RepoScope Compliance intelligence for your codebase

Gap & Remediation Plan — ISO/IEC 42001:2023

Company: Acme Corp
Generated: June 27, 2026
Audit Period: 2026-01-01 to 2026-12-31

Summary

Total gaps identified: 1
Critical/High severity: 0
Medium/Low severity: 1
Controls not assessed (outside scope): 8

Open Items

Gap 1: A.7.3 — Data Provenance

Framework: ISO/IEC 42001:2023
Severity: Medium
Status: ❌ OPEN
Findings: 1
- src/services/recommendations.ts:24 — AI-generated recommendation engine logs outputs without recording the input-data reference (EU AI Act Art. 12(2)(a)) (medium)
Recommended Fix: Record the input data — or a reference to it — alongside each AI event in the provenance ledger.
Owner: [ORG TO COMPLETE: Remediation owner]
Target Date: [ORG TO COMPLETE: Target remediation date]
Completion Evidence: [ORG TO COMPLETE: Describe how closure will be verified]

Controls Outside Scope

Control ID	Control Name	Required Evidence
`A.5.3`	AI System Impact Assessment	AI impact assessment documentation
`A.6.2.4`	AI System Testing & Validation	Organizational policy / process documentation
`A.6.2.6`	AI System Deployment Criteria	Organizational policy / process documentation
`A.7.2`	Data Quality for AI	Organizational policy / process documentation
`A.7.4`	Data Preparation	Organizational policy / process documentation
`A.8.4`	Reporting AI System Issues	Organizational policy / process documentation
`A.9.2`	AI System Use Procedures	Human-oversight and AI-use procedures
`A.9.3`	Human Oversight of AI	Human-oversight and AI-use procedures

Tracking

Gap #	Control	Severity	Owner	Target Date	Status
1	`A.7.3`	Medium	[ORG TO COMPLETE: Owner]	[ORG TO COMPLETE: Target date]	Open

Previously Remediated (Game Plan archive)

Removed hardcoded Stripe secret key from the billing service — completed 2026-04-18
Enabled TLS certificate verification on outbound webhook calls — completed 2026-05-09

Disclaimer: Code-level controls only. Coverage percentages reflect how many framework controls have matching RepoScope detectors. This is a development aid, not a certification tool — auditors make the final determination.

Note: Code-level AI management controls only. ISO/IEC 42001 requires organizational policies, risk assessments, and process evidence that are beyond the scope of code scanning. This is a development aid for identifying code-level control gaps, not a certification tool — consult a qualified auditor for formal certification.