Report for the regulator and auditors
The company, 22/10/2026. All your documentation on one page.
What you send if the supervisory authority or an auditor asks. Save it as a PDF after the annual review. How to
2 of 6Ready for the regulator
4entries in the AI inventory
0decisions about people made by a human
✓audit log intact (13 entries)
- ! All use of AI is recorded and assessed Missing: 1 waiting for confirmation, 1 task from the legal requirements.
- ! The AI policy has been adopted No AI policy adopted yet.
- ! Those who use AI have taken the course Take the AI literacy course (10 min.)
- ! A person decides cases about people 1 case waiting for a person.
- ✓ Everything is saved as proof 13 events in the audit log. None has been changed or deleted.
- ✓ The AI has only seen codes, not your data Real names and numbers have stayed with GoalCube in the EU.
1. AI inventory
| Use of AI | Risk | Human approval | Confirmed | Rule set |
|---|---|---|---|---|
| Summary of customer enquiries | Minimal risk | No | GoalCube (automatically under a rule), 22/10/2026 | 2026.3 |
| Overview of supplier contracts | Minimal risk | No | GoalCube (automatically under a rule), 22/10/2026 | 2026.3 |
| Assessment of applicants for controller | High risk | Yes | CB, 22/10/2026 | 2026.3 |
| Replies to HR cases | High risk | Yes | Pending | – |
2. AI policy
No AI policy adopted.
3. AI literacy (Art. 4 AI Act)
None.
4. Human decisions about people (Art. 22 GDPR, Art. 14 AI Act)
0 cases decided, 1 open. Of 0 people assessed, a human approved the AI's recommendation in 0 cases, made a different decision in 0 and asked for more information in 0. 0 decisions have been confirmed with a passkey.
5. Tasks completed
None.
6. Missing
- Confirm 1 entry in the AI inventory (AI Act and GDPR (the inventory shows which requirements apply))
- Take the AI literacy course (10 min.) (Art. 4 AI Act)
- Adopt an AI policy (Art. 24 GDPR; Art. 4 AI Act (good practice))
- Assessment of applicants for controller: Use the system according to the provider's instructions for use and monitor its operation. (Art. 26(1) and (5) AI Act)
- Assessment of applicants for controller: Tell the people the decisions concern that AI is involved. (Art. 26(11) AI Act)
- Assessment of applicants for controller: Inform employee representatives and the employees affected before the system is put into use. (Art. 26(7) AI Act)
- Assessment of applicants for controller: Carry out a data protection impact assessment (DPIA). (Art. 35 GDPR and Art. 26(9) AI Act)
7. Audit log and timestamps
The log is a hash chain (SHA-256) with 13 entries from 22/10/2026. The chain is intact. 0 entries have an independent timestamp (RFC 3161). Latest hash: f6eb7ae887d724fefb0be9fe…
Storage: midlertidig (forsvinder ved ny udrulning). Simplified and not legal advice.