Module 8: Capstone Project — Ethics Audit of an AI System
Findings: the Transparency + Compliance sections
Description
We keep filling in the report with Findings: Transparency and Explainability and Findings: Compliance (EU AI Act + GDPR). The same pattern as M8-03, applied to these critical sections.
By the end you'll have 3 more completed sections of the report.
Section: Transparency and Explainability (typical findings)
# Section 6: Transparency and Explainability Findings
## 6.1 Overview
We reviewed 5 items related to disclosure, explanations, citations,
limitations, and confidence indicators.
## 6.2 Status Summary
| Item | Description | Status | Critical |
|------|-------------|--------|----------|
| 3.1 | AI disclosure to users | ✅ Yes | Yes |
| 3.2 | Decision explanations | ⚠️ Partial | Yes |
| 3.3 | Source citations | ✅ Yes | Yes |
| 3.4 | Limitations disclosed | ❌ No | No |
| 3.5 | Confidence indicators | N/A | No |
Compliant: 2, partial: 1, gap: 1, N/A: 1.
## 6.3 Detailed Findings
### Item 3.2: Decision explanations — PARTIAL
**Current state**: For RAG answers, citations are provided. For
classification decisions (intent routing, content filtering),
no explanation is provided to users.
**Required state**: All automated decisions affecting users have
meaningful explanations.
**Gap**: Some decision pathways lack explanations.
**Evidence reviewed**:
- RAG responses: they include citations ✓
- Intent classification: silent processing
- Content filter: rejection with no explanation
**Root cause**: The focus was on user-visible chat responses; the auxiliary
decisions were overlooked.
**Impact**:
- Only partial GDPR Art. 22 compliance
- User confusion when content is filtered with no explanation
**Recommendation**:
1. Audit ALL decisions the system makes per user interaction
2. For each one, ensure a user-facing explanation
3. Build template responses for the common rejection reasons
**Priority**: MEDIUM
**Owner**: Tech Lead + Product
**Estimated effort**: 1 week
**Target**: 2026-06-30
### Item 3.4: Limitations disclosed — GAP
**Current state**: No user-facing disclosure of the system's limitations.
**Required state**: Users should know what the AI cannot do (e.g., real-time
data, certain topics out of scope, a knowledge cutoff).
**Gap**: The limitations aren't communicated.
**Impact**:
- Users may rely on the system for use cases beyond its capability
- Overreliance risk
- Trust erodes if the user discovers the limitations the hard way
**Recommendation**:
1. Document the system's limitations comprehensively
2. Surface them in user onboarding
3. Mention them in chat responses where relevant ("I can't access real-time data")
**Priority**: LOW-MEDIUM
**Owner**: Product + Tech Lead
**Estimated effort**: 3-5 days
**Target**: 2026-Q3
## 6.4 Patterns and themes
**Pattern**: Transparency is partial. The user-visible chat is well handled;
the auxiliary decisions and the limitations less so.
**Recommendation pattern**: Adopt an "every user-affecting decision needs an
explanation" principle.Section: Compliance — EU AI Act (typical findings)
# Section 7: EU AI Act Compliance Findings
## 7.1 Overview
We reviewed compliance with the EU AI Act. System classification: limited risk
(no Art. 22 automated decisions that significantly affect individuals).
## 7.2 Status Summary
| Item | Description | Status | Critical |
|------|-------------|--------|----------|
| 4.1 | Risk classification | ✅ Yes | Yes |
| 4.2 | High-risk obligations | N/A | N/A (not high-risk) |
| ... |
## 7.3 Detailed Findings
### Item 4.1: Risk classification — Yes
The system is classified as "limited risk" because:
- It doesn't make decisions with legal/significant effects on individuals
- It doesn't process biometric or sensitive special category data
- It doesn't perform AI uses listed in EU AI Act Annex III
Risk classification document: ethics-audit/risk-classification-2026-03.md
**However**: reclassification is recommended if:
- New use cases are added (e.g., recommendations for HR decisions)
- The decision-making capability expands significantly
### Item 4.5: Limited risk transparency obligations
**Required**: Disclose the AI to users (Art. 52).
**Status**: ✅ Yes (via Item 3.1 — onboarding informs users they're
interacting with AI).
## 7.4 Recommendations summary
| ID | Recommendation | Priority | Target |
|----|----------------|----------|--------|
| EU-1 | Re-classify if the use case expands | LOW | Triggered |
| EU-2 | Monitor EU AI Act amendments | LOW | Ongoing |Section: Compliance — GDPR (typical findings)
# Section 8: GDPR Compliance Findings
## 8.1 Overview
A comprehensive GDPR compliance review for the processing of personal data
of EU/EEA residents.
## 8.2 Status Summary
| Item | Description | Status | Critical |
|------|-------------|--------|----------|
| 5.1 | Lawful basis per processing | ✅ Yes | Yes |
| 5.2 | Art. 22 automated decisions | N/A | N/A |
| 5.3 | Data subject rights process | ⚠️ Partial | Yes |
| 5.4 | International transfer safeguards | ❌ No | Yes |
| 5.5 | Breach notification process | ✅ Yes | Yes |
| 5.6 | DPO consultation | ✅ Yes | Yes |
Compliant: 3, partial: 1, gap: 1, N/A: 1.
## 8.3 Detailed Findings
### Item 5.3: Data subject rights — PARTIAL
**Current state**: The right of access is implemented (a data export endpoint).
The right of erasure has a manual workflow but no automation.
**Required state**: All 6 GDPR rights implemented with a documented
process meeting the 1-month SLA.
**Gap**: The rectification, portability, and restriction processes are informal.
Erasure can be slow.
**Recommendation**:
1. Formally document each right's process
2. Build internal admin tools for fast handling
3. Train the support team
**Priority**: HIGH (regulatory)
**Owner**: Tech Lead + DPO + Customer Success
**Estimated effort**: 3-4 weeks
**Target**: 2026-Q3
### Item 5.4: International transfers — GAP
**Current state**: Data is processed by OpenAI (US) and Pinecone (US).
SCCs weren't signed; or they were signed but aren't on file.
**Required state**: SCCs (or other safeguards) signed and documented
for all extra-EU processors.
**Gap**: The documentation of the safeguards is missing.
**Impact**: A GDPR Chapter V violation. Fines up to 4% of global revenue.
**Recommendation**:
1. Verify whether SCCs were signed
2. If not, sign them immediately with both providers
3. File the documents in the compliance folder
4. Update the privacy policy to mention the transfers + safeguards
**Priority**: CRITICAL (a likely existing risk)
**Owner**: Legal Counsel + DPO
**Estimated effort**: 1-2 weeks
**Target**: 2026-06-15 (urgent)
## 8.4 Patterns and themes
**Pattern**: Customer-facing compliance is handled (Art. 22, transparency),
while internal compliance (transfers, formal processes) is underdeveloped.
**Root cause**: Compliance work was prioritized by visibility; back-office
compliance was neglected.
**Recommendation pattern**: Audit all the GDPR articles, not just the
"customer-facing" ones.Common traps for these sections
Trap 1 — Treating limited risk as "no work needed." Limited risk still has obligations (transparency, etc.). Apply them.
Trap 2 — Thinking GDPR is only about Art. 22. There are 99 articles. Most don't apply, but some do. Audit broadly.
Trap 3 — Assuming the SCCs are in place. Without checking the actual signed documents, you assumed compliance. Verify it.
Trap 4 — Documenting compliance superficially. "GDPR: compliant ✓" vs. "Section 8 with 6 items, evidence per item." Detail matters.
Trap 5 — No re-classification trigger. EU AI Act classifications change if the system changes. Document the triggers.
Exercise
For your system:
- Add 3 more sections to the report (transparency, EU AI Act, GDPR)
- Each with a status summary table + detailed findings for the gaps
- Identify the patterns across sections
Summary
You learned:
- ✅ The findings section pattern applied to transparency + compliance
- ✅ Cross-references between sections (Item 3.1 ↔ Item 4.5)
- ✅ The pattern: customer-facing handled, internal neglected
- ✅ The traps: assumed SCCs, GDPR reduced to Art. 22, no reclassification
Checkpoint: if your 3 new sections follow the pattern from the previous one, you're set.
Next capsule
05 — Findings: Documentation + Governance. The last sections of the report's findings.