Treating EU AI Act Compliance as Code: A CI/CD Approach

Haytham Kaoukji (Hi_Sam) — Fri, 14 Aug 2026 09:38:26 +0000

The EU AI Act's transparency obligations (Article 50) became enforceable on August 2, 2026. If you're shipping AI features into the EU, that's not a future date to plan around anymore, it's now.

Most teams still handle this the way we handled security compliance in 2015: a spreadsheet, a legal review, and a PDF nobody opens again until the next audit. That doesn't scale, and it doesn't fit how software actually gets built and shipped continuously.

What if compliance was a build step, not a document?

That's the idea behind OpenComplAI, an open-source project I've been building: EU AI Act risk classification and compliance checks that run in your pipeline, the same way you'd run a security scanner or a linter.

How it works

The core is a deterministic, rule-based risk engine, no ML inference involved in the compliance decision itself (the dependency list is scanned in CI specifically to enforce that). It's Python underneath (Pydantic v2 for the data models, Typer/Rich for the CLI), with a small set of services behind it:

a Gateway API (Node/TypeScript) for request routing
a Risk Engine that runs the classification logic
an Evidence Vault for immutable, content-addressed audit trails
a Doc Generator that produces Annex IV-format compliance dossiers

Quickstart

pip install opencomplai
opencomplai init --system-id my-model --intended-purpose "customer support chatbot"
opencomplai check

There's also a zero-setup discovery mode that never fails your build, useful for figuring out where you stand before you gate anything:

opencomplai scan --quick .

And a pre-commit hook if you want the check earlier than CI:

- repo: https://github.com/opencomplai/opencomplai
  rev: v0.1.2
  hooks:
    - id: opencomplai-quick-scan

What it actually checks

The interactive checker (opencomplai checker --web, or --local for a fully offline version) walks through whether the Act applies to your system at all, and if so, whether you're a provider or a deployer, since the obligations differ substantially. From there it handles risk-tier classification (including general-purpose AI model considerations) and generates the evidence trail you'd actually need to hand to an auditor.

Where it stands

It's early. Community edition is AGPL-3.0; there's a commercial tier in the works for teams that want a hosted dashboard, SSO, and additional rule engines, but the core compliance engine is fully open.

I'd genuinely value feedback from anyone who has done EU AI Act conformity work manually: what parts of that process actually generalize into rules, and what still needs a human in the loop? Issues, PRs, and just general "here's what we ran into" reports are all welcome.