Art. 9 paragraph citations for risk_assessment fields are wrong in config descriptions, wizard prompts, the user-manual config reference and the six-language site wizard (CR-A01-062) #539

Wave 2 · theme D2-8: Docs tied to medium-effort code fixes · highest severity High · 16 finding(s) · effort medium

Summary

A risk officer maps ForgeLM's risk_assessment record to Art. 9 using the field descriptions. The mitigation measures are filed as the post-market-data evaluation step (9(2)(c)), and the 9(9) vulnerable-groups consideration is mis-cited.

Primary finding

CR-A01-062 — Art. 9 paragraph citations for risk_assessment fields are wrong in config descriptions, wizard prompts, the user-manual config reference and the six-language site wizard

severity Medium · reachability default · intent contract-violation · confidence confirmed · independently confirmed · not reproduced (code trace)

What happens. These are adjacent mislabels in the same family; the citations below rely on model knowledge of Reg. 2024/1689 and are medium confidence. - mitigation_measures cites 'Article 9(2)(c)' (config.py:1271). Art. 9(2)(c) is the evaluation of risks from post-market-monitoring data; risk-management measures are 9(2)(d). - vulnerable_groups_considered cites 'Article 9(2)(b)' (config.py:1275). The vulnerable-groups and under-18 consideration is Art. 9(9). - risk_category's description (config.py:1268) says 'high-risk and unacceptable trigger Annex IV documentation requirements'. Unacceptable-risk practices are prohibited under Art. 5 and have no Annex IV route. The same citations are repeated in: - forgelm/wizard/_collectors.py:754, 758, 760; - docs/usermanuals/en/reference/configuration.md:273-274 and tr :274-275; - site/js/translations.js:1727/1731 (EN), 2122/2126 (TR) and the DE/FR/ES/ZH equivalents.

Where.

• forgelm/config.py:1273-1275
• forgelm/config.py:1271
• forgelm/config.py:1275
• forgelm/wizard/_collectors.py:760
• forgelm/wizard/_collectors.py:758
• docs/usermanuals/en/reference/configuration.md:273-274
• docs/usermanuals/tr/reference/configuration.md:274-275
• site/js/translations.js:1731
• site/js/translations.js:2126
• site/js/translations.js:2521

Evidence.

• rg '9(2)' over forgelm/, docs/ and site/ lists the occurrences cited above.

Recommended fix. Change mitigation_measures to Art. 9(2)(d) and vulnerable_groups_considered to Art. 9(9) everywhere; drop 'unacceptable' from the Annex IV trigger sentence. Regenerate the docs and site strings.

Other findings with the same root cause

These close with the same fix; update them in the same pull request.

• CR-A07-062 (code, Medium) — Annex IV section numbers are mislabelled in the writer, verifier, docs and site: 5 of the 9 keys point at the wrong Annex IV point
  severity Medium · reachability default · intent contract-violation · confidence confirmed · independently confirmed · not reproduced (code trace)
  Failure scenario. A provider assembles the Art. 11 technical file from annex_iv_metadata.json and ForgeLM's documented mapping. A notified body cross-checks it against Annex IV and finds: - the risk management system filed under §9 (post-market) instead of §5; - training metrics filed under §7 (harmonised standards); - compute under §2(g) (testing); - a configuration echo filed as §6 lifecycle changes. ForgeLM's own pages also disagree about what §7 is: performance_metrics per annex-iv.md:183, the 'declaration'…
  Where. forgelm/compliance.py:1850-1861 (no §2(g) comment exists in the writer; computational_resources at :1843 sits under the generic '§2' comment at :1836), forgelm/verify/_annex_iv.py:34-44, docs/usermanuals/en/compliance/annex-iv.md:79-87,183, docs/usermanuals/tr/compliance/annex-iv.md:79-87
  Recommended fix. Relabel against the final text: - computational_resources → §2(c); - performance_metrics → §2(g), with §3/§4 inputs; - risk_management → §5; - monitoring_and_logging → §9 (Art. 72), or §3 for the logging part; - technical_documentation → §1(c)/§3 (or split it). Apply this to the writer comments, the _ANNEX_IV_REQUIRED_FIELDS descriptions, the EN/TR docs tables, the ISO/SoA rows and human-oversigh…

• CR-A09-016 (code, Medium) — Annex IV section labels in the verifier appear not to match Regulation (EU) 2024/1689 Annex IV
  severity Medium · reachability default · intent contract-violation · confidence confirmed · independently confirmed · not reproduced (code trace)
  Where. forgelm/verify/_annex_iv.py:34-44, forgelm/compliance.py:1819-1861, site/compliance.html:156, forgelm/compliance.py:1856-1860
  Recommended fix. Re-map the field descriptions to the regulation's numbering, and state which Annex IV points the artefact does not cover (for example §7/§8).

• TECH-T10-006 (technology, Next release) — Regulation: EU AI Act: AI Act article/annex citations in config, wizard, writer and verifier: Art. 9(2), Art. 10(2) and the Annex IV point numbering (incl. verify-annex-iv '§1-9' claim) (incorrect-cl…
  severity Next release
  Item. AI Act article/annex citations in config, wizard, writer and verifier: Art. 9(2), Art. 10(2) and the Annex IV point numbering (incl. verify-annex-iv '§1-9' claim) · verdict: incorrect-claim · urgency: Next release
  State in ForgeLM. Art. 9: mitigation_measures is cited as 'Article 9(2)(c)' (forgelm/config.py:1271; forgelm/wizard/_collectors.py:754,758; docs/usermanuals/en/reference/configuration.md:273, tr:274; site/js/translations.js:1727,2122,2517,2912,3307,3702). vulnerable_groups_considered is cited as 'Article 9(2)(b)' (config.py:1275; wizard:760). intended_use is cited as 9(2)(a) (config.py:1261). Art. 10(2): annotatio…
  State of the ecosystem on 2026-10-01. The Omnibus did not amend Arts 9 or 10(2), or Annex IV. Original OJ text: - Art. 9(2): (a) identify/analyse risks under the intended purpose; (b) estimate/evaluate risks incl. reasonably foreseeable misuse; (c) evaluate other risks from post-market monitoring data (Art. 72); (d) adopt risk management measures. - Art. 9(9): under-18s and other vulnerable groups. - Art. 10(2): (b) data collection a…
  Recommendation. - Re-cite mitigation_measures as Art. 9(2)(d), vulnerable_groups_considered as Art. 9(9) and annotation_process as Art. 10(2)(c). - Phrase intended_use as context for Art. 9(2)(a)-(b). - Relabel the Annex IV table: compute 2(c); design 2(a)-(b); metrics 2(g)/3/4; cybersecurity 2(h); risk management 5; PMM 9. - Either add keys for point 6 (changes) and point 7 (standards applied, or the solutions…
  Sources.

  • Regulation (EU) 2024/1689, Art. 9(2),(9), Art. 10(2), Art. 11, Art. 47, Annex IV (2024-07-12)
  • Regulation (EU) 2026/1744, Art. 1 (no amending point for Art. 9, Art. 10(2) or Annex IV; Art. 1(10) Art. 11(1)) (2026-07-24)

• DOC-BLEGAL-018 (docs, High) — docs/reference/verify_annex_iv_subcommand.md: wrong detail — validates the nine required field categories per EU AI Act Annex IV §1-9; computational_resources §2(g); technical_documentation §3-5; mon…
  severity High
  Where. docs/reference/verify_annex_iv_subcommand.md:6, :166, :168-171 (Turkish mirror: docs/reference/verify_annex_iv_subcommand-tr.md:6, :166, :168-171) · type: wrong detail
  The document says. validates the nine required field categories per EU AI Act Annex IV §1-9; computational_resources §2(g); technical_documentation §3-5; monitoring_and_logging §6 post-market monitoring; performance_metrics §7; risk_management §9
  What the code does. Annex IV of Reg. (EU) 2024/1689 (unamended by 2026/1744) numbers its points as follows: 1 general description (1(a) intended purpose, provider, version); 2(a)-(b) methods and design specifications; 2(c) architecture AND 'the computational resources used to develop, train, test and validate'; 2(d) data; 2(g) validation/testing, metrics and signed test logs; 2(h) cybersecurity; 3 monitoring, functi…
  Proposed correction. Validates the nine ForgeLM-defined field categories of the Annex IV artefact. Mapping: computational_resources → Annex IV 2(c); data_governance → 2(d); technical_documentation → 2(a)-(b), 3; monitoring_and_logging → 3 and the post-market monitoring plan (Art. 72); performance_metrics → 4, 2(g); risk_management → 5. Points 6 (lifecycle changes), 7…
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

• DOC-BLEGAL-019 (docs, High) — docs/usermanuals/en/compliance/annex-iv.md: wrong detail — It walks the nine top-level fields the EU AI Act requires for high-risk systems (§1-9) ... computational_resources §2(g); monitoring_and_log…
  severity High
  Where. docs/usermanuals/en/compliance/annex-iv.md:8,75-87 (Turkish mirror: docs/usermanuals/tr/compliance/annex-iv.md:8,75-87) · type: wrong detail
  The document says. It walks the nine top-level fields the EU AI Act requires for high-risk systems (§1-9) ... computational_resources §2(g); monitoring_and_logging §6 — post-market monitoring; performance_metrics §7; risk_management §9
  What the code does. The EU AI Act does not require these nine fields. Annex IV has nine points: 2(c) compute; 2(g) validation and metrics; 4 metric appropriateness; 5 risk management; 6 lifecycle changes; 7 harmonised standards; 8 copy of the EU declaration of conformity; 9 post-market performance evaluation and the PMM plan. The verifier's keys leave points 6-9 uncovered and mislabel 2(c), 5 and 9.
  Proposed correction. It walks the nine top-level keys ForgeLM emits (covering parts of Annex IV points 1, 2, 3, 4 and 5); points 6-9 are not produced. Relabel the table as in the overview fix (2(c), 2(g)/4, 5).
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

• DOC-BLEGAL-027 (docs, High) — docs/usermanuals/en/compliance/overview.md: wrong detail — nine top-level keys mapped onto Annex IV §1-9 ... computational_resources §2(g); monitoring_and_logging §6 — post-market monitoring; perform…
  severity High
  Where. docs/usermanuals/en/compliance/overview.md:125-137 (Turkish mirror: docs/usermanuals/tr/compliance/overview.md:125-137) · type: wrong detail
  The document says. nine top-level keys mapped onto Annex IV §1-9 ... computational_resources §2(g); monitoring_and_logging §6 — post-market monitoring; performance_metrics §7; risk_management §9
  What the code does. Annex IV of Reg. 2024/1689 is not amended by 2026/1744. Computational resources are point 2(c). 2(g) is validation/testing and metrics. Point 4 is the appropriateness of the performance metrics. Point 5 is the risk-management system (Art. 9). Point 6 is lifecycle changes. Point 7 is the harmonised standards applied. Point 8 is a copy of the EU declaration of conformity. Point 9 is post-market per…
  Proposed correction. Relabel: computational_resources → Annex IV 2(c); performance_metrics → 2(g) and 4; risk_management → 5; monitoring_and_logging → 2(g)/3 (audit-log reference) — not 9; state that points 6 (lifecycle changes), 7 (harmonised standards), 8 (EU declaration of conformity) and 9 (post-market monitoring plan) are not produced and must be authored by the…
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

• DOC-BLEGAL-034 (docs, High) — docs/usermanuals/en/reference/json-output.md: wrong detail — EU AI Act Annex IV §1-9 artefact integrity check. / true when all 9 §1-9 fields are present ... / required §1-9 fields missing
  severity High
  Where. docs/usermanuals/en/reference/json-output.md:689,707,720 (Turkish mirror: docs/usermanuals/tr/reference/json-output.md:693,711,724) · type: wrong detail
  The document says. EU AI Act Annex IV §1-9 artefact integrity check. / true when all 9 §1-9 fields are present ... / required §1-9 fields missing
  What the code does. The nine verifier keys do not correspond to Annex IV points 1-9. Points 6 (lifecycle changes), 7 (harmonised standards), 8 (EU declaration of conformity) and 9 (post-market monitoring plan) are not covered. Compute is 2(c), and risk management is point 5.
  Proposed correction. Integrity and completeness check of the nine ForgeLM Annex IV keys (covering parts of Annex IV points 1-5; points 6-9 are not produced). / true when all nine required ForgeLM keys are present ...
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

• DOC-BLEGAL-040 (docs, High) — site/compliance.html: wrong detail — "Annex IV's nine required §1-9 sections — auto-populated from the run: system identification, intended purpose, components, computational resources, data governan…
  severity High
  Where. site/compliance.html:156 (EN key compliance.art11.body, site/js/translations.js:3857) (Turkish mirror: site/js/translations.js:3916 (TR compliance.art11.body)) · type: wrong detail
  The document says. "Annex IV's nine required §1-9 sections — auto-populated from the run: system identification, intended purpose, components, computational resources, data governance, technical documentation, monitoring & logging, performance metrics, risk management."
  What the code does. Annex IV of Reg. (EU) 2024/1689 (not amended by Reg. 2026/1744) has nine points with different content: 1 general description (1(a) intended purpose, provider, version); 2 detailed description of elements and development (2(c) architecture and computational resources, 2(d) data, 2(g) validation/testing and metrics, 2(h) cybersecurity); 3 monitoring, functioning and control; 4 appropriateness of p…
  Proposed correction. 'Pre-fills the parts of Annex IV a training run can evidence (points 1(a), 2(c)-(d), 2(g), 3 and inputs for 5); points 4 and 6-9 (incl. harmonised standards and the declaration of conformity) remain the provider's to complete.' Align the verifier key labels with the Annex IV point numbering.

• DOC-BLEGAL-070 (docs, Medium) — docs/guides/data_audit.md: false claim — a deterministic regex/length/structure pipeline keeps the audit reproducible (Annex IV requirement)
  severity Medium
  Where. docs/guides/data_audit.md:396-397 (Turkish mirror: docs/guides/data_audit-tr.md:402) · type: false claim
  The document says. a deterministic regex/length/structure pipeline keeps the audit reproducible (Annex IV requirement)
  What the code does. Annex IV of Reg. (EU) 2024/1689 requires descriptions: 2(d) data and data-cleaning methodologies, and 2(g) validation and testing procedures with 'test logs and all test reports dated and signed'. Neither the AI Act nor Reg. 2026/1744 imposes a reproducibility requirement. The only 'reproducible' wording, in new Art. 5(1a)(a)(ii), is unrelated. Determinism supports the 2(d)/2(g) documentation but…
  Proposed correction. Replace '(Annex IV requirement)' with '(this supports the Annex IV §2(d)/§2(g) documentation of data-cleaning and testing methods; Annex IV itself does not mandate reproducibility)'. Mirror in the TR file.
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

• DOC-BLEGAL-144 (docs, Medium) — docs/usermanuals/en/reference/configuration.md: wrong detail — mitigation_measures: [] # Article 9(2)(c): mitigation steps / vulnerable_groups_considered: false # Article 9(2)(b): impact on vulnerabl…
  severity Medium
  Where. docs/usermanuals/en/reference/configuration.md:273-274 (Turkish mirror: docs/usermanuals/tr/reference/configuration.md:274-275) · type: wrong detail
  The document says. mitigation_measures: [] # Article 9(2)(c): mitigation steps / vulnerable_groups_considered: false # Article 9(2)(b): impact on vulnerable groups
  What the code does. In Reg. (EU) 2024/1689 (unchanged by Reg. (EU) 2026/1744), Art. 9(2)(c) is the evaluation of other risks from post-market monitoring data (Art. 72), Art. 9(2)(d) is 'the adoption of appropriate and targeted risk management measures', and vulnerable groups (under-18s and others) are Art. 9(9). Mitigation measures therefore map to Art. 9(2)(d) and vulnerable groups to Art. 9(9). Lines 270-271 (9(2)…
  Proposed correction. Change to '# Article 9(2)(d): risk-management measures adopted' and '# Article 9(9): impact on persons under 18 and other vulnerable groups'. Fix the same wording at its source, forgelm/config.py:1271 and :1275 and forgelm/wizard/_collectors.py:754, 758 and 760. TR: '# Madde 9(2)(d): alınan risk yönetimi önlemleri' / '# Madde 9(9): 18 yaş altı ve…
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

• DOC-BFIELD-025 (docs, Low) — forgelm/config.py: wrong detail — annotation_process: Article 10(2)(b): annotation / labelling methodology.
  severity Low
  Where. forgelm/config.py:789-791 · type: wrong detail
  The document says. annotation_process: Article 10(2)(b): annotation / labelling methodology.
  What the code does. EU AI Act Art. 10(2)(b) covers data collection processes and data origin. Annotation and labelling are data-preparation operations under Art. 10(2)(c). The same citation appears in wizard/_collectors.py:776.
  Code references. forgelm/wizard/_collectors.py:776

• DOC-BFIELD-030 (docs, Low) — forgelm/config.py: misleading — high-risk and unacceptable trigger Annex IV documentation requirements.
  severity Low
  Where. forgelm/config.py:1266-1269 (RiskAssessmentConfig.risk_category, F20) · type: misleading
  The document says. high-risk and unacceptable trigger Annex IV documentation requirements.
  What the code does. The code effect of a strict tier is a ConfigError unless evaluation.safety.enabled (config.py:1822-1842), plus an auto_revert warning and the Article 5 banner (config.py:1849-1876). Annex IV export is not conditioned on the tier.
  Code references. forgelm/config.py:1822-1876
  Proposed correction. 'high-risk/unacceptable (here or in compliance.risk_classification) require evaluation.safety.enabled: true (config error otherwise) and warn when auto_revert is off.'

• DOC-BLEGAL-247 (docs, Low) — forgelm/config.py: wrong detail — mitigation_measures: "Article 9(2)(c): operator-supplied mitigation steps"; vulnerable_groups_considered: "Article 9(2)(b): ... impact on vulnerable groups"
  severity Low
  Where. forgelm/config.py:1271,1275 · type: wrong detail
  The document says. mitigation_measures: "Article 9(2)(c): operator-supplied mitigation steps"; vulnerable_groups_considered: "Article 9(2)(b): ... impact on vulnerable groups"
  What the code does. Art. 9(2)(c) is the evaluation of risks from post-market monitoring data (Art. 72). Risk management measures are Art. 9(2)(d), with 9(5)(b) for mitigation and control. Vulnerable groups are Art. 9(9). Art. 9 is unamended by Reg. 2026/1744.
  Proposed correction. 'Article 9(2)(d) / 9(5): risk management measures ...'; 'Article 9(9): ... persons under 18 and other vulnerable groups'.

• DOC-BLEGAL-252 (docs, Low) — site/js/translations.js: wrong detail — "Article 9(2)(a): describe the system's intended purpose"; "Article 9(2)(c): controls you put in place against the misuse risks"; "Article 9(2)(b): ... effects…
  severity Low
  Where. site/js/translations.js:1719,1727,1731,1759 (wizard hints, EN) (Turkish mirror: site/js/translations.js:2114,2122,2126,2154 (TR; same errors in DE/FR/ES/ZH blocks)) · type: wrong detail
  The document says. "Article 9(2)(a): describe the system's intended purpose"; "Article 9(2)(c): controls you put in place against the misuse risks"; "Article 9(2)(b): ... effects on children, minorities"; "Article 10(2)(b): labelling methodology"
  What the code does. Art. 9 is unamended by Reg. 2026/1744. Art. 9(2)(a) is identification and analysis of risks under the intended purpose; the purpose statement itself is Annex IV 1(a). 9(2)(b) covers risks under reasonably foreseeable misuse, which is correct for the misuse hint (1723). 9(2)(c) covers evaluation of risks from post-market monitoring data (Art. 72), and risk-management measures are 9(2)(d) with 9(4)…
  Proposed correction. 1719: 'Article 9(2)(a) / Annex IV 1(a): intended purpose (anchors risk identification)'; 1727: 'Article 9(2)(d), 9(5): risk management measures'; 1731: 'Article 9(9): impact on persons under 18 and other vulnerable groups'; 1759: 'Article 10(2)(c): annotation and labelling'.

• DOC-D3B01-033 (docs, Low) — docs/usermanuals/en/compliance/annex-iv.md: misleading — system_components = software/hardware components + supplier list; data_governance = data sources, governance, validation methodology; technica…
  severity Low
  Where. docs/usermanuals/en/compliance/annex-iv.md:81,83,84,86 (Turkish mirror: docs/usermanuals/tr/compliance/annex-iv.md:81,83,84,86) · type: misleading
  The document says. system_components = software/hardware components + supplier list; data_governance = data sources, governance, validation methodology; technical_documentation = design + development methodology; performance_metrics = accuracy / robustness / cybersecurity metrics.
  What the code does. Writer content differs. system_components = {model_lineage, training_parameters} (no supplier list). data_governance = manifest data_provenance (primary_dataset, fingerprint, shuffle, clean_text; no validation methodology). technical_documentation = {forgelm_version, generated_at, known_limitations}. performance_metrics = evaluation_results.metrics (no cybersecurity metrics). The doc's wording co…
  Code references. forgelm/compliance.py:1838-1859, forgelm/compliance.py:1534-1539, forgelm/verify/_annex_iv.py:34-44
  Proposed correction. Describe the actual content, as in the Compliance Overview table: system_components = model lineage + training parameters; data_governance = dataset provenance (path, fingerprint, shuffle/clean_text); technical_documentation = ForgeLM version, generation time, known limitations; performance_metrics = training/eval metrics.
  Turkish mirror. the Turkish page has the same error; fix both in the same PR

Acceptance criteria

• A regression test reproduces the failure scenario and asserts the corrected behaviour.
• Documentation listed above is corrected in English and in its Turkish mirror in the same PR.
• Every finding in this issue is resolved or explicitly closed with a reason.

_{Found by the October 2026 ForgeLM code and documentation review against commit cab2947. Code links point at that commit; line numbers may have moved since. Finding IDs (CR-…, DOC-…, TECH-…) are stable references for this backlog.}