AiGov: Human-Governed GDPR Audits

The description states that AiGov is a human-governed GDPR audit workbench where:

• An AI agent (specifically Codex) proposes scope, evidence requests, obligations, and checks.
• Human auditors control every decision.
• The case is reconstructed from records.

It uses:

• A coding agent as the main audit environment.
• SQLite for durable case storage.
• A web UI for auditor interaction.
• Python for backend services.
• HTML/CSS/JS for frontend.
• REST API for communication.

The system is described as not replacing the auditor, but rather supporting substantial audit work while keeping human authority over decisions.

Inference This is a prototype or demonstrator, not a production-ready product. It focuses on architecture and interaction patterns rather than full functionality.

The author states:

• Initially, they thought GDPR auditing could be done by summarizing documents using AI.
• Later, they realized this approach was flawed because professional audits require case-specific reasoning.
• They evolved toward a model where the coding agent is structured as the audit environment, not just a tool.
• The goal is to build an executable, human-governed audit methodology that integrates legal and methodological sources with AI-driven proposals.

Inference The positioning has shifted from a generic document summarizer to a specialized, human-in-the-loop auditing framework. However, the claim of being a "workbench" or "framework" is not substantiated by evidence of adoption or usage beyond the author’s own development.

The description states:

• The target use case is auditing customer-service chatbots.
• It is intended for professional GDPR auditors who need to understand systems, actors, purposes, data flows, and available evidence.
• The system supports case-specific reasoning, which implies a niche audience with deep domain expertise.

Inference The ICP appears to be GDPR compliance professionals or auditors working in regulated environments, particularly those dealing with digital services like chatbots. No explicit customer names or segments are provided.

Not evidenced.

The description does not mention:

• Revenue streams
• Pricing models
• Customers or clients
• Monetization strategy

Inference There is no evidence of a business model or pricing structure beyond the author’s own development efforts. The project is presented as a hackathon submission, not a commercial offering.

The description states:

• Built with Codex, Python, SQLite, HTML/CSS/JS, REST API
• Uses record-based reconstruction instead of browser or conversation state
• Implements durable case objects, provenance tracking, and versioning
• Supports human decision gates and reconstruction mechanisms
• Demonstrator proves:
  • Opening audit cases
  • Navigating through a Decision Navigator
  • Accepting, amending, or rejecting proposals
  • Reconstructing decisions from stored records

Inference The technical stack suggests a lightweight, local-first approach with strong emphasis on durability and traceability. The architecture is described as human-in-the-loop, but no evidence of scalability or integration into existing tools is given.

Not evidenced.

The description does not include:

• Customers
• Revenue
• Usage metrics
• Product adoption
• Market traction

Inference This is a prototype or proof-of-concept, likely built during a hackathon. There is no evidence of real-world deployment or user feedback.

The author states:

• They researched assurance-case tools, legal workbenches, audit-management systems, evidence-review platforms, and workflow engines.
• Found individual patterns but no open-source solution combining:
  • Coding-agent reasoning
  • Executable audit methodology
  • Legal and evidential provenance
  • Human decision authority
  • Durable case state
  • Reconstruction and selective reconsideration

Inference There is a perceived gap in the market for such a hybrid system. However, no competitors are named or described in detail.

1. Unproven scalability: The system is described as a demonstrator; no evidence of handling large-scale audits.
2. No commercial traction: No customers, revenue, or product usage data.
3. Limited scope: Focuses only on chatbot auditing; unclear if it generalizes to other domains.
4. Dependency on author’s expertise: The project is built by one person with no coding or audit experience initially — raises questions about long-term maintainability and team capacity.
5. Unclear integration with external tools: While the system supports telemetry analysis, there's no mention of how it connects to real-world systems or platforms.

1. What specific legal and methodological sources are used to guide the AI agent’s reasoning?
2. How does the system handle uncertainty or missing information in a way that is defensible for audit purposes?
3. Has the prototype been tested with actual auditors or compliance professionals?
4. What are the plans for expanding beyond chatbot auditing?
5. Is there any plan to integrate with existing audit management systems or platforms?
6. How will the system scale to support multiple concurrent audits or users?
7. What is the roadmap for moving from a demonstrator to a production-ready tool?