Evidence Package — EU AI Act — Article 12
Prepared for: [ORG TO COMPLETE: Auditor name / firm]
Company: Acme Corp
Date: June 27, 2026
Audit Period: 2026-01-01 to 2026-12-31
How to Read This Document
This document pre-answers common auditor evidence requests for EU AI Act — Article 12. Each section maps to a control and provides what we can demonstrate from automated code-level analysis, what requires additional organizational evidence, and supporting data.
Art12.1.a: Automatic Event Logging
Auditor may ask: "Show me how AI system events are automatically logged."
Evidence provided:
- Status: PASS
- No findings detected for this control.
- Scan timestamp: 2026-06-27T15:00:00.000Z
- Code Provenance Engine ledger: 4 entries recorded (3 AI-generated), latest 2026-06-27T08:22:00.000Z. Run "Verify Chain Integrity" to confirm tamper-evidence; export via reposcope.exportProvenance for Art. 12(4) authority access.
Additional evidence needed: No additional code-level evidence needed. Organizational evidence may still be required.
Art12.1.b: Traceability of AI Outputs
Auditor may ask: "Demonstrate traceability of AI outputs throughout the lifecycle."
Evidence provided:
- Status: PASS
- No findings detected for this control.
- Scan timestamp: 2026-06-27T15:00:00.000Z
- Code Provenance Engine ledger: 4 entries recorded (3 AI-generated), latest 2026-06-27T08:22:00.000Z. Run "Verify Chain Integrity" to confirm tamper-evidence; export via reposcope.exportProvenance for Art. 12(4) authority access.
Additional evidence needed: No additional code-level evidence needed. Organizational evidence may still be required.
Art12.2.a: Identification of Input Data
Auditor may ask: "Show me how input data is identified and recorded."
Evidence provided:
- Status: PARTIAL
- 1 lower-severity finding mapped to this control.
- Scan timestamp: 2026-06-27T15:00:00.000Z
- Code Provenance Engine ledger: 4 entries recorded (3 AI-generated), latest 2026-06-27T08:22:00.000Z. Run "Verify Chain Integrity" to confirm tamper-evidence; export via reposcope.exportProvenance for Art. 12(4) authority access.
Additional evidence needed: Remediation in progress — see the Gap & Remediation Plan. Expected closure: [ORG TO COMPLETE: Target remediation date].
Art12.2.b: Tamper-Evidence
Auditor may ask: "How do you ensure logs are tamper-evident?"
Evidence provided:
- Status: PASS
- No findings detected for this control.
- Scan timestamp: 2026-06-27T15:00:00.000Z
- Code Provenance Engine ledger: 4 entries recorded (3 AI-generated), latest 2026-06-27T08:22:00.000Z. Run "Verify Chain Integrity" to confirm tamper-evidence; export via reposcope.exportProvenance for Art. 12(4) authority access.
Additional evidence needed: No additional code-level evidence needed. Organizational evidence may still be required.
Art12.3: Retention & Accessibility
Auditor may ask: "What is your log retention policy?"
Evidence provided:
- Status: PASS
- No findings detected for this control.
- Scan timestamp: 2026-06-27T15:00:00.000Z
- Code Provenance Engine ledger: 4 entries recorded (3 AI-generated), latest 2026-06-27T08:22:00.000Z. Run "Verify Chain Integrity" to confirm tamper-evidence; export via reposcope.exportProvenance for Art. 12(4) authority access.
Additional evidence needed: No additional code-level evidence needed. Organizational evidence may still be required.
Art12.4: National Authority Access
Auditor may ask: "Can you provide logs to a national authority upon request?"
Evidence provided:
- Status: PASS
- No findings detected for this control.
- Scan timestamp: 2026-06-27T15:00:00.000Z
- Code Provenance Engine ledger: 4 entries recorded (3 AI-generated), latest 2026-06-27T08:22:00.000Z. Run "Verify Chain Integrity" to confirm tamper-evidence; export via reposcope.exportProvenance for Art. 12(4) authority access.
Additional evidence needed: No additional code-level evidence needed. Organizational evidence may still be required.
Disclaimer: Code-level controls only. Coverage percentages reflect how many framework controls have matching RepoScope detectors. This is a development aid, not a certification tool — auditors make the final determination.
Note: Code-level provenance controls only. This assessment identifies where AI-generated code exists and whether provenance records are in place. It is a development aid for Article 12 readiness, not a legal compliance determination — consult qualified legal counsel for formal compliance assessment.