Mydep

Περιγραφή

This research will create a practical, legally grounded audit guide that helps notified bodies and internal auditors evaluate AI-enabled “products with digital elements” against the dual requirements of the EU AI Act and the Cyber-Resilience Act (CRA). By mapping articles, annexes and conformity-assessment modules from both laws onto a unified checklist, defining the technical artefacts and evidence an auditor must inspect, and piloting the workflow on at least one real or simulated product, the research aims to deliver a step-by-step manual that regulators can reference and vendors can adopt with minimal overhead.
Dual-regime requirement mapping. Which AI Act obligations (risk management, data governance, transparency, human oversight) align or conflict with CRA secure-by-design and vulnerability-handling requirements, and how can these be synthesised into a single, de-duplicated audit taxonomy?
Evidence & metric specification. What concrete artefacts (documentation, test results, logs, model cards, SBOMs) and quantitative metrics should an auditor collect to verify each item in the unified taxonomy, and how can portions of this evidence gathering be automated?
Audit workflow validation. When the draft guide is applied to a representative AI-enabled product (e.g., a connected medical device or an industrial vision system), what gaps, redundancies or feasibility issues emerge, and how should the guide be refined to balance thoroughness with audit effort?

Στοιχεία Εργασίας