Compliance as Code for AI Systems
Shift-left approach to EU AI Act compliance using code-based policy enforcement, automated scanning, and version-controlled documentation.
Compliance as Code means expressing regulatory requirements as machine-executable policies that live alongside your application code. For the EU AI Act, this translates Articles 9 through 15 into compliance rules, policy checks, and automated documentation checks that run on every commit.
This approach eliminates the gap between legal requirements and engineering implementation. Instead of interpreting regulation text during quarterly audits, your team works with concrete, testable rules that are version-controlled, peer-reviewed, and continuously enforced.
What compliance as code means for the EU AI Act
The EU AI Act contains over 100 articles with technical obligations that range from risk management systems (Article 9) to audit trail requirements (Article 12) to human oversight mechanisms (Article 14). Traditional compliance approaches treat these as checklists managed in spreadsheets. Compliance as Code treats them as executable specifications.
Traditional compliance
- xLegal team interprets regulation, writes checklist
- xEngineers manually verify checklist items against code
- xQuarterly audits catch violations months after introduction
- xDocumentation lives in separate systems, drifts from code
- xNo version history of compliance state over time
Compliance as Code
- +Regulation requirements encoded as compliance rules and policy checks
- +Automated scanning verifies compliance on every commit
- +Violations detected at PR stage, before merge
- +Documentation generated from code analysis, stays in sync
- +Full git history of compliance rules and scan results
The three pillars of AI Act compliance as code
1. Code scanning rules
Static analysis rules that detect compliance violations directly in your source code across 10+ programming languages.
Rules detect AI-specific patterns: model inference without logging, training pipelines without data quality checks, decision points without human oversight hooks.
Every rule maps to a specific EU AI Act article and requirement. Findings include the article reference, obligation text, and suggested fix.
Python, TypeScript, JavaScript, Go, Rust, C++, C#, Swift, Kotlin, R, and Julia. Same compliance rules, language-specific patterns.
Rules handle snake_case, camelCase, PascalCase, and common misspellings of AI-related terms to reduce false negatives.
2. Document policies
Open Policy Agent policies that validate compliance documents against EU AI Act requirements in 8 EU languages.
Policies check that technical documentation contains all 9 mandatory sections with the required level of detail.
Compare existing documentation against all applicable requirements. Generate a prioritized list of missing content.
Policies validate documents in English, German, French, Spanish, Dutch, Italian, Polish, and Portuguese.
Additional policies for general-purpose AI systems covering transparency obligations and model documentation.
3. Version-controlled documentation
Compliance documentation that lives in your repository, versioned alongside your code, and validated by automated policies.
Risk assessments, data governance policies, and system descriptions stored as structured documents in your repository.
Annex IV technical documentation generated from code analysis results. Always reflects the current state of your codebase.
Git history provides a complete audit trail of compliance documentation changes, who made them, and when.
Automated checks detect when documentation no longer matches the codebase, flagging outdated sections for update.
Mapping regulation articles to code
Each EU AI Act article with technical obligations can be decomposed into specific, testable requirements. Here is how key articles translate into compliance-as-code checks:
Article 9: Risk management system
Establish, implement, document, and maintain a risk management system
Verify risk assessment functions exist, are documented, and produce structured output. Check for bias detection and mitigation code.
Validate risk management methodology document covers identification, analysis, estimation, and evaluation of risks.
Article 10: Data and data governance
Training, validation, and testing data must be subject to data governance practices
Detect data loading without validation steps, training pipelines missing quality checks, and undocumented data preprocessing.
Check for data governance policy covering collection, preparation, labeling, quality criteria, and bias examination.
Article 12: Record-keeping
Automatic recording of events (logs) throughout the AI system's lifetime
Flag AI operations without structured logging, missing event timestamps, absent correlation IDs, and unlogged decision outputs.
Validate logging policy describes what events are captured, retention periods, and access controls.
Article 13: Transparency
Design for sufficient transparency to enable deployers to interpret system output
Detect AI outputs without confidence scores or explanations. Check for missing user-facing documentation of AI capabilities and limitations.
Verify instructions for use document covers intended purpose, level of accuracy, known limitations, and interaction with humans.
Article 14: Human oversight
Design to allow effective oversight by natural persons
Identify fully autonomous decision paths without human intervention points, missing override mechanisms, and absent escalation logic.
Check for human oversight plan covering when and how human operators can intervene, override, or halt the system.
Getting started
Determine whether your system is high-risk (Annex III), limited-risk, or minimal-risk. This determines which compliance rules apply.
Scan your codebase and documentation against applicable EU AI Act requirements to establish a baseline compliance score.
Add compliance scanning as a pipeline step. Start with advisory mode (report only), then switch to blocking mode.
Focus on critical findings first (prohibited practices, missing human oversight), then high-priority (risk management, record-keeping).
Once your score meets your threshold, generate Annex IV documentation and Declaration of Conformity from scan results.
Related guides
How Scanara Helps
Scanara automates EU AI Act compliance from code to dossier. Connect your GitHub repos and get compliance reports in minutes.