No LLM is allowed near my compliance decisions, and CI enforces it

I decided no LLM would go near my compliance decisions.

If a tool decides whether your AI system is legal to ship, the last thing I want deciding that is another model nobody can explain.

Opencomplai's rule engine (packages/core) and CLI are fully deterministic. No LLM. No ML inference. Not anywhere in the compliance decision path.

That's a design constraint, not a line for the landing page, and I don't just assert it. CI enforces it. Every pyproject.toml, package.json and requirements*.txt in the repo is scanned for unapproved AI/LLM packages on every PR, with excludes for tests, examples and fixtures so a demo notebook doesn't fail the build.

Add a transformers import to the risk engine without going through approval and the build breaks before it merges.

There is an ML path. packages/ai is an optional plugin with an ONNX/transformers intent classifier, plus an even more optional [deep] extra for local GGUF models via llama-cpp-python. It's opt-in, sandboxed to its own package, and it never touches the pass/fail decision. It classifies free-text system descriptions. It doesn't decide whether Article 5 applies to you.

I use AI every day. Last month I ran a workflow with more than 200 agents for more than 75 hours. So this isn't fear of the tool.

What I'm afraid of is an audit trail that says "the model decided this was compliant." That's not an audit trail. That's a liability with extra steps.

A regulator, or your own legal team, needs to trace why a system got classified high-risk down to a specific readable rule, not a probability distribution.

The scanner and the full inventory are in the repo if you want to see exactly what is allow-listed and why: github.com/Opencomplai/opencomplai, docs/security/ai-inventory.md.