From 63abdd38896c13a76cc43d7a64d9016833cbc213 Mon Sep 17 00:00:00 2001 From: "kapil.madan" Date: Sun, 30 Aug 2026 16:14:31 +0530 Subject: [PATCH 1/2] fix(policy): four metadata blocks did not list what the policy reads `aicertify explain eu_ai_act` reported 142 declared fields and 13 measured. The playground manifest reports 150 and 14. Neither was wrong about its own source: the manifest unions an AST scan with the metadata comment block, while `explain` reads the comment block alone. The eight fields in the difference are read by the code and were never declared in the block. transparency.rego no RequiredMetrics block at all (4 fields) risk_management.rego no RequiredMetrics block at all (4 fields) robustness.rego missing system.continues_to_learn_after_deployment record_keeping.rego missing logs.sectoral_minimum_months The block is part of the spec, per CLAUDE.md, and it is the only field list a consumer reading one file can see. Both counts now agree at 150 declared and 14 measured. The union in the manifest is what hid this: a field present in either source appears in the output, so a block can rot indefinitely without any published number moving. --- .../eu_ai_act/v1/documentation/record_keeping.rego | 1 + .../eu_ai_act/v1/risk_management/risk_management.rego | 8 ++++++++ .../eu_ai_act/v1/technical_robustness/robustness.rego | 1 + international/eu_ai_act/v1/transparency/transparency.rego | 8 ++++++++ 4 files changed, 18 insertions(+) diff --git a/international/eu_ai_act/v1/documentation/record_keeping.rego b/international/eu_ai_act/v1/documentation/record_keeping.rego index 7c2fbf4..b9fb002 100644 --- a/international/eu_ai_act/v1/documentation/record_keeping.rego +++ b/international/eu_ai_act/v1/documentation/record_keeping.rego @@ -3,6 +3,7 @@ # - logs.retained # - logs.retention_months # - logs.role +# - logs.sectoral_minimum_months # # RequiredParams: none package international.eu_ai_act.v1.documentation.record_keeping diff --git a/international/eu_ai_act/v1/risk_management/risk_management.rego b/international/eu_ai_act/v1/risk_management/risk_management.rego index 0921ad0..c5bdb31 100755 --- a/international/eu_ai_act/v1/risk_management/risk_management.rego +++ b/international/eu_ai_act/v1/risk_management/risk_management.rego @@ -1,3 +1,11 @@ +# RequiredMetrics: +# - risk_management.risk_assessment.completeness +# - risk_management.risk_assessment.overall_risk +# - risk_management.mitigation_measures.completeness +# - risk_management.monitoring_system.completeness +# +# RequiredParams: none +# package international.eu_ai_act.v1.risk_management import data.helper_functions.declarations diff --git a/international/eu_ai_act/v1/technical_robustness/robustness.rego b/international/eu_ai_act/v1/technical_robustness/robustness.rego index 8cc8a84..26b2095 100644 --- a/international/eu_ai_act/v1/technical_robustness/robustness.rego +++ b/international/eu_ai_act/v1/technical_robustness/robustness.rego @@ -7,6 +7,7 @@ # - robustness.feedback_loop_risk_addressed # - cybersecurity.controls_in_place # - cybersecurity.adversarial_attacks_addressed +# - system.continues_to_learn_after_deployment # # RequiredParams: none package international.eu_ai_act.v1.technical_robustness diff --git a/international/eu_ai_act/v1/transparency/transparency.rego b/international/eu_ai_act/v1/transparency/transparency.rego index e5d23ee..cce3066 100644 --- a/international/eu_ai_act/v1/transparency/transparency.rego +++ b/international/eu_ai_act/v1/transparency/transparency.rego @@ -1,3 +1,11 @@ +# RequiredMetrics: +# - documentation.technical_documentation.completeness +# - documentation.explainability.completeness +# - metrics.model_card.completeness +# - metrics.toxicity.max_toxicity +# +# RequiredParams: none +# package international.eu_ai_act.v1.transparency import data.helper_functions.declarations From 03072058b6121980e5a462e63ccd41b12479f6d5 Mon Sep 17 00:00:00 2001 From: "kapil.madan" Date: Sun, 30 Aug 2026 16:17:58 +0530 Subject: [PATCH 2/2] chore: regenerate coverage data for the corrected metadata blocks The blocks are a source for coverage.json, so changing them without regenerating left the derived file behind. CI's --check mode caught it. --- docs/coverage/coverage.json | 20 ++++++++++++++++---- 1 file changed, 16 insertions(+), 4 deletions(-) diff --git a/docs/coverage/coverage.json b/docs/coverage/coverage.json index 297342a..a46152e 100644 --- a/docs/coverage/coverage.json +++ b/docs/coverage/coverage.json @@ -2601,7 +2601,8 @@ "system.high_risk", "logs.retained", "logs.retention_months", - "logs.role" + "logs.role", + "logs.sectoral_minimum_months" ], "provided_metrics": [], "required_params": [], @@ -3823,7 +3824,12 @@ "default": false } ], - "required_metrics": [], + "required_metrics": [ + "risk_management.risk_assessment.completeness", + "risk_management.risk_assessment.overall_risk", + "risk_management.mitigation_measures.completeness", + "risk_management.monitoring_system.completeness" + ], "provided_metrics": [], "required_params": [], "input_fields": [ @@ -3898,7 +3904,8 @@ "robustness.fallback_or_fail_safe_documented", "robustness.feedback_loop_risk_addressed", "cybersecurity.controls_in_place", - "cybersecurity.adversarial_attacks_addressed" + "cybersecurity.adversarial_attacks_addressed", + "system.continues_to_learn_after_deployment" ], "provided_metrics": [], "required_params": [], @@ -3942,7 +3949,12 @@ "default": false } ], - "required_metrics": [], + "required_metrics": [ + "documentation.technical_documentation.completeness", + "documentation.explainability.completeness", + "metrics.model_card.completeness", + "metrics.toxicity.max_toxicity" + ], "provided_metrics": [], "required_params": [], "input_fields": [