Which documents to upload for a better report

AIR only judges what your documents say. When a document does not cover a risk theme, the theme lands in Needs evidence. The risk may still be there; AIR had nothing to read about it.

The text you need often exists already, in a policy, a design note or a test report.

Documents that close the most gaps

• Scope and use. Who runs the system, who uses it, who is affected by its output, and whether any output reaches real decisions about people.
• Data and retention. Where the data comes from, what personal data it holds, how long it is kept, and who can access it.
• Human oversight. Who reviews the output, and how a person can challenge, correct or override a result.
• Evaluation. How the system was tested, results for different groups of people, known errors and limits.
• Governance. Who is accountable, how changes are approved, how incidents are handled, and any ethics or approval records.
• AI tools and agreements. Which AI services and models the system uses, what data goes to each, and the data processing agreements with those vendors.

Why architecture documents matter

Architecture and design documents are mostly plumbing, but they usually name the AI tools the system uses. AIR records one line per AI tool: who runs it, the data sent to it, and whether a data processing agreement is stated. Without them, AIR cannot tell which outside tools receive your data.

Formats

AIR accepts PDF, Word, PowerPoint, Excel, text, Markdown, CSV and JSON files. Word and PDF files are converted to text for reading, and the original stays available in the report.

After you add a document

A new document needs a new assessment, which uses 1 credit. The next report says which documents were added or changed, and what closed as a result.