Opencomplai

Blog

Engineering notes and EU AI Act guides from the Opencomplai team: compliance checks in CI, risk classification, evidence and open-source releases.

Engineering

Why a compliance tool needs its own egress allowlist

Why my compliance engine has a dedicated egress-proxy service: one allowlist, one choke point, and a full answer to what the pipeline was allowed to talk to.

Engineering

I modeled EU AI Act compliance as a state machine, not a checkbox list

I model every EU AI Act control as a five-state machine because evidence expires. How a freshness TTL turns 'are we still compliant' into a query.

Engineering

An immutable ledger for legal evidence, and a tool whose only job is proving it wasn't touched

How do you know an audit log wasn't edited after the fact? A content-addressed evidence store and a standalone verifier that checks the chain independently.

Engineering

I made my compliance tool fail the build rather than lie in the audit report

My compliance tool fails the release gate when a HIGH-risk system's dossier still has a placeholder in a required field. Why I chose that over a green checkmark.

Engineering

No LLM is allowed near my compliance decisions, and CI enforces it

There are no LLM calls in my compliance decision path, and CI blocks adding any. Why an audit trail can't say a model decided, and where the optional ML sits.

Engineering

What actually broke when I open-sourced my own compliance engine

Projecting a private monorepo into a public OSS release broke in ways I didn't expect: a leaking lockfile, a prune script that deleted .github, and one lesson.

Regulation

Your Hiring AI Is Either High-Risk, or Already Illegal

If your recruitment AI scores a candidate's enthusiasm from an interview video, that's not a 2027 compliance problem. It's already illegal, and has been since February 2025.

2 min read
Guide

How to Stop Shadow AI Without Killing Developer Velocity

A practical checklist for reducing shadow AI: why bans backfire, what to actually monitor, and how to roll out guardrails without becoming a blocker.

6 min read
Comparison

NIST AI RMF vs. EU AI Act: What's the Difference and Do You Need Both?

NIST AI RMF is a voluntary US framework. The EU AI Act is binding law. Here's how they differ, where they overlap, and which one your team actually needs.

6 min read
Regulation

ISO/IEC 42001 Certification: What It Covers and How to Prepare with Open-Source Tools

What ISO/IEC 42001 actually requires, who needs certification, and how automating evidence collection cuts the manual audit-prep work down.

6 min read
Guide

EU AI Act GitHub Actions Integration: A Step-by-Step Setup Guide

How to wire EU AI Act compliance checks into your GitHub Actions pipeline with Opencomplai, from install to reading your first failed check.

6 min read
Regulation

EU AI Act High-Risk AI System Checklist: Annex III Explained for Engineers

A plain-language walkthrough of the EU AI Act's Annex III high-risk categories, for engineers who need to know if their system is on the list.

7 min read
Shift Left AI Compliance: Why Your Pipeline Needs an Eval Stage

Shift Left AI Compliance: Why Your Pipeline Needs an Eval Stage

Treat compliance and risk management like automated tests that run right inside your deployment pipeline. Catch bad AI behavior before it ships, not six months later in an audit.

Surviving the EU AI Act on a Startup Budget

You don't need a million dollar legal budget to comply with the EU AI Act. You need a better engineering workflow. Here's how startups can get ready with open source tools.

Beyond the Spreadsheet: Automating AI Model Cards

Static model cards are useless the second they're saved. Here's how modern teams generate living compliance documents automatically while they write and deploy code.

The Shadow AI Trap: Securing Workflows Without Slowing Down

Top-down AI bans always fail. The only way to eliminate shadow AI is to make the secure, compliant path the easiest path to build, a paved road for AI development.

Regulatory Technical Debt: The Hidden Cost of Waiting

Building AI without compliance baked into the foundation feels fast, right up until your first enterprise deal stalls. Why AI risk management is a core product feature, not a legal afterthought.

Opencomplai is live

Introducing Opencomplai, the open-source AI compliance platform that connects directly to your CI/CD pipeline.

Compliance

Why AI Compliance Cannot Be an Afterthought

Most software teams treat compliance as a final step before launch. When modern AI is in your product, that old way breaks.

5 min read
Regulation

The Developer's Guide to EU AI Act Readiness

The EU AI Act isn't just a legal document. It's an engineering checklist. Here's what your team actually needs to build before the clock runs out.

7 min read
Contact