Skip to main content

EU AI Act for Developers

For developers: the EU AI Act duties that reach your code and how Scanara checks each pull request. Next step: open the sample report.

What reaches developers

  1. Logging, oversight and accuracy are code

    If your employer provides a high-risk AI system, the system must record events automatically (Article 12). It must allow human oversight (Article 14). It needs appropriate accuracy, robustness and cybersecurity (Article 15).

  2. Most features are not high-risk

    High-risk means a use listed in Annex III or a product covered by Annex I (Article 6). Check that first. Other rules can still apply, such as the Article 50 disclosure duty for chatbots.

  3. Some practices are prohibited

    Article 5 has prohibited listed practices, such as inferring emotions at work, since 2 February 2025. Fines reach EUR 35 million or, for an undertaking, 7% of worldwide annual turnover, whichever is higher (Article 99(3)).

What Scanara adds to your pull requests

✗Scanara EU AI Act Compliancefailure

Mode: Blocking Mode

Compliance Score: 58/100

# Findings Summary

Critical: 0

High: 7

Medium: 14

Low: 22

Total: 43

# Threshold Violations

High findings: 7 (max allowed: 5)

Compliance score: 58% (min required: 60%)

▸ View full report on Scanara Dashboard →

Example of the check summary Scanara posts on GitHub, in English. The numbers are illustrative.

  1. A check on every pull request

    Scanara posts a GitHub check run named Scanara EU AI Act Compliance on each pull request. In Blocking mode a failed check stops the merge when you require the check in branch protection.

  2. Audit or Blocking mode

    Audit mode reports only. Blocking mode fails the check when a threshold is exceeded. Set thresholds per repository: maximum critical findings, maximum high findings and minimum score. The defaults are 0, 5 and 60.

  3. A report behind every check

    Each check links to a report with a score and a grade from A to F, findings by article, severity and file, and a risk score per file.

  4. Several languages, different accuracy

    Scanara assigns each language an accuracy tier. Python, JavaScript and TypeScript have the highest confidence (1.00). R and Julia are experimental (0.75) with more false positives and misses.

Questions developers ask

How do I connect Scanara to my repositories?

Connect your GitHub account, choose the repositories to scan, then switch on the merge gate for a repository and set its mode and thresholds. The merge gate needs no pipeline changes: GitHub sends a webhook when a pull request opens or changes.

What do I see on a pull request?

A check run named Scanara EU AI Act Compliance. Its summary shows the mode, the compliance score and a table of findings by severity. A link opens the full report in the Scanara dashboard.

What is the difference between Audit and Blocking mode?

Audit mode reports without failing, so the pull request can still merge. Blocking mode fails the check when a threshold is exceeded. To stop the merge, require the check in GitHub branch protection.

Which programming languages does Scanara scan?

Several languages, with different accuracy: Python, JavaScript and TypeScript are the most accurate, R and Julia are experimental. Detection covers standard ML framework patterns. Custom wrappers and obfuscated code may be missed.

What does the Free plan include?

Free includes 5 scans in total, 1 AI system and 2 repositories, without the merge gate. Paid plans add monthly scans and the merge gate.

Read next

Look at a sample report first

The demo shows an anonymised compliance report, so you can see what a pull request check links to.

Scanara prepares evidence from your repositories

Scanara reads your connected GitHub repositories and runs rule-based scans for standard AI and machine-learning patterns. It can miss non-standard code. Separately, it generates draft documentation from templates and your assessment answers as evidence for your compliance work. You make the classification decisions.