Why We Built Scanara
The EU AI Act becomes enforceable August 2, 2026. The tooling wasn't ready. This is what we did about it.
The EU AI Act becomes enforceable August 2, 2026 — 12 weeks from now. Every engineering team building AI in or selling into the EU needs to comply. We spent six months talking to CTOs and compliance leads at companies scrambling to figure out what that means for their codebase. The consistent answer surprised us: they couldn't find tooling built for them.
Section 1
The Gap
The existing compliance tools — OneTrust, Credo AI, Holistic AI — are questionnaire-based GRC platforms. They were built for privacy officers, legal teams, and auditors. They don't scan code. They don't integrate with GitHub. They produce PDFs that require manual updates every sprint.
We ran the numbers with one fintech CTO. A complete manual compliance program for a single high-risk AI system: legal counsel at €400/hour for initial review, a technical writer for Annex IV documentation (60 hours), quarterly review cycles, and a dedicated compliance FTE to maintain it. That's €52,000/year in engineering time — before the first line of compliant code ships.
And it still breaks the moment a developer changes the model or updates the training pipeline. The PDF becomes stale. The assessment is wrong. Nobody knows.
Section 2
The Developer-Native Approach
The insight was simple: compliance obligations in the EU AI Act are code-level requirements. Article 9 requires a risk management system. Article 12 requires audit logging. Article 13 requires transparency documentation. These aren't policies — they're architectural properties you either have or you don't.
Scanara encodes EU AI Act articles as executable compliance rules. Every scan maps findings to specific articles: 9, 10, 12, 13, 14, 15, 17, and 80+ more. The result is compliance that lives in the same workflow as the code — not in a PDF on a shared drive.
The merge gate is the key piece. Non-compliant code doesn't reach production. Not because a reviewer caught it three weeks later, but because the CI pipeline blocked it before the pull request merged. That's the only compliance model that keeps pace with a shipping engineering team.
Section 3
What We're Building
Scanara is built for teams who need to be compliant before August 2. That deadline is the forcing function for everything.
Currently covering 44/44 code-detectable + 22/22 OPA document articles. The remaining articles are institutional or transitional provisions with no operator-facing obligations. The scanner handles every code-level and document obligation a developer can actually act on.
August 2, 2026 is the deadline.
If your team is building AI systems and selling into the EU, we should talk. Design partner spots are limited — we work closely with early customers to make sure the scanner covers your stack.