Compliance reports

Gather the evidence an auditor asks for, for one AI system or the whole organization over a period, then print it or export it as CSV.

When an auditor asks for evidence, Compliance gathers it for you: everything Altrum recorded about one AI system, or the whole organization, over a period you choose, on one page you can print or export. You type nothing in. Every section comes from work your organization has already done in Altrum.

It is for owners, admins, Governance Leads and auditors when your organization has the governance module.

Choose what and when

• Report on: The organization, or one of your AI systems.
• Period: Last quarter (the last whole calendar quarter), Last 12 months (the last twelve whole months) or Custom, any days up to 400 days long, which is as long as request logs are kept.

The choice is in the page’s address, so a link opens the same report.

An AI system’s report

Section	What it shows
Identity	Owner, project, purpose and stage, and the models and MCP tools it used in the period.
Rating	The rating in force when the period started, then each change in it, with how it changed, who made it and the note. Beside the title: the rating today, its EU AI Act category and its residual rating.
Lifecycle	Each move in the period, such as asked for approval, approved and went live, with who made it and the note.
Posture	Its posture score at the end of each month, and today’s score with any gaps.
Risks and controls	Each risk the latest assessment identified and how well it is covered. This one is as on the day of the report, and says so: Altrum does not keep past coverage.
Guardrails	The version live when the period started, each version applied in the period, and what the guardrails caught: requests blocked, masked and logged only, by guardrail.
Red-team runs	Each red-team run in the period: the guardrail version, how many attacks were caught, and the categories that got through with how many. The attack texts are not in the report; they are on each run.
Incidents	Each incident open at any point in the period, with its severity, status and resolution.
Access	Its keys today with when each was last used, and the decisions about them in access reviews started in the period.
Changes	The audit trail entries about it in the period, newest first, up to 200; the rest stay in the audit trail.

The organization’s report

Section	What it shows
AI systems	One row for each AI system: rating, stage, posture, guardrail violations and incidents in the period. Choose a name to open its own report.
Risk mix	How many AI systems not retired are at each rating, and their share.
Posture	The average posture of its AI systems at the end of each month.
Incidents	Every incident open at any point in the period.
Access reviews	Each review started in the period, when it was completed, and how many keys were kept and revoked.
Red-team runs	Each run in the period and whose guardrails it checked.

Without the AI Gateway

An organization without the AI Gateway gets every section it can. What the guardrails caught, models and tools used, red-team runs, keys and access reviews each say:

Left out: this organization does not have the AI Gateway.

Print and export

• Print opens your browser’s print dialog. The report prints on A4 with a heading naming what it covers, the period and who it was generated by and when. The section index and the controls stay off paper, a section starts a new page when it does not fit, no table row is split, and long cells wrap so every column is on the page.
• Export CSV saves one section as a CSV file, or Export all, one file each saves every section. The files are made in your browser from what is on screen.

Who can do what

	Owner	Admin	Governance Lead	Auditor	Member
Read and export compliance reports	Yes	Yes	Yes	Yes	No

Reports are limited to 120 an hour for each person.

If something goes wrong

The start must be before the end, and at most 400 days apart.

Choose a shorter period.