From scoping to delivery
Organisation, departments, processes, tasks and AI systems; evidence items, quotations, contradictions, sign-offs, recommendations, report and manifest: a single audit file, a single trail.
The product
The software holds the audit file. The auditor keeps the judgement.
Clear AI-Act records, versions and dates each evidence item, quotation, contradiction and decision, from scoping the engagement to delivery of the report. Its engine checks the consistency of the audit file and proposes strategic and operational recommendations; the auditor judges them, arbitrates, signs off and chooses what is delivered.
Autonomy
The entire engagement in a single tool.
External functions on decision
Calls to an external service are disabled by default, with a zero budget. The auditor enables them passage by passage, after approving the context and setting a spending cap.
A self-sufficient delivery
REVUE.html, DOSSIER.json and MANIFESTE.json are placed on several encrypted USB drives, the key for which is delivered separately. The manifest describes evidence items, hashes, versions, coverage, reservations and limitations, and receives a qualified eIDAS electronic timestamp.
Adaptability
The audit file adapts to the audited organisation.
Seven levels of analysis
Engagement, organisation, department, process, task, system (data and AI), implementation. Each evidence item attaches to the level it documents, and each recommendation to the level it targets.
Seven families of evidence items
Policies and procedures, technical file, audio interviews, digitised documents, web pages, logs and registers, questionnaires. For each, reading coverage is displayed: complete, partial or unavailable.
A chosen and versioned reference framework
The reference framework starts from Regulation (EU) 2024/1689. It is a candidate framework, dated and sourced, which the auditor activates after review; its activation and its versions are recorded in the trail.
Specialist models on demand
For a passage classified C1, the auditor may call on a specialist model: exact context approved, double confirmation, spending cap set. The response enters the audit file as a proposal.
Engine and human judgement
The engine establishes the state of the audit file and makes proposals. The auditor judges and decides.
- Checks hashes, versions, reading coverage, reviews and dependencies before each result.
- Classifies each point in the audit file: documented, to be requested or excluded.
- A modified evidence item, rule or assertion makes the sign-offs that depended on it “to be reviewed”.
- Proposes strategic and operational recommendations, level by level, from the state of the audit file.
- Records each action in the trail, dated and chained by hashes, verified each time the file is opened.
- Activates the reference framework after review.
- Classifies each passage: C0 public, C1 anonymised, C2 confidential; a C2 passage remains in the audit file.
- Arbitrates contradictions and signs off, with name and reason.
- Judges the proposed recommendations, amends or rejects them, and chooses what is delivered.
The engine’s results are documentary and its recommendations are proposals. Only the auditor’s sign-off brings a finding or a recommendation into the report.
The method
Four steps, each recorded in the trail.
- 01 · Scope
Scope the engagement
Organisation record, departments in scope, processes and tasks concerned, AI systems with their version, use and audience. The reference framework is activated after review.
In the trail: engagement scoped, scope set, systems declared.
- 02 · Collect
Build the audit file
Each evidence item receives its SHA-256 hash, its extraction and a proposed filing that the auditor confirms. Interviews carry a timestamped consent; the qualification of what was said is human, versioned and revocable.
In the trail: evidence items received, hashes calculated, coverage established.
- 03 · Examine
Quote, challenge, sign off
The auditor classifies passages, quotes the exact passage, located to the nearest byte, and links the assertion to the articles concerned. Counter-evidence opens a contradiction; the auditor arbitrates it and signs off. The deterministic check then classifies each point.
In the trail: exact quotation, contradiction opened, sign-off recorded, check executed.
- 04 · Deliver
Recommend and deliver
The software proposes recommendations by level, from organisation to system; the auditor judges and finalises them. Readable and printable review report; manifest timestamped by a qualified eIDAS provider; encrypted export onto several USB drives.
In the trail: recommendations finalised, delivery prepared, audit file exported.
When an evidence item changes during the engagement, the new version enters the audit file, the old one is kept, and the sign-offs that relied on it become “to be reviewed”.
The full walkthrough, in 31 steps.
A service company, two departments, two AI systems: the demo covers the engagement from scoping to delivery.