Audits
The Audit extension is experimental and opt-in. Its scope and behavior may change in future releases, and only the EU AI Act assessment is available today.
The Audits extension records per-App-Instance compliance assessments, starting with the EU AI Act. An organization enables it in the Extension Store, and nothing is auto-enabled on upgrade.
For how the platform maps onto regulatory regimes in general, see Compliance and Regulatory Context. This page is about the concrete audit tooling.
Enable the Audit extension
Audits are delivered as an installable extension, off by default.
- Open the Extension Store (requires the Extension Manager role or System Admin).
- Enable Audits for the organization.
Enabling the extension makes the Audits tab appear on every App Instance and activates the two audit roles. Uninstalling hides the tab and revokes edit and approve rights, without touching any role assignment stored on a user.
Roles
| Capability | Roles | Notes |
|---|---|---|
| View | App Manager, App Developer | Read-only access to the Audits tab. |
| Edit | Audit Editor | Change answers and toggle the open/saved status. |
| Approve | Audit Manager | Approve and reopen an audit. Audit Manager includes Audit Editor. |
The Audit Editor and Audit Manager roles only count while the extension is enabled. Audit Manager is assigned explicitly; no other role implies it, so sign-off stays a deliberate delegation.
The Audits tab
The tab lives on each App Instance detail view, in the Audits section. It has one sub-tab per regulation:
- EU AI Act: a ten-question assessment (Q1-Q10) that classifies the App Instance against Regulation (EU) 2024/1689. A help panel above the questionnaire explains the regulation.
- GDPR (DSGVO): planned. The assessment is not yet available.
Audit lifecycle
An audit moves through three states:
open ──save──▶ saved ──approve──▶ approved
◀──────reopen────────┘
- open: draft, nothing persisted yet.
- saved: answers stored, still editable.
- approved: frozen snapshot, read-only. Only an Audit Manager can reopen it.
Editing answers and the open/saved transitions need the Audit Editor right. Approving and reopening need the Audit Manager right. Once an audit is approved, editing is blocked until a manager reopens it.
Common mistakes
- Expecting the Audits tab without enabling the extension. The tab and the audit roles only exist while the Audit extension is enabled for the organization.
- Assigning Audit Editor and expecting sign-off. Editing and approving are separate rights. Approve and reopen require Audit Manager.
- Editing an approved audit. An approved audit is frozen. An Audit Manager must reopen it before answers can change again.