EU AI Act Compliance for Developers
Which EU AI Act duties engineers build into high-risk AI systems, and three guides on audit trails, CI/CD pipelines and rule-based scanning.
Providers of high-risk AI systems must build in logging (Article 12), human oversight (Article 14) and accuracy and cybersecurity (Article 15). They must also keep technical documentation up to date (Article 11). Deployers keep logs (Article 26(6)).
These duties apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I). Article 2 lists exclusions. Fines reach up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher (Article 99(4)). Next step: pick the guide below for your task.
Three guides: logs, pipeline checks and rule-based scanning
EU AI Act Compliance in Your CI/CD Pipeline
What the Act requires that a CI/CD pipeline can evidence, three pipeline stages, how Scanara’s GitHub merge gate works and where rule-based scans stop.
Compliance as Code for AI Systems
How Compliance as Code applies to Articles 9 to 15: what a rule can test, what stays with a person and what Scanara’s rule-based scans cover and do not cover.
AI Act Audit Trail Requirements
What Articles 12, 19 and 26(6) require of logging, what the Act leaves open, and engineering practices that protect logs as evidence.
EU AI Act Compliance Checklist
A checklist of the duties in Regulation (EU) 2024/1689 by role and risk class, with the article for each item.
Exclusions, older systems and fine caps
The Regulation does not apply to AI systems used exclusively for military, defence or national security purposes (Article 2(3)). It does not apply to AI systems specifically developed and put into service for the sole purpose of scientific research and development (Article 2(6)), or to research, testing or development before placing on the market or putting into service, except testing in real-world conditions (Article 2(8)). Free and open-source systems are excluded unless they are placed on the market or put into service as high-risk systems or fall under Article 5 or 50 (Article 2(12)). Natural persons who use a system in a purely personal non-professional activity are not bound as deployers (Article 2(10)). For high-risk systems related to products under Annex I Section B legislation, such as motor vehicles, aviation, rail, marine equipment, agricultural vehicles and machinery, only Article 6(1), Article 60a and Articles 102 to 112 apply. Articles 57 to 59 apply only in so far as that legislation integrates the requirements (Article 2(2)).
High-risk systems placed on the market or put into service before the application date are covered only after significant design changes. In any case, providers and deployers of high-risk systems intended to be used by public authorities must take the necessary steps to comply by 2 August 2030 (Article 111(2)).
For SMEs, each fine is up to the percentage or amount, whichever is lower (Article 99(6)). For small mid-cap enterprises (SMCs, defined in Article 3(14b)), the same cap applies to fines under Article 99(4) and (5) (Article 99(6a)). The EUR 15 million tier also covers the obligations of providers and operators under Article 25(2) and (4) (Article 99(4), point (da)).
Scanara prepares evidence from your repositories
Scanara reads your connected GitHub repositories and runs rule-based scans for standard AI and machine-learning patterns. It can miss non-standard code. Separately, it generates draft documentation from templates and your assessment answers as evidence for your compliance work. You make the classification decisions.