v0.13.1 · Open source · AGPL-3.0

Hosted dashboard in private beta · Hosted dashboard beta · Book a demo

EU AI Act compliance that runs in your CI.

Opencomplai checks the AI system you declare against the EU AI Act, starting from its intended purpose, fails the build when an obligation is missing, and writes an evidence artifact for every commit. It can also propose a classification from your code, which you confirm. Deterministic rules, open source, runs in your own pipeline.

pip install opencomplai

Read the docs Star on GitHub

~/hiring-system

Exit code 1 · the job fails

17 stars on GitHubLatest release v0.13.1AGPL-3.0Runs in your infrastructureMember of NVIDIA Inception

How it works

One gate, three supporting commands

Gate

opencomplai check

Exits non-zero when a control fails, so the pull request fails like a failing test. Writes compliance-artifact.json, the evidence record for that commit; sign it with --sign.

Declare

opencomplai init

Run once: writes the intended purpose to the manifest the gate classifies against.

Report

opencomplai gaps

An article-by-article gap report with ISO/IEC 42001 clause references. Informational; it never gates CI.

Discover

opencomplai scan --quick

Finds AI SDKs and biometric code in your repo, and part of the critical-infrastructure area. Its token scan does not look for Annex III areas 3 to 8, but with the opencomplai-ai plugin installed it also lists leads for areas 3, 4, 6 and 8, and for area 5 at the lowest confidence (area 7 is notice only): call sites for a person to review, never findings. Use scan --ai-intent or scan --propose for a proper look. Discovery only: it never fails your build.

Features

What it does today

Status as of release 0.13.0. Each entry says whether it is available, partly covered or in private beta, and what is still open.

Guided classification
Declare the system's intended purpose, or run opencomplai checker. The manifest then records the role, the risk tier, the duties that follow and a line of reasoning for each role. opencomplai scan --propose can suggest a classification from your code, and a person confirms it with accept --proposal.
Limit: Not legal advice: your declared purpose stays authoritative and a proposal is only a suggestion. The scan was measured only on synthetic programs labelled by one author.
Available
Several roles at once
Record every role a system holds, for example provider and deployer. The checker runs once per role and merges the duties, and an article that binds only a role you do not hold leaves the gap table when a recorded checker session says so.
Limit: Not a legal determination: the roles and the session are what you recorded.
Available
Obligation backlog
opencomplai gaps --sort priority puts the rows that still need work first, ordered by the deadline of each article (the date it applies from), then by status and by effort, smallest first. Verdicts and exit codes do not change with the order.
Limit: Effort sizes are rough estimates, an ordering hint and not a time estimate for your system.
Available
Instructions and checklist documents
opencomplai instructions generate drafts the Article 13(3) instructions for use from your manifest, one row for each of the 13 points, with "not captured" where the manifest holds nothing. opencomplai recommend writes a checklist or document skeleton for each open gap, and deployer-pack seals the instructions into one file that a recipient can check offline.
Limit: The pack is our own experimental format and its wording awaits legal review. A provider's pack that a deployer imports counts toward the Article 26 row as Partial at most, never Met.
Partly covered
Incident workflow
opencomplai incident keeps a local register of serious incidents (Article 73) and a hash-chained log of each change, signed when a signing key is present. It works out the notification deadline from the time you became aware and the incident class, and shows what is due soon or overdue when you ask. A system that a check halted for review returns to running only with a token that a named person signs (approve, then resume).
Limit: It does not detect incidents and does not send notifications, and the deadline day counts await legal review. Oversight records are self-declared, so they never count as fully met.
Partly covered
Agent inventory
Declare each agent with its tools and models in the manifest. opencomplai agents inventory, check and report list them, validate the declaration and cross-check it against what a code scan found.
Limit: Declared, not discovered live: there is no live register of what each agent may do, and the scan side is heuristic.
Available
Financial-services mapping
opencomplai gaps --map-to DORA or --map-to EBA adds a column that cites the DORA chapter or EBA guideline covering similar subject matter next to each EU AI Act article it relates to. The gap report also names the ISO/IEC 42001 clause that each article maps to.
Limit: DORA and EBA rows are citations only, with no checks behind them and no status computed. The identifiers are not checked against the primary texts, the ISO/IEC 42001 clause mapping is unreviewed, and nothing is assessed beyond the EU AI Act.
Partly covered
Several organisations
In the hosted dashboard each organisation is its own tenant, with its own users, projects, API keys and audit log. A person who belongs to more than one organisation picks one at sign-in and can switch between them.
Limit: Private beta: organisations are set up with you in the demo, and the hosted service is not generally available.
Private beta
GitHub, GitLab and terminal
The GitHub Action posts the result as one pull request comment and keeps the evidence artifact. A GitLab CI component and an Azure Pipelines template run the same check and publish a JUnit result. Any other CI or a terminal runs opencomplai check directly. The hosted dashboard (private beta) has a connect page with copy-paste setup for GitHub Actions, GitLab CI and a plain curl call.
Limit: The check itself needs no key. Pushing to the hosted dashboard needs a project API key issued there.
Available

In your pipeline

A compliance check that behaves like a test

Add one step to GitHub Actions. With that step in place, each pull request that runs it gets a verdict, an exit code and an evidence artifact.

.github/workflows/compliance.yml

- name: Opencomplai compliance check
  run: |
    pip install opencomplai
    opencomplai init \
      --system-id "${{ env.MODEL_NAME }}" \
      --intended-purpose "${{ env.USE_CASE }}"
    opencomplai check --scan-mode ci

opencomplai check

Opencomplai Compliance Check
  system_id:    hiring-system
  commit_ref:   HEAD
  result:       CONTROL_FAIL
  duration_ms:  0
  signed:       no (OSS unsigned)
  failed_controls: EU_AIA_ART6_HIGH_RISK, EU_AIA_ART6_PROFILING

  Artifact written to compliance-artifact.json

From opencomplai gaps

Article	Status	ISO/IEC 42001
Art. 6	MET	Clause 6.1
Art. 9	MISSING	Clause 6.1 / Clause 8.2-8.3
Art. 10	UNVERIFIED	Clause 8.1
Art. 13	MISSING	Clause 7.4
Art. 50	UNVERIFIED	Clause 7.4

Statuses are heuristic estimates — not a legal determination.

Coverage

What gets checked, stated plainly

The EU AI Act is evaluated natively; NIST AI RMF and ISO/IEC 42001 are projected from that evaluation, not assessed independently.

EU AI Act
Rules for risk classification and obligations run natively on every check.
Evaluated
NIST AI RMF
A partial report projected from the EU AI Act evaluation through a published crosswalk. The mapping is unreviewed.
Derived
ISO/IEC 42001
A native pack of attestation rows that reference existing checks. Partial and unreviewed; rows read Unverified until a provider records them.
Attestation-led
DORA
Clause citations only, with no checks behind them.
Mapped
EBA
Clause citations only, with no checks behind them.
Mapped

Deterministic by design

No LLM in the decision path

Verdicts come from rules in the open-source core, not from a model. The same input gives the same result, and you can read every rule in the repo.

“No LLM. No ML inference. Not anywhere in the compliance decision path.”

— from our engineering notes

Read the AI inventory

Open source vs Enterprise

Open source

Free forever

Full CLI and Python SDK
Runs in GitHub Actions, GitLab CI or any CI, or from a terminal
EU AI Act evaluated; NIST AI RMF and ISO/IEC 42001 partial and unreviewed; DORA and EBA mapped only
Guided classification, several roles at once, an obligation backlog ranked by deadline and effort, and an agent inventory
Partly covered: instructions documents, an incident register, and DORA and EBA citations; the limits are on the product page
Hosted dashboard Free plan (private beta): one connected pipeline
An evidence artifact for every run
Community support on GitHub and Discord

Read the docs

Enterprise

For teams that need more

Hosted evidence dashboard with higher limits (private beta)
Priority support, response times agreed in your contract
Custom integrations
Compliance advisory

Book a demo

Free trial up to 3 months, set up with you in the demo.

Compare plans

From the blog

All posts →

EngineeringOct 22, 2026

AGPL for a compliance tool: the license nobody expects

Why the Community Edition is AGPL-3.0 rather than MIT or Apache: the network clause, the open-core boundary, and the trade-off I accepted.

Read post →

RegulationOct 19, 2026

Your credit-scoring AI has the same problem your hiring AI does

Underwriting models fed by social-media, browsing or device data may hit Article 5 before Annex III. How credit and insurance AI splits into high-risk versus prohibited.

Read post →

EngineeringOct 15, 2026

Same engine, EU AI Act today, NIST RMF tomorrow

I built the risk engine so it doesn't know what the EU AI Act is. Why the regulation lives in a mapping layer, and what NIST RMF or ISO 42001 would need.

Read post →

Product updates

Get release notes in your inbox

Occasional emails about new releases and EU AI Act changes that affect the engine. Nothing else.

We use your email only for these updates. See our Privacy Policy.