EU AI Act Article 12 — Management Readiness Attestation

Executive Summary

Acme Corp's codebase was assessed against the record-keeping and automatic event-logging obligations of EU AI Act Article 12 for high-risk AI systems (EU AI Act — Article 12 2024/1689) using automated code-level analysis. The assessment covers 6 controls, of which 6 are testable at the code level (100% coverage).

• Controls implemented: 5
• Controls with gaps: 0
• Controls partially implemented: 1
• Controls outside code scanning scope: 0

Key Findings

• Art. 12(2)(a) Identification of Input Data — 1 finding(s), severity Medium

Scope & Limitations

This assessment covers CODE-LEVEL controls only. The following areas require separate, organizational assessment:

All in-scope controls are testable at the code level.

Disclaimer: Code-level controls only. Coverage percentages reflect how many framework controls have matching RepoScope detectors. This is a development aid, not a certification tool — auditors make the final determination.

Note: Code-level provenance controls only. This assessment identifies where AI-generated code exists and whether provenance records are in place. It is a development aid for Article 12 readiness, not a legal compliance determination — consult qualified legal counsel for formal compliance assessment.

Attestation

I, the undersigned, have reviewed the above assessment and confirm that:

1. The scope and limitations are understood.
2. The identified gaps will be addressed per the remediation plan.
3. Controls outside code scanning scope are managed through separate processes.
4. I confirm awareness of EU AI Act Article 12 obligations regarding automatic event logging and traceability for high-risk AI systems.

Name: Dana Lee
Title: Chief Information Security Officer
Signature: ____________________
Date: ____________________