# Evidence Pack Checklist (EU AI Act audit readiness)

Not legal advice. This checklist is designed to be auditable: each item should map to an artifact,
log, or export bundle you can produce on request.

Version: v1.0  
Last updated: 2025-12-16  
Changelog:
- 2025-12-16 v1.0 Initial release

Report an issue: https://kla.digital/contact?subject=Template%20issue%20-%20Evidence%20Pack%20Checklist

## 1) System description & intended use

- [ ] Minimum: system card (purpose, users, boundaries, deployment context)
- [ ] Strong: architecture diagram + component inventory + versioning scheme
- [ ] Gold: traceable mapping from live systems to doc sections (evidence pointers)

## 2) Risk management file

- [ ] Minimum: risk register + mitigations + residual risk sign-off
- [ ] Strong: mitigation verification evidence (tests, sampling outcomes)
- [ ] Gold: policy-as-code controls with enforcement logs + change history

## 3) Human oversight records

- [ ] Minimum: oversight SOP + intervention triggers + role definitions
- [ ] Strong: review queue records (approve/reject/edit/override + rationale)
- [ ] Gold: sampled review outcomes + disagreement handling + training evidence

## 4) Testing & validation evidence

- [ ] Minimum: evaluation report + acceptance thresholds
- [ ] Strong: subgroup/segment analysis + robustness testing
- [ ] Gold: continuous evaluation tied to releases + signed artifacts

## 5) Monitoring & incident logs (post-market)

- [ ] Minimum: monitoring plan + incident workflow
- [ ] Strong: drift/quality dashboards + incident reports
- [ ] Gold: sampling policy with burst rules + corrective action verification evidence

## 6) Change management & approvals

- [ ] Minimum: release notes + change approvals for material changes
- [ ] Strong: model/prompt/policy diffs with effective dates
- [ ] Gold: automated gating (fail-closed) + exportable change trail

## 7) Logging integrity proof & retention

- [ ] Minimum: audit event taxonomy + retention policy
- [ ] Strong: integrity mechanism documented + periodic verification reports
- [ ] Gold: evidence pack exports with manifests + checksums + independent verification steps

## 8) Annex IV mapping (if high-risk)

- [ ] Minimum: Annex IV-aligned technical documentation draft
- [ ] Strong: section-by-section evidence pointers
- [ ] Gold: one-click export bundle (PDF + manifest) from live telemetry + review trail