EU AI Act for CTOs
For CTOs of AI providers: the EU AI Act duties that reach engineering and what Scanara checks in code. Next step: open the sample report.
What the EU AI Act asks of engineering
Providers of high-risk systems build Articles 8 to 15
These articles cover risk management, data governance, logging, instructions for use, human oversight, accuracy, robustness and cybersecurity. They apply from 2 December 2027 (Annex III systems) or 2 August 2028 (Annex I products) (Article 113(c)).
Documentation and a quality system come with it
Providers also keep technical documentation (Article 11, Annex IV) and run a quality management system (Article 17). They keep the documentation for 10 years (Article 18).
Classification decides which duties apply
A system is high-risk only through Annex III or Annex I (Article 6). Classify each system first. Article 5 lists prohibited practices, which apply since 2 February 2025.
What Scanara does for engineering teams
A check on every pull request
Scanara posts a GitHub check on each pull request and links to the full report. Audit mode only reports. Blocking mode fails the check above your thresholds.
Code scan against the Act’s requirements
Rules generated from the Act’s text look for standard ML framework patterns in your code. Custom wrappers and obfuscated code can be missed.
Draft technical documentation
Scanara generates a draft of the Annex IV documentation from your inputs and assessment answers. Your team completes and verifies it.
Inventory with recorded classification
You register each AI system. Scanara records its risk classification and your reasoning. Your team makes the classification decision.
Key date and fine ceiling
2 December 2027
High-risk rules apply to Annex III systems from this date, and to Annex I products from 2 August 2028 (Article 113(c)).
EUR 15 million or 3%
Fine ceiling for breaches of provider and deployer duties: up to EUR 15 million or, for an undertaking, up to 3% of worldwide annual turnover, whichever is higher (Article 99(4)). For SMEs and small mid-caps the lower amount is the cap (Article 99(6) and (6a)).
Questions CTOs ask
Which EU AI Act duties reach my engineering team?
It depends on your role and on whether the system is high-risk. Providers of high-risk systems meet Articles 8 to 15 and Article 17 (Article 16). Deployers follow Article 26: they use the system as instructed, assign human oversight and keep logs under their control for at least six months, unless other law provides otherwise.
When do the high-risk rules apply to our systems?
From 2 December 2027 for Annex III systems and from 2 August 2028 for Annex I products (Article 113(c)). A high-risk system placed on the market or put into service earlier is covered only after significant design changes. In any case, providers and deployers of high-risk systems intended to be used by public authorities must take the necessary steps to comply by 2 August 2030 (Article 111(2)).
Does the merge gate work on the Free plan?
No. The Free plan has no merge gate and allows 5 scans in total, 1 AI system and 2 repositories. The Team plan includes the merge gate on 1 repository. The Business plan includes it on all repositories.
Can Scanara tell us whether our system is high-risk?
No. Scanara structures the classification and records your reasoning. Your team decides, with counsel where the stakes are high. The same code can be high-risk or not, depending on its intended purpose.
Does a passing scan mean we comply with the Act?
No. A scan checks code patterns and required document content. It cannot confirm real-world conduct, and passing it does not discharge an obligation.
Read next
See a sample scan report
The demo shows a real, anonymised compliance report and the product walkthrough.
Scanara prepares evidence from your repositories
Scanara reads your connected GitHub repositories and runs rule-based scans for standard AI and machine-learning patterns. It can miss non-standard code. Separately, it generates draft documentation from templates and your assessment answers as evidence for your compliance work. You make the classification decisions.