Is it compliant?

Which standards apply to this solution, how each was satisfied, and what is still open. Controls are applied during creation, not evidenced afterwards.

3 open findings

Standards applied

Selected automatically from the solution's tier, domain and data classification.

Standard	Owner	How it applied	Result
Model Risk Management	MRM Office	High-impact tier	42 / 42 controls
GDPR — data minimisation	Privacy Office	Pseudonymisation at index	Pass
BCBS 239 — risk data aggregation	Risk	Lineage + quality evidence	Pass
EU AI Act — high-risk duties	Compliance	Transparency + human oversight	Pass
Bias & fairness testing	MRM Office	4 protected attributes	82% coverage
Internal AI policy v3	AI CoE	Guardrails + approval gate	Pass

Open findings

Each has a named owner and a due date before the next review.

f-441

Bias coverage missing on two protected attributes

Owner: Risk Analytics · due 2026-09-30

Medium

f-438

Stale lineage node — feature store refresh lag

Owner: Customer Data · due 2026-08-31

Low

f-430

Harness regression on multi-intent turns

Owner: AI CoE · due 2026-08-22

Medium

Control results

Continuously evaluated, not point-in-time.

Policy checks42 / 42

Data quality96.7%

Residual riskLow

Bias test coverage82%

Open findings3

Access reviewscurrent

Governance by design

Every control here was enforced by a gate in Forge — the evidence is a by-product of building, not a separate compliance exercise.