Sample · fictional company, documents and code

What your buyer or auditor receives.

Lumen Support is a made-up AI SaaS company. Merron read two of its documents and three files from its code, built the checklist for its role under the EU AI Act and cited every passage. The reviewer entries were written by us to show the format.

Found in this sample: policy and code disagree

Different retention periods for conversations in the documents and code: 7 days vs 21 days.

D1 · extracted line 3, characters 1–58 · 7 days
C2 · lumen/reply-assistant/src/config/retention.ts:1 @ 4f2c9a1 · 21 days

Evidence pack

Lumen Reply Assistant — fictional

Lumen Support — fictional · Provider · limited risk

1 of 3 required items evidenced · 7 of 17 items reviewed · 1 of 1 contradiction still open

Created: 9/28/2026, 9:00:00 AM
System record: revision 3 · review v7
Sources: 2 documents · 3 code excerpts
Fingerprint (SHA-256): c2e0685a243ba6a7…

17 of 17 items

Required for this role only

ItemLegal basisStatusEvidence and reviewer note

E1People are told they interact with an AI system
Required for this role
Art. 50(1); Art. 50(5)
Missing
Not supplied — reviewer finding
The chat widget shows "Chat with us" and no notice that replies are AI-generated. Art. 50(1) applies to this provider; add a notice at the first interaction.
E2Marking of synthetic content
Required for this role
Art. 50(2); Art. 50(5)
Missing
Not supplied — reviewer finding
Suggested replies are generated text. Nothing in the selected code marks them as AI-generated in a machine-readable way, and no document describes marking. Art. 50(2) applies to this provider.
G1AI literacy of staff
Required for this role
Art. 4 (as amended by Regulation (EU) 2026/1744)
Evidenced
Documented — reviewer assertion
- D2 · extracted line 5, characters 1–112
Training before access and a completion record are stated. Ask for an export of the HR record as dated evidence.
A1Intended purpose, scope and version
Recommended
Annex IV 1(a); Art. 3(12)
Evidenced
Documented — reviewer assertion
- D2 · extracted line 2, characters 1–82
- D2 · extracted line 3, characters 1–71
Purpose, excluded uses and the pinned model are stated in the AI use policy.
A2Forms of supply and integration
Recommended
Annex IV 1(b)–(e)
Open
Not reviewed
B1Development process and third-party components
Recommended
Annex IV 2(a); Art. 25; Art. 53 / Annex XII
Evidenced
Documented — reviewer assertion
- C1 · lumen/reply-assistant/src/ai/reply.ts:2 @ 4f2c9a1
- D1 · extracted line 5, characters 1–62
OpenAI gpt-4o is called in src/ai/reply.ts and named as a subprocessor. No supplier agreement is attached yet.
B2Design specification and architecture
Recommended
Annex IV 2(b)–(c)
Open
Not reviewed
B3Data governance for training, validation and testing
Recommended
Art. 10; Annex IV 2(d)
Open
Not reviewed
B4Input and output data in operation, restricted data handling
Recommended
Annex IV 3; Art. 26(4)
Open
Not reviewed
C3Capabilities, limitations and evaluation results
Recommended
Annex IV 3; Art. 13(3)(b)
Open
Not reviewed
C4Human oversight design
Recommended
Art. 14; Annex IV 2(e), 3
Open
Not reviewed
C5Record-keeping and logging
Recommended
Art. 12; Art. 19; Art. 26(6)
Conflicting
Not reviewed · 1 open contradiction
D1Use per instructions and assigned human oversight
Recommended
Art. 26(1); Art. 26(2)
Open
Not reviewed
D2Monitoring of operation and incident escalation
Recommended
Art. 26(5); Art. 73
Open
Not reviewed
G2Named owner and approval authority
Recommended
Art. 17(1)(m); Art. 26(2)
Evidenced
Documented — reviewer assertion
- D2 · extracted line 4, characters 1–47
- D2 · extracted line 6, characters 1–87
Named owner and change approval by the Head of Product.
G3Third parties and processing locations
Recommended · adjacent law
GDPR Art. 28, 44 (adjacent law); Art. 25
Open
Not reviewed
G4Retention and deletion of records
Recommended
Art. 18; Art. 19; Art. 26(6); GDPR storage limitation (adjacent law)
Conflicting
Contradictory evidence · 1 open contradiction
- D1 · extracted line 3, characters 1–58
- C2 · lumen/reply-assistant/src/config/retention.ts:1 @ 4f2c9a1
The privacy notice says 7 days; the code keeps transcripts for 21. One of them must change before the pack goes to the buyer.

Download evidence ZIP

The ZIP holds this table as auditor-summary.csv, every original source and the full review history. Statuses describe evidence, not compliance; nothing here is approved or certified.

Make this for your own product

Connect your code read-only, add your documents if you have them, answer a few questions. Merron walks you through the rest.

Start free →See pricing