{"slug": "show-hn-opencomplai-open-source-eu-ai-act-compliance-checks-in-ci-cd", "title": "Show HN: OpenComplAI – open-source EU AI Act compliance checks in CI/CD", "summary": "OpenComplAI, an open-source tool from the Opencomplai project, automates EU AI Act compliance checks directly in CI/CD pipelines, enabling developers to gate releases with automated 'Pass/Fail' results and generate audit-ready logs. The tool, currently in a Closed Beta Pilot, includes a CLI, rule engine, and SDK, and can be installed via 'pip install opencomplai' with a first compliance check running in under 15 minutes.", "body_md": "**Stop manual audits → Start shipping.**\n\nOpenComplAI brings EU AI Act compliance directly into your CI/CD pipeline, turning fragmented legal mandates into automated, machine-readable \"Pre-Ship Checks.\"\n\n[Watch the OpenComplAI demo (MP4)](https://raw.githubusercontent.com/Opencomplai/opencomplai-enterprise/main/assets/opencomplai.mp4)\n\nTraditional GRC tools are disconnected dashboards that create \"velocity tax.\" We shift compliance left:\n\n**Prevent Non-Compliance:** Gate releases by blocking builds that violate safety rules.**Automated Evidence:** Generate audit-ready logs automatically for every deployment.**Framework-Agnostic:** Built to adapt to evolving global standards (EU AI Act, NIST RMF, ISO).\n\n**Define:** Create a compliance manifest for your model.**Integrate:** Add the OpenComplAI action to your GitHub/GitLab pipeline.**Ship:** Get an automated \"Pass/Fail\" result before your code ever hits production.\n\n[ Check out our Dummy Repo (Sandbox)](/Opencomplai/opencomplai/blob/main/examples/sample-system) –\n\n*Test how we catch AI errors without risking your production code.*\n\n`opencomplai-core`\n\n: The rule engine that evaluates controls.`opencomplai-cli`\n\n: Run checks locally in your dev environment.`opencomplai-sdk`\n\n: Programmatically embed compliance into your custom internal tooling.\n\nGet your first compliance check running in **under 15 minutes**:\n\n```\npip install opencomplai\n```\n\nThis installs the CLI, core rule engine, and SDK with a stable API contract (see\n[CHANGELOG](/Opencomplai/opencomplai/blob/main/CHANGELOG.md) for exit-code and artifact-schema guarantees).\n\nFor contributors who want to work from a checkout instead, install from source — the\n`core`\n\n, `cli`\n\n, and `sdk-python`\n\npackages must be installed together:\n\n```\ngit clone https://github.com/Opencomplai/opencomplai\ncd opencomplai\npip install -e packages/core -e packages/cli -e packages/sdk-python\n# or, with uv:  uv sync\n```\n\nThen run a first assessment:\n\n```\nopencomplai init --system-id my-model --intended-purpose \"customer support chatbot\"\nopencomplai check\n```\n\nOr try it with zero setup first — `opencomplai scan --quick .`\n\nruns a discovery-only\nscan with no manifest required and never gates your build:\n\n```\nopencomplai scan --quick .\n```\n\nAdd Opencomplai to your own `.pre-commit-config.yaml`\n\nto run the quick scan (or the\nfull compliance gate, once you have a manifest) on every commit:\n\n```\nrepos:\n  - repo: https://github.com/Opencomplai/opencomplai\n    rev: v0.1.2\n    hooks:\n      - id: opencomplai-quick-scan   # discovery only, never fails the commit\n      # - id: opencomplai-check      # full EU AI Act gate — requires system-manifest.json\n```\n\nFull Docker-based deployment is documented in\n[docs/src/deployment/quickstart.md](/Opencomplai/opencomplai/blob/main/docs/src/deployment/quickstart.md).\n\nWe are currently in a **Closed Beta Pilot**. If you are an AI engineer or ML platform lead, we want your feedback.\n\n— discuss EU AI Act workflows, pipeline integration, and stress-test the engine with other MLOps engineers[Join our Developer Discord](https://discord.gg/egjX5JgQJ)[Report a bug](https://github.com/Opencomplai/opencomplai/issues/new?template=bug_report.md)·[Request a feature](https://github.com/Opencomplai/opencomplai/discussions/new?category=ideas)[LinkedIn](https://www.linkedin.com/company/opencomplai)·[Reddit research community](https://www.reddit.com/user/akin_opencomplai/m/opencomplai_research/)\n\nNot sure whether the EU AI Act applies to your system, or which obligations you carry as a provider versus a deployer? Use the interactive [EU AI Act Checker](https://docs.opencomplai.com/getting-started/eu-ai-act-checker/) — a browser-based wizard covering scope, high-risk classification, GPAI, and obligations. No account needed. Or run it locally:\n\n```\nopencomplai checker --web          # opens the hosted docs page\nopencomplai checker --web --local  # serves a self-contained copy offline\n```\n\n| Component | Kind | Responsibility |\n|---|---|---|\n| core | package | Risk assessment primitives and policy mapping logic (no HTTP). |\n| cli | package | Command-line interface that runs local checks and orchestrates workflows. |\n| sdk-python | package | Python SDK that wraps the core and provides a stable integration surface. |\n| gateway-api | service | HTTP entrypoint for multi-service deployments; request validation and routing. |\n| risk-engine | service | Risk classification execution and rules evaluation as a service. |\n| evidence-vault | service | Evidence storage with immutability guarantees and content-addressed artifacts. |\n| doc-generator | service | Dossier/document generation (e.g. Annex IV-style outputs) from stored evidence. |\n| egress-proxy | service | Allowlisted egress enforcement for controlled external connectivity. |\n\n```\nopencomplai/\n├── packages/\n│   ├── core/              # Risk assessment engine — Python, Pydantic v2, no HTTP\n│   ├── cli/               # CLI tool — Typer + Rich, calls core or gateway-api\n│   └── sdk-python/        # Python SDK — pip-installable, wraps core\n├── services/\n│   ├── gateway-api/       # REST API — Node.js + TypeScript + Fastify (OpenAPI-first)\n│   ├── risk-engine/       # Risk classification service — Python + FastAPI\n│   ├── evidence-vault/    # Immutable ledger + CAS — Python + FastAPI + PostgreSQL\n│   ├── doc-generator/     # Annex IV dossier generator — Python + FastAPI\n│   └── egress-proxy/      # Allowlisted egress enforcer — Python + FastAPI\n├── tools/\n│   └── verify-ledger/     # Evidence ledger chain verification tool\n├── infra/\n│   ├── docker/            # Dockerfiles (one per service)\n│   ├── compose/           # Docker Compose reference deployment + .env.example\n│   └── migrations/        # Alembic database migrations\n├── docs/                  # MkDocs documentation (published via GitHub Actions)\n├── examples/              # Working code examples\n├── scripts/               # bootstrap.sh, doctor.py, verify-sbom.sh\n└── .github/\n    ├── workflows/         # GitHub Actions CI workflows\n    ├── ISSUE_TEMPLATE/\n    └── pull_request_template.md\n```\n\nOpencomplai is open-core:\n\n**Community Edition**— this repository, licensed under** AGPL-3.0**. The full risk assessment engine, CLI, SDK, services, and EU AI Act checker.** Enterprise Edition**— a hosted premium dashboard, single sign-on, additional rule engines, and commercial support, available under a commercial licence. See[opencomplai.com](https://opencomplai.com)for details.\n\nSee [CONTRIBUTING.md](/Opencomplai/opencomplai/blob/main/CONTRIBUTING.md) for development setup, workflow conventions, and code\nstyle. Look for issues labelled `good first issue`\n\nto find starter-sized contributions. All\ncontributors sign the [Contributor Licence Agreement](/Opencomplai/opencomplai/blob/main/CLA.md).\n\nOpencomplai's classification logic is fully deterministic and rule-based. No LLM or ML inference is used in production.\n\nAll dependency files are scanned in CI to enforce this policy. See\n[docs/security/ai-inventory.md](/Opencomplai/opencomplai/blob/main/docs/security/ai-inventory.md) for the full inventory and\nthe process for approving future AI dependencies.\n\nOpencomplai Community Edition is licensed under the GNU Affero General Public Licence v3.0\n(AGPL-3.0) — see [LICENSE](/Opencomplai/opencomplai/blob/main/LICENSE). For use cases that the AGPL does not fit, a commercial\nlicence is available as part of the Enterprise Edition; contact us via\n[opencomplai.com](https://opencomplai.com).", "url": "https://wpnews.pro/news/show-hn-opencomplai-open-source-eu-ai-act-compliance-checks-in-ci-cd", "canonical_source": "https://github.com/opencomplai/opencomplai", "published_at": "2026-08-14 09:29:23+00:00", "updated_at": "2026-08-14 09:41:03.216550+00:00", "lang": "en", "topics": ["ai-policy", "developer-tools", "ai-tools", "mlops"], "entities": ["OpenComplAI", "Opencomplai", "EU AI Act", "GitHub", "GitLab", "NIST RMF", "ISO", "Discord"], "alternates": {"html": "https://wpnews.pro/news/show-hn-opencomplai-open-source-eu-ai-act-compliance-checks-in-ci-cd", "markdown": "https://wpnews.pro/news/show-hn-opencomplai-open-source-eu-ai-act-compliance-checks-in-ci-cd.md", "text": "https://wpnews.pro/news/show-hn-opencomplai-open-source-eu-ai-act-compliance-checks-in-ci-cd.txt", "jsonld": "https://wpnews.pro/news/show-hn-opencomplai-open-source-eu-ai-act-compliance-checks-in-ci-cd.jsonld"}}