Skip to content

TR/FR/ES/ZH upgrade 'EU AI Act ready' to 'EU AI Act compliant' (TR/FR: 'compliant by default'), contradicting the same locale's compliance.limits (CR-A18-011) #458

Open
Open
TR/FR/ES/ZH upgrade 'EU AI Act ready' to 'EU AI Act compliant' (TR/FR: 'compliant by default'), contradicting the same locale's compliance.limits (CR-A18-011)#458
Labels
area: siteCode area: sitebacklog: knownAlready tracked in docs/roadmapbugSomething isn't workingdependenciesDependency or ecosystem currencydocumentationImprovements or additions to documentationseverity: highWrong behaviour or a false claim users rely onsource: review-2026-10Found by the October 2026 code and documentation reviewurgency: next-releaseTechnology currency: fix in the next releasewave: 1Roadmap wave 1: high severity, small effort
Milestone
Wave 1 — public contract and documented usage

Description

@cemililik
cemililik
opened on Oct 9, 2026

Wave 1 · theme D1-9: Compliance mappings and marketing language · highest severity High · 12 finding(s) · effort trivial

Summary

A Turkish or French visitor (the locale is auto-selected from the browser) reads 'EU AI Act compliant by default' on the homepage hero. A team relies on it as a conformity statement in procurement or audit material. The project's own compliance page and SoA say the toolkit cannot make a system compliant, and the features are opt-in.

Primary finding

CR-A18-011 — TR/FR/ES/ZH upgrade 'EU AI Act ready' to 'EU AI Act compliant' (TR/FR: 'compliant by default'), contradicting the same locale's compliance.limits

severity High · reachability default · intent contract-violation · confidence confirmed · independently confirmed · reproduced end to end · already tracked: KNOWN-OPEN DOCS-02/14/15/16 (S15) — docs/roadmap/phase-16-trust-surface-hardening.md:749-751,771-772

What happens. EN says 'EU AI Act ready' (home.hero.meta1) and 'EU AI Act ready by default' (home.hero.compliance.title). Several locales turn this into a conformity claim. home.hero.meta1 reads tr 'EU AI Act uyumlu', fr 'Conforme EU AI Act', es 'Conforme con EU AI Act' and zh '符合 EU AI Act', all meaning 'compliant'. home.hero.compliance.title reads tr 'Varsayılan olarak EU AI Act uyumlu' and fr 'EU AI Act conforme par défaut', meaning 'EU AI Act compliant by default'. de keeps 'bereit' and es/zh keep 'listo'/'就绪' in the title. In the same locale, compliance.limits.intro and limits.li1 say software 'cannot certify a system' and ForgeLM 'does not certify your system', and home.cap.iso.body says 'Software is aligned, not certified'. The 'by default' wording also contradicts opt-in semantics: the compliance features (compliance.* block, safety gate, approval gate, auto_revert) are opt-in, as home.hero.compliance.lead itself says.

Where.

Evidence.

  • node cmp.js: tr/fr/es/zh home.hero.meta1 and tr/fr home.hero.compliance.title contain 'uyumlu'/'conforme'/'符合' while EN has no 'compliant'. A full grep shows no other key where a locale adds 'compliant' that EN lacks (apart from benign 'HuggingFace uyumlu README'). In the same locale, compliance.limits.li1 says the toolkit does not certify.

Recommended fix. Change tr/fr/es/zh home.hero.meta1 and tr/fr home.hero.compliance.title back to 'ready' semantics ('hazır', 'prêt', 'listo', '就绪'). Also reconsider 'by default' in EN, since the compliance block and gates are opt-in.

Other findings with the same root cause

These close with the same fix; update them in the same pull request.

  • TECH-T10-003 (technology, Next release) — Regulation: EU AI Act: 'EU AI Act compliance' marketing language (feature claims vs evidence-only reality) (at-risk)
    severity Next release
    Item. 'EU AI Act compliance' marketing language (feature claims vs evidence-only reality) · verdict: at-risk · urgency: Next release
    State in ForgeLM. The bare phrase 'EU AI Act compliance' appears as a feature at pyproject.toml:20 (PyPI description), site/index.html:8, site/compliance.html:8,11 and site/js/translations.js:311,3845. docs/product_strategy.md:68 claims a 'complete EU AI Act compliance evidence bundle', and :95 shows '✅ Art. 9-17 + Annex IV'. docs/usermanuals/en/getting-started/introduction.md:59 promises 'conformity declaration s…
    State of the ecosystem on 2026-10-01. The AI Act places compliance on the provider. Art. 16(g) and Art. 47(1) say 'The provider shall draw up' the EU declaration of conformity, and Art. 47(4) says 'the provider shall assume responsibility for compliance'. Conformity runs through Art. 43. Presumption comes only from OJ-cited harmonised standards (Art. 40), and none is cited for the AI Act. Directive 2006/114/EC (OJ L 376/21, 27.12.200…
    Recommendation. Use evidence wording everywhere (EN, TR, all site locales, PyPI): 'EU AI Act documentation and evidence support (Annex IV-style technical documentation, Art. 9/10 records, audit trail)'. Remove 'conformity declaration scaffolding' / 'uygunluk beyanı şablonları', or align them with overview.md:78. Keep the 'cannot certify' limits copy next to every claim. Source or drop the 'only open-source tool'…
    Sources.

  • DOC-BLEGAL-020 (docs, High) — docs/usermanuals/en/compliance/annex-iv.md: false claim — Article 16 conformity is the deployer's signed deliverable and must be authored and signed outside the toolkit
    severity High
    Where. docs/usermanuals/en/compliance/annex-iv.md:183 (Turkish mirror: docs/usermanuals/tr/compliance/annex-iv.md:183) · type: false claim
    The document says. Article 16 conformity is the deployer's signed deliverable and must be authored and signed outside the toolkit
    What the code does. Under Art. 16(g), Art. 47(1) and 47(4), and Annex V points 3 and 8, the provider draws up and signs the EU declaration of conformity. A deployer does so only when Art. 25(1) makes it a provider.
    Proposed correction. The EU declaration of conformity (Art. 47, Annex IV point 8) is the provider's signed deliverable and must be authored and signed outside the toolkit.
    Turkish mirror. the Turkish page has the same error; fix both in the same PR

  • DOC-BLEGAL-021 (docs, High) — docs/usermanuals/en/compliance/annex-iv.md: false claim — [IS-T10-20] '§7 in this artefact is performance_metrics (accuracy / robustness), not a conformity declaration. Article 16 conformity is the…
    severity High
    Where. docs/usermanuals/en/compliance/annex-iv.md:183 (Turkish mirror: docs/usermanuals/tr/compliance/annex-iv.md:183) · type: false claim
    The document says. [IS-T10-20] '§7 in this artefact is performance_metrics (accuracy / robustness), not a conformity declaration. Article 16 conformity is the deployer's signed deliverable'
    What the code does. Reg. (EU) 2024/1689 Art. 16(g): providers of high-risk AI systems shall 'draw up an EU declaration of conformity in accordance with Article 47'. Art. 47(1): 'The provider shall draw up' it. Art. 47(4): the provider 'shall assume responsibility'. Annex V requires a statement of sole provider responsibility and the signature. A deployer bears this duty only when Art. 25(1) makes it a provider. In A…
    Proposed correction. ForgeLM does not generate an EU declaration of conformity (Annex IV point 8 is a copy of it; Art. 47). Under Art. 16(g) and Art. 47, the provider of the high-risk AI system draws it up, signs it and assumes responsibility for compliance; a deployer does so only when Art. 25(1) makes it the provider. It must be authored and signed outside the toolk…
    Turkish mirror. the Turkish page has the same error; fix both in the same PR

  • DOC-BLEGAL-026 (docs, High) — docs/usermanuals/en/compliance/overview.md: false claim — Article 16 conformity is the deployer's signed deliverable, not a code artefact.
    severity High
    Where. docs/usermanuals/en/compliance/overview.md:61 (Turkish mirror: docs/usermanuals/tr/compliance/overview.md:61) · type: false claim
    The document says. Article 16 conformity is the deployer's signed deliverable, not a code artefact.
    What the code does. Art. 16(g) and Art. 47(1) state that 'The provider shall draw up' the EU declaration of conformity. Under Art. 47(4) the provider assumes responsibility, and Annex V point 3 requires a statement that it is issued 'under the sole responsibility of the provider'. A deployer has this duty only if Art. 25(1) makes it a provider.
    Proposed correction. The EU declaration of conformity (Art. 47) is drawn up and signed by the provider of the high-risk AI system (or by whoever becomes provider under Art. 25), outside the toolkit.
    Turkish mirror. the Turkish page has the same error; fix both in the same PR

  • DOC-BLEGAL-039 (docs, High) — site/compliance.html: misleading — "Each card maps a Regulation (EU) 2024/1689 article to the ForgeLM module that fulfils it."
    severity High
    Where. site/compliance.html:135 (EN key compliance.mapping.lead, site/js/translations.js:3851) (Turkish mirror: site/js/translations.js:3910 (TR 'onu yerine getiren')) · type: misleading
    The document says. "Each card maps a Regulation (EU) 2024/1689 article to the ForgeLM module that fulfils it."
    What the code does. Arts 9-15 are requirements on the high-risk AI system, and Arts 16-17 are obligations of the provider (Art. 3(3)). Art. 16(a) makes the provider ensure compliance, which is demonstrated through the Art. 43 conformity assessment; a presumption of conformity comes only from OJ-cited harmonised standards (Art. 40), of which none is cited. Under Art. 47(4) the provider 'shall assume responsibility fo…
    Proposed correction. 'Each card maps a Regulation (EU) 2024/1689 article to the ForgeLM module that produces supporting evidence for it. Compliance remains the provider's responsibility.'

  • DOC-BLEGAL-042 (docs, High) — site/features.html: misleading — EU AI Act Articles 9-17, GDPR Article 15 + 17, ISO 27001 / SOC 2 Type II alignment evidence.
    severity High
    Where. site/features.html:405 (Turkish mirror: site/js/translations.js:1137) · type: misleading
    The document says. EU AI Act Articles 9-17, GDPR Article 15 + 17, ISO 27001 / SOC 2 Type II alignment evidence.
    What the code does. Art. 16 lists provider obligations (b) name and address, (f) conformity assessment, (g) EU declaration of conformity, (h) CE marking, (i) registration and (l) accessibility, and ForgeLM produces nothing for any of them. Art. 15 covers accuracy, robustness and cybersecurity, including poisoning and adversarial examples, beyond a checksum manifest. Compliance remains the provider's (Arts 16(g), 47(…
    Proposed correction. 'Evidence artefacts supporting EU AI Act Arts. 9-15 and 17 (provider obligations such as conformity assessment, CE marking and registration remain yours), GDPR Art. 15/17 primitives, ISO 27001 / SOC 2 mapping notes.' Fix site/js/translations.js:1032 (EN), :1137 (TR), :4469 (DE), :4515 (FR), :4561 (ES) and :4607 (ZH) too.

  • DOC-BLEGAL-045 (docs, High) — site/index.html: misleading — "EU AI Act ready by default." / "EU AI Act ready"
    severity High
    Where. site/index.html:184,238 (EN key home.hero.compliance.title / home.hero.meta1 at site/js/translations.js:325,340) (Turkish mirror: site/js/translations.js:431,446 (TR 'Varsayılan olarak EU AI Act uyumlu' / 'EU AI Act uyumlu' — 'compliant', an even stronger claim; FR/ES/ZH 'conforme'/'符合' likewise)) · type: misleading
    The document says. "EU AI Act ready by default." / "EU AI Act ready"
    What the code does. Under Reg. (EU) 2024/1689 (CELEX 32024R1689, ELI http://data.europa.eu/eli/reg/2024/1689/oj) the provider must ensure compliance. Art. 16(a), Art. 16(g)/47(1) say the provider draws up the EU declaration of conformity, and Art. 47(4) says the provider 'shall assume responsibility for compliance'. Conformity runs through the Art. 43 assessment, and a presumption of conformity comes only from OJ-ci…
    Proposed correction. Replace with evidence wording, e.g. 'EU AI Act evidence, built in' / 'Generates evidence for your EU AI Act technical documentation (opt-in compliance block)'. Never say 'ready', 'compliant' or 'by default'.

  • DOC-D3B04B-006 (docs, High) — docs/usermanuals/en/getting-started/introduction.md: false claim — Compliance stage includes 'conformity declaration scaffolding'.
    severity High · already tracked: KNOWN-OPEN DOCS-02 docs/roadmap/phase-16-trust-surface-hardening.md:776-777
    Where. docs/usermanuals/en/getting-started/introduction.md:59 (Turkish mirror: docs/usermanuals/tr/getting-started/introduction.md:33) · type: false claim
    The document says. Compliance stage includes 'conformity declaration scaffolding'.
    What the code does. No code under forgelm/ produces a declaration of conformity or a scaffold for one (rg -i 'conformity|declaration' in forgelm/*.py finds nothing relevant). export_compliance_artifacts writes compliance_report.json, training_manifest.yaml, data_provenance.json, risk_assessment.json and annex_iv_metadata.json only (forgelm/compliance.py:2171-2236). The sibling manual pages say ForgeLM does not gener…
    Code references. forgelm/compliance.py:2171-2236, forgelm/trainer.py:2006-2020, docs/usermanuals/en/compliance/overview.md:61
    Proposed correction. Replace 'conformity declaration scaffolding' with 'QMS SOP templates (docs/qms/); the declaration of conformity is the provider's own signed deliverable and is not generated'.
    Turkish mirror. the Turkish page has the same error; fix both in the same PR

  • DOC-BLEGAL-082 (docs, Medium) — docs/guides/safety_compliance.md: misleading — risk_assessment.json # Article 9: risk classification ... model_integrity.json # Article 15 ... audit_log.jsonl # Article 12: tamper-evident append-only…
    severity Medium
    Where. docs/guides/safety_compliance.md:254-268 (Turkish mirror: docs/guides/safety_compliance-tr.md:290-302) · type: misleading
    The document says. risk_assessment.json # Article 9: risk classification ... model_integrity.json # Article 15 ... audit_log.jsonl # Article 12: tamper-evident append-only log ... Each file maps to a specific EU AI Act requirement.
    What the code does. Under Art. 9(2) the risk management system is 'a continuous iterative process ... throughout the entire lifecycle'. Risk classification is Art. 6. Art. 12(1) requires the high-risk system itself to allow automatic logging over its lifetime, tied to Art. 79(1), Art. 72 and Art. 26(5) (Art. 12(2)), and a training-pipeline log is not that capability. These artefacts are evidence that supports the do…
    Proposed correction. Relabel: 'risk_assessment.json # Art. 9 risk-management input (classification is Art. 6)', 'audit_log.jsonl # training-pipeline evidence (Annex IV 2(g)); not the Art. 12 runtime logging capability', and replace 'Each file maps to a specific EU AI Act requirement' with 'Each file is evidence supporting the provider's documentation for the article s…
    Turkish mirror. the Turkish page has the same error; fix both in the same PR

  • DOC-BLEGAL-096 (docs, Medium) — docs/reference/architecture.md: misleading — EU AI Act compliance engine covering Articles 9-17
    severity Medium
    Where. docs/reference/architecture.md:140 (Turkish mirror: docs/reference/architecture-tr.md:139) · type: misleading
    The document says. EU AI Act compliance engine covering Articles 9-17
    What the code does. In Reg. (EU) 2024/1689, Arts. 9-15 are the Chapter III Section 2 requirements for high-risk systems. Art. 16 lists provider obligations (QMS, documentation keeping, conformity assessment, declaration of conformity, CE marking, registration, corrective actions) and Art. 17 is the QMS. Code cannot discharge these organisational duties. The 'Art. 13 deployer document' mapping at :145 is apt, because…
    Proposed correction. EU AI Act evidence generators supporting the Articles 9-15 technical requirements (Art. 11/Annex IV documentation, Art. 13 instructions for use). Provider obligations under Arts. 16-17 (QMS, conformity assessment, declaration of conformity) remain organisational duties that ForgeLM does not discharge.
    Turkish mirror. the Turkish page has the same error; fix both in the same PR

  • DOC-BLEGAL-123 (docs, Medium) — docs/usermanuals/en/compliance/overview.md: misleading — Every successful (or failed) run produces a structured evidence bundle that maps cleanly onto EU AI Act Articles 9-17, GDPR Article 5, and ISO…
    severity Medium
    Where. docs/usermanuals/en/compliance/overview.md:8 (Turkish mirror: docs/usermanuals/tr/compliance/overview.md:8) · type: misleading
    The document says. Every successful (or failed) run produces a structured evidence bundle that maps cleanly onto EU AI Act Articles 9-17, GDPR Article 5, and ISO 27001 control objectives.
    What the code does. Arts 16-17 are organisational provider obligations: QMS, conformity assessment (Art. 43), declaration of conformity (Art. 47), CE marking, registration and corrective action. A training-run bundle cannot 'map cleanly' onto them. Reg. 2026/1744 also amended Art. 10 (10(5) deleted) and Art. 17(2), and moved application to 2 Dec 2027 / 2 Aug 2028.
    Proposed correction. Every run produces a structured evidence bundle that supports parts of the technical documentation and record-keeping expected under EU AI Act Articles 9-15, and data-protection accountability under GDPR Article 5; provider obligations under Articles 16-17 remain organisational.
    Turkish mirror. the Turkish page has the same error; fix both in the same PR

Acceptance criteria

  • A regression test reproduces the failure scenario and asserts the corrected behaviour.
  • Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
  • Every finding in this issue is resolved or explicitly closed with a reason.

Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.

Activity

  1. cemililik
    added this to the v0.12.0 — Wave 1: public contract and documented usage milestone on Oct 9, 2026
  2. cemililik
    added
    bugSomething isn't working
    documentationImprovements or additions to documentation
    area: siteCode area: site
    backlog: knownAlready tracked in docs/roadmap
    dependenciesDependency or ecosystem currency
    severity: highWrong behaviour or a false claim users rely on
    source: review-2026-10Found by the October 2026 code and documentation review
    urgency: next-releaseTechnology currency: fix in the next release
    wave: 1Roadmap wave 1: high severity, small effort
    on Oct 9, 2026
  3. cemililik
    added this to ForgeLM Project Planon Oct 9, 2026
  4. cemililik
    added a parent issue on Oct 9, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    area: siteCode area: sitebacklog: knownAlready tracked in docs/roadmapbugSomething isn't workingdependenciesDependency or ecosystem currencydocumentationImprovements or additions to documentationseverity: highWrong behaviour or a false claim users rely onsource: review-2026-10Found by the October 2026 code and documentation reviewurgency: next-releaseTechnology currency: fix in the next releasewave: 1Roadmap wave 1: high severity, small effort

    Type

    No type

    Projects

    Milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions