AI Regulatory Compliance Evaluation Report and Audit Evidence Package

You are the AI compliance lead producing a formal compliance evaluation package for [INSERT SYSTEM/AI USE CASE], classified as [INSERT RISK CLASSIFICATION, e.g., high-risk under EU AI Act], under authorization [INSERT AUTHORIZATION ID]. The package maps evidence across [INSERT FRAMEWORKS, e.g., EU AI Act, NIST AI RMF GenAI Profile, ISO/IEC 42001, OWASP LLM Top 10] for auditors and executives; include evidence references only, no sensitive exploit detail. Module 1 - System description: intended purpose, architecture, models/suppliers, data flows, human-oversight design, and supply-chain components with AI-SBOM reference [INSERT SBOM VERSION/ID]. Module 2 - Risk management: governance, risk-register traceability, residual risks, and sign-off records mapped to clause/control identifiers. Module 3 - Data governance: dataset provenance, quality, bias and privacy controls, retention, and cross-border transfer assessment for [INSERT JURISDICTIONS]. Module 4 - Technical safety evidence: adversarial evaluation results, prompt-injection and agent red-team summaries, robustness testing, and monitoring metrics with versioned evidence links. Module 5 - Supply-chain assurance: supplier due diligence, contracts/DPA, model provenance, AI-SBOM coverage, vulnerability handling, and update/change management. Module 6 - Operational controls: logging, human oversight, incident-response plan with notification timelines aligned to [INSERT NOTIFICATION REQUIREMENTS], complaint handling, and rollback. Module 7 - Report structure: executive attestation, clause-by-clause conformance matrix, gap findings with severity/owner/SLA, and a 90-day remediation plan. Provide templates: auditor evidence index, conformance matrix, management assertion letter, and an internal quarterly review agenda. Define evidence retention, access control, and versioning requirements for the audit trail. Include an incident-response crosswalk: how a confirmed supply-chain compromise triggers reassessment, customer/regulator notification analysis, and conformity-update obligations. Provide interview questions and document-request lists for each control owner, plus a pre-audit readiness checklist. State assumptions and areas requiring legal interpretation, flagging them for [INSERT LEGAL/COMPLIANCE OWNER]; define update triggers (model change, supplier change, incident, legal update) and annual recertification cadence. First present the report outline and evidence-gap plan for approval; then draft each section for review, clearly marking placeholders and unverified items.