Level 2 · Practice & recap
Run it yourself
Section titled “Run it yourself”The whole arc runs on a laptop CPU, on the real UCI Student Performance dataset combining its TWO cohorts, maths and Portuguese (about a thousand rows; no GPU, no token, no synthetic data). Each command’s result is exactly the tag linked in the arc.
Use the V1 milestone chip (in the arc) to clone the repo and check out the starting point, then install the project dependencies:
uv sync # install deps from pyproject.toml + uv.lock (includes fairlearn)With the project environment active, reproduce the arc. Each block below is the REAL step from the steps/ script —the same one that builds the published repo, not a hand-written copy—; the “copy” button gives you the exact command. The commands and commit messages are the verbatim Spanish artefacts of the repo:
1 · Measure V1 (untreated) → RED. Compile the gate contract from froga.yaml and run it. froga run exits non-zero on purpose (red gate), and still signs the evidence:
froga compilegit add -Agit commit -m "compile: assessment plan OSCAL (contrato del gate, antes del modelo)"
patch: params.patchpatch: dvc-evaluate.patchpatch: train.patchpatch: evaluate.patchpatch: compliance-eval.patchfroga runmay failgit add -Agit commit -m "modelo: logreg V1 (train/evaluate + dvc.yaml) — run: V1 evidencia base (gate RED esperado; seed=42)"
2 · Treat the risk and re-measure → GREEN. The treatment and the re-measurement are a single versioned step: one commit with TWO real code changes in train.py —each student’s exact age is generalized to a tercile (the Sweeney k-anonymity technique) and the estimator switches from a plain logistic regression to fairlearn’s ExponentiatedGradient(DemographicParity)— and, in the same step, the engine runs the gate again. The diff below shows both changes for real (neither is a flag); with age generalized, k-anonymity for the age/address/family-size trio rises from 1 to 27 —the 95% bootstrap CI [18, 37] sits entirely above the k ≥ 5 threshold—:
git checkout -b tratamiento/minimizacion-rgpdpatch: train-treatment.patchfroga rungit add -Agit commit -m "treatment: fairlearn DemographicParity (sexo) + minimización RGPD (edad→tercil, k-anonimato) — ISO 23894 §6.5"
Each step lands on the same gate colour as its tag: step 080 reproduces student-v1.0.0-red, step 090 reproduces student-v2.0.0-green. A nightly CI job re-clones each tag and checks the colour still matches.
3 · Statement of Applicability (SoA). Before requesting approval, Martha crosses the risk programme against the ISO/IEC 42001 Annex A catalogue (6.1.3 b/c/f) — which management-system controls are implemented, which are excluded with a justification, and which remain a gap to review. The new data-minimization gate shows up under A.7.4 (data quality):
froga soa
4 · Periodic review: re-measure, don’t take anything for granted. A green approval does not close the cycle forever — an acknowledged residual remains (the model’s opacity, with no control that reduces its likelihood). The froga.yaml declared review_interval: P1Y, so the system enters its periodic review cadence (ISO 23894 §6.6). James opens the review (froga review) and the engine moves the system to «under review» — the approval is suspended. The review means measuring again: re-run the gate with the same parameters, to produce fresh evidence:
froga rungit add -Agit commit -m "run: re-medición V2.0.1 ante la revisión periódica (mismo params; gate verde confirmado; seed=42)"
The verdict does not change: still GREEN. k-anonymity is still 27, over the same threshold of 5 — re-measuring does not degrade what has not changed. The V2.0.1 re-measurement re-anchors the evidence to the current state (the bundle’s triple.code updates) but the gate is still where it was, exactly what the review must confirm. Martha re-requests (froga request) and James re-approves (froga approve) over that fresh evidence, with the conscious-acceptance reason for the residual back on the record. The system returns to «approved», now anchored to V2.0.1. The review did not take anything for granted: it re-confirmed it with up-to-date evidence.
What you just built
Section titled “What you just built”A high-risk AI system — declared, classified under Annex III §3, treated with a versioned change, with the signed evidence in git — that closes clean GREEN, with no statistical ambiguity, on the control that genuinely supported an honest red→green arc: the data minimization of a student who may be a minor (GDPR Art. 5(1)(c)). The risk was real (216 of 1044 students were exactly re-identifiable by their age, address, and family size), the treatment was a versioned code change in train.py (age is generalized to a tercile), and the gate moved from k=1 to k=27 with a confidence interval that sits entirely on the safe side — nothing underpowered, nothing manufactured. In parallel, demographic parity also improved (0.024 → 0.014) and lands certified as an audit control, not the gate: on the real sample (maths + Portuguese combined, 1044 rows) gender disparity was already small — inflating it into a red would have been as dishonest as manufacturing a green. What does remain an acknowledged residual is the model’s opacity (Art. 13): with no control reducing its likelihood, its level stays above the programme’s appetite, and James accepts it consciously, with a reason on the record, next to the signed approval act. The same signed bundle projects onto ISO 23894 and prEN 18228 with real verdicts — presumption = false today — and no DORA/MDR were declared, because no overlay applies. That is Level 2’s whole lesson: a clean gate does not mean the entire programme is resolved — it means the control that genuinely could be sustained, was, and what has not been reduced stays acknowledged, not hidden. And that approval is not an ending: the periodic review (P1Y, ISO 23894 §6.6) reopens it, sends Martha back to measure (§6.7), and green is re-confirmed with fresh evidence — never taken for granted.
Self-check
Section titled “Self-check”V1 measures k-anonymity = 1 over the age/address/family-size trio. What exactly does that number mean, and why is it a GDPR risk rather than a mere statistical curiosity?
k-anonymity = 1 means at least one student in the dataset is the only person sharing their exact combination of age, address (urban/rural), and family size — in fact, 216 of the 1044 students are in that situation. That is precisely what the GDPR calls re-identification: someone with a bit of outside knowledge (say, “I know a 17-year-old from a rural area, from a large family, who applied this year”) could point straight at that dataset row, even without a name in the table. Because the subjects may be minors, the GDPR demands a reinforced protection bar (Art. 5(1)(c), data minimization) — and a dataset where one in five students is re-identifiable with three common attributes does not meet it. It is not a curiosity: it is the risk declared in risk.minors-vulnerable-processing, turned into a number.
The treatment generalizes exact age to a tercile (b0/b1/b2) but leaves address and family size untouched. Why is that single change enough to move k-anonymity from 1 to 27?
Because exact age is by far the highest-cardinality attribute of the three — the dataset has many distinct age values, each forming small groups once crossed with address and family size. Replacing it with a tercile (only three possible values: b0/b1/b2) drastically cuts the number of possible trio combinations — from hundreds of tiny groups down to just 16 groups, all with dozens of students at minimum. Address and family size were already “coarse” attributes (only two values each: urban/rural, small/large family), so they contributed almost nothing to the granularity — generalizing them too would not have moved the result much. It is Sweeney’s classic generalization technique: you don’t need to hide EVERY identifying attribute, just coarsen the one that discriminates the most.
V2's demographic parity (0.014) sits well under the 0.08 gate, with a confidence interval that never crosses it. Why is this NOT the level's blocking gate, if it is also a real, measured risk?
Because the reason a red→green arc exists on a control is that the data genuinely supports it — and here it didn’t: on the honest sample (maths + Portuguese combined, 1044 rows, with the 382 students who take both courses treated as one person, not two independent rows) gender disparity was already small in untreated V1 (0.024) and drops a bit further with treatment (0.014) — there was never a real red to treat. (An earlier version of this script measured fairness on a held-out set of only 99 students, and that small sample inflated the apparent disparity — a statistical-honesty lesson in its own right, but not one that supported an arc.) Turning demographic parity into a gate would have required manufacturing an artificial red or forcing the threshold until it “closed” — both exactly what this approach exists to prevent. The control stays real: it is measured with 5-fold out-of-fold cross-validation over the full sample and lands certified green as an audit, on the record, visible — but the arc the data genuinely supported is the minimization of a minor’s data.
The data-minimization gate closes GREEN, but James still has to supply a reason to approve anyway. Why, if the blocking control already passed?
Because this system’s risk programme declares SIX risks, and the gate only reflects the state of the blocking controls (here, one: minors-data-minimization). risk.opacity — automated decisions without sufficient explainability — is a different risk, with an inherent Critical level (almost-certain likelihood × high impact) and only an audit control (accuracy-floor), with no measure that reduces its likelihood. Its residual therefore sits ABOVE the programme’s declared appetite — something the engine detects and announces explicitly, even though it does not block the gate (audit controls never block, by design). Management approval (ISO 42001 6.1.3) requires someone with authority to acknowledge that residual and consciously decide to accept it — with the reason required and recorded in the signed act, not in a note off to the side. A green gate certifies what the gate measures; the approval certifies that an accountable person looked at the WHOLE programme, not just the gate.
The system declares ISO 23894 and prEN 18228, but not DORA or MDR — nor a complete GDPR catalogue either. Why is that mix of 'yes, declared' and 'not yet projected' the honest answer?
It declares only the standards that actually govern it, and only as far as the engine can genuinely project them. Student selection is high-risk under the AI Act with no sector overlay, so DORA (finance) and the MDR (medical devices) do not apply — declaring them would be over-claiming. The GDPR, by contrast, DOES apply (the subjects may be minors), but the engine does not yet have a full GDPR clause catalogue to project automatically — so the measurable part (data minimization, Art. 5(1)(c)) became a real control with a numeric gate, while the part that is not yet measurable (child’s consent, DPIA, no profiling) is carried as an attested measure: declared with evidence and signed, but honestly flagged as not automatically verified. As for prEN 18228: it is a harmonised draft (HarmonizedDraft), so its presumption flag is false — even though the engine projects real per-clause verdicts onto it. Honesty cuts three ways at once: declare what governs you, measure what you can genuinely measure, and flag as pending what you still can’t.
Where to go next
Section titled “Where to go next”You have now governed a high-risk system on the clean spine and met your first GDPR data-minimization gate. Next come the overlays — sector regimes that stack on top of the AI Act: