Meridian Compliance Report

continue

Generated 22 July 2026, 11:32 UTC
Report 706782afbd63ddcad48382e3
Meridian provides automated compliance assessments and recommendations, not legal advice. Final compliance determinations should be reviewed by qualified legal, compliance, or security professionals where required.

Executive Summary

Applicable Controls
60
Controls determined to apply to this repository
Implemented
0
Requires Documentation
26
Requires Operational Evidence
11
Code Improvement Recommended
23

Repository Overview

In ProductionFalse

Technology Stack

1874 files · 314603 lines

Languagesgo, java, javascript, jsx, python, tsx, typescript
FrameworksExpress, FastAPI, Next.js, React
CI/CD & IaCDocker, GitHub Actions, GitLab CI

Business Signals

Stores personal dataTrue
Uses AITrue
Primary jurisdictionUnited States
Processes paymentsFalse
Regulated financial entityFalse

What Meridian Understood

This repository features a multi-language structure using Go, Java, JavaScript, JSX, Python, TypeScript, along with web frameworks including Express, FastAPI, Next.js, and React. It integrates AI via the OpenAI SDK, mainly destined for runtime in Dockerized environments, controlled via GitHub Actions and GitLab CI.

Architecture: Web application with AI integration

Compliance Scope

Applicable Regulations

EU AI ActAI Governance & Responsible AI
Your repository deploys AI models or AI-powered systems.
Required: matched on ai_usage.

Not Applicable Regulations

DPDPA 2023Privacy & Data Protection
Excluded: 'primary_jurisdiction' does not match the condition required for this framework.
DPDPA Rules, 2025Privacy & Data Protection
Excluded: 'primary_jurisdiction' does not match the condition required for this framework.
GDPRPrivacy & Data Protection
Excluded: 'primary_jurisdiction' does not match the condition required for this framework.
RBI FREE-AI FrameworkAI Governance & Responsible AI
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
SEBI AI/ML GuidelinesAI Governance & Responsible AI
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
RBI Digital Payment Security ControlsPayments & Financial Security
Excluded: 'processes_payments' does not match the condition required for this framework.
PCI DSSPayments & Financial Security
Excluded: 'processes_payments' does not match the condition required for this framework.
RBI IT Governance & Risk ControlsCybersecurity & Operational Security
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
RBI NBFC IT FrameworkFinancial Sector Regulations
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
RBI NBFC Outsourcing DirectionsFinancial Sector Regulations
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
RBI Outsourcing DirectionsFinancial Sector Regulations
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
RBI Payments Banks Outsourcing DirectionsFinancial Sector Regulations
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
RBI Small Finance Banks Outsourcing DirectionsFinancial Sector Regulations
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
SEBI Cybersecurity FrameworkCybersecurity & Operational Security
Excluded: 'regulated_financial_entity' does not match the condition required for this framework.
CERT-In DirectionsCybersecurity & Operational Security
Excluded: 'primary_jurisdiction' does not match the condition required for this framework.
SOC 2 Trust Services CriteriaTrust & Assurance
Excluded: 'production' does not match the condition required for this framework.

Compliance Readiness

Implemented

Authentication Cross Border Transfer Controls Data Classification Data Lifecycle Management

Code Improvement Recommended

Access Control Audit Logging Consent Management Data Retention Encryption At Rest Encryption In Transit Key Management

Requires Documentation

Asset Inventory Backup And Recovery Business Impact Analysis Configuration Management Data Deletion Data Masking Data Protection Impact Assessment Data Subject Request Handling Grievance Redressal Incident Response Plan Information Security Policy Log Retention Policy Management Privacy Impact Assessment Records Of Processing

Requires Operational Evidence

AI Risk Assessment Access Review BCP And DR Testing Bias Detection Change Management Data Loss Prevention Data Quality Management Governance Framework Incident Detection Maker Checker Model Monitoring Model Testing Patch Management Penetration Testing Physical Access Control Privileged Access Management Regulatory Change Monitoring Regulatory Reporting SOC Operations Security Awareness Training Third Party Risk Assessment Vendor Contract Management Vulnerability Scanning

Enterprise Readiness

Detected

Authentication

Recommended Improvements

Access Control Audit Logging Encryption At Rest Encryption In Transit Key Management Data Retention

Operational Requirements

Privileged Access Management BCP And DR Testing Penetration Testing Third Party Risk Assessment Vendor Contract Management Security Awareness Training

Documentation Required

Incident Response Plan Information Security Policy

SOC 2 Scope

The subset of the capabilities above that SOC 2's own controls actually reach.

Detected

Authentication

Recommended Improvements

Access Control Audit Logging Encryption At Rest Encryption In Transit Key Management Data Retention

Operational Requirements

Privileged Access Management BCP And DR Testing Penetration Testing Third Party Risk Assessment Vendor Contract Management Security Awareness Training

Documentation Required

Incident Response Plan

AI Governance

Critical AI Findings
23
AI frameworksOpenAI SDK
AI infrastructurenone detected
Vector databasesnone detected
Notebooks1
AI regulations evaluatedEU Artificial Intelligence Act

Not mapped (no real control data available): ISO_42001, NIST_AI_RMF, OECD_AI_PRINCIPLES

Deployment Profile

Hosted LLM usage

AI Governance Posture

Replaces a bare AI maturity score with the actual capabilities checked.

Requires Operational Processes

Governance Framework AI Risk Assessment Model Monitoring Model Testing Bias Detection Maker Checker Penetration Testing

Code Improvement Recommended

Audit Logging

Top Priorities

  1. Access Control (CRITICAL) — Can the organization (as a third-country provider) demonstrate that it has appointed an authorised representative in the Union and that the representative fulfils all required tasks?
    Improves compliance posture for: EU AI Act.
  2. Data Subject Request Handling (HIGH) — Can the organization demonstrate that it has implemented appropriate data governance and management practices for training, validation, and testing data sets of high-risk AI systems?
    Improves compliance posture for: EU AI Act.
  3. Consent Management (HIGH) — Can the organization demonstrate that it has implemented appropriate safeguards when processing special categories of personal data for bias detection and correction?
    Improves compliance posture for: EU AI Act.
  4. Audit Logging (HIGH) — Can the organization demonstrate that high-risk AI systems have logging capabilities for automatic event recording throughout their lifetime?
    Improves compliance posture for: EU AI Act.
  5. Privileged Access Management (HIGH) — Can the organization demonstrate that high-risk AI systems are designed for effective human oversight throughout their use?
    Improves compliance posture for: EU AI Act.

Full breakdown by effort below.

Recommended Actions

Quick Wins

  • Access Control (CRITICAL)
    Can the organization (as a third-country provider) demonstrate that it has appointed an authorised representative in the Union and that the representative fulfils all required tasks?
    Improves compliance posture for: EU AI Act.

Medium Effort

  • Data Subject Request Handling (HIGH)
    Can the organization demonstrate that it has implemented appropriate data governance and management practices for training, validation, and testing data sets of high-risk AI systems?
    Improves compliance posture for: EU AI Act.
  • Consent Management (HIGH)
    Can the organization demonstrate that it has implemented appropriate safeguards when processing special categories of personal data for bias detection and correction?
    Improves compliance posture for: EU AI Act.
  • Audit Logging (HIGH)
    Can the organization demonstrate that high-risk AI systems have logging capabilities for automatic event recording throughout their lifetime?
    Improves compliance posture for: EU AI Act.
  • Privileged Access Management (HIGH)
    Can the organization demonstrate that high-risk AI systems are designed for effective human oversight throughout their use?
    Improves compliance posture for: EU AI Act.
  • Backup And Recovery (HIGH)
    Can the organization demonstrate that high-risk AI systems are resilient to errors and have measures to address feedback loops?
    Improves compliance posture for: EU AI Act.
  • Data Retention (HIGH)
    Can the organization demonstrate that it retains automatically generated logs for at least six months (or as otherwise required) for high-risk AI systems?
    Improves compliance posture for: EU AI Act.
  • Records Of Processing (MEDIUM)
    Can the organization demonstrate that it has drawn up and maintains up-to-date technical documentation for high-risk AI systems as required by Annex IV?
    Improves compliance posture for: EU AI Act.
  • Maker Checker (MEDIUM)
    Can the organization demonstrate that high-risk AI systems are designed for effective human oversight throughout their use?
    Improves compliance posture for: EU AI Act.
  • Model Testing (MEDIUM)
    Can the organization demonstrate that high-risk AI systems achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle?
    Improves compliance posture for: EU AI Act.
  • Business Impact Analysis (MEDIUM)
    Can the organization demonstrate that high-risk AI systems are resilient to errors and have measures to address feedback loops?
    Improves compliance posture for: EU AI Act.
  • Data Lifecycle Management (MEDIUM)
    Can the organization demonstrate that it retains all required documentation for 10 years after placing a high-risk AI system on the market?
    Improves compliance posture for: EU AI Act.
  • Grievance Redressal (MEDIUM)
    Can the organization demonstrate that it has procedures to handle complaints regarding infringement of the AI Act?
    Improves compliance posture for: EU AI Act.
  • Policy Management (LOW)
    Can the organization demonstrate that it has implemented appropriate data governance and management practices for training, validation, and testing data sets of high-risk AI systems?
    Improves compliance posture for: EU AI Act.
  • Security Awareness Training (LOW)
    Can the organization demonstrate that high-risk AI systems are designed for effective human oversight throughout their use?
    Improves compliance posture for: EU AI Act.
  • Data Quality Management (INFORMATIONAL)
    Can the organization demonstrate that high-risk AI systems achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle?
    Improves compliance posture for: EU AI Act.

Strategic Initiatives

  • AI Risk Assessment (HIGH)
    Can the organization demonstrate that high-risk AI systems are designed for effective human oversight throughout their use?
    Improves compliance posture for: EU AI Act.
  • Bias Detection (HIGH)
    Can the organization demonstrate that high-risk AI systems achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle?
    Improves compliance posture for: EU AI Act.
  • Data Loss Prevention (HIGH)
    Can the organization demonstrate that high-risk AI systems achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle?
    Improves compliance posture for: EU AI Act.
  • Privacy Impact Assessment (HIGH)
    Can the organization demonstrate that it has established, implemented, documented, and maintained a risk management system for high-risk AI systems throughout their lifecycle?
    Improves compliance posture for: EU AI Act.
  • Data Protection Impact Assessment (HIGH)
    Can the organization demonstrate that it has established, implemented, documented, and maintained a risk management system for high-risk AI systems throughout their lifecycle?
    Improves compliance posture for: EU AI Act.
  • Physical Access Control (MEDIUM)
    Can the organization demonstrate that high-risk AI systems achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle?
    Improves compliance posture for: EU AI Act.
  • Model Monitoring (MEDIUM)
    Can the organization demonstrate that high-risk AI systems achieve appropriate levels of accuracy, robustness, and cybersecurity throughout their lifecycle?
    Improves compliance posture for: EU AI Act.

Compliance Roadmap

Now · Quick Wins

  • Access Control

Next · Medium Effort

  • Data Subject Request Handling
  • Consent Management
  • Audit Logging
  • Privileged Access Management
  • Backup And Recovery
  • Data Retention
  • Records Of Processing
  • Maker Checker
  • Model Testing
  • Business Impact Analysis
  • Data Lifecycle Management
  • Grievance Redressal
  • Policy Management
  • Security Awareness Training
  • Data Quality Management

Later · Strategic Initiatives

  • AI Risk Assessment
  • Bias Detection
  • Data Loss Prevention
  • Privacy Impact Assessment
  • Data Protection Impact Assessment
  • Physical Access Control
  • Model Monitoring

Next Steps

Start with Top Priorities above, then work through the full Quick Wins/Medium Effort/Strategic Initiatives breakdown. Technical Findings below show exactly where each gap was detected in your repository; export to PDF/HTML for a shareable version, or JSON/SARIF to feed a CI pipeline.

Technical Findings (23)

Critical EU_AI_ART_20_001 — Corrective Actions and Duty of Information Code Improvement Recommended
Missing: Audit Logging
Critical EU_AI_ART_27_001 — Fundamental Rights Impact Assessment Code Improvement Recommended
Missing: Consent Management
Critical EU_AI_ART_5_001 — Prohibition of Subliminal Manipulative Techniques Code Improvement Recommended
Missing: Consent Management
Critical EU_AI_ART_5_002 — Prohibition of Exploiting Vulnerabilities Code Improvement Recommended
Missing: Consent Management
Critical EU_AI_ART_5_003 — Prohibition of Social Scoring Code Improvement Recommended
Missing: Consent Management
Critical EU_AI_ART_5_004 — Prohibition of Predictive Policing Risk Assessments Based Solely on Profiling Code Improvement Recommended
Missing: Consent Management
Critical EU_AI_ART_5_006 — Prohibition of Emotion Recognition in Workplace and Education Code Improvement Recommended
Missing: Consent Management
Critical EU_AI_ART_5_007 — Prohibition of Biometric Categorisation for Sensitive Characteristics Code Improvement Recommended
Missing: Consent Management
Critical EU_AI_ART_5_008 — Restrictions on Real-Time Remote Biometric Identification for Law Enforcement Code Improvement Recommended
Missing: Consent Management
Critical EU_AI_ART_73_001 — Reporting of Serious Incidents Code Improvement Recommended
Missing: Audit Logging
High EU_AI_ART_18_001 — Documentation Keeping Code Improvement Recommended
Satisfied: Data Lifecycle Management
core/llm/llms/Asksage.ts:68-68 (data_minimization_module_fanin)
High EU_AI_ART_19_001 — Retention of Automatically Generated Logs Code Improvement Recommended
Satisfied: Data Lifecycle Management
Missing: Audit Logging, Data Retention
core/llm/llms/Asksage.ts:68-68 (data_minimization_module_fanin)
High EU_AI_ART_10_003 — Processing of Special Categories of Personal Data for Bias Detection Code Improvement Recommended
Missing: Consent Management
High EU_AI_ART_12_001 — Logging Capabilities Code Improvement Recommended
Missing: Audit Logging
High EU_AI_ART_13_001 — Transparency and Instructions for Use Code Improvement Recommended
Missing: Consent Management
High EU_AI_ART_22_001 — Authorised Representative of Providers Established in Third Countries Code Improvement Recommended
Missing: Access Control
High EU_AI_ART_27_002 — Notification of Fundamental Rights Impact Assessment Code Improvement Recommended
Missing: Audit Logging
High EU_AI_ART_50_001 — Transparency - Interaction with AI Systems Code Improvement Recommended
Missing: Consent Management
High EU_AI_ART_50_003 — Transparency - Emotion Recognition and Biometric Categorisation Code Improvement Recommended
Missing: Consent Management
High EU_AI_ART_50_004 — Disclosure of Deep Fakes and AI-Generated Text Code Improvement Recommended
Missing: Consent Management
High EU_AI_ART_54_001 — Authorised Representatives of Providers of General-Purpose AI Models Code Improvement Recommended
Missing: Access Control
High EU_AI_ART_72_001 — Post-Market Monitoring System Code Improvement Recommended
Missing: Audit Logging
High EU_AI_ART_86_001 — Right to Explanation of Individual Decision-Making Code Improvement Recommended
Missing: Consent Management

Control Mapping Appendix

Raw control-level mapping (control IDs, clause text) is intentionally not inlined here — export to JSON or SARIF for the complete, machine-readable control mapping.