> Auto-generated by Codepliant on 2026-03-19. Compares current compliance state (from code analysis) against regulatory target state. This analysis should be validated by qualified legal and compliance professionals. Document Version: 1.0 Document Owner: Acme Inc Next Review Date: 2027-03-19

## Executive Summary

Metric | Value
--- | ---
Total Gaps Identified | 6
Critical Gaps | 2
High Priority Gaps | 3
Medium Priority Gaps | 1
Services Analyzed | 8
Regulations Covered | EU AI Act, PCI DSS, ePrivacy, SOC 2

## Gap Analysis Table

Requirement | Current State | Target State | Gap | Priority | Effort
--- | --- | --- | --- | --- | ---
AI System Transparency (Art. 50) | AI disclosure and model card generated | AI usage disclosed in product UI; users informed before AI interaction | Add in-product AI disclosure; link to model card from UI | 🔴 Critical | Low
PCI DSS Compliance | Payment processors detected via code scan | PCI DSS SAQ completed; tokenization verified; no raw card data stored | Complete PCI DSS Self-Assessment Questionnaire; verify tokenization implementation | 🔴 Critical | High
AI Risk Classification | Risk level set to: limited | All AI systems classified; high-risk systems registered in EU database | Document classification rationale; register if high-risk | 🟠 High | Medium
Human Oversight (Art. 14) | AI governance framework generated | Human oversight mechanisms implemented; override capabilities documented | Implement human review workflow for AI decisions; document override procedures | 🟠 High | High
Cookie Consent (ePrivacy Directive) | Cookie inventory generated; analytics services detected | Cookie banner deployed; consent recorded; non-essential cookies blocked until consent | Deploy CMP with granular cookie categories; implement server-side consent enforcement | 🟠 High | Medium
SOC 2 Type II Audit Readiness | Security and access control policies generated | SOC 2 Type II audit completed; evidence collection automated | Map controls to Trust Service Criteria; begin 6-month evidence collection period | 🟡 Medium | High

## Per-Regulation Breakdown

### EU AI Act

3 gaps identified (1 critical, 2 high)

- 🔴 AI System Transparency (Art. 50): Add in-product AI disclosure; link to model card from UI (Effort: Low)
- 🟠 AI Risk Classification: Document classification rationale; register if high-risk (Effort: Medium)
- 🟠 Human Oversight (Art. 14): Implement human review workflow for AI decisions; document override procedures (Effort: High)

### PCI DSS

1 gaps identified (1 critical, 0 high)

- 🔴 PCI DSS Compliance: Complete PCI DSS Self-Assessment Questionnaire; verify tokenization implementation (Effort: High)

### ePrivacy

1 gaps identified (0 critical, 1 high)

- 🟠 Cookie Consent (ePrivacy Directive): Deploy CMP with granular cookie categories; implement server-side consent enforcement (Effort: Medium)

### SOC 2

1 gaps identified (0 critical, 0 high)

- 🟡 SOC 2 Type II Audit Readiness: Map controls to Trust Service Criteria; begin 6-month evidence collection period (Effort: High)

## Remediation Roadmap

### Immediate (Week 1) — Critical Gaps

- AI System Transparency (Art. 50) (EU AI Act): Add in-product AI disclosure; link to model card from UI
- PCI DSS Compliance (PCI DSS): Complete PCI DSS Self-Assessment Questionnaire; verify tokenization implementation

### Short-term (Weeks 2-4) — High Priority Gaps

- AI Risk Classification (EU AI Act): Document classification rationale; register if high-risk
- Human Oversight (Art. 14) (EU AI Act): Implement human review workflow for AI decisions; document override procedures
- Cookie Consent (ePrivacy Directive) (ePrivacy): Deploy CMP with granular cookie categories; implement server-side consent enforcement

### Medium-term (Months 2-3) — Medium Priority Gaps

- SOC 2 Type II Audit Readiness (SOC 2): Map controls to Trust Service Criteria; begin 6-month evidence collection period

This gap analysis is generated from automated code analysis and regulatory checklists. It does not constitute legal advice. Have this document reviewed by a qualified compliance professional before acting on it.