Level 6 · Course recap
What you just saw
Section titled “What you just saw”The capstone. A receiving public body — Servizo Atlante de Saúde — procured AI from two suppliers, each of whom built and signed an AI system in its own git repo (that work was Levels 1-5) and delivered by mirroring the repo. Supplier A — Ollomar Diagnóstica S.L. shipped a retina screener (a medical device, with an MDR crosswalk); Supplier B — EduAtlante Analytics S.L. shipped an education model (AI-Act stack, no MDR). The external auditor, Aitor, verified each with only the supplier’s public key — no private keys, no data transit, no network. Both deliveries printed firma VÁLIDA and exited 0 — the retina delivery 7/7, the education delivery 6/6 — proving authenticity for both. And yet: the retina delivery is BLOCKED (its blocking model-dr-sensitivity control is RED — recall 0.414 < 0.80, AI Act Art. 15), while the education delivery is ACCEPTED (its blocking fairness-parity control is GREEN, no blocking RED). Neither is “conformant” — gapToFullConformance is computed independently, never flips the verdict, and is true for both. So the three distinct things landed: authenticity (Aitor’s verify) ≠ acceptance (the buyer’s tender/pliego door = valid signatures + no blocking RED) ≠ conformity (a per-clause judgement that only a notified body can issue — and there is none in this chain). Provider vs deployer (Art. 16 / Art. 25) split the responsibilities: the supplier signs, the buyer verifies and accepts. The MDR crosswalk is a cross-map only, never “MDR governed.” Tender-as-code is already built (froga sign-pliego + froga conformance --against-pliego: the threshold is imposed by the tender, not the supplier); and the remaining frontiers were named honestly: EU MCC-AI clause generation, eIDAS (today the key is pinned/TOFU, not legally attributed), Sigstore/Rekor, a federated graph, and 10-year retention — all roadmap. The line to carry away: a valid signature proves the bytes are authentic; it does not open the tender door, and it does not certify the law.
Self-check
Section titled “Self-check”State the three distinct judgements this level turns on — authenticity, acceptance, conformity — and place EACH of the two deliveries on all three.
Authenticity = are the bytes exactly what the private-key holder signed? Established by Aitor’s froga verify (firma VÁLIDA, exit 0). Acceptance = does the buyer’s tender (pliego) door open? Decided by deliveryAcceptance = signatures verify and no blocking control RED. Conformity = does each clause of the law hold? A per-clause judgement that only an accredited notified body can issue. Now the two deliveries: Supplier A (Ollomar, retina) is authentic (7/7 firma VÁLIDA, exit 0) + NOT accepted (blocking model-dr-sensitivity RED, recall 0.414 < 0.80 → BLOCKED) + NOT conformant (carries a documented gap). Supplier B (EduAtlante, education) is authentic (6/6 firma VÁLIDA, exit 0) + accepted (blocking fairness-parity GREEN, no blocking RED) + NOT conformant (still carries a documented gap — gapToFullConformance is true and is computed independently of the accept/block decision). Neither delivery is “conformant”; conformity is a separate judgement nobody in this chain issued.
Both deliveries print `firma VÁLIDA` and exit 0 — yet one is BLOCKED and one is ACCEPTED. How can both be authentic while their acceptance differs?
Because verify proves authenticity, not acceptance — they answer different questions. froga verify checks each artefact’s DSSE in-toto signature: keyid == sha256(public key), a valid ECDSA-P256 signature over the DSSE PAE, and the in-toto subject digest == sha256(artifact bytes). It exits 0 iff every present artefact verifies — so both deliveries pass (retina 7/7, education 6/6) because in both cases the bytes are exactly what the signer signed. Acceptance is a separate judgement made by the buyer’s tender gate (deliveryAcceptance): accepted iff signatures verify and no blocking control is RED. The retina delivery’s blocking model-dr-sensitivity control is RED (recall 0.414 < 0.80), so the tender door stays shut → BLOCKED; the education delivery’s blocking fairness-parity control is GREEN with no blocking RED → ACCEPTED. A perfectly authentic delivery can be a perfectly blocked one: authenticity is a cryptographic fact about the bytes; acceptance is a judgement about the content against the tender.
Why is there no notified body in this chain, and why does 'accepted' (or even 'authentic') NOT mean 'conformant'?
Because Aitor verifies but does not certify, and the acceptance gate is a tender door, not a CE certificate. Aitor is an external auditor on the buyer side: with only the public key he proves authenticity and reads the honest state (blocked / accepted / the documented gap) — but he has no accreditation, is not in NANDO, and has no certificate to issue. The buyer’s “accepted” verdict is a procurement decision (valid signatures + no blocking RED against the pliego), not a conformity assessment — the cloud i18n even states verbatim that the per-clause conformity opinion “is issued by the notified body,” not by this gate. Conformity is a separate, per-clause judgement that only an accredited, independent notified body can make — and there is none in this chain. So “authentic” means the bytes are what the signer signed, “accepted” means the tender criterion was met, and neither means the product meets the law clause by clause — gapToFullConformance is true for both deliveries, computed independently and never flipping the accept/block verdict. The retina screener’s MDR crosswalk is a cross-map only (never “MDR governed”); an MDR Class IIa device would need a notified body under the MDR procedure (Art. 52) that this chain does not have.
Where to go next
Section titled “Where to go next”You have reached the end of the course. Across six levels you went from the ISO-pure spine (N1) to the high-risk backbone (N2), through three overlays — health/MDR (N3), finance/DORA (N4), employment (N5) — and now to the procurement chain (N6), where the whole point landed: authenticity ≠ acceptance ≠ conformity, verified by an auditor who does not certify, with no notified body in the chain. To go deeper on the mechanisms this capstone touched: