1. Inventory comes before assessment
Each row needs a stable systemId, system name, accountable owner and documented facts about role, EU exposure, interaction, content and controls. The tool evaluates the supplied list; it cannot discover shadow AI or omitted systems.
2. Every system retains its own path
Provider and deployer paths are calculated per system. The result separates implement, verify, review and monitor lanes without turning them into a risk ranking.
3. Human notice and technical marking remain separate
The matrix keeps perceptible disclosures and machine-readable marking as distinct implementation tracks. Neither is presented as an automatic substitute for the other.
4. Missing evidence becomes a work queue
Decision records, accessibility review, detection testing, market-entry dates and disclosure controls remain provided, missing or review states rather than being hidden inside a percentage.
5. The checksum checks consistency, not identity
The JSON envelope uses SHA-256 to detect changed snapshot bytes. It is not a signature, does not authenticate the exporter and does not prove declarations are true.
6. A baseline reports change without inventing cause
A prior snapshot reveals systems added, removed or changed by stable systemId. The diff does not claim who made a change, why it happened or whether compliance improved.
7. The Evidence Package creates a verifiable handoff
The ZIP uses BagIt 1.0 conventions, SHA-256 manifests and PROV-JSONLD. The review copy replaces identifiers; the internal copy preserves names only after explicit selection.
8. Local verification is not a signature
Another browser can check coverage and hashes without uploading the ZIP. The result proves internal consistency, not exporter identity, compliance or resistance to deliberate repacking.
Frequently asked questions
H/M Blindspot · hogarmas.net
Does the mapper certify Article 50 compliance?
No. It is a decision aid for a supplied inventory and does not inspect production controls, decide final legal scope or verify portfolio completeness.
Are system or owner names uploaded?
No. The inventory runs in the current tab. Fixed aggregate metrics exclude text, names, answers, file names, checksums and findings.
Can I compare two inventory versions?
Yes. Export a checksum snapshot and load it later as the baseline. Meaningful comparison depends on stable systemId values.
What is included in the USD 490 Portfolio Sprint?
Up to 25 supplied systems, one 90-minute remote session, an Evidence Package and an owner action memo within five business days. Legal review, certification, taxes and technical implementation are excluded unless separately scoped.