Skip to main content

Compliance as Code for AI Systems

How Compliance as Code applies to Articles 9 to 15: what a rule can test, what stays with a person and what Scanara’s rule-based scans cover and do not cover.

Compliance as code means writing parts of legal requirements as rules that run with your code. For providers of high-risk AI systems, some requirements of Articles 9 to 15 can be tested this way, but most need human judgment.

The duties apply from 2 December 2027 (Annex III) and 2 August 2028 (Annex I). Article 2 lists exclusions. Fines reach up to EUR 15 million or 3% of worldwide annual turnover, whichever is higher (Article 99(4)). Next step: pick one article and list which of its requirements a rule can test.

A rule can test whether something exists; a person must judge whether it is adequate

The Act’s requirements speak of what is appropriate to the intended purpose. Rules turn the checkable part into tests and leave the rest to people.

What a rule can test

  • Whether logging code exists around model calls (Article 12).
  • Whether required documents exist and contain the expected sections (Articles 11, 13, 17 and 47).
  • Whether a risk class is recorded for each system.
  • Who changed a rule or a document, and when (git history).

What needs a person

  • Whether the risk analysis is adequate and the residual risk acceptable (Article 9(5)).
  • Whether the system is high-risk, which depends on its intended purpose (Article 6).
  • Whether human oversight works in practice and is staffed (Articles 14 and 26(2)).
  • Whether documents are true and complete. A scan checks that content is present.

Three building blocks: code rules, document policies, versioned documentation

Code rules

Static analysis rules (Semgrep) detect standard ML framework patterns in your source code.

  • Pattern detection: Rules flag AI operations without recognisable logging, validation or human intervention points.
  • Article mapping: Each rule maps to an article of the Act.
  • Limits: Detection confidence varies by programming language tier, and experimental tiers have higher false-positive and false-negative rates. Custom wrappers and obfuscated code can be missed.

Document policies

Open Policy Agent (OPA) policies check compliance documents for required content in eight languages: EN, DE, FR, IT, ES, NL, PL and PT.

  • Technical documentation sections: Policies check that the technical documentation contains the eight sections that Scanara’s rules require, based on Annex IV. They check that content is present, not that it is good.
  • GPAI documents: A document scan covers the documentation of providers of general-purpose AI models (Article 53). Dossier generation drafts Annex XI and XII documents.

Versioned documentation

Documentation in your repository is versioned together with your code.

  • Documentation as code: Risk assessments and system descriptions live as structured files. Your git history shows who changed what and when. Article 11 requires technical documentation to be kept up to date.
  • Generated drafts: Scanara drafts documents aligned with Annex IV from your inputs and assessment answers. Autofill is partial, and wrong inputs produce well-formatted wrong documents.

From article to check: what a rule covers and what stays with you

Five articles show how a requirement splits into a rule-based check and a human task. Coverage differs by article: some have code rules, some document scans, some a guided assessment.

Article 9: risk management

Requirement
Establish, implement, document and maintain a risk management system over the lifecycle (Article 9(1) and (2)).
Check in Scanara
Code rule: flags AI decision points without recognisable risk assessment or validation code. A guided assessment records your risk analysis as evidence.
Stays with you
Identifying and judging the risks, and deciding that the residual risk is acceptable (Article 9(5)).

Article 11: technical documentation

Requirement
Draw up technical documentation before market placement or putting into service and keep it up to date, with at least the Annex IV elements.
Check in Scanara
Document scan: checks that the eight required sections that Scanara’s rules define for technical documentation, based on Annex IV, are present. Dossier generation drafts Annex IV documentation from your inputs.
Stays with you
Writing accurate content and keeping it current. A scan checks presence, not truth.

Article 12: record-keeping

Requirement
Allow the automatic recording of events (logs) over the lifetime of the system.
Check in Scanara
Code rule: flags AI operations without recognisable logging.
Stays with you
Choosing the events to record for the three purposes of Article 12(2), and keeping the logs.

Article 13: transparency

Requirement
Design the system so that deployers can interpret its output and use it appropriately, and provide instructions for use.
Check in Scanara
Document scan: checks that instructions for use exist and contain the required sections.
Stays with you
Making the instructions accurate and understandable for deployers.

Article 14: human oversight

Requirement
Design the system so that natural persons can oversee it effectively. As appropriate and proportionate, they must be able to intervene or interrupt the system, for example through a ‘stop’ button or a similar procedure (Article 14(1) and (4)(e)).
Check in Scanara
Code rule: flags decision paths without a recognisable human intervention point.
Stays with you
Designing oversight that works in practice and assigning trained people (Article 26(2)).

What Scanara does not do

Scanara does not observe running systems, judge intended purpose or business context, give legal advice or replace a conformity assessment by a notified body where one is required. The same code can be minimal-risk or high-risk, depending on its intended purpose. A passing scan does not show compliance.

Getting started in five steps

  • 1

    Classify your AI system

    Decide whether your system is high-risk (Article 6, Annex III). The result depends on the intended purpose and is your decision.

  • 2

    Run an initial scan

    Scan your code and documents to get a baseline of findings. Read them as pointers, not as a verdict.

  • 3

    Add the scan to your pipeline

    Start in report-only mode, then consider blocking mode. The CI/CD guide describes the stages.

  • 4

    Work through findings by priority

    Have a person review findings that point to Article 5 or Article 14 first.

  • 5

    Draft the documentation

    Generate draft Annex IV and Annex V documents from your inputs, then complete and verify them.

Exclusions, older systems and fine caps

The Regulation does not apply to AI systems used exclusively for military, defence or national security purposes (Article 2(3)). It does not apply to AI systems specifically developed and put into service for the sole purpose of scientific research and development (Article 2(6)), or to research, testing or development before placing on the market or putting into service, except testing in real-world conditions (Article 2(8)). Free and open-source systems are excluded unless they are placed on the market or put into service as high-risk systems or fall under Article 5 or 50 (Article 2(12)). Natural persons who use a system in a purely personal non-professional activity are not bound as deployers (Article 2(10)). For high-risk systems related to products under Annex I Section B legislation, such as motor vehicles, aviation, rail, marine equipment, agricultural vehicles and machinery, only Article 6(1), Article 60a and Articles 102 to 112 apply. Articles 57 to 59 apply only in so far as that legislation integrates the requirements (Article 2(2)).

High-risk systems placed on the market or put into service before the application date are covered only after significant design changes. In any case, providers and deployers of high-risk systems intended to be used by public authorities must take the necessary steps to comply by 2 August 2030 (Article 111(2)).

For SMEs, each fine is up to the percentage or amount, whichever is lower (Article 99(6)). For small mid-cap enterprises (SMCs, defined in Article 3(14b)), the same cap applies to fines under Article 99(4) and (5) (Article 99(6a)). The EUR 15 million tier also covers the obligations of providers and operators under Article 25(2) and (4) (Article 99(4), point (da)).

Read next: pipeline stages, audit trails and technical documentation

Scanara prepares evidence from your repositories

Scanara reads your connected GitHub repositories and runs rule-based scans for standard AI and machine-learning patterns. It can miss non-standard code. Separately, it generates draft documentation from templates and your assessment answers as evidence for your compliance work. You make the classification decisions.