How Scanara's rules are built and verified

How Scanara evaluates documentation with OPA and Rego

Scanara's document-level compliance checks run on Open Policy Agent (OPA). OPA evaluates technical documentation against EU AI Act obligations. This follows the same policy-as-code approach used throughout the OPA ecosystem: declarative rules, deterministic evaluation, and an auditable result every time. This runs alongside Scanara's source-code scanning. Code scanning checks what the code does. OPA checks what the documentation says.

Each documentation file goes through the same steps. First, Scanara parses it and detects its language (8 EU languages are supported). Then it normalizes the file into a structured input document: sections, headings, extracted text. OPA evaluates this structured document against a compiled Rego policy bundle.

Scanara generates these policies from a canonical mapping between EU AI Act article text and machine-checkable requirements. No policy is hand-written per repository. Every rule traces back to one specific article, paragraph, and point. Evaluation produces one finding per obligation: satisfied, missing, or partial. These findings feed into the compliance report together with the source-code findings.

The example below shows the pattern. It's simplified for public documentation. The production ruleset covers dozens of obligation categories, plus multi-language detection, severity weighting, and cross-document consistency checks not shown here.

package eu_ai_act.example.article_11

# Illustrative pattern only — simplified for public documentation.
# Scanara's production ruleset covers dozens of obligation categories with
# multi-language detection, severity weighting, and cross-document
# consistency checks not shown here.

default satisfied := false

# A document satisfies this (illustrative) Article 11 check when its parsed
# sections include the required topic, with non-empty content.
satisfied if {
	some section in input.document.sections
	section.topic == "risk_management_process"
	count(trim_space(section.content)) > 0
}

finding := {
	"article": "11",
	"obligation": "technical_documentation.risk_management_process",
	"status": "satisfied",
} if satisfied

finding := {
	"article": "11",
	"obligation": "technical_documentation.risk_management_process",
	"status": "missing",
	"severity": "high",
} if not satisfied

Together, the two engines automatically detect 66 EU AI Act articles: 44 code-detectable and 22 document-level via OPA. Coverage spans all 8 EU languages. Findings from both engines feed directly into the generated compliance dossier. The evidence trail traces back to an actual scan result, not a self-reported checklist.