# Governance Report — Contract/document AI assistance

_HumanOSE — governance preparation, assurance support and audit-ready evidence. No legal compliance certification._

**Product:** HumanOSE  
**Use Case:** uc\_cx\_d04 (v1)  
**Source system:** causax  
**Language:** EN  
**Data mode:** synthetic  
**Generated at:** 2026-09-04T07:31:08.809Z  
**Report status:** Active  
**Integrity hash:** 9b52633bcf8b1154…  

> This report is based exclusively on synthetic data (pilot operation). No real personal data.

> This report does not certify legal compliance.

## Executive summary

Extraction, summarization and clause indicators for contracts and documents — in the pilot only synthetic sample contracts.

- **Intended purpose:** Drafting and review support with expert review of every output — no legal advice.
- **Preliminary risk class:** Elevated risk — human review required
- **Human oversight required:** Yes
- **Governance Readiness:** 1/8 Controls with evidence/reviewed

> Governance Readiness denotes the degree of preparation (evidence in place/reviewed) — it does not certify conformity.

## Use case profile

- **Intended purpose:** Drafting and review support with expert review of every output — no legal advice.
- **Affected groups of persons:** vertragsparteien\_mittelbar
- **Data sources:** synthetische\_mustervertraege
- **AI function:** extraction, generation
- **Potential impact:** operativ, rechtsfolgen\_bei\_fehlern
- **Jurisdiction:** eu-de
- **Source system:** causax
- **Lifecycle state:** Active

## Risk assessment (preliminary)

- **Preliminary risk class:** Elevated risk — human review required
- **Confidence of the assessment:** high
- **Ruleset:** v0.1.0
- **Human review required:** Yes

> The risk classification is preliminary and does not replace a legal assessment.

### Reasoning (rule reference)

- R-ELEV-LEGALDOC-01 — AI extraction from contract/legal documents — misextractions can have legal consequences; expert review of every output.
- R-LIM-TRANSPARENCY-01 — Generative or recommending AI function — transparency and labeling obligations must be reviewed.

### Recommended risk mitigations

- Expert review of every AI output before use; labeling of the AI-generated portion.
- Label AI-generated content as such; escalation to a human is possible at any time.

### Uncertainty of the assessment

Rule set v0.1 works with internal review heuristics on the EU AI Act, GDPR, Swiss DSG and the UK context. The assessment depends on the completeness of the registry entries and does not replace a legal review.

## Policy & control overview

> The control status documents the review of the evidence — it does not certify conformity.

| Control | Reference | Status | Evidence |
|---|---|---|---|
| Record-keeping / logging | EU AI Act Art. 12 | Open | 0 |
| Transparency & labeling | EU AI Act Art. 13 / 50 | Evidence attached | 1 |
| Lawfulness of processing | DSGVO Art. 6 | Open | 0 |
| Data minimization | DSGVO Art. 5(1c) | Open | 0 |
| Data subject rights | DSGVO Art. 12–22 | Open | 0 |
| AI literacy of those involved | EU AI Act Art. 4 | Open | 0 |
| Access control | ISO 27001 A.9 (Referenz) | Open | 0 |
| Audit/evidence chain | SysTec Evidence Standard (ADR-003) | Open | 0 |

### Open gaps

- Record-keeping / logging
- Lawfulness of processing
- Data minimization
- Data subject rights
- AI literacy of those involved
- Access control
- Audit/evidence chain

## Human oversight

- **Responsible human:** actor\_klaus
- **Reviewer:** actor\_klaus (reviewer)

> Human responsibility remains mandatory; AI does not make automatic decisions about persons.

### Review history

| Timestamp | Reviewer | Decision |
|---|---|---|
| 2026-08-30T09:49:30.196Z | actor\_klaus | Approved by human review |

## Evidence summary

- **Evidence chain status:** invalid (suspected tampering)
- **Number of evidence events:** 46
- **Verification passed:** No

> Simulated anchoring (PageCipher integration pending) — marked as a simulation.

| # | Timestamp | Actor | Action | Hash |
|---|---|---|---|---|
| 624 | 2026-09-02T19:07:42.723Z | actor\_system\_humanose | governance\_report\_generated | fd6145065992… |
| 640 | 2026-09-02T19:07:46.729Z | actor\_system\_humanose | governance\_report\_generated | c5a6167b74fc… |
| 642 | 2026-09-02T19:07:47.190Z | actor\_system\_humanose | governance\_report\_generated | 98f5ed3b1e44… |
| 654 | 2026-09-02T19:07:50.226Z | actor\_system\_humanose | governance\_report\_generated | cefec1f2fbc3… |
| 668 | 2026-09-02T19:07:57.208Z | actor\_system\_humanose | governance\_report\_generated | 39171a31b047… |
| 672 | 2026-09-02T19:07:58.226Z | actor\_system\_humanose | governance\_report\_generated | 38511f7e9555… |
| 736 | 2026-09-04T05:43:23.357Z | actor\_system\_humanose | governance\_report\_generated | 91b5b1bbf92d… |
| 814 | 2026-09-04T06:40:02.162Z | actor\_system\_humanose | governance\_report\_generated | ff93632aed7f… |
| 822 | 2026-09-04T06:43:48.765Z | actor\_system\_humanose | governance\_report\_generated | fc88915d54a3… |
| 858 | 2026-09-04T06:48:07.013Z | actor\_system\_humanose | governance\_report\_generated | 391e2c436e0d… |
| 864 | 2026-09-04T06:48:21.730Z | actor\_system\_humanose | governance\_report\_generated | 28e39c1f00d0… |
| 870 | 2026-09-04T06:48:42.957Z | actor\_system\_humanose | governance\_report\_generated | 56cecfa5a3e3… |
| 1022 | 2026-09-04T07:28:27.877Z | actor\_system\_humanose | governance\_report\_generated | ecb1982696e3… |
| 1028 | 2026-09-04T07:30:35.535Z | actor\_system\_humanose | governance\_report\_generated | 54dcdf56f921… |

### PageCipher anchor status

- **PageCipher integration status:** Active (HTTP integration with PageCipher)
- **PageCipher anchor status:** 32/46 Anchored
- **PageCipher anchor reference:** pagecipher:b7219e6f798b145ad0b32ae0b760e3cc
- **Last anchoring attempt:** 2026-09-04T07:30:35.543Z

> The PageCipher anchor proves the integrity and provenance of the evidence — it does not certify legal compliance.

## Open risks & gaps

- 7 open controls without evidence

## Legal notices (disclaimer)

- This report does not certify legal compliance.
- The risk classification is preliminary and does not replace a legal assessment.
- The legal assessment may require a specialized legal review.
- This report serves governance and compliance preparation on an evidence basis. It does not constitute legal advice, certification, or a conformity attestation.
- Human responsibility remains mandatory; AI does not make automatic decisions about persons.

## Appendix

### Control catalog

| Control | Source | Reference |
|---|---|---|
| Check for prohibited practices | eu\_ai\_act | EU AI Act Art. 5 |
| Risk management system | eu\_ai\_act | EU AI Act Art. 9 |
| Data governance | eu\_ai\_act | EU AI Act Art. 10 |
| Technical documentation (Annex IV-like) | eu\_ai\_act | EU AI Act Art. 11 / Annex IV |
| Record-keeping / logging | eu\_ai\_act | EU AI Act Art. 12 |
| Transparency & labeling | eu\_ai\_act | EU AI Act Art. 13 / 50 |
| Human oversight | eu\_ai\_act | EU AI Act Art. 14 |
| Accuracy, robustness, cybersecurity | eu\_ai\_act | EU AI Act Art. 15 |
| Lawfulness of processing | gdpr | DSGVO Art. 6 |
| Data minimization | gdpr | DSGVO Art. 5(1c) |
| Data protection impact assessment (DPIA) | gdpr | DSGVO Art. 35 |
| Data subject rights | gdpr | DSGVO Art. 12–22 |
| Bias monitoring | internal\_policy | SysTec Policy AI-BIAS-01 |
| AI literacy of those involved | ai\_literacy | EU AI Act Art. 4 |
| Access control | security | ISO 27001 A.9 (Referenz) |
| Audit/evidence chain | audit | SysTec Evidence Standard (ADR-003) |

### Generation metadata

- **Generated at:** 2026-09-04T07:31:08.809Z
- **Version:** 0.1.0
- **Language coverage:** 100 %
- **Number of evidence events:** 1031