> Auto-generated by Codepliant on 2026-03-19. Per-regulation readiness scores with visual progress indicators. This scorecard should be reviewed by qualified legal and compliance professionals. Document Version: 1.0 Document Owner: Acme Inc Next Review Date: 2027-03-19

## Overall Readiness

Overall Score: 55% ██████░░░░

Regulation | Score | Progress
--- | --- | ---
EU AI Act | 70% | ███████░░░
PCI DSS | 25% | ███░░░░░░░
SOC 2 | 70% | ███████░░░

## Per-Regulation Assessment

### EU AI Act — 70% ███████░░░

European Union Artificial Intelligence Act

Requirement | Status | Weight
--- | --- | ---
AI System Transparency (Art. 50) | + Ready | 20%
AI Risk Classification | + Ready | 20%
Human Oversight (Art. 14) | - Action Needed | 20%
AI Model Documentation | + Ready | 15%
AI Governance Framework | + Ready | 15%
Bias Monitoring & Testing | - Action Needed | 10%

Action items to reach 100%:

- Human Oversight (Art. 14) (20%): Implement human review workflow for AI decisions; document override procedures
- Bias Monitoring & Testing (10%): Implement bias testing and fairness metrics for AI outputs

### PCI DSS — 25% ███░░░░░░░

Payment Card Industry Data Security Standard

Requirement | Status | Weight
--- | --- | ---
Tokenization / No Raw Card Storage | + Ready | 25%
PCI DSS Self-Assessment Questionnaire | - Action Needed | 25%
Network Security Controls | - Action Needed | 20%
Vulnerability Management | - Action Needed | 15%
Access Control & Monitoring | - Action Needed | 15%

Action items to reach 100%:

- PCI DSS Self-Assessment Questionnaire (25%): Complete the appropriate PCI DSS SAQ for your merchant level
- Network Security Controls (20%): Implement firewall rules, encryption in transit, and access controls
- Vulnerability Management (15%): Conduct quarterly vulnerability scans and annual penetration tests
- Access Control & Monitoring (15%): Implement least-privilege access and audit logging for payment systems

### SOC 2 — 70% ███████░░░

Service Organization Control Type 2

Requirement | Status | Weight
--- | --- | ---
Security Policy Documentation | + Ready | 20%
Access Control Policy | + Ready | 20%
Change Management Process | - Action Needed | 15%
Incident Response Plan | + Ready | 15%
Vendor Risk Management | + Ready | 15%
Evidence Collection & Audit Trail | - Action Needed | 15%

Action items to reach 100%:

- Change Management Process (15%): Document change management procedures with approval workflows
- Evidence Collection & Audit Trail (15%): Begin 6-month evidence collection period; automate evidence gathering

## Priority Action Plan

### High-Impact Actions (sorted by regulatory weight)

1. [PCI DSS] PCI DSS Self-Assessment Questionnaire (25%): Complete the appropriate PCI DSS SAQ for your merchant level
2. [EU AI Act] Human Oversight (Art. 14) (20%): Implement human review workflow for AI decisions; document override procedures
3. [PCI DSS] Network Security Controls (20%): Implement firewall rules, encryption in transit, and access controls
4. [PCI DSS] Vulnerability Management (15%): Conduct quarterly vulnerability scans and annual penetration tests
5. [PCI DSS] Access Control & Monitoring (15%): Implement least-privilege access and audit logging for payment systems
6. [SOC 2] Change Management Process (15%): Document change management procedures with approval workflows
7. [SOC 2] Evidence Collection & Audit Trail (15%): Begin 6-month evidence collection period; automate evidence gathering
8. [EU AI Act] Bias Monitoring & Testing (10%): Implement bias testing and fairness metrics for AI outputs

This regulatory readiness scorecard is generated from automated code analysis. Scores reflect documentation and configuration readiness, not full legal compliance. This does not constitute legal advice. Have this assessment reviewed by qualified compliance professionals.