Example · Written by Yobel Tzegai · Last checked 9 October 2026

What does an EU AI Act audit report look like?

An example, for a fictional company called Harbrook: the full AI Act audit that Complipath (complipath.io) builds from a workspace's own records. Every requirement for every AI system is marked Met, Partly, Not met or n/a. The findings are sorted by risk and a signed version is locked as a PDF.

Check your AI systems, free

Who Harbrook is

Harbrook is invented for this page. In the example it builds Applicant sorter, a tool that sorts job applications for an employer's recruiters, sells it to employers and runs two other AI systems.

Nothing here is real: no customer, no person, no file and no measured figure. Where the app prints a person's name, this example prints a role. Where it prints a date, a count or a fingerprint, this example leaves it out.

Which systems the report covers

Section 2 of the PDF, Scope, lists each AI system with what it does, Harbrook's role and the risk class from its classification. Articles 4 and 5 are checked for every system; the rest follow from each system's role and risk class.

Example · 2. Scope (fictional company)
AI system	What it does	Our role	Risk class
Applicant sorter	Sorts incoming job applications for an employer's recruiters to review	Provider	High-risk, point 4(a) of Annex III
Help chat	Harbrook's own chat, answering questions from people using its product	Provider	Limited risk
Ticket router	A bought tool that sends each support ticket to the right team	User (deployer)	Minimal risk

5. All checks: an excerpt

The matrix sets what the law asks of you against every system. These six rows are an excerpt, and the article numbers are written out here where the app's matrix abbreviates them.

The second column is the app's one-line name for each requirement, not the law's text. Each is read in full in Articles 5, 9, 11, 12, 14 and 50 of Regulation (EU) 2024/1689, as amended.

Example · an excerpt of 5. All checks (fictional company)
Requirement	What it asks	Applicant sorter	Help chat	Ticket router
Article 5	No prohibited AI practice	Met	Met	Met
Article 9	A risk management system	Partly	n/a	n/a
Article 11	Technical documentation	Partly	n/a	n/a
Article 12	Automatic record-keeping	Not met	n/a	n/a
Article 14	Built for human oversight	Met	n/a	n/a
Article 50	Telling people they are talking to an AI	n/a	Met	n/a

How a cell is decided

Met: a document linked as proof for exactly that requirement.
Partly: a person's statement, a file marked not enough, a file for the whole article rather than its paragraph or a requirement marked done or in progress without a file.
Not met: nothing on file.
n/a: the requirement does not apply to that system, by its role or its risk class.
Article 5 is Met when the system's classification is confirmed and Partly while it is not confirmed or not made. It is Not met when the system is classified as a prohibited practice.
Article 4 is read from the AI literacy record: Met when every person on it has read the AI basics, Partly when some have and Not met otherwise.

4. Findings and plan: an excerpt

Every cell that is Partly or Not met becomes a finding, sorted by risk. Article 4 gives one finding for the whole company. A finding closes itself when its cell becomes Met.

High: nothing on file for a duty of a high-risk system. Medium: partly proven, nothing on file outside high risk or no role set for a system. Low: almost done, with a small step left.
Each finding takes an owner and a due date. A new owner is told by email, unless it is the person assigning it.
In a real report the Owner column carries a person's name and Due carries a date. This example puts a role in place of the name and leaves the date out.

Example · an excerpt of 4. Findings and plan (fictional company)
Risk	Requirement	Finding and fix	Owner	Due
High	Article 12	Automatic record-keeping: nothing on file for Applicant sorter. Fix: upload the document that shows it.	Head of engineering	(date)
Medium	Article 9	A risk management system — only partly proven (Applicant sorter). Fix: upload the document that shows it.	Head of product	(date)
Medium	Article 11	Technical documentation — only partly proven (Applicant sorter). Fix: upload the document that shows it.	Not assigned	—

Who signs it and how a copy is checked

While the report is a draft, section 6, Confirmed by, reads Not signed yet, with the line “A draft: it changes as the register changes.”
Sign and lock version 1 signs it with the name of the person who presses it and the date. That version never changes; the live audit keeps updating beside it.
A signed copy prints its fingerprint under Check this copy, with the line “If one word changes, this fingerprint changes. Ask Harbrook for the shared link to compare.”
This example prints no fingerprint, because Harbrook has no signed version to take one from.
Every page carries the footer “A self-assessment made with Complipath. Not a certification or a legal opinion.”

The appendix: the proof behind every check

Each proof is printed under its requirement and system, for example Article 14 · Applicant sorter · Document · oversight-design.pdf, followed by the passage the document was linked with. This example leaves the passage out.
A statement is printed as Stated, with the person's name, the date, the question they were asked and their answer. A statement is shown as a statement, never as a document.

What this example does not show

Real data. Harbrook, its systems, its files and the roles named here are invented, and no number on the page is a measurement.
The dates. The cells say what is on file for each requirement, not from which date it applies: the deadlines page has the dates.
A certification. The report is a self-assessment, not a conformity assessment under Article 43 of Regulation (EU) 2024/1689.
A model's writing. The matrix, the findings and the summary are counted by code from the records. Rules decide. AI only drafts. A person confirms.

Starter

€499 a month

Prices exclude VAT.

Up to 20 AI systems
Every duty, deadline and article
Evidence and the audit log
Your first system is free, with no end date

Check your AI systems, free

All plans

Questions

Is Harbrook a real company?

No. Harbrook, its three AI systems, its files and the roles named on this page are invented, and no number on it is a measurement. What is real is the shape: the sections, the statuses, the findings and the signature are those of the report Complipath builds, in the app's own words.

Why are the counts and the fingerprint left out?

Because invented figures would look like measured ones. A real report counts its checks, documents and statements from the workspace and prints the fingerprint of its signed version. Harbrook has no workspace, so this example leaves those out rather than making them up. The statuses and the wording around them are the app's.

Is the audit report a certification?

No. Every page of the PDF says it is a self-assessment made with Complipath, not a certification or a legal opinion. A conformity assessment under Article 43 is a separate procedure for high-risk AI systems, which Complipath does not run. The report shows what your own records prove, one requirement at a time.

Can I get this report for my own systems?

Yes. The full AI Act audit is part of Starter and the trial. Register your AI systems and link your documents as proof: the matrix is built live from what you hold. When it is right, Sign and lock version 1 saves a signed version that never changes, while the live audit keeps updating.