EU AI Act Compliance in Your CI/CD Pipeline
How to integrate EU AI Act compliance checks into your CI/CD pipeline with automated scanning and policy enforcement.
The EU AI Act (Regulation (EU) 2024/1689) introduces legally binding compliance requirements for AI systems. For engineering teams, this means compliance checks cannot remain a quarterly audit exercise. They need to run on every commit, every pull request, and every deployment, just like your tests and linters.
This guide covers how to embed EU AI Act compliance directly into your CI/CD pipeline, turning regulatory requirements into automated gates that catch violations before they reach production.
Why compliance belongs in your pipeline
Manual compliance reviews create a bottleneck between your engineering velocity and regulatory obligations. When compliance checks run only during periodic audits, violations accumulate in the codebase for weeks or months before detection. By that point, fixing them requires significant rework.
Shift-left detection
Catch missing risk management documentation (Article 9), absent logging configurations (Article 12), or missing human oversight mechanisms (Article 14) at the pull request stage, not during an audit.
Continuous evidence trail
Every pipeline run generates timestamped compliance reports. This builds the continuous documentation trail that Article 12 record-keeping requires, without any manual effort.
Reduced remediation cost
A compliance violation found during code review costs hours to fix. The same violation found during a regulatory audit can cost weeks of rework and fines of up to 15 million EUR (3% of global turnover) for technical obligation violations, or up to 35 million EUR (7% of global turnover) for prohibited practices under Article 5.
Developer-owned compliance
When compliance checks are part of the pipeline, developers get immediate feedback on regulatory requirements. Compliance stops being a legal team concern and becomes an engineering practice.
Pipeline architecture for AI Act compliance
An effective compliance pipeline runs checks at three stages: on every pull request, before merge, and before deployment. Each stage catches different categories of violations with increasing strictness.
Stage 1: Pull request checks
Run on every PR. Fast feedback loop (under 2 minutes). Catches the most common violations.
- --Code scanning -- Static analysis with compliance rules mapped to EU AI Act articles. Detects missing bias checks, absent logging, hardcoded thresholds, and undocumented AI decision points.
- --Document validation -- Policy engine rules verify that required compliance documents exist and contain mandatory sections (risk assessment, intended purpose, data governance).
- --Risk classification check -- Verify that the AI system's risk level is declared and consistent with the codebase analysis.
Stage 2: Merge gate enforcement
Blocking check before merge. Prevents non-compliant code from reaching the main branch.
- --Compliance score threshold -- Block merges if the compliance score drops below a configurable threshold (e.g., 70% for high-risk systems).
- --Critical violation blocking -- Any finding related to prohibited practices (Article 5) or missing human oversight (Article 14) blocks the merge unconditionally.
- --Documentation completeness -- Verify that Annex IV technical documentation sections are present and match the current codebase state.
Stage 3: Pre-deployment validation
Full compliance scan before production. Generates a first-draft compliance dossier.
- --Full scan -- Deep code scan across all supported languages plus document validation in all 8 EU languages.
- --Dossier generation -- Automatically generate Annex IV, Annex XI, and Declaration of Conformity documents from scan results.
- --Audit trail snapshot -- Store a complete compliance snapshot with the deployment for traceability.
GitHub Actions integration
The most common CI/CD integration pattern uses GitHub Actions with a compliance scanning step that runs alongside your existing test suite. The scan produces a structured JSON report that maps findings to specific EU AI Act articles.
Typical workflow structure
# .github/workflows/compliance.yml
name: EU AI Act Compliance
on:
pull_request:
branches: [main]
push:
branches: [main]
jobs:
compliance-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Run AI Act compliance scan
# Scans code with compliance rules mapped
# to EU AI Act articles + validates
# documents with policy engine
run: scanara scan --format json
- name: Check compliance threshold
# Block merge if score < threshold
run: scanara gate --min-score 70
- name: Upload compliance report
uses: actions/upload-artifact@v4
with:
name: compliance-report
path: scanara-report.jsonWhat the pipeline checks for
Each scan covers two dimensions: code analysis and document validation. Together, they map to the full scope of the EU AI Act's technical requirements.
Code analysis
Detects AI decision points without risk assessment, missing bias detection, and unvalidated model outputs.
Identifies training pipelines without data quality checks, missing dataset documentation, and undocumented preprocessing.
Flags AI operations without structured logging, missing audit trail events, and absent traceability mechanisms.
Identifies autonomous decision paths without human intervention points, missing kill switches, and absent override mechanisms.
Detects missing model validation, absent accuracy metrics, and untested edge cases in AI decision logic.
Scans for social scoring patterns, manipulative AI implementations, and prohibited biometric categorization.
Document validation
Validates all 9 required sections of technical documentation are present with mandatory content.
Checks for documented risk assessment methodology, identified risks, and mitigation measures.
Verifies Declaration of Conformity contains all legally required elements per Annex V.
Validates documents in all 8 EU languages where required (instructions for use, user-facing documentation).
Implementation checklist
Related guides
How Scanara Helps
Scanara automates EU AI Act compliance from code to dossier. Connect your GitHub repos and get compliance reports in minutes.