Executive Report

agents-for-openbb

Audit ID: CSVA-20260614-9BE11290 | Risk class: HIGH | Date: 2026-06-17 09:47 UTC

Compliance Verdict: PARTIAL EVIDENCE

PARTIAL TECHNICAL ALIGNMENT — identified control gaps require remediation within 90 days.

Immediate action: Begin remediation on priority articles. Schedule re-audit in 6-8 weeks.

KPI Dashboard

How scores are computed: Each of the 46 checkpoints carries a weight (2–5). The article score is the weighted average of its checkpoints. Articles 9, 10, 14, 15 are gate articles — a score below 50 on any of them sets that article to 0 and overrides the global score downward. Full methodology: factdna.ai/methodology

🔬 Runtime Sessions Analysis (Process Mining — Behavioral Audit)

Analysed sample: 2026-04-04 → 2026-04-05 (2 jours · 109 événements)
20 sessions · 18 checkpoints · Average compliance : 🟡 71.9% · Non-compliance : 25.6%

Source: workflow mining E5 — session-level behavioral evidence. Each row represents the evaluation of one AI Act control across all sessions in the period.

Critical Gates — Art. 9 / 10 / 14 / 15

A GATE FAIL on any of these articles overrides the global score. Deployment in high-risk regulated environments is not recommended regardless of overall maturity score.

Evidence Level Breakdown — Per Checkpoint

This section answers: 'Is oversight genuinely integrated into system architecture, or merely aspirational?'
Each checkpoint shows its highest evidence level observed in the analysed artefacts. A NOT OBSERVED verdict does not assert that a control is absent — it asserts that no evidence of it was found in the scope of this audit.

Evidence Level Scale:

🟢 Art. 9 — Risk Management System | 92/100

⚠️ Note: NOT OBSERVED means no evidence was found in the artefacts analysed (source code, tests, configs, logs). It does not assert that the control is absent from the full system.

🟢 Art. 10 — Data Governance | 92/100

⚠️ Note: NOT OBSERVED means no evidence was found in the artefacts analysed (source code, tests, configs, logs). It does not assert that the control is absent from the full system.

🚫 Note: NOT ASSESSABLE means the control requires an evidence channel that was not available in this audit (e.g. runtime traces or a dataset). It is neither pass nor fail — it signals that the system is not instrumented to demonstrate this control. Make the system auditable, then re-run.

🟢 Art. 14 — Human Oversight | 85/100

⚠️ Note: NOT OBSERVED means no evidence was found in the artefacts analysed (source code, tests, configs, logs). It does not assert that the control is absent from the full system.

🟢 Art. 15 — Robustness & Accuracy | 85/100

⚠️ Evidence Contradictions — Auditor Review Required

These checkpoints show runtime evidence COMPLIANT but automated test FAILED.
This pattern may indicate: (1) staged/synthetic log files, (2) broken test environment, (3) code path mismatch between test and production.
The compliance verdict should not be accepted without verifying the authenticity of the runtime traces.

Top Business Risks

⚠️ See Critical Gates section above — gate failures constitute regulatory risk even when no DOC↔CODE collisions are detected.

Remediation Projection

Phase 1 priority: Articles Article 12 — resolves immediate regulatory exposure.

LEGAL STATUS: TECHNICAL EVIDENCE REPORT — This document is an automated factual report. It documents technical alignment with EU AI Act control points. It does not constitute legal advice or regulatory certification.