// CONTACT
Talk to a governance engineer.
Prefer a walkthrough over a self-serve audit? Tell us about your estate and we'll show you OAG against one of your own repositories.
// CONTACT
Prefer a walkthrough over a self-serve audit? Tell us about your estate and we'll show you OAG against one of your own repositories.
YOU 81% · INDUSTRY BENCHMARK 68% · FULL COMPLIANCE 100%
⚠ Top risks:
💡 Recommendations:
src/risk/scoring.ts:114
Credit-scoring model lacks a documented risk management lifecycle. Article 9 requires continuous risk identification and mitigation for high-risk systems.
Remediation: Implement a risk register module and wire it to the model lifecycle. OAG template: ISO 42001 §6.1.
ml/pipeline/train.py:58
Dataset lineage is not tracked. Competence and data-quality controls cannot be evidenced.
Remediation: Add provenance metadata capture at ingestion; seal each dataset version.
config/prod.env:3
Production API keys present in version control. Full history exposure.
Remediation: Rotate keys immediately; move to a secrets manager; purge history.
api/chat/handler.ts:40
End users are not informed they are interacting with an AI system.
Remediation: Add disclosure at interaction entry points.
src/decisions/auto.ts:201
Loan denials execute without a human-review path.
Remediation: Introduce an escalation gate for adverse decisions.
PRE 0x4be2c1f0a93d77e6b21c88f5d0a3e91c7f6b24d8901e5c3a7b4f2d6e8a0c9135
POST 0x91cf81192d5e2df1d555b9cdb4ec004dfe441b5b4d5d7a504ddc042824653155
SHA-256 · binary Merkle tree · dual-root (pre/post) · SEALED 2026-08-03 09:15:56 UTC · ISO/IEC 12207:2026 §6.4.4
Layers: digest → clauses → sections → report · Chain valid: YES ✅ · oag://audit/verify/OAG-2026-0803-7F3A
This report is tamper-evident. Any modification after sealing is independently detectable.
This is a sample report for demonstration. Findings shown are illustrative and do not relate to any real organisation. OAG reports are technical assessments, not legal advice.