# H/M Article 50 Portfolio Mapper

Free browser-local portfolio mapper for a supplied inventory of one to 250 AI systems.

## What it does

- Maps each supplied system independently through the six decision paths used by the H/M Article 50 transparency tool.
- Produces one system matrix, obligation matrix, evidence matrix and visible-disclosure inventory.
- Separates implementation, verification, scope-review and monitoring lanes without assigning a score.
- Preserves the general 2026-08-02 date and a limited 2026-12-02 Article 50(2) transition-review label.
- Creates an unsigned SHA-256 consistency envelope.
- Compares a valid baseline with a current snapshot by stable `systemId`.
- Exports JSON, CSV, Markdown, a printable report and a locally verifiable BagIt 1.0 Evidence Package.

## Input

Send no inventory to an API. Paste or import a JSON document that follows:

- Input schema: https://hogarmas.net/article-50-portfolio/input-schema.json
- Starter template: https://hogarmas.net/article-50-portfolio/template.json
- Synthetic example: https://hogarmas.net/article-50-portfolio/example.json

Unknown facts should use `unsure`. Stable `systemId` values are required for meaningful baseline comparison.

## Output

- Snapshot schema: `hm.article50-portfolio.v1`
- Checksum envelope: `hm.article50-portfolio-envelope.v1`
- Declaration diff: `hm.article50-portfolio-diff.v1`
- Ruleset: `2026-07-29.1`
- Source single-system ruleset: reported in each generated snapshot

Machine resources:

- Snapshot schema: https://hogarmas.net/article-50-portfolio/schema.json
- Envelope schema: https://hogarmas.net/article-50-portfolio/envelope-schema.json
- Diff schema: https://hogarmas.net/article-50-portfolio/diff-schema.json
- Evidence Package profile: https://hogarmas.net/article-50-portfolio/evidence-package-profile.json
- Interactive tool: https://hogarmas.net/article-50-portfolio/
- Single-system tool: https://hogarmas.net/ai-transparency/

## Privacy

The inventory, system names, owner names and answers remain in the current browser tab. No application storage is used. The only runtime network request is an optional aggregate metric with a fixed event identifier. It excludes inventory text, names, answers, file names, checksum values and findings. JSON, CSV, Markdown, print and internal-package exports intentionally include supplied names and owner fields. The default Evidence Package uses privacy-minimized aliases and removes supplied names, owners, tags and detailed baseline identifiers; this reduces disclosure but does not guarantee anonymity.

## Evidence Package

The browser can create and verify the H/M Article 50 Portfolio Evidence Package profile:

- Container: BagIt 1.0 directory conventions from RFC 8493.
- Payload digest: SHA-256 payload and tag manifests.
- Provenance: W3C PROV-O JSON-LD.
- Required payloads: portfolio envelope, CSV matrix, Markdown brief, obligation matrix, evidence matrix and provenance graph.
- Optional payload: full internal baseline diff or aggregate-only privacy-minimized diff.
- Maximum local verification size: 50 MB.

Manifest verification checks package self-consistency and coverage. The package is unsigned, does not authenticate the exporter and does not stop a malicious party from rebuilding a new internally consistent ZIP.

## Integrity boundary

The envelope checksum detects inconsistent snapshot bytes. It is not a digital signature, does not authenticate the exporter and does not prove that declarations are accurate.

## Diff boundary

Baseline comparison reports added, removed and changed declarations. It does not infer who changed them, why they changed, semantic impact or whether compliance improved.

## Product boundary

The mapper evaluates only the supplied inventory. It does not discover shadow AI, verify portfolio completeness, inspect production controls, decide legal scope finally, provide legal advice or certify compliance.

## Article 50 Portfolio Sprint

The founding USD 490 service covers up to 25 supplied systems, one 90-minute remote working session, an Evidence Package and an owner action memo delivered within five business days. Scope and payment are confirmed by email. Taxes, legal review, legal opinions, compliance certification and technical implementation are excluded unless separately scoped.

## Official sources

- Article 50: https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-50
- Commission guidance: https://digital-strategy.ec.europa.eu/en/policies/guidelines-transparency-ai-generated-content
- Commission quick facts: https://digital-strategy.ec.europa.eu/en/factpages/quick-facts-transparency-rules-ai-systems
- EU AI Act compliance checker: https://ai-act-service-desk.ec.europa.eu/en/eu-ai-act-compliance-checker
- C2PA browser SDK documentation: https://opensource.contentauthenticity.org/docs/c2pa-js/packages/c2pa-web/