Frequently asked questions

Open-source EU AI Act compliance checks that run in your CI/CD pipeline: classify a system, fail the build on a failed control, and write an evidence artifact for every run.

Yes. The CLI, SDK and rules are AGPL-3.0 and free forever. Enterprise adds a hosted dashboard (private beta), support and advice.

If you only run Opencomplai in your own pipeline, the AGPL asks nothing of your code. Obligations apply if you modify Opencomplai and offer it to others over a network.

EU AI Act: evaluated natively, with high-risk classification, transparency and checks that look for human-oversight, transparency and classification evidence in your repository on each run; they detect the presence of evidence, not whether oversight works. NIST AI RMF: derived, the same EU AI Act evidence is projected onto its subcategories through a crosswalk, so coverage is partial and the mapping is unreviewed. ISO/IEC 42001: a native pack, attestation-led, partial and unreviewed, with rows that read Unverified until a provider records them. DORA and EBA: mapped only, as citations without checks.

Available: guided classification, several roles at once, the obligation backlog, the agent inventory and the GitHub, GitLab and terminal integrations. Partly covered: instructions documents, the incident register and the DORA and EBA citations. Features of the hosted dashboard, such as several organisations, are in private beta. The limits of each entry are listed on the product page.

No. Opencomplai is a CLI and SDK you run in your own infrastructure. Nothing about your codebase leaves your environment during a normal scan.

No. Verdicts come from deterministic rules in the open-source core. There's no LLM or ML inference in the decision path. The optional plugin (opencomplai-ai) is off by default and advisory. When you pass --ai-intent it classifies code call sites, and what it finds can raise a scan's severity and, when --fail-on is set, change its exit. The default is none, so nothing fails on it unless you set --fail-on. The configured default model for --ai-intent is a local model that needs the [deep] extra and a download; on a base install the scan prints 'AI intent skipped'. --ai-intent also lists candidates: AI libraries that production code imports but that give no Annex III signal. They are leads for a person, never findings, and never change an exit code.

It can suggest one, and you decide. The scan reads your code and writes a classification proposal; you review it and confirm it before it is recorded. scan --propose uses a deterministic matcher (fixed signal lists, no model inference) unless you pass --ai-model, and a proposal is only a suggestion until a person confirms it. A proposal is ignored with one warning when the code or manifest changed after it was written. Your declared purpose stays authoritative: an unconfirmed proposal never changes a verdict. Suggestions need the optional AI plugin (`pip install opencomplai-ai`), and are advisory and not legal advice.

Only measured on synthetic programs. The default scan covers Annex III area 1 and part of area 2 and has no token signal for areas 3 to 8 of its own; with the opencomplai-ai plugin installed it also lists leads for areas 3, 4, 6 and 8, and for area 5 at the lowest confidence (area 7 is notice only). A lead points at a call site for a person to review, is never a finding, and never changes an exit code. Without the plugin the scan prints one line that names `pip install opencomplai-ai`. A quiet default scan is not evidence that no Annex III area applies. On a held-out set of 24 synthetic programs labelled by one author, the intent path (scan --ai-intent) had 50.0% precision (n=8) and 33.3% recall (n=12); the default scan path had 25.0% and 8.3%. That is a baseline for tuning the signals, not accuracy on real repositories.

Yes, in private beta. A Free plan covers one connected pipeline; paid plans are arranged with us, and a free trial of up to 3 months starts with a demo. Book a demo.

No. It's supporting evidence, never a declaration of conformity. Gap statuses are heuristic estimates.

GitHub issues and Discord for the open-source version, support terms agreed in your contract with Enterprise. See Support & Community for every channel.