EU AI Act compliance that runs in your CI.
Opencomplai checks the AI system you declare against the EU AI Act, starting from its intended purpose, fails the build when an obligation is missing, and writes an evidence artifact for every commit. It can also propose a classification from your code, which you confirm. Deterministic rules, open source, runs in your own pipeline.
~/hiring-system
How it works
One gate, three supporting commands
01
Gate
opencomplai checkExits non-zero when a control fails, so the pull request fails like a failing test. Writes compliance-artifact.json, the evidence record for that commit; sign it with --sign.
02
Declare
opencomplai initRun once: writes the intended purpose to the manifest the gate classifies against.
03
Report
opencomplai gapsAn article-by-article gap report with ISO/IEC 42001 clause references. Informational; it never gates CI.
04
Discover
opencomplai scan --quickFinds AI SDKs and biometric code in your repo, and part of the critical-infrastructure area. Its token scan does not look for Annex III areas 3 to 8, but with the opencomplai-ai plugin installed it also lists leads for areas 3, 4, 6 and 8, and for area 5 at the lowest confidence (area 7 is notice only): call sites for a person to review, never findings. Use scan --ai-intent or scan --propose for a proper look. Discovery only: it never fails your build.
In your pipeline
A compliance check that behaves like a test
Add one step to GitHub Actions. Every pull request gets a verdict, an exit code and an evidence artifact.
.github/workflows/compliance.yml
- name: Opencomplai compliance check
run: |
pip install opencomplai
opencomplai init \
--system-id "${{ env.MODEL_NAME }}" \
--intended-purpose "${{ env.USE_CASE }}"
opencomplai check --scan-mode ciopencomplai check
Opencomplai Compliance Check
system_id: hiring-system
commit_ref: HEAD
result: CONTROL_FAIL
duration_ms: 0
signed: no (OSS unsigned)
failed_controls: EU_AIA_ART6_HIGH_RISK, EU_AIA_ART6_PROFILING
Artifact written to compliance-artifact.json
From opencomplai gaps
| Article | Status | ISO/IEC 42001 |
|---|---|---|
| Art. 6 | MET | Clause 6.1 |
| Art. 9 | MISSING | Clause 6.1 / Clause 8.2-8.3 |
| Art. 10 | UNVERIFIED | Clause 8.1 |
| Art. 13 | MISSING | Clause 7.4 |
| Art. 50 | UNVERIFIED | Clause 7.4 |
Statuses are heuristic estimates — not a legal determination.
Coverage
What gets checked, stated plainly
The EU AI Act is evaluated natively; NIST AI RMF and ISO/IEC 42001 are projected from that evaluation, not assessed independently.
EU AI Act
Rules for risk classification and obligations run natively on every check.
EvaluatedNIST AI RMF
A partial report projected from the EU AI Act evaluation through a published crosswalk. The mapping is unreviewed.
DerivedISO/IEC 42001
A native pack of attestation rows that reference existing checks. Partial and unreviewed; rows read Unverified until a provider records them.
Attestation-ledDORA
Clause citations only, with no checks behind them.
MappedEBA
Clause citations only, with no checks behind them.
Mapped
Deterministic by design
No LLM in the decision path
Verdicts come from rules in the open-source core, not from a model. The same input gives the same result, and you can read every rule in the repo.
“No LLM. No ML inference. Not anywhere in the compliance decision path.”
— from our engineering notes
Read the AI inventoryOpen source vs Enterprise
Open source
Free forever
- Full CLI and Python SDK
- Runs in GitHub Actions or any CI
- EU AI Act evaluated; NIST AI RMF and ISO/IEC 42001 partial and unreviewed; DORA and EBA mapped only
- Hosted dashboard Free plan (private beta): one connected pipeline
- An evidence artifact for every run
- Community support on GitHub and Discord
Enterprise
For teams that need more
- Hosted evidence dashboard with higher limits (private beta)
- Priority support, response times agreed in your contract
- Custom integrations
- Compliance advisory
From the blog
All posts →The EU AI Act scanner that cannot break your build, by design
opencomplai scan --quick is discovery-only: no manifest, no config and no code path that can fail your build. Why I made the first run deliberately boring.
Read post →Why a compliance tool needs its own egress allowlist
Why my compliance engine has a dedicated egress-proxy service: one allowlist, one choke point, and a full answer to what the pipeline was allowed to talk to.
Read post →I modeled EU AI Act compliance as a state machine, not a checkbox list
I model every EU AI Act control as a five-state machine because evidence expires. How a freshness TTL turns 'are we still compliant' into a query.
Read post →Product updates
Get release notes in your inbox
Occasional emails about new releases and EU AI Act changes that affect the engine. Nothing else.
We use your email only for these updates. See our Privacy Policy.