Compliance audit of caio-ai: a production video translation and dubbing pipeline
We used iCOMPLY to audit our own AI system — a composite pipeline of 7 foundation models deployed on AWS Lambda. Here is exactly what we found, including the gaps.
Why we are publishing this
iCOMPLY is built by the same team that built caio-ai. When we set out to build a compliance platform, the first question we asked was: can it actually find real issues in a real system? So we pointed it at our own production pipeline — the most complex AI system we have — and ran the full intake analysis. This page is the unedited result. The transparency gaps are real. The open questions are real. We are publishing them because honest self-assessment is exactly what the EU AI Act expects (Article 43), and because any compliance tool that hides its own shortcomings has no business reviewing yours.
System Overview
- System name
- caio-ai
- Domain
- Media and Entertainment
- Description
- Production AWS-serverless video translation and dubbing pipeline. Takes user-uploaded videos, transcribes them, translates to 1–10 target languages, synthesises dubbed audio in the target language using zero-shot voice cloning, lip-syncs the output to the original speaker, and optionally adapts the result for social platforms (YouTube, TikTok, Instagram, LinkedIn).
- EU AI Act role type
- Provider of the integrated pipeline
- Deployment
- AWS Lambda + Step Functions, multi-region, with optional RunPod A100 GPU workers for lip-sync
Composite Model Stack (7 models)
caio-ai does not retrain any of these models. User feedback is injected per-job into Claude prompts ("learn from human corrections") but no dataset is collected for fine-tuning.
Preliminary Classification
Applicable articles (candidate list)
Human oversight
Script Review (step_mode): Users can pause the pipeline at 5 stages — transcript, translation, voice synthesis, lip-sync, post-processing — and approve or reject before credits are charged. Documented in src/handlers/script_review/app.py.
Transparency Gaps Identified
These are real compliance gaps found in the caio-ai codebase. They are not hypothetical. Each gap maps to a specific article and has a severity rating.
Outputs are not marked in a machine-readable format detectable as artificially generated. Art. 50(2) places this obligation directly on the provider of the synthetic-content system — i.e. caio-ai — without ambiguity.
No tooling provided to help downstream content creators fulfil their Art. 50(4) deep-fake disclosure obligation when publishing the dubbed video. Legally the burden is on the deployer; practically caio-ai's customers have no default disclosure mechanism to deploy.
Voice cloning uses auto-extracted reference audio with no explicit consent gate
No data subject rights API — no DELETE /jobs/{job_id} endpoint
Open Classification Questions
These questions were surfaced by iCOMPLY's intake analysis and flagged for human review. They require judgment calls that the AI engine deliberately does not make on its own.
- 1.Does AWS Rekognition use for segment routing constitute biometric categorisation under Annex III section 1, triggering high-risk obligations?
- 2.Is documenting the auto-extracted voice reference sufficient for AIGP review, or does the platform require an explicit consent gate?
- 3.Art. 50(4) places the deep-fake disclosure burden on the deployer publishing the dubbed video — but should caio-ai ship a default disclosure overlay so customers comply by default? (Art. 50(2) machine-readable marking is unambiguously caio-ai's obligation as provider; that gap is settled, not open.)
- 4.Is relying on each sub-provider's DPA sufficient, or does a consolidated subprocessor compliance report need to exist?
- 5.Is the 7-day S3 lifecycle sufficient for GDPR Art. 17, or is a synchronous delete API required?
What happens next
- Intake analysis complete — the system is registered in iCOMPLY with full technical details, 7-vendor subprocessor chain, and 2 deployment records.
- Classification conversation — the 5 open questions above will be resolved in an interactive classify session with the AI engine, producing a definitive risk tier and Article 6 reasoning.
- Obligation mapping — once classified, the map conversation produces a prioritised obligation list with effort estimates and deadlines.
- Annex IV documentation — generate the full 8-section technical documentation as DOCX, with gap markers for anything not yet provided.
- Expert review + publication — AIGP-certified specialist reviews all outputs and the full case study is published with real documents attached.
Your AI system has the same gaps
Every composite AI pipeline has transparency obligations under Article 50. Most have subprocessor chain gaps. The question is whether you find them now or a regulator finds them after August 2.