Módulo 8: Proyecto Integrador — Ethics Audit of an AI System
Findings: Transparency + Compliance sections
Descripción
Continuamos llenando el report con Findings: Transparency and Explainability y Findings: Compliance (EU AI Act + GDPR). Mismo pattern que M8-03, aplicado a estas sections críticas.
Al terminar tendrás 3 sections más completed del report.
Section: Transparency and Explainability (typical findings)
# Section 6: Transparency and Explainability Findings
## 6.1 Overview
Reviewed 5 items related to disclosure, explanations, citations,
limitations, and confidence indicators.
## 6.2 Status Summary
| Item | Description | Status | Critical |
|------|-------------|--------|----------|
| 3.1 | AI disclosure to users | ✅ Yes | Yes |
| 3.2 | Decision explanations | ⚠️ Partial | Yes |
| 3.3 | Source citations | ✅ Yes | Yes |
| 3.4 | Limitations disclosed | ❌ No | No |
| 3.5 | Confidence indicators | N/A | No |
Compliant: 2, partial: 1, gap: 1, N/A: 1.
## 6.3 Detailed Findings
### Item 3.2: Decision explanations — PARTIAL
**Current state**: For RAG answers, citations provided. For
classification decisions (intent routing, content filtering),
no explanation provided to users.
**Required state**: All automated decisions affecting users have
meaningful explanations.
**Gap**: Some decision pathways lack explanations.
**Evidence reviewed**:
- RAG responses: include citations ✓
- Intent classification: silent processing
- Content filter: rejection without explanation
**Root cause**: Focus was on user-visible chat responses; auxiliary
decisions overlooked.
**Impact**:
- GDPR Art. 22 partial compliance only
- User confusion when content filtered without explanation
**Recommendation**:
1. Audit ALL decisions made by system per user interaction
2. For each, ensure user-facing explanation
3. Build template responses for common rejection reasons
**Priority**: MEDIUM
**Owner**: Tech Lead + Product
**Estimated effort**: 1 week
**Target**: 2026-06-30
### Item 3.4: Limitations disclosed — GAP
**Current state**: No user-facing disclosure of system limitations.
**Required state**: Users should know what AI cannot do (e.g., real-time
data, certain topics out of scope, knowledge cutoff).
**Gap**: Limitations not communicated.
**Impact**:
- Users may rely on system for use cases beyond capability
- Overreliance risk
- Trust eroded if user discovers limitations the hard way
**Recommendation**:
1. Document system limitations comprehensively
2. Surface in user onboarding
3. Mention in chat responses where relevant ("I cannot access real-time data")
**Priority**: LOW-MEDIUM
**Owner**: Product + Tech Lead
**Estimated effort**: 3-5 days
**Target**: 2026-Q3
## 6.4 Patterns and themes
**Pattern**: Transparency partial. User-visible chat is well-handled;
auxiliary decisions and limitations less so.
**Recommendation pattern**: Adopt "every user-affecting decision needs
explanation" principle.Section: Compliance — EU AI Act (typical findings)
# Section 7: EU AI Act Compliance Findings
## 7.1 Overview
Reviewed compliance with EU AI Act. System classification: limited risk
(no Art. 22 automated decisions affecting individuals significantly).
## 7.2 Status Summary
| Item | Description | Status | Critical |
|------|-------------|--------|----------|
| 4.1 | Risk classification | ✅ Yes | Yes |
| 4.2 | High-risk obligations | N/A | N/A (not high-risk) |
| ... |
## 7.3 Detailed Findings
### Item 4.1: Risk classification — Yes
System classified as "limited risk" because:
- Does not make decisions causing legal/significant effects on individuals
- Does not process biometric or sensitive special category data
- Does not perform AI uses in EU AI Act Annex III
Risk classification document: ethics-audit/risk-classification-2026-03.md
**However**: Reclassification recommended if:
- New use cases added (e.g., recommendations for HR decisions)
- Decision-making capability significantly expands
### Item 4.5: Limited risk transparency obligations
**Required**: Disclose AI to users (Art. 52).
**Status**: ✅ Yes (via Item 3.1 — onboarding informs users they're
interacting with AI).
## 7.4 Recommendations summary
| ID | Recommendation | Priority | Target |
|----|---------------|----------|--------|
| EU-1 | Re-classify if use case expands | LOW | Triggered |
| EU-2 | Monitor EU AI Act amendments | LOW | Ongoing |Section: Compliance — GDPR (typical findings)
# Section 8: GDPR Compliance Findings
## 8.1 Overview
Comprehensive GDPR compliance review for processing of personal data
of EU/EEA residents.
## 8.2 Status Summary
| Item | Description | Status | Critical |
|------|-------------|--------|----------|
| 5.1 | Lawful basis per processing | ✅ Yes | Yes |
| 5.2 | Art. 22 automated decisions | N/A | N/A |
| 5.3 | Data subject rights process | ⚠️ Partial | Yes |
| 5.4 | International transfers safeguards | ❌ No | Yes |
| 5.5 | Breach notification process | ✅ Yes | Yes |
| 5.6 | DPO consultation | ✅ Yes | Yes |
Compliant: 3, partial: 1, gap: 1, N/A: 1.
## 8.3 Detailed Findings
### Item 5.3: Data subject rights — PARTIAL
**Current state**: Right of access implemented (data export endpoint).
Right of erasure has manual workflow but no automation.
**Required state**: All 6 GDPR rights implemented with documented
process meeting 1-month SLA.
**Gap**: Rectification, portability, restriction processes informal.
Erasure can be slow.
**Recommendation**:
1. Document each right's process formally
2. Build internal admin tools for fast handling
3. Train support team
**Priority**: HIGH (regulatory)
**Owner**: Tech Lead + DPO + Customer Success
**Estimated effort**: 3-4 weeks
**Target**: 2026-Q3
### Item 5.4: International transfers — GAP
**Current state**: Data processed by OpenAI (US) and Pinecone (US).
SCCs not signed; or signed but not on file.
**Required state**: SCCs (or other safeguards) signed and documented
for all extra-EU processors.
**Gap**: Documentation of safeguards missing.
**Impact**: GDPR Chapter V violation. Fines up to 4% global revenue.
**Recommendation**:
1. Verify if SCCs were signed
2. If not, sign immediately with both providers
3. File documents in compliance folder
4. Update privacy policy to mention transfers + safeguards
**Priority**: CRITICAL (likely existing risk)
**Owner**: Legal Counsel + DPO
**Estimated effort**: 1-2 weeks
**Target**: 2026-06-15 (urgent)
## 8.4 Patterns and themes
**Pattern**: Customer-facing compliance handled (Art. 22, transparency),
internal compliance (transfers, formal processes) underdeveloped.
**Root cause**: Compliance work prioritized by visibility; back-office
compliance neglected.
**Recommendation pattern**: Audit all GDPR articles, not just
"customer-facing" ones.Trampas comunes para estas sections
Trampa 1 — Treating limited risk como "no work needed". Limited risk still has obligations (transparency, etc.). Apply them.
Trampa 2 — GDPR only about Art. 22. There are 99 articles. Most don't apply, but some do. Audit broadly.
Trampa 3 — Asuming SCCs son in place. Sin checking actual signed documents, asumed compliance. Verify.
Trampa 4 — Documenting compliance superficially. "GDPR: compliant ✓" vs "Section 8 with 6 items, evidence per item". Detail matters.
Trampa 5 — Sin re-classification trigger. EU AI Act classifications change if system changes. Document triggers.
Ejercicio
Para tu sistema:
- Sumar 3 sections más al report (transparency, EU AI Act, GDPR)
- Each with status summary table + detailed findings for gaps
- Identify patterns across sections
Resumen
Aprendiste:
- ✅ Pattern de findings sections aplicado a transparency + compliance
- ✅ Cross-references entre sections (Item 3.1 ↔ Item 4.5)
- ✅ Pattern: customer-facing handled, internal neglected
- ✅ Trampas: SCCs asumed, GDPR only Art. 22, no reclassification
Checkpoint: si tus 3 nuevas sections siguen pattern del previous, listo.
Siguiente cápsula
05 — Findings: Documentation + Governance. Last sections del report findings.