AI Governance Audit Report

Workspace: demo@ylbsecurity.com · Generated: 2026-09-07 18:54 UTC · Frameworks: EU AI Act · ISO/IEC 42001

CONTROL MATURITY

11%

IMPLEMENTED

2 / 22

Prohibited

High

Limited

Minimal

AI systems

AI System Inventory & Classification

HR Screening AssistantHIGH · 65

Production · in-house · user-facing · sensitive

LLM-powered CV screening tool used by the HR team. Processes applicant data including education, work history and personal details to produce a shortlist score for each candidate.

Classification rationale (2026-09-03 13:26 UTC): High-risk under Art. 6 / Annex III. Trigger(s): employment/worker management decisions (Annex III). The system is subject to the full obligations of Chapter III: risk management (Art. 9), data governance (Art. 10), technical documentation (Art. 11), logging (Art. 12), transparency (Art. 13), human oversight (Art. 14), accuracy & robustness (Art. 15), plus registration in the EU database and post-market monitoring.

Latest assessment (v1, 50/100): Moderate residual risk. Several Art. 9 obligations are not fully met; address the mitigations below.

Apply data minimisation and pseudonymisation; document lawful basis for special-category data (Art. 10).
Introduce a human-in-the-loop review step before decisions take effect (Art. 14).
Conduct a fundamental-rights impact assessment (Art. 27) before deployment.
Document the oversight procedure: named overseers, override authority, escalation path (Art. 14).
Enable automatic event logging with retention ≥ 6 months and alerting (Art. 12).
Assemble Annex IV technical documentation: purpose, architecture, data, metrics, risks.

DEMO - Acme Support ChatbotLIMITED · 35

Production · in-house · internal · none

Customer support chatbot for Acme Corp. Answers FAQs and discloses it is AI.

Classification rationale (2026-09-07 18:54 UTC): Limited risk under Art. 50 — transparency obligations. Users must be clearly informed they are interacting with an AI system, and synthetic content must be labelled as such.

Latest assessment (v1, 37/100): Moderate residual risk. Several Art. 9 obligations are not fully met; address the mitigations below.

Add input filtering / prompt-injection defenses and adversarial testing before each release (Art. 15).
Enable automatic event logging with retention ≥ 6 months and alerting (Art. 12).
Assemble Annex IV technical documentation: purpose, architecture, data, metrics, risks.
Deliver AI-literacy training to operators and record completion (Art. 26).

DEMO - Acme Invoice Parser (internal)MINIMAL · 10

Development · in-house · internal · none

Internal OCR+LLM tool extracting invoice fields. Human approves every payment.

Classification rationale (2026-09-07 18:54 UTC): Minimal risk. No specific obligations under the AI Act; voluntary codes of conduct (Art. 95) are encouraged.

Controls Matrix — EU AI Act & ISO/IEC 42001

Code	Control	Framework	Status	Evidence
`AIA-5`	Prohibited practices screening Confirm no system engages in Art. 5 banned practices (social scoring, manipulation, emotion inference at work, biometric categorisation of sensitive traits).	EU AI ACT	Implemented	Art.5 screening SOP v3 signed 2026-09-01
`AIA-6`	Risk classification register Every AI system is classified (prohibited / high / limited / minimal) with a documented rationale (Art. 6).	EU AI ACT	Implemented	Classification register: 3 systems classified with rationale
`AIA-9`	Risk management system A continuous, documented risk management process exists across the system lifecycle (Art. 9).	EU AI ACT	In Progress	Risk management procedure draft under review
`AIA-10`	Data governance Training, validation and testing datasets are relevant, representative, examined for bias, and properly governed (Art. 10).	EU AI ACT	Not Started	—
`AIA-11`	Technical documentation Annex IV documentation is maintained for each high-risk system (Art. 11).	EU AI ACT	Not Started	—
`AIA-12`	Record-keeping / logging Automatic event logs over the lifetime, appropriate to the intended purpose (Art. 12).	EU AI ACT	Not Started	—
`AIA-13`	Transparency & instructions for use Instructions for use are provided; users know they interact with AI where required (Art. 13, 50).	EU AI ACT	Not Started	—
`AIA-14`	Human oversight Effective human oversight measures are in place so natural persons can intervene (Art. 14).	EU AI ACT	Not Started	—
`AIA-15`	Accuracy, robustness & cybersecurity Systems achieve appropriate accuracy and robustness; adversarial testing performed (Art. 15).	EU AI ACT	Not Started	—
`AIA-27`	Fundamental-rights impact assessment FRIA completed for deployers of high-risk systems in listed domains (Art. 27).	EU AI ACT	Not Started	—
`AIA-49`	Registration in EU database High-risk systems registered in the EU database before market placement (Art. 49).	EU AI ACT	Not Started	—
`AIA-61`	Post-market monitoring A post-market monitoring system collects and analyses performance data in production (Art. 61).	EU AI ACT	Not Started	—
`ISO-4.1`	Context of the organization Internal/external issues, interested parties and AI system scope are defined (ISO 42001 §4).	ISO 42001	Not Started	—
`ISO-5.2`	AI policy A top-level AI policy is established, communicated and maintained (ISO 42001 §5.2).	ISO 42001	Not Started	—
`ISO-6.1`	Risk & opportunity process AI risk assessment and treatment process, including impact assessment, is established (ISO 42001 §6.1).	ISO 42001	Not Started	—
`ISO-6.2`	AI objectives Measurable AI objectives are set with plans to achieve them (ISO 42001 §6.2).	ISO 42001	Not Started	—
`ISO-7.2`	AI competence & awareness Personnel have demonstrated AI competence; training gaps are addressed (ISO 42001 §7.2).	ISO 42001	Not Started	—
`ISO-8.1`	AI system lifecycle controls Operational planning and controls cover design, development, deployment and retirement (ISO 42001 §8.1).	ISO 42001	Not Started	—
`ISO-8.2`	Data management controls Data sources, quality, labelling and provenance controls are documented (ISO 42001 §8.2 / Annex B).	ISO 42001	Not Started	—
`ISO-9.1`	Monitoring & measurement AI system performance and impacts are monitored and evaluated (ISO 42001 §9.1).	ISO 42001	Not Started	—
`ISO-9.2`	Internal audit Internal audits of the AI management system are performed at planned intervals (ISO 42001 §9.2).	ISO 42001	Not Started	—
`ISO-10.1`	Continual improvement Nonconformities are corrected and the AIMS continually improved (ISO 42001 §10).	ISO 42001	Not Started	—

AegisGRC by YLB Security — governance evidence for EU AI Act and ISO/IEC 42001. Classification logic implements Art. 5 / Art. 6 / Annex III triggers; assessments weight Art. 9–15 obligations.