# Compliance Gap Analysis — Acme Inc

> Auto-generated by Codepliant on 2026-03-19.
> Compares current compliance state (from code analysis) against regulatory target state.
> This analysis should be validated by qualified legal and compliance professionals.
> **Document Version:** 1.0  
> **Document Owner:** Acme Inc  
> **Next Review Date:** 2027-03-19

## Executive Summary

| Metric | Value |
|--------|-------|
| Total Gaps Identified | **6** |
| Critical Gaps | **2** |
| High Priority Gaps | **3** |
| Medium Priority Gaps | **1** |
| Services Analyzed | 8 |
| Regulations Covered | EU AI Act, PCI DSS, ePrivacy, SOC 2 |

## Gap Analysis Table

| Requirement | Current State | Target State | Gap | Priority | Effort |
|-------------|---------------|--------------|-----|----------|--------|
| AI System Transparency (Art. 50) | AI disclosure and model card generated | AI usage disclosed in product UI; users informed before AI interaction | Add in-product AI disclosure; link to model card from UI | 🔴 Critical | Low |
| PCI DSS Compliance | Payment processors detected via code scan | PCI DSS SAQ completed; tokenization verified; no raw card data stored | Complete PCI DSS Self-Assessment Questionnaire; verify tokenization implementation | 🔴 Critical | High |
| AI Risk Classification | Risk level set to: limited | All AI systems classified; high-risk systems registered in EU database | Document classification rationale; register if high-risk | 🟠 High | Medium |
| Human Oversight (Art. 14) | AI governance framework generated | Human oversight mechanisms implemented; override capabilities documented | Implement human review workflow for AI decisions; document override procedures | 🟠 High | High |
| Cookie Consent (ePrivacy Directive) | Cookie inventory generated; analytics services detected | Cookie banner deployed; consent recorded; non-essential cookies blocked until consent | Deploy CMP with granular cookie categories; implement server-side consent enforcement | 🟠 High | Medium |
| SOC 2 Type II Audit Readiness | Security and access control policies generated | SOC 2 Type II audit completed; evidence collection automated | Map controls to Trust Service Criteria; begin 6-month evidence collection period | 🟡 Medium | High |

## Per-Regulation Breakdown

### EU AI Act

**3 gaps identified** (1 critical, 2 high)

- 🔴 **AI System Transparency (Art. 50)**: Add in-product AI disclosure; link to model card from UI *(Effort: Low)*
- 🟠 **AI Risk Classification**: Document classification rationale; register if high-risk *(Effort: Medium)*
- 🟠 **Human Oversight (Art. 14)**: Implement human review workflow for AI decisions; document override procedures *(Effort: High)*

### PCI DSS

**1 gaps identified** (1 critical, 0 high)

- 🔴 **PCI DSS Compliance**: Complete PCI DSS Self-Assessment Questionnaire; verify tokenization implementation *(Effort: High)*

### ePrivacy

**1 gaps identified** (0 critical, 1 high)

- 🟠 **Cookie Consent (ePrivacy Directive)**: Deploy CMP with granular cookie categories; implement server-side consent enforcement *(Effort: Medium)*

### SOC 2

**1 gaps identified** (0 critical, 0 high)

- 🟡 **SOC 2 Type II Audit Readiness**: Map controls to Trust Service Criteria; begin 6-month evidence collection period *(Effort: High)*

## Remediation Roadmap

### Immediate (Week 1) — Critical Gaps

- [ ] **AI System Transparency (Art. 50)** (EU AI Act): Add in-product AI disclosure; link to model card from UI
- [ ] **PCI DSS Compliance** (PCI DSS): Complete PCI DSS Self-Assessment Questionnaire; verify tokenization implementation

### Short-term (Weeks 2-4) — High Priority Gaps

- [ ] **AI Risk Classification** (EU AI Act): Document classification rationale; register if high-risk
- [ ] **Human Oversight (Art. 14)** (EU AI Act): Implement human review workflow for AI decisions; document override procedures
- [ ] **Cookie Consent (ePrivacy Directive)** (ePrivacy): Deploy CMP with granular cookie categories; implement server-side consent enforcement

### Medium-term (Months 2-3) — Medium Priority Gaps

- [ ] **SOC 2 Type II Audit Readiness** (SOC 2): Map controls to Trust Service Criteria; begin 6-month evidence collection period

---

*This gap analysis is generated from automated code analysis and regulatory checklists. It does not constitute legal advice. Have this document reviewed by a qualified compliance professional before acting on it.*
