docs/usermanuals/en/data/croissant-card.md: misleading — The audit report (data_audit_report.json) already carries every signal an EU AI Act Article 10 reviewer needs: PII counts, secrets summary,… (DOC-BLEGAL-028) #135

Wave 1 · theme D1-10: Documentation-only fixes · highest severity High · 1 finding(s) · effort docs fix

Summary

Providers may stop at the audit report and skip bias examination and the other Art. 10 practices, which narrows the obligation.

Primary finding

DOC-BLEGAL-028 — docs/usermanuals/en/data/croissant-card.md: misleading — The audit report (data_audit_report.json) already carries every signal an EU AI Act Article 10 reviewer needs: PII counts, secrets summary,…

severity High

Where. docs/usermanuals/en/data/croissant-card.md:8 (Turkish mirror: docs/usermanuals/tr/data/croissant-card.md:8) · type: misleading

The document says. The audit report (data_audit_report.json) already carries every signal an EU AI Act Article 10 reviewer needs: PII counts, secrets summary, near-duplicate pairs, cross-split leakage, language distribution.

What the code does. Art. 10(2) requires governance practices on (a) design choices, (b) collection and origin, (c) preparation, (d) assumptions, (e) availability and suitability, (f) examination for possible biases, (g) bias detection, prevention and mitigation measures and (h) data gaps. Art. 10(3)-(4) add representativeness, statistical properties and context. The audit's signals cover only part of this, with no bias examination and no representativeness analysis.

User impact. Providers may stop at the audit report and skip bias examination and the other Art. 10 practices, which narrows the obligation.

Proposed correction. 'The audit report carries data-quality signals (PII counts, secrets, near-duplicates, leakage, language distribution) that support part of an Art. 10 data-governance file; bias examination (Art. 10(2)(f)-(g)), representativeness (10(3)) and the other 10(2) practices must be documented separately.' TR: 'Audit raporu Madde 10 dosyasının bir kısmını destekleyen veri-kalitesi sinyalleri taşır; önyargı incelemesi (10(2)(f)-(g)) ve temsil edicilik (10(3)) ayrıca belgelenmelidir.'

Turkish mirror. the Turkish page has the same error; fix both in the same PR

Acceptance criteria

• Each statement is re-checked against the code at fix time.
• Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
• Every finding in this issue is resolved or explicitly closed with a reason.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}