Regulatory source mapping

Article 9: Risk management

Reviewed source contains policy evaluation, configurable risk thresholds, escalation paths, and Guardian evaluation paths. Continuous coverage, threshold suitability, and effectiveness in the exact deployment remain open assurance gates.

Applies to: Fleet, Guardian, VCP

Article 12: Record-keeping

Reviewed source contains audit logging and cryptographic integrity paths for designated decisions. Record coverage varies by integration and configuration. Completeness, retention, key custody, and independent verification of the exact deployment remain open.

Applies to: Fleet

Article 14: Human oversight

Reviewed source contains configurable approval, escalation, pause, override, and termination paths. Effective operator authority, response times, procedure coverage, and exercised audit records remain deployment-specific assurance work.

Applies to: Fleet

Article 15: Accuracy, robustness, cybersecurity

Reviewed source contains governance checks, risk signals, and signature-verification paths. Accuracy targets, robustness testing, cybersecurity validation, monitoring coverage, and runtime effectiveness remain open for each deployment.

Applies to: Guardian, Fleet, VCP

Govern

VCP source supports portable policy documents, version metadata, and signature verification. Organisational adoption, approval authority, and enforcement coverage remain open.

Map

Guardian and Fleet source expose risk-context and threshold concepts that can contribute to system mapping. Completeness of the deployment inventory and context classification remain open.

Measure

Source includes evaluation scores, risk observations, and audit-capable data paths. Metric validity, sampling, aggregation, coverage, and independent review remain open.

Manage

Source includes configurable pause, override, escalation, termination, and incident response paths. Operational authority, exercised response, and record completeness remain open.

A.2 Policies related to AI

Creeds and constitutions express AI policy in machine-readable form, and VCP source supports version metadata and signature verification. Policy ownership, approval, and review cadence remain organisational decisions.

A.6 AI system life cycle

Reviewed source contains policy evaluation, escalation paths, and audit events for designated decisions. Life-cycle coverage, log retention, and monitoring effectiveness in the exact deployment remain open.

A.8 Information for interested parties

Designated decisions record their reasons, reason codes, and the rules applied, which can support explanations to users and reviewers. What is disclosed, to whom, and when remains a deployment decision.

A.9 Use of AI systems

Constitutions and scope controls can hold a system to its intended use, with approval, escalation, and override paths for human oversight. Defining intended use and responsible-use objectives remains with the organisation.

Data minimisation

The source includes a local Guardian package alongside optional gateway and provider integrations. Actual inputs, outputs, metadata, recipients, logs, and retention depend on the selected configuration and require a deployment data-flow review.

Data subject rights

Reviewed source contains authenticated export and erasure workflows. Exact-revision deployment, complete datastore and provider coverage, retention approval, identity verification, and exercised request evidence remain open.

Legal basis

The lawful basis for each processing purpose is stated in Privacy Policy section 3. Source contains consent and withdrawal records for designated workflows. Legitimate-interest balancing records and purposes not currently operated remain legal-review decisions.

International transfers

Transfer posture depends on hosting, configured providers, support access, and other recipients. The processor inventory, transfer map, data residency evidence, contractual safeguards, and transfer impact assessments remain open.

Data protection by design

Source includes configurable privacy policies, access controls, audit paths, and data subject workflows. Threat modelling, configuration review, necessity and proportionality decisions, and runtime exercises remain necessary.

Source capability examples

• Designated governance evaluations and outcomes can emit audit events
• Selected approval and override workflows can record decisions
• Policy and configuration paths carry version information
• Selected lifecycle, risk, and escalation paths expose recordable events
• Exact event coverage and field completeness require deployment verification

Integrity mechanisms

• Selected records and artifacts have hashing or signing paths
• VCP source includes signature-verification support for signed policies
• Some audit paths support chained integrity records
• Algorithm use, key custody, coverage, and verifier exercises remain open

Export and review

• Selected workflows expose structured export or reporting paths
• Available filters and formats depend on the specific service
• Regulatory reporting still requires scope and legal review
• Deployment exercises must prove completeness and reviewer access