Checklist for independent audit of claims and documents (legal / technical / compliance) before moving from TESTNET to FULL LIVE. This is a readiness checklist — it does not replace an external auditor's report.
| ☐/☑ | Checklist item | Acceptance criterion | Evidence |
|---|---|---|---|
| ☐ | Claims without certification/notification suggestion | No wording suggesting a certificate, accreditation or notified-body status; services described as advisory/readiness. | /en/trust-center |
| ☐ | Audit-only / readiness positioning | Public materials consistently position the offering as audit/readiness, not as implementation or compliance guarantee. | /docs/ai-act-readiness.html |
| ☐ | GRL legal umbrella | Responsible entity and legal umbrella (GRL) clearly identified; UnionAI ↔ legal entity relationship documented. | /en/governance |
| ☐ | GDPR / data protection | Privacy policy published, processing bases and data subject rights described; DPO contact indicated. | /en/privacy |
| ☐ | No AI Act overclaims | No statement declares "full AI Act compliance"; claims limited to mapping/readiness scope. | /docs/ai-act-readiness.html |
| ☐/☑ | Checklist item | Acceptance criterion | Evidence |
|---|---|---|---|
| ☐ | Authentication boundary | Private resources require a token; anonymous access to PRIVATE-scope data returns 401/403 (no payload or metadata leak). | /api/auth/* |
| ☐ | Rate limiting | Request limit active on sensitive endpoints; mechanism with fallback (Redis → in-memory), verified under load. | smoke / CI |
| ☐ | Hash-chain evidence | Evidence chain verifiable end-to-end; no validation bypass; local artefact integrity confirmed. | /api/evidence/verify |
| ☐ | HA / backup | Multi-machine deployment (HA) and backup policy; state persistence survives restart. | /en/status |
| ☐ | Smoke CI | CI pipeline (Unit + Smoke) green on last deploy; regression tests for auth and evidence. | CI (Unit + Smoke) |
| ☐ | No secrets in repo/UI | Keys and tokens exclusively in environment secrets; no sensitive values in code, repository or UI layer. | repo audit + secret scan |
| ☐/☑ | Checklist item | Acceptance criterion | Evidence |
|---|---|---|---|
| ☐ | AI Act readiness matrix | Readiness matrix maps requirements to implementation status; gaps labelled and assigned. | /docs/ai-act-readiness.html |
| ☐ | Risk register | Risks catalogued with assessment, owner and mitigation status; current. | /en/risk-register |
| ☐ | Incident policy | Incident reporting, classification and communication process documented and publicly available. | /en/incidents |
| ☐ | Human oversight | Human oversight mechanisms over agent actions described; intervention and escalation points defined. | /en/human-oversight |
| ☐ | Evidence manifest | Evidence manifest complete; artefacts with sha256 hashes; no unexplained null entries. | /evidence/manifest.json |
The external review must be performed by independent third parties — self-assessment does not satisfy this gate's criterion. Recommended composition:
Output: an external report with date, scope, findings and status of each checklist item. Items ☐ move to ☑ only on the basis of auditor confirmation.
First non-invasive review: 2026-05-24. Report and remediation status: docs/reports/EXTERNAL_REVIEW_2026-05-24.md.
✅ 2026-05-24 — GO CONTROLLED / NOT FULL GO. Report: EXTERNAL_REVIEW_2026-05-24.md✅ 2026-05-24 — GO CONTROLLED; claims softened (LEGAL_CLAIMS_MATRIX).✅ 2026-05-24 — GO CONTROLLED conditionally. Report: AI_ACT_READINESS_REVIEW_2026-05-24.md✅ 2026-05-24 — 0 BLOCKER/CRITICAL/MAJOR. Report: SELF_PENTEST_2026-05-24.md✅ 2026-05-25 — completed and accepted; all CRITICAL + MAJOR addressed, verified live.Remediation: CRITICAL-01 (CSP), CRITICAL-02 (CORS allowlist), BLOCKER-01/02 — closed. Details in report.
Aggregate status: independent pentest (RSpace) COMPLETED and ACCEPTED 2026-05-25; all CRITICAL + MAJOR addressed, verified live and accepted by the auditor. FULL GO (P2-07) REACHED: 3 signatures on /production-gate + NETWORK_STATUS=PRODUCTION switched 2026-05-26.