Why We Built Scanara
The EU AI Act’s high-risk rules apply from 2 december 2027 and 2 augustus 2028. This is why we built Scanara.
The EU AI Act’s high-risk requirements apply in two steps. They apply to Annex III systems from 2 december 2027 and to Annex I systems from 2 augustus 2028. Providers and deployers of high-risk AI systems in the EU need to prepare. We spent six months talking to CTOs and compliance leads at companies working out what that means for their codebase. The consistent answer surprised us: they couldn’t find tooling built for them.
The Gap
Many of the compliance tools we looked at were built around questionnaires and documents, for privacy officers, legal teams and auditors. We wanted a tool that works on the code itself and in the pull request workflow.
A manual compliance programme for a single high-risk AI system takes legal review, technical writing for Annex IV documentation, regular review cycles and someone to maintain it all. It goes stale the moment a developer changes the model or the training pipeline, and nobody notices.
The Developer-Native Approach
Part of the EU AI Act can be checked in code and documents. Article 9 requires a risk management system. Article 12 requires automatic logging of events. Article 13 requires information for deployers. Some of that shows up in an architecture, and some of it needs a person to judge.
Scanara turns the Act’s requirements into executable checks where code or documents can show them. Every finding names its article. Where code cannot show an obligation, a guided assessment covers it. The result lives in the same workflow as the code, not in a PDF on a shared drive.
The merge gate is the key piece. A compliance check can block a pull request before it merges, instead of a reviewer finding the problem weeks later. A passing check does not make the code compliant; it shows the result and a link to the report in the pull request.
What We're Building
Scanara is built for teams that need to prepare for the high-risk deadlines: 2 december 2027 for Annex III systems and 2 augustus 2028 for Annex I systems.
In Scanara’s coverage map, 66 of the 113 articles have at least one automated rule (24 August 2026 snapshot: 43 through code rules, 23 through document rules). The other articles have no automated rule. Some articles bind EU institutions or Member States, not operators, and are out of scope by design. The methodology page lists the measured figures with their date. A scan reports findings; it does not show that an obligation is fulfilled.
Prepare before the high-risk deadlines.
If your team builds AI systems and sells into the EU, we should talk. Email us about your stack, or see the demo first.
Frequently Asked Questions
Which EU AI Act deadlines apply?
High-risk requirements apply from 2 december 2027 for Annex III systems and from 2 augustus 2028 for Annex I systems (Article 113, as amended by Regulation (EU) 2026/1744). Banned practices apply since 2 februari 2025 and general-purpose AI model duties since 2 augustus 2025.
Why build a developer-first compliance tool?
In our experience, many compliance tools are built around questionnaires and documents for privacy officers and legal teams. Scanara scans code and documents and runs in GitHub and CI/CD. Compare tools against your own needs, and ask legal counsel about legal questions.
How much of the EU AI Act does Scanara cover?
In Scanara’s coverage map, 66 of the 113 articles have at least one automated rule (24 August 2026 snapshot: 43 through code rules, 23 through document rules). The other articles have no automated rule. Some bind EU institutions or Member States, not operators. The methodology page lists measured figures with their date.
Can Scanara make us compliant by the deadline?
No software can. Scanara scans code and documents, guides assessments and drafts documentation. Your organisation remains responsible for meeting the obligations. Start with a free scan to see where your codebase stands.