| Field | Value |
|---|---|
| system_id | golden-sys |
| intended_purpose | credit scoring for loan applications |
| compliance_target | EU_AI_ACT |
| high_risk_presumption | False |
| Rule | Status | Reference | Rationale |
|---|---|---|---|
| Prohibited AI Practice Detection (Article 5) | PASS | EU AI Act, Article 5 | No prohibited practice signals detected in 'credit scoring for loan applications'. |
| High-Risk System Classification (Article 6 / Annex III) | FAIL | EU AI Act, Article 6, Annex III | Use case 'credit scoring for loan applications' matches Annex III categories: essential_services. |
| Profiling Detection — Force High-Risk (Article 6(3)) | FAIL | EU AI Act, Article 6(3), Recital 34 | Profiling signals detected in use case: credit, credit scoring, scoring. System is classified as high-risk per Article 6(3). |
| Substantial Modification Trap (Article 25 / Article 3(23)) | PASS | EU AI Act, Article 25, Article 3(23), Recital 66 | No substantial modification declared in assessment answers. |
| Article | Status | Source | Evidence | Rationale |
|---|---|---|---|---|
| Art. 4 | UNVERIFIED | obligation | ai_literacy | Obligation 'AI literacy' applies; no automated verification run. |
| Art. 5 | UNVERIFIED | obligation | prohibited | Obligation 'Prohibited AI practices' applies; no automated verification run. |
| Art. 6 | MISSING | rule | EU_AIA_ART6_HIGH_RISK | Use case 'credit scoring for loan applications' matches Annex III categories: essential_services. |
| Art. 9 | PARTIAL | artifact | docs/risk_register.md | Found candidate artifact/signal for 'risk_register' (1 path(s), 0 code hint(s)) with content markers found (risk identification + mitigation). Heuristic only — not a full obligation assessment. |
| Art. 10 | UNVERIFIED | evaluator | none | No source data supplied for this article in this run. |
| Art. 11 | MISSING | artifact | technical_documentation_dossier | No conventional documentation/code probe matched for 'technical_documentation_dossier'. Add the expected file or construct, then re-run gaps. |
| Art. 12 | MISSING | artifact | event_log_evidence | No conventional documentation/code probe matched for 'event_log_evidence'. Add the expected file or construct, then re-run gaps. |
| Art. 13 | PARTIAL | artifact | INSTRUCTIONS.md | Found 'INSTRUCTIONS.md' but it lacks Art. 13(3) topic content markers — a bare or empty file is not a set of instructions for use. |
| Art. 14 | MISSING | artifact | human_oversight_construct | No conventional documentation/code probe matched for 'human_oversight_construct'. Add the expected file or construct, then re-run gaps. |
| Art. 15 | UNVERIFIED | evaluator | none | No source data supplied for this article in this run. |
| Art. 16 | MISSING | artifact | provider_qms_bundle | No conventional documentation/code probe matched for 'provider_qms_bundle'. Add the expected file or construct, then re-run gaps. |
| Art. 17 | PARTIAL | artifact | docs/qms.md | Found candidate artifact/signal for 'provider_qms' (1 path(s), 0 code hint(s)). Heuristic only — not a full obligation assessment. |
| Art. 24 | MISSING | artifact | distributor_conformity | No conventional documentation/code probe matched for 'distributor_conformity'. Add the expected file or construct, then re-run gaps. |
| Art. 25 | MET | rule | EU_AIA_ART25_MODIFICATION_TRAP | No substantial modification declared in assessment answers. |
| Art. 26 | MISSING | artifact | deployer_use_records | No conventional documentation/code probe matched for 'deployer_use_records'. Add the expected file or construct, then re-run gaps. |
| Art. 27 | MISSING | artifact | provider_fria | No conventional documentation/code probe matched for 'provider_fria'. Add the expected file or construct, then re-run gaps. |
| Art. 43 | MISSING | artifact | conformity_assessment_docs | No conventional documentation/code probe matched for 'conformity_assessment_docs'. Add the expected file or construct, then re-run gaps. |
| Art. 49 | MISSING | artifact | eu_database_registration_evidence | No conventional documentation/code probe matched for 'eu_database_registration_evidence'. Add the expected file or construct, then re-run gaps. |
| Art. 50 | MISSING | artifact | transparency_notice_evidence | No conventional documentation/code probe matched for 'transparency_notice_evidence'. Add the expected file or construct, then re-run gaps. |
| Art. 53 | UNVERIFIED | obligation | gpai_provider | Obligation 'General-purpose AI model provider obligations' applies; no automated verification run. |
| Art. 55 | UNVERIFIED | obligation | gpai_systemic_risk | Obligation 'GPAI model with systemic risk obligations' applies; no automated verification run. |
| Art. 72 | MISSING | artifact | post_market_monitoring_plan | No conventional documentation/code probe matched for 'post_market_monitoring_plan'. Add the expected file or construct, then re-run gaps. |
| Art. 73 | MISSING | artifact | serious_incident_log | No conventional documentation/code probe matched for 'serious_incident_log'. Add the expected file or construct, then re-run gaps. |
| Date | Obligation | Applies to | Source | Confidence |
|---|---|---|---|---|
| 2025-02-02 | AI literacy, Art. 4 verified: Art. 4 was replaced by Reg. (EU) 2026/1744, Art. 1(5). It is in Chapter I, which applies from 2 February 2025. | Art. 4 | Reg. (EU) 2024/1689, Art. 4 and Art. 113(a) | high |
| 2025-02-02 | Prohibited AI practices, Art. 5(1)(a)-(h) verified: Art. 113(a) read in the Official Journal text of Reg. (EU) 2026/1744 (OJ L, 24.7.2026); Chapters I and II apply from 2 February 2025. | Art. 5 | Reg. (EU) 2024/1689, Art. 5 and Art. 113(a) as amended by Reg. (EU) 2026/1744, Art. 1(40)(a) | high |
| 2025-08-02 | General-purpose AI model obligations Art. 111(3): providers of general-purpose AI models placed on the market before 2 August 2025 comply by 2 August 2027. | Art. 53, Art. 55 | Reg. (EU) 2024/1689, Arts. 53, 55 and 113 | medium |
| 2026-08-02 | Transparency obligations, Art. 50(1)-(4) verified: Art. 50 keeps the general application date of 2 August 2026; Reg. (EU) 2026/1744 replaces only Art. 50(7) (codes of practice). | Art. 50 | Reg. (EU) 2024/1689, Art. 50 and Art. 113, first paragraph | high |
| 2026-12-02 | New prohibited AI practices, Art. 5(1)(ba) and (bb) verified: points (ba) and (bb) and Art. 5(1a) and (1b) read in the Official Journal text; Art. 113(a) as amended applies them from 2 December 2026. | Art. 5 | Reg. (EU) 2026/1744, Art. 1(7) and Art. 1(40)(a) | high |
| 2027-12-02 | High-risk obligations for Annex III systems verified: Art. 113(c)(i) read in the Official Journal text; Chapter III, Sections 1, 2 and 3, with the exception of Art. 6(5), apply from 2 December 2027 to systems classified as high-risk under Art. 6(2) and Annex III. | Art. 6, Art. 9, Art. 10, Art. 11, Art. 12, Art. 13, Art. 14, Art. 15, Art. 16, Art. 17, Art. 24, Art. 25, Art. 26, Art. 27, Art. 43 | Reg. (EU) 2024/1689, Art. 113(c)(i) as amended by Reg. (EU) 2026/1744, Art. 1(40)(b) | high |
| 2028-08-02 | High-risk obligations for Annex I product systems verified: Art. 113(c)(ii) read in the Official Journal text; Chapter III, Sections 1, 2 and 3, with the exception of Art. 6(5), apply from 2 August 2028 to systems classified as high-risk under Art. 6(1) and Annex I. | Art. 6, Art. 9, Art. 10, Art. 11, Art. 12, Art. 13, Art. 14, Art. 15, Art. 16, Art. 17, Art. 24, Art. 25, Art. 26, Art. 27, Art. 43 | Reg. (EU) 2024/1689, Art. 113(c)(ii) as amended by Reg. (EU) 2026/1744, Art. 1(40)(b) | high |
| date unconfirmed | Art. 49(2) registration of systems exempted under Art. 6(3) unverified: Reg. (EU) 2026/1744, Art. 1(42) keeps the registration duty and deletes only Annex VIII Section B points 7 and 9; the text does not settle its date. Reading 1: the duty is triggered through Art. 6(4), which is in Chapter III Section 1, so 2 December 2027 under Art. 113(c)(i). Reading 2: Art. 49 is in Chapter III Section 5, which Art. 113(c) does not list, so the general date of 2 August 2026 applies. Not chosen; for the lawyer. | Art. 6 | Reg. (EU) 2024/1689, Art. 49(2) and Art. 6(4) | low |
No eval summary supplied — run with --sample-set.
No scan summary supplied — run with --scan.
Generated by opencomplai report. Informational only — the canonical CI gate
is compliance-artifact.json produced by opencomplai check. This
report does not replace the Annex IV dossier (opencomplai docs generate).
Embedded JSON is a CLI envelope, not a signed ScanStatusArtifact.