How to cite SWT3 witness anchors in a conformity assessment report. Complete EU AI Act example for assessment bodies.
Conformity Assessment Report
High-Risk AI System -- Third-Party Conformity Assessment per Article 43(1)
Provider Under Assessment: Exemplar Financial AI Ltd.
AI System: AutoLend v3.2 (Credit Decision Engine)
Risk Classification: High-Risk (Annex III, Area 5(b) -- Creditworthiness)
Assessment Body: European AI Conformity Partners GmbH
Notified Body ID: NB-2847 (Fictional)
Assessment Standard: EN ISO/IEC 42001:2023 + EU AI Act Annex VI
Report ID: EACP-2026-0847
Report Date: 2026-10-10
Assessment Window: 2026-08-01 through 2026-10-08
This assessment evaluates the conformity of AutoLend v3.2 with EU Regulation 2024/1689 (the AI Act) requirements for high-risk AI systems. AutoLend is a credit decision engine used by three European financial institutions to evaluate consumer creditworthiness under Annex III, Area 5(b).
The assessment covers Articles 9 (Risk Management), 10 (Data Governance), 13 (Transparency), 14 (Human Oversight), and 15 (Accuracy, Robustness, and Cybersecurity). Technical documentation was evaluated against Annex IV requirements.
This assessment relied on three categories of evidence:
CONDITIONAL PASS. 4 of 5 assessed articles are conforming. One minor non-conformity identified on Article 13 (Transparency) requiring corrective action within 90 days. Reassessment of Art. 13 scheduled for January 2027.
| Metric | Value |
|---|---|
| Procedures Assessed | 18 |
| Conforming | 15 |
| Non-Conforming (Minor) | 1 |
| Observations | 2 |
| SWT3 Anchors Verified | 23 (5 independently recomputed) |
| Assessment Window | 2026-08-01 through 2026-10-08 (70 days) |
This assessment was conducted per the documented procedure EACP-QMS-P-012 "Conformity Assessment of AI Systems Using Cryptographic Evidence" (Rev 1.0, effective 2026-07-01), within the scope of NB-2847's ISO/IEC 17065 accreditation.
SWT3 witness anchors were verified using a two-step process:
sovereign.tenova.io/verify. Each returned VALID (anchor exists, fingerprint matches, no revocation).The SWT3 fingerprint formula is implemented in 7 independent SDK implementations (Python, TypeScript, Rust, C#, Ruby, Swift, Go) and verified against a shared test vector suite. Independent recomputation (Step 2 above) used OpenSSL 3.x, which is not an SWT3 SDK implementation, confirming that the formula is reproducible using standard cryptographic tools without vendor dependency.
The assessment window was defined as 2026-08-01 through 2026-10-08 (70 days). Only anchors with epoch timestamps within this window were considered as primary evidence. Of the 18 procedures assessed, 16 had continuous anchor coverage (at least one anchor per 7-day period). Two procedures (AI-DATA.1 and AI-FAIR.1) had intermittent or absent coverage, which is documented in the Article 10 findings below.
SWT3 anchors were accepted as sufficient evidence for TEST-method assessment objectives per NIST 800-53A methodology. INTERVIEW and DOCUMENT_REVIEW objectives were assessed through traditional methods as documented in this report. Where SWT3 evidence and interview evidence covered the same objective, both sources were considered. Discrepancies between SWT3 verdicts and assessor findings are documented in the relevant article section.
| Procedure | Anchor | Verified | Witness Date |
|---|---|---|---|
| AI-GRD.1 (Guardrail Enforcement) | SWT3-E-VULTR-AI-AIGRD1-PASS-1791532800-a7c3e91f02b4 |
VALID (recomputed) | 2026-10-05 |
| AI-GRD.2 (Guardrail Coverage) | SWT3-E-VULTR-AI-AIGRD2-PASS-1791446400-d12f8b6c4e91 |
VALID | 2026-10-04 |
| AI-SAFE.1 (Safety Classification) | SWT3-E-VULTR-AI-AISAFE1-PASS-1791360000-e8f2a7b10c34 |
VALID | 2026-10-03 |
Assessor notes: Art. 9(9) requires continuous iteration of the risk management system. The SWT3 evidence demonstrates continuous monitoring over the 70-day assessment window (23 anchors across 18 procedures). This continuous evidence pattern satisfies Art. 9(9) more robustly than periodic manual reviews.
Supplementary evidence: Interview with Head of Model Risk (EACP-INT-0847-02) confirmed quarterly risk review cadence and escalation procedures for model drift events.
| Procedure | Anchor | Verified | Witness Date |
|---|---|---|---|
| AI-DATA.1 (Data Provenance) | SWT3-E-VULTR-AI-AIDATA1-PASS-1790841600-b3d7f2e8a190 |
VALID (recomputed) | 2026-09-28 |
| AI-FAIR.1 (Bias Detection) | Not witnessed during assessment window. | ||
Assessor notes: AI-DATA.1 anchor confirms data provenance tracking is operational. The absence of an AI-FAIR.1 anchor is consistent with the provider's statement that comprehensive bias monitoring is not yet deployed. This is documented as an observation rather than a non-conformity because Art. 10(2)(f) requires "examination in view of possible biases" and the provider demonstrates partial coverage with a documented remediation plan.
Supplementary evidence: Data governance procedure document (DGP-2026-v2, section 4.3) reviewed. Interview with Data Protection Officer (EACP-INT-0847-03) confirmed bias detection roadmap.
| Procedure | Anchor | Verified | Witness Date |
|---|---|---|---|
| AI-ID.1 (Agent Identification) | SWT3-E-VULTR-AI-AIID1-PASS-1791100800-c4a8f7e2d301 |
VALID (recomputed) | 2026-10-01 |
| AI-EXPL.1 (Explainability) | SWT3-E-VULTR-AI-AIEXPL1-PASS-1791187200-f9b2c6e1a478 |
VALID | 2026-10-02 |
Assessor notes: The SWT3 evidence confirms that agent identification and explainability mechanisms are operational. However, operational evidence of system transparency does not satisfy the documentation obligation under Art. 13(3)(d). The provider must update deployer-facing documentation to include quantitative performance metrics.
Corrective action required: Update deployer documentation to include accuracy benchmarks, robustness test results, and cybersecurity assessment outcomes. Provide this documentation to all current deployers. Deadline: 90 days (2027-01-08).
Supplementary evidence: Deployer documentation package reviewed (AutoLend Integration Guide v3.2). Interview with development team lead (EACP-INT-0847-04) confirmed benchmarks exist internally but are not distributed.
| Procedure | Anchor | Verified | Witness Date |
|---|---|---|---|
| AI-HITL.1 (Human Override) | SWT3-E-VULTR-AI-AIHITL1-PASS-1791014400-e7d3b8f2a156 |
VALID | 2026-09-30 |
| AI-HITL.2 (Override Effectiveness) | SWT3-E-VULTR-AI-AIHITL2-PASS-1790928000-a2c9e4f7b831 |
VALID (recomputed) | 2026-09-29 |
Supplementary evidence: Interview with Chief AI Officer (EACP-INT-0847-01) confirmed override authority structure. Override audit log reviewed (12 overrides in assessment window, all documented with justification).
| Procedure | Anchor | Verified | Witness Date |
|---|---|---|---|
| AI-ROBUST.1 (Robustness Testing) | SWT3-E-VULTR-AI-AIROBUST1-PASS-1790755200-f1a6c3d9e247 |
VALID | 2026-09-27 |
| AI-PERF.1 (Performance Monitoring) | SWT3-E-VULTR-AI-AIPERF1-PASS-1790668800-b8e2f4a7c130 |
VALID (recomputed) | 2026-09-26 |
| ID | Article | Severity | Description | Deadline | Responsible |
|---|---|---|---|---|---|
| NC-001 | Art. 13 | MINOR | Update deployer documentation to include quantitative accuracy, robustness, and cybersecurity metrics per Art. 13(3)(d). | 2027-01-08 | Head of Product, Exemplar Financial AI |
| ID | Article | Description | Recommendation |
|---|---|---|---|
| OBS-001 | Art. 10 | Bias detection covers age and gender but not all protected characteristics. | Expand bias monitoring to disability status and ethnicity before Q2 2027. |
| OBS-002 | Art. 15 | Adversarial testing limited to known attack vectors. | Expand to emerging techniques (model extraction, data poisoning) relevant to financial AI. |
Five SWT3 anchors were selected for independent SHA-256 fingerprint recomputation. Selection criteria: one anchor per assessed article, prioritizing the most recent anchor for each.
| Procedure | Anchor (Truncated) | Verification Method | Result | Verified On |
|---|---|---|---|---|
| AI-GRD.1 | ...a7c3e91f02b4 |
SHA-256 recomputation (OpenSSL 3.x) | MATCH | 2026-10-09 |
| AI-DATA.1 | ...b3d7f2e8a190 |
SHA-256 recomputation (OpenSSL 3.x) | MATCH | 2026-10-09 |
| AI-ID.1 | ...c4a8f7e2d301 |
SHA-256 recomputation (OpenSSL 3.x) | MATCH | 2026-10-09 |
| AI-HITL.2 | ...a2c9e4f7b831 |
SHA-256 recomputation (OpenSSL 3.x) | MATCH | 2026-10-09 |
| AI-PERF.1 | ...b8e2f4a7c130 |
SHA-256 recomputation (OpenSSL 3.x) | MATCH | 2026-10-09 |
Remaining 18 anchors were verified via the public verifier at sovereign.tenova.io/verify. All returned VALID.
| Section | Title | Status | Notes |
|---|---|---|---|
| 1 | General Description | COMPLETE | System purpose, intended use, interaction with hardware/software. |
| 2 | Development Process | COMPLETE | Design specifications, model architecture, training methodology. |
| 3 | Monitoring and Functioning | COMPLETE | SWT3 continuous monitoring evidence (AI-INF.1, AI-GRD.1 anchors). |
| 4 | Performance and Accuracy | PARTIAL | Internal benchmarks exist but not formatted per Art. 13(3)(d). Linked to NC-001. |
| 5 | Risk Management | COMPLETE | Risk policy v2.1 reviewed. SWT3 evidence for AI-SAFE.1. |
| 6 | Changes Log | COMPLETE | Version history documented. Lifecycle chain evidence (AI-LCM.1). |
| 7 | Harmonised Standards | COMPLETE | EN ISO/IEC 42001:2023 applied. |
| 8 | EU Declaration of Conformity | PENDING | To be issued upon resolution of NC-001. |
Assessment Outcome: CONDITIONAL PASS
AutoLend v3.2 demonstrates substantial conformity with EU AI Act requirements for high-risk AI systems under Annex III, Area 5(b). One minor non-conformity (NC-001) was identified regarding deployer documentation under Article 13(3)(d). Two observations were recorded for continuous improvement.
The assessment body recommends conditional certification pending:
The use of SWT3 cryptographic witness evidence enabled continuous assessment over the 70-day window, providing stronger temporal coverage than periodic manual assessments. All 23 anchors were verified, with 5 independently recomputed using the assessor's own tools. The evidence integrity chain was confirmed intact.
SWT3 witness anchors cited in this report follow the format:
| Segment | Meaning | Example |
|---|---|---|
| TIER | Deployment tier (E=Enclave, S=SaaS, H=Hybrid) | E |
| PROVIDER | Infrastructure provider | VULTR |
| UCT | Control category | AI |
| PROCEDURE | Specific procedure from the UCT Registry | AIGRD1 |
| VERDICT | Assessment result | PASS |
| EPOCH | Unix timestamp of witness event | 1791532800 |
| SHA256_12 | First 12 characters of the SHA-256 fingerprint | a7c3e91f02b4 |
Any anchor can be independently verified at sovereign.tenova.io/verify with no account or authentication. The SHA-256 fingerprint formula is published in the SWT3 Protocol Specification and can be recomputed using any standard cryptographic library.