections over physical assets only after data and software are no longer recoverable?
  4. Key Management (CRITICAL) — Can the organization demonstrate that it discontinues logical and physical protections over physical assets only after data and software are no longer recoverable?
  5. Data Subject Request Handling (HIGH) — Can the organization demonstrate that it has implemented appropriate data governance and management practices for training, validation, and testing data sets of high-risk AI systems?

Full breakdown by effort below.

Recommended Actions

Quick Wins

  • Access Control (CRITICAL)
    Can the organization (as a third-country provider) demonstrate that it has appointed an authorised representative in the Union and that the representative fulfils all required tasks?
  • Encryption At Rest (CRITICAL)
    Can the organization demonstrate that it discontinues logical and physical protections over physical assets only after data and software are no longer recoverable?
  • Encryption In Transit (CRITICAL)
    Can the organization demonstrate that it discontinues logical and physical protections over physical assets only after data and software are no longer recoverable?

Medium Effort

  • Key Management (CRITICAL)
    Can the organization demonstrate that it discontinues logical and physical protections over physical assets only after data and software are no longer recoverable?
  • Data Subject Request Handling (HIGH)
    Can the organization demonstrate that it has implemented appropriate data governance and management practices for training, validation, and testing data sets of high-risk AI systems?
  • Consent Management (HIGH)
    Can the organization demonstrate that it has implemented appropriate safeguards when processing special categories of personal data for bias detection and correction?
  • Audit Logging (HIGH)
    Can the organization demonstrate that high-risk AI systems have logging capabilities for automatic event recording throughout their lifetime?
  • Privileged Access Management (HIGH)
    Can the organization demonstrate that high-risk AI systems are designed for effective human oversight throughout their use?
  • Backup And Recovery (HIGH)
    Can the organization demonstrate that high-risk AI systems are resilient to errors and have measures to address feedback loops?
  • Data Retention (HIGH)
    Can the organization demonstrate that it retains automatically generated logs for at least six months (or as otherwise required) for high-risk AI systems?
  • Incident Response Plan (HIGH)
    Can the organization demonstrate that it authorizes, designs, implements, maintains, and monitors environmental protections, backup processes, and recovery infrastructure?
  • Records Of Processing (MEDIUM)
    Can the organization demonstrate that it has drawn up and maintains up-to-date technical documentation for high-risk AI systems as required by Annex IV?
  • Maker Checker (MEDIUM)
    Can the organization demonstrate that high-risk AI systems are designed for effective human oversight throughout their use?
  • Model Testing (MEDIUM)
    Can the organization demonstrate that high-risk AI systems achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle?
  • Business Impact Analysis (MEDIUM)
    Can the organization demonstrate that high-risk AI systems are resilient to errors and have measures to address feedback loops?
  • Data Lifecycle Management (MEDIUM)
    Can the organization demonstrate that it retains all required documentation for 10 years after placing a high-risk AI system on the market?
  • Grievance Redressal (MEDIUM)
    Can the organization demonstrate that it has procedures to handle complaints regarding infringement of the AI Act?
  • Data Masking (MEDIUM)
    Can the organization demonstrate that it selects and develops general control activities over technology to support the achievement of objectives?
  • Data Classification (MEDIUM)
    Can the organization demonstrate that it discontinues logical and physical protections over physical assets only after data and software are no longer recoverable?
  • Policy Management (LOW)
    Can the organization demonstrate that it has implemented appropriate data governance and management practices for training, validation, and testing data sets of high-risk AI systems?
  • Security Awareness Training (LOW)
    Can the organization demonstrate that high-risk AI systems are designed for effective human oversight throughout their use?
  • Data Quality Management (INFORMATIONAL)
    Can the organization demonstrate that high-risk AI systems achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle?

Strategic Initiatives

  • AI Risk Assessment (HIGH)
    Can the organization demonstrate that high-risk AI systems are designed for effective human oversight throughout their use?
  • Bias Detection (HIGH)
    Can the organization demonstrate that high-risk AI systems achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle?
  • Data Loss Prevention (HIGH)
    Can the organization demonstrate that high-risk AI systems achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle?
  • Data Protection Impact Assessment (HIGH)
    Can the organization demonstrate that it has established, implemented, documented, and maintained a risk management system for high-risk AI systems throughout their lifecycle?
  • Privacy Impact Assessment (HIGH)
    Can the organization demonstrate that it has established, implemented, documented, and maintained a risk management system for high-risk AI systems throughout their lifecycle?
  • Model Monitoring (MEDIUM)
    Can the organization demonstrate that high-risk AI systems achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle?
  • Physical Access Control (MEDIUM)
    Can the organization demonstrate that high-risk AI systems achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle?

Compliance Roadmap

Now · Quick Wins

  • Access Control
  • Encryption At Rest
  • Encryption In Transit

Next · Medium Effort

  • Key Management
  • Data Subject Request Handling
  • Consent Management
  • Audit Logging
  • Privileged Access Management
  • Backup And Recovery
  • Data Retention
  • Incident Response Plan
  • Records Of Processing
  • Maker Checker
  • Model Testing
  • Business Impact Analysis
  • Data Lifecycle Management
  • Grievance Redressal
  • Data Masking
  • Data Classification
  • Policy Management
  • Security Awareness Training
  • Data Quality Management

Later · Strategic Initiatives

  • AI Risk Assessment
  • Bias Detection
  • Data Loss Prevention
  • Data Protection Impact Assessment
  • Privacy Impact Assessment
  • Model Monitoring
  • Physical Access Control

Next Steps

Start with Top Priorities above, then work through the full Quick Wins/Medium Effort/Strategic Initiatives breakdown. Technical Findings below show exactly where each gap was detected in your repository; export to PDF/HTML for a shareable version, or JSON/SARIF to feed a CI pipeline.

Technical Findings (54)

Showing top 50 of 54, ranked by severity then confidence. Export to JSON or SARIF for the complete list.

Critical SOC2_CC6_6 — External Threat Protection Requires Code Changes
Satisfied: Data Classification
Missing: Access Control, Audit Logging, Encryption At Rest, Encryption In Transit, Key Management
lib/crewai/src/crewai/rag/embeddings/providers/ibm/types.py:32-32 (data_classification)
lib/crewai-tools/src/crewai_tools/tools/snowflake_search_tool/snowflake_search_tool.py:47-47 (data_classification)
lib/crewai/src/crewai/a2a/utils/task.py:74-74 (data_classification)
lib/crewai/src/crewai/a2a/auth/client_schemes.py:194-194 (data_classification)
lib/crewai/src/crewai/rag/embeddings/providers/ibm/watsonx.py:137-143 (data_classification)
lib/crewai/src/crewai/a2a/auth/client_schemes.py:225-225 (data_classification)
Critical SOC2_CC6_8 — Unauthorized and Malicious Software Control Requires Code Changes
Satisfied: Data Classification
Missing: Access Control, Audit Logging, Encryption At Rest, Encryption In Transit, Key Management
lib/crewai/src/crewai/rag/embeddings/providers/ibm/types.py:32-32 (data_classification)
lib/crewai-tools/src/crewai_tools/tools/snowflake_search_tool/snowflake_search_tool.py:47-47 (data_classification)
lib/crewai/src/crewai/a2a/utils/task.py:74-74 (data_classification)
lib/crewai/src/crewai/a2a/auth/client_schemes.py:194-194 (data_classification)
lib/crewai/src/crewai/rag/embeddings/providers/ibm/watsonx.py:137-143 (data_classification)
lib/crewai/src/crewai/a2a/auth/client_schemes.py:225-225 (data_classification)
Critical EU_AI_ART_20_001 — Corrective Actions and Duty of Information Requires Code Changes
Missing: Audit Logging
Critical EU_AI_ART_27_001 — Fundamental Rights Impact Assessment Requires Code Changes
Missing: Consent Management
Critical EU_AI_ART_5_001 — Prohibition of Subliminal Manipulative Techniques Requires Code Changes
Missing: Consent Management
Critical EU_AI_ART_5_002 — Prohibition of Exploiting Vulnerabilities Requires Code Changes
Missing: Consent Management
Critical EU_AI_ART_5_003 — Prohibition of Social Scoring Requires Code Changes
Missing: Consent Management
Critical EU_AI_ART_5_004 — Prohibition of Predictive Policing Risk Assessments Based Solely on Profiling Requires Code Changes
Missing: Consent Management
Critical EU_AI_ART_5_006 — Prohibition of Emotion Recognition in Workplace and Education Requires Code Changes
Missing: Consent Management
Critical EU_AI_ART_5_007 — Prohibition of Biometric Categorisation for Sensitive Characteristics Requires Code Changes
Missing: Consent Management
Critical EU_AI_ART_5_008 — Restrictions on Real-Time Remote Biometric Identification for Law Enforcement Requires Code Changes
Missing: Consent Management
Critical EU_AI_ART_73_001 — Reporting of Serious Incidents Requires Code Changes
Missing: Audit Logging
Critical SOC2_CC7_3 — Security Event Evaluation Requires Code Changes
Missing: Audit Logging
Critical SOC2_CC7_4 — Incident Response Program Execution Requires Code Changes
Missing: Audit Logging
Critical SOC2_P6_6 — Notification of Breaches and Incidents Requires Code Changes
Missing: Audit Logging, Consent Management
High SOC2_P3_1 — Collection of Personal Information Requires Code Changes
Satisfied: Data Classification
Missing: Access Control, Consent Management, Encryption At Rest, Encryption In Transit, Key Management
lib/crewai/src/crewai/rag/embeddings/providers/ibm/types.py:32-32 (data_classification)
lib/crewai-tools/src/crewai_tools/tools/snowflake_search_tool/snowflake_search_tool.py:47-47 (data_classification)
lib/crewai/src/crewai/a2a/utils/task.py:74-74 (data_classification)
lib/crewai/src/crewai/a2a/auth/client_schemes.py:194-194 (data_classification)
lib/crewai/src/crewai/rag/embeddings/providers/ibm/watsonx.py:137-143 (data_classification)
lib/crewai/src/crewai/a2a/auth/client_schemes.py:225-225 (data_classification)
High SOC2_P4_1 — Limitation of Personal Information Use Requires Code Changes
Satisfied: Data Classification
Missing: Access Control, Consent Management, Encryption At Rest, Encryption In Transit, Key Management
lib/crewai/src/crewai/rag/embeddings/providers/ibm/types.py:32-32 (data_classification)
lib/crewai-tools/src/crewai_tools/tools/snowflake_search_tool/snowflake_search_tool.py:47-47 (data_classification)
lib/crewai/src/crewai/a2a/utils/task.py:74-74 (data_classification)
lib/crewai/src/crewai/a2a/auth/client_schemes.py:194-194 (data_classification)
lib/crewai/src/crewai/rag/embeddings/providers/ibm/watsonx.py:137-143 (data_classification)
lib/crewai/src/crewai/a2a/auth/client_schemes.py:225-225 (data_classification)
High SOC2_P5_1 — Data Subject Access to Personal Information Requires Code Changes
Satisfied: Data Classification
Missing: Access Control, Consent Management, Encryption At Rest, Encryption In Transit, Key Management
lib/crewai/src/crewai/rag/embeddings/providers/ibm/types.py:32-32 (data_classification)
lib/crewai-tools/src/crewai_tools/tools/snowflake_search_tool/snowflake_search_tool.py:47-47 (data_classification)
lib/crewai/src/crewai/a2a/utils/task.py:74-74 (data_classification)
lib/crewai/src/crewai/a2a/auth/client_schemes.py:194-194 (data_classification)
lib/crewai/src/crewai/rag/embeddings/providers/ibm/watsonx.py:137-143 (data_classification)
lib/crewai/src/crewai/a2a/auth/client_schemes.py:225-225 (data_classification)
High SOC2_CC6_5 — Discontinuation of Protections Requires Code Changes
Satisfied: Data Classification, Data Lifecycle Management
Missing: Access Control, Encryption At Rest, Encryption In Transit, Key Management
lib/crewai/src/crewai/rag/embeddings/providers/ibm/types.py:32-32 (data_classification)
lib/crewai-tools/src/crewai_tools/tools/snowflake_search_tool/snowflake_search_tool.py:47-47 (data_minimization_module_fanin)
lib/crewai-tools/src/crewai_tools/tools/snowflake_search_tool/snowflake_search_tool.py:47-47 (data_classification)
lib/crewai/src/crewai/a2a/utils/task.py:74-74 (data_minimization_module_fanin)
lib/crewai/src/crewai/a2a/utils/task.py:74-74 (data_classification)
lib/crewai/src/crewai/rag/embeddings/providers/ibm/types.py:32-32 (data_minimization_module_fanin)
lib/crewai/src/crewai/a2a/auth/client_schemes.py:194-194 (data_classification)
lib/crewai/src/crewai/rag/embeddings/providers/ibm/watsonx.py:137-143 (data_classification)
lib/crewai/src/crewai/a2a/auth/client_schemes.py:225-225 (data_classification)
lib/crewai/src/crewai/rag/embeddings/providers/ibm/watsonx.py:137-143 (data_minimization_module_fanin)
High EU_AI_ART_18_001 — Documentation Keeping Requires Code Changes
Satisfied: Data Lifecycle Management
lib/crewai-tools/src/crewai_tools/tools/snowflake_search_tool/snowflake_search_tool.py:47-47 (data_minimization_module_fanin)
lib/crewai/src/crewai/a2a/utils/task.py:74-74 (data_minimization_module_fanin)
lib/crewai/src/crewai/rag/embeddings/providers/ibm/types.py:32-32 (data_minimization_module_fanin)
lib/crewai/src/crewai/rag/embeddings/providers/ibm/watsonx.py:137-143 (data_minimization_module_fanin)
High EU_AI_ART_19_001 — Retention of Automatically Generated Logs Requires Code Changes
Satisfied: Data Lifecycle Management
Missing: Audit Logging, Data Retention
lib/crewai-tools/src/crewai_tools/tools/snowflake_search_tool/snowflake_search_tool.py:47-47 (data_minimization_module_fanin)
lib/crewai/src/crewai/a2a/utils/task.py:74-74 (data_minimization_module_fanin)
lib/crewai/src/crewai/rag/embeddings/providers/ibm/types.py:32-32 (data_minimization_module_fanin)
lib/crewai/src/crewai/rag/embeddings/providers/ibm/watsonx.py:137-143 (data_minimization_module_fanin)
High SOC2_C1_2 — Disposal of Confidential Information Requires Code Changes
Satisfied: Data Lifecycle Management
lib/crewai-tools/src/crewai_tools/tools/snowflake_search_tool/snowflake_search_tool.py:47-47 (data_minimization_module_fanin)
lib/crewai/src/crewai/a2a/utils/task.py:74-74 (data_minimization_module_fanin)
lib/crewai/src/crewai/rag/embeddings/providers/ibm/types.py:32-32 (data_minimization_module_fanin)
lib/crewai/src/crewai/rag/embeddings/providers/ibm/watsonx.py:137-143 (data_minimization_module_fanin)
High SOC2_P4_2 — Retention of Personal Information Requires Code Changes
Satisfied: Data Lifecycle Management
Missing: Data Retention
lib/crewai-tools/src/crewai_tools/tools/snowflake_search_tool/snowflake_search_tool.py:47-47 (data_minimization_module_fanin)
lib/crewai/src/crewai/a2a/utils/task.py:74-74 (data_minimization_module_fanin)
lib/crewai/src/crewai/rag/embeddings/providers/ibm/types.py:32-32 (data_minimization_module_fanin)
lib/crewai/src/crewai/rag/embeddings/providers/ibm/watsonx.py:137-143 (data_minimization_module_fanin)
High SOC2_P4_3 — Disposal of Personal Information Requires Code Changes
Satisfied: Data Lifecycle Management
lib/crewai-tools/src/crewai_tools/tools/snowflake_search_tool/snowflake_search_tool.py:47-47 (data_minimization_module_fanin)
lib/crewai/src/crewai/a2a/utils/task.py:74-74 (data_minimization_module_fanin)
lib/crewai/src/crewai/rag/embeddings/providers/ibm/types.py:32-32 (data_minimization_module_fanin)
lib/crewai/src/crewai/rag/embeddings/providers/ibm/watsonx.py:137-143 (data_minimization_module_fanin)
High EU_AI_ART_10_003 — Processing of Special Categories of Personal Data for Bias Detection Requires Code Changes
Missing: Consent Management
High EU_AI_ART_12_001 — Logging Capabilities Requires Code Changes
Missing: Audit Logging
High EU_AI_ART_13_001 — Transparency and Instructions for Use Requires Code Changes
Missing: Consent Management
High EU_AI_ART_22_001 — Authorised Representative of Providers Established in Third Countries Requires Code Changes
Missing: Access Control
High EU_AI_ART_27_002 — Notification of Fundamental Rights Impact Assessment Requires Code Changes
Missing: Audit Logging
High EU_AI_ART_50_001 — Transparency - Interaction with AI Systems Requires Code Changes
Missing: Consent Management
High EU_AI_ART_50_003 — Transparency - Emotion Recognition and Biometric Categorisation Requires Code Changes
Missing: Consent Management
High EU_AI_ART_50_004 — Disclosure of Deep Fakes and AI-Generated Text Requires Code Changes
Missing: Consent Management
High EU_AI_ART_54_001 — Authorised Representatives of Providers of General-Purpose AI Models Requires Code Changes
Missing: Access Control
High EU_AI_ART_72_001 — Post-Market Monitoring System Requires Code Changes
Missing: Audit Logging
High EU_AI_ART_86_001 — Right to Explanation of Individual Decision-Making Requires Code Changes
Missing: Consent Management
High SOC2_A1_3 — Recovery Plan Testing Requires Code Changes
Missing: Audit Logging
High SOC2_CC4_1 — Ongoing and Separate Evaluations Requires Code Changes
Missing: Audit Logging
High SOC2_CC4_2 — Evaluation and Communication of Deficiencies Requires Code Changes
Missing: Audit Logging
High SOC2_CC7_1 — Detection and Monitoring of Vulnerabilities Requires Code Changes
Missing: Audit Logging
High SOC2_CC7_2 — Anomaly Monitoring and Analysis Requires Code Changes
Missing: Audit Logging
High SOC2_CC7_5 — Recovery from Security Incidents Requires Code Changes
Missing: Audit Logging
High SOC2_CC8_1 — Change Management Requires Code Changes
Missing: Audit Logging
High SOC2_CC9_2 — Vendor and Business Partner Risk Management Requires Code Changes
Missing: Access Control
High SOC2_P1_1 — Privacy Notice to Data Subjects Requires Code Changes
Missing: Consent Management
High SOC2_P1_2 — Privacy Notice Maintenance Requires Code Changes
Missing: Consent Management
High SOC2_P2_1 — Choice and Consent Communication Requires Code Changes
Missing: Consent Management
High SOC2_P3_2 — Explicit Consent for Collection Requires Code Changes
Missing: Consent Management
High SOC2_P5_2 — Correction of Personal Information Requires Code Changes
Missing: Consent Management
High SOC2_P6_1 — Disclosure of Personal Information to Third Parties Requires Code Changes
Missing: Access Control, Consent Management
High SOC2_P6_2 — Record of Authorized Disclosures Requires Code Changes
Missing: Audit Logging

Repository Intelligence Profile

1272 files · 294129 lines · complexity 0.96

languagepython languagejavascript authAuthentication encryptionEncryption iacGitHub Actions ai_frameworkCrewAI monitoringOpenTelemetry vector_databaseChromaDB databaseMySQL databasePostgreSQL ai_frameworkOpenAI SDK vector_databaseQdrant databaseSQL (via SQLAlchemy)

AI Governance Summary

Critical AI Findings
23
AI frameworksCrewAI, OpenAI SDK
AI infrastructurenone detected
Vector databasesChromaDB, Qdrant
Notebooks0
AI regulations evaluatedEU Artificial Intelligence Act

Not mapped (no real control data available): ISO_42001, NIST_AI_RMF, OECD_AI_PRINCIPLES