Findings and remediation

A finding is a gap or problem that needs fixing. Findings come from gap analyses, red-team tests and audits, or you log them yourself.

Log a finding

1. 1
   Go to Issues → Findings → + New finding.
2. 2
   Choose the AI system and the requirement it breaks.
3. 3
   Pick a severity:

   • Critical: breaks the law or harms people now. Fix immediately.
   • High: likely non-compliance or real harm. Fix within weeks.
   • Medium: a gap an auditor would flag. Plan a fix.
   • Low: a good-practice improvement.
4. 4
   Describe what's wrong and what proves it.
5. 5
   Optionally add the first fix: the task, who owns it and the due date.

Track the fix

Open a finding to see its tasks. Each task has an owner, a due date and a status. Overdue tasks are flagged on the finding and in Reminders, and the owner is notified.

Close it

• Mark resolved when the fix is done. If tasks are still open, you'll be asked to confirm.
• Accept the risk when you decide not to fix it for now. You must say why and who approved it; the reason is kept on the finding.
• Reopen if it comes back.

Critical and high findings notify reviewers when logged. Every change is recorded in the activity log at the bottom of the page.