Product
How Opencomplai works
Opencomplai is an open-source, AGPL-3.0 compliance engine that runs where your code already runs — a CI step, not a dashboard you have to remember to check.
The pipeline at a glance
One gate, three supporting commands
1. Gate
opencomplai check
Runs the deterministic rules engine against the manifest and writes compliance-artifact.json; add --sign to sign it. Exit code 0 is PASS, 1 is CONTROL_FAIL and 3 is POLICY_BLOCK.
Show the real CLI output
opencomplai check
Opencomplai Compliance Check
system_id: chatbot-minimal
commit_ref: HEAD
result: PASS
duration_ms: 0
signed: no (OSS unsigned)
Artifact written to compliance-artifact.json2. Declare
opencomplai init
Declares the system's intended purpose and writes system-manifest.json; the gate reads that manifest on every check.
Show the real CLI output
opencomplai init
Signing keypair already exists at ~/.opencomplai
Manifest written to system-manifest.json
system_id: chatbot-minimal
intended_purpose: customer support chatbot
compliance_target: EU_AI_ACT
Next step: run opencomplai check to assess compliance.3. Report
opencomplai gaps
Projects the same results into a per-article EU AI Act report — Met, Partial, Missing or Unverified. Informational only; it never gates CI.
Show the real CLI output
opencomplai gaps
Opencomplai Gap Report — demo
Statuses are heuristic estimates — not a legal determination.
┌─────────┬────────────────────┬────────────┬────────────┬────────────────────┬───────────────────┐
│ Article │ Mapped │ Status │ Source │ Evidence │ Rationale │
├─────────┼────────────────────┼────────────┼────────────┼────────────────────┼───────────────────┤
│ Art. 6 │ Clause 6.1 │ MET │ rule │ EU_AIA_ART6_HIGH_… │ Use case │
│ │ (Actions to │ │ │ │ 'customer support │
│ │ address risks and │ │ │ │ chatbot' does not │
│ │ opportunities) │ │ │ │ match any Annex │
│ │ │ │ │ │ III high-risk │
│ │ │ │ │ │ categories. │
└─────────┴────────────────────┴────────────┴────────────┴────────────────────┴───────────────────┘
Gap report is informational only — it does not gate CI. See `opencomplai check` for the
compliance-artifact.json CI contract.4. Discover
opencomplai scan --quick
A zero-config scan of what your repo actually imports and calls, no manifest required. It never gates CI and suggests the init command to declare what it found. The default scan covers Annex III area 1 (biometrics) and part of area 2. Its token scan has no signal for areas 3 to 8; with the opencomplai-ai plugin installed it also lists leads for areas 3, 4, 6 and 8, and for area 5 at the lowest confidence (area 7 is notice only). A lead points at a call site for a person to review, is never a finding, and never changes an exit code. Without the plugin the scan prints one line that names `pip install opencomplai-ai`. A quiet default scan is not evidence that no Annex III area applies. Sample output from release 0.12.0.
Show the real CLI output
opencomplai scan --quick
Code Corroboration Scan
severity: major
declared: (none)
detected: biometric
discrepancies: biometric
evidence:
- app.py:1 token: "face_recognition" category: biometric confidence: 0.75
import face_recognition
- app.py:1 token: "face_recognition" category: biometric confidence: 0.85
import face_recognition
Declaration is authoritative; confirm or update intended_purpose.
Discovery only — not a compliance verdict. No manifest was loaded and no CI gate was evaluated.
Detected categories: biometric
Suggested next step:
opencomplai init --system-id <your-system-id> --intended-purpose "biometric"Suggest from your code, you confirm
Not sure how to classify a system? opencomplai scan --propose reads your code and writes a classification proposal, which is only a suggestion; scan --propose uses a deterministic matcher (fixed signal lists, no model inference) unless you pass --ai-model, and it needs the optional AI plugin (pip install opencomplai-ai).opencomplai accept --proposal shows it and records it only after you confirm. Your declared purpose stays authoritative: an unconfirmed proposal never changes a verdict, and a confirmed one that disagrees with what you declared is reported by check --scan as a discrepancy. A proposal is ignored with one warning when the code or manifest changed after it was written. A suggestion is not legal advice.
Reading the other Annex III areas
opencomplai scan --ai-intent and scan --propose read code for the areas the default scan does not. The configured default model of --ai-intent needs the [deep]extra; on a base install the scan prints "AI intent skipped".scan --ai-intent also lists candidates: AI libraries that production code imports but that give no Annex III signal. A candidate is a lead for a person. It is never a finding and never changes an exit code.
Measured only on 24 synthetic programs labelled by one author. On the intent path, precision was 50.0% (n=8) and recall 33.3% (n=12); on the default scan path, 25.0% and 8.3%. That is a baseline for tuning the signals, not accuracy on real repositories.
Hand over evidence
opencomplai export --sign signs the whole JSON evidence package, and opencomplai verify --kind evidence-package checks it offline. A local checklists the SHA-256 digests of the manifest and of the scan or eval report it read. The summary, JUnit and SARIF output state whether the artifact is signed. "Signed" means a signature is present, not that it was verified.
Runs in CI, not a separate portal
.github/workflows/compliance.yml
- name: Opencomplai compliance check
run: |
pip install opencomplai
opencomplai init \
--system-id "${{ env.MODEL_NAME }}" \
--intended-purpose "${{ env.USE_CASE }}"
opencomplai check --scan-mode ciA non-zero exit fails the job: 1 is CONTROL_FAIL, 3 is POLICY_BLOCK and 4 is TRAP_DETECTED, and 2 means the input was invalid. compliance-artifact.json is the evidence record for that commit.
The GitHub Action has a strict input. strict: "true" adds --with-gaps --scan --fail-on major --require-exemption-record --sign-if-available, each once; a flag you set through args, sign or with-gaps wins. Exit codes and CLI defaults are unchanged.
What ends up in your repo
system-manifest.json
The declared intended purpose and risk tier, written by opencomplai init.
compliance-artifact.json
The per-run evidence contract written by opencomplai check — the CI gate reads this.
Gap report
A per-article EU AI Act status from opencomplai gaps. Informational; doesn't gate CI.
Features
What it does today
Status as of release 0.13.0. Each entry says whether it is available, partly covered or in private beta, and what is still open.
Guided classification
AvailableDeclare the system's intended purpose, or run
opencomplai checker. The manifest then records the role, the risk tier, the duties that follow and a line of reasoning for each role.opencomplai scan --proposecan suggest a classification from your code, and a person confirms it withaccept --proposal.Limit: Not legal advice: your declared purpose stays authoritative and a proposal is only a suggestion. The scan was measured only on synthetic programs labelled by one author.
Several roles at once
AvailableRecord every role a system holds, for example provider and deployer. The checker runs once per role and merges the duties, and an article that binds only a role you do not hold leaves the gap table when a recorded checker session says so.
Limit: Not a legal determination: the roles and the session are what you recorded.
Obligation backlog
Availableopencomplai gaps --sort priorityputs the rows that still need work first, ordered by the deadline of each article (the date it applies from), then by status and by effort, smallest first. Verdicts and exit codes do not change with the order.Limit: Effort sizes are rough estimates, an ordering hint and not a time estimate for your system.
Instructions and checklist documents
Partly coveredopencomplai instructions generatedrafts the Article 13(3) instructions for use from your manifest, one row for each of the 13 points, with "not captured" where the manifest holds nothing.opencomplai recommendwrites a checklist or document skeleton for each open gap, anddeployer-packseals the instructions into one file that a recipient can check offline.Limit: The pack is our own experimental format and its wording awaits legal review. A provider's pack that a deployer imports counts toward the Article 26 row as Partial at most, never Met.
Incident workflow
Partly coveredopencomplai incidentkeeps a local register of serious incidents (Article 73) and a hash-chained log of each change, signed when a signing key is present. It works out the notification deadline from the time you became aware and the incident class, and shows what is due soon or overdue when you ask. A system that a check halted for review returns to running only with a token that a named person signs (approve, thenresume).Limit: It does not detect incidents and does not send notifications, and the deadline day counts await legal review. Oversight records are self-declared, so they never count as fully met.
Agent inventory
AvailableDeclare each agent with its tools and models in the manifest.
opencomplai agents inventory,checkandreportlist them, validate the declaration and cross-check it against what a code scan found.Limit: Declared, not discovered live: there is no live register of what each agent may do, and the scan side is heuristic.
Financial-services mapping
Partly coveredopencomplai gaps --map-to DORAor--map-to EBAadds a column that cites the DORA chapter or EBA guideline covering similar subject matter next to each EU AI Act article it relates to. The gap report also names the ISO/IEC 42001 clause that each article maps to.Limit: DORA and EBA rows are citations only, with no checks behind them and no status computed. The identifiers are not checked against the primary texts, the ISO/IEC 42001 clause mapping is unreviewed, and nothing is assessed beyond the EU AI Act.
Several organisations
Private betaIn the hosted dashboard each organisation is its own tenant, with its own users, projects, API keys and audit log. A person who belongs to more than one organisation picks one at sign-in and can switch between them.
Limit: Private beta: organisations are set up with you in the demo, and the hosted service is not generally available.
GitHub, GitLab and terminal
AvailableThe GitHub Action posts the result as one pull request comment and keeps the evidence artifact. A GitLab CI component and an Azure Pipelines template run the same check and publish a JUnit result. Any other CI or a terminal runs
opencomplai checkdirectly. The hosted dashboard (private beta) has a connect page with copy-paste setup for GitHub Actions, GitLab CI and a plaincurlcall.Limit: The check itself needs no key. Pushing to the hosted dashboard needs a project API key issued there.
Coverage
One evaluation, three frameworks
EU AI Act rules run natively. NIST AI RMF and ISO/IEC 42001 are projected from that same evidence, not separately evaluated.
EU AI Act
Rules for risk classification and obligations run natively on every check.
EvaluatedNIST AI RMF
A partial report projected from the EU AI Act evaluation through a published crosswalk. The mapping is unreviewed.
DerivedISO/IEC 42001
A native pack of attestation rows that reference existing checks. Partial and unreviewed; rows read Unverified until a provider records them.
Attestation-ledDORA
Clause citations only, with no checks behind them.
MappedEBA
Clause citations only, with no checks behind them.
Mapped
Runs in your infrastructure
A CLI and SDK you run in your own infrastructure. Nothing about your codebase leaves your environment during a normal scan.
Need a shared view across teams?
Enterprise adds a hosted evidence dashboard, in private beta: every team's check results and gap reports in one place, scoped to your organisation.
Free trial up to 3 months, set up with you in the demo.
Read the code before you run it
The full source is on GitHub and the packages are on PyPI — that's the point of open source.