Gap Attribution: Why Knowing Your Score Is Not Enough

A compliance score of 63% tells you almost nothing.

It does not tell you whether the problem is insufficient source material, missing regulatory framework coverage, weak reasoning chains, or all three. It does not tell you which specific actions would raise the score. And it does not give your compliance team a prioritised remediation path.

This is why TraceGov built gap attribution.

The Problem with Scores Alone

Most AI evaluation frameworks produce a single number or a set of numbers. RAGAS gives you faithfulness and relevance scores. DeepEval produces metric-specific results. These numbers answer "how did the AI perform?" but not "why did it perform that way?"

For regulated organisations, the "why" is the question that matters.

When a regulator asks about your AI governance under Article 13 of the EU AI Act, "our system scores 63% on transparency" is a starting point. But "our system scores 63% on transparency because source coverage is limited to 7 of 15 available chunks, and assertion density exceeds our evidence base by a factor of 3.2" — that is a governance diagnostic.

What Gap Attribution Does

Gap attribution decomposes every TRACE dimension score into its contributing factors. When a score is below the target threshold, the system identifies exactly which factors caused the gap.

The Five Gap Factors

SCG — Source Coverage Gap The AI response draws from fewer sources than available. If your workspace contains 200 document chunks and the response references 8, the source coverage ratio is 4%. Gap attribution quantifies this and identifies which additional documents would improve coverage.

Example: "Transparency score 58%. Source Coverage accounts for 14 of 42 gap points. Adding chunks from the DORA framework document would close 8 points."

PKC — Prior Knowledge Confidence The AI relies on prior training knowledge rather than workspace-specific evidence. High PKC gaps indicate the response makes claims that cannot be traced to uploaded documents.

Example: "Reasoning score 71%. PKC accounts for 9 of 29 gap points. Three claims in the response reference GDPR Article 22 but no uploaded document covers Article 22."

DLT — Depth Limitation Tolerance The response addresses the topic at surface level when deeper analysis is available. DLT gaps indicate the retrieval pipeline found deep evidence but the response used shallow summaries.

Example: "Auditability score 65%. DLT accounts for 11 of 35 gap points. Detailed technical specifications exist in the uploaded risk assessment but were not referenced."

ADG — Assertion Density Gap The response contains more claims than the evidence base can support. When a 600-word response makes 25 assertions but only 8 can be verified against sources, the assertion density gap is significant.

Example: "Compliance score 61%. ADG accounts for 17 of 39 gap points. Response contains 22 compliance-related assertions, 9 are source-verified."

FSC — Fundamental System Constraint Some gap is structural — inherent to the system's architecture or the available data. FSC is capped at approximately 5% per dimension and is identified separately so users do not mistake structural limitations for actionable gaps.

Example: "Explainability score 67%. FSC accounts for 4 of 33 gap points. The remaining 29 points are addressable through source expansion and assertion refinement."

Why This Matters for EU AI Act Compliance

Article 13 — Transparency requires explanation, not just measurement

A governance tool that reports "63% transparency" without explaining the composition of that score does not enable the deployer to "interpret a system's output and use it appropriately" as Article 13(1) requires.

Gap attribution provides the interpretation layer. The deployer sees not just the score but the specific factors — and can make informed decisions about whether to accept the risk, request human review, or improve the evidence base.

Article 14 — Human oversight requires actionable information

Article 14 requires deployers to exercise "effective oversight" of high-risk AI systems. Effective oversight means the human reviewer has enough information to identify anomalies and intervene.

A score alone is not actionable. A score with gap attribution — showing that the primary gap driver is Source Coverage at 14 points — gives the reviewer a specific action: expand the source material for this topic.

Article 9 — Risk management requires root cause analysis

Article 9 requires deployers to identify and analyse "the known and the reasonably foreseeable risks." Gap attribution is risk decomposition: it identifies the root causes of governance gaps so they can be systematically addressed.

How Gap Attribution Works in TraceGov

Every TRACE score returned by TraceGov includes a gap_attribution object with:

1. Per-dimension breakdown — Each of the five TRACE dimensions (T, R, A, C, E) shows its individual gap factors
2. Factor rankings — Gap factors are ranked by magnitude, so the compliance team knows which factor to address first
3. Specific remediation signals — Where possible, the system identifies which documents, frameworks, or evidence would close the gap
4. Structural vs. addressable split — FSC (structural) gaps are clearly separated from SCG/PKC/DLT/ADG (addressable) gaps

The scoring is deterministic. Given the same response, sources, and knowledge graph state, gap attribution produces the same decomposition. This reproducibility is essential for audit compliance.

The Competitive Difference

Gap attribution is the difference between grading and diagnosing. Grading tells you where you stand. Diagnosing tells you how to improve.

Start With Your First Score

Upload a document. Ask a question. See TRACE score every dimension — and then see gap attribution explain exactly why each score is where it is.

Every Explorer account includes full gap attribution on every response. No paywall on diagnostics.

See why your AI governance score is not 100%. Start with the Explorer tier — free, EU-hosted, GDPR compliant. Start Tracing — Free →