EU AI Act compliance scanning for CI/CD pipelines.

Systima Comply analyses your codebase for AI framework usage, validates your risk classification against the EU AI Act, checks obligation compliance, and reports findings directly in pull requests. Think of it as Snyk for AI regulation.

Systima Comply is an engineering tool, not legal advice. It does not replace professional regulatory assessment.

• AI framework detection: 37+ frameworks across Python and TypeScript/JavaScript (OpenAI, Anthropic, LangChain, scikit-learn, face_recognition, and more)
• Risk classification validation: Validates declared risk levels against detected frameworks; flags mismatches (e.g. biometric processing in a "limited-risk" system)
• Obligation compliance checking: Per-article checks for Articles 5, 9, 10, 11, 12, 13, 14, 27, and 50
• Call-chain analysis: Traces AI API call return values through your code to detect regulated decision patterns
• Annex III domain detection: Identifies when AI output flows into employment, credit, insurance, education, law enforcement, or other regulated domains
• PR comments: Well-formatted GitHub PR comments with obligation tables, findings, and remediation links
• Multiple output formats: GitHub PR comment, JSON, SARIF (for GitHub Code Scanning), Markdown
• Baseline diffing: Track compliance posture over time; see what changed in each PR
• Zero external dependencies: No API calls, no telemetry, no data exfiltration. Runs entirely locally.
• Deterministic: Same codebase + same config = identical results every time. No LLM calls, no probabilistic analysis.

# Scan your codebase
npx @systima/comply scan

# Initialise a configuration file
npx @systima/comply init

# Generate a compliance report
npx @systima/comply report --out COMPLIANCE_REPORT.md

# .github/workflows/comply.yml
name: EU AI Act Compliance
on:
  pull_request:
    types: [opened, synchronize, reopened]
permissions:
  contents: read
  pull-requests: write
  security-events: write
jobs:
  compliance:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: systima-ai/comply@v1
        with:
          fail-on: warning
          output-format: all
      - uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: comply-results.sarif

Create a .systima.yml file in your repository root. Run npx @systima/comply init to generate one interactively, or create it manually:

version: "1"

organisation:
  name: "Acme Corp"
  eu_presence: true
  operator_role: provider     # provider | deployer | both

systems:
  - id: loan-assessor
    name: "Loan Assessment Engine"
    description: "ML model scoring loan applications for creditworthiness"
    scope:
      paths:
        - src/lending/**
      exclude:
        - src/lending/tests/**
    classification:
      risk_level: high
      annex_iii_category: "5b"   # Creditworthiness assessment
      rationale: "Automated credit scoring affecting natural persons"
    regulations:
      - eu_ai_act
      - gdpr
    documentation:
      risk_management: docs/lending/risk-management.md
      data_governance: docs/lending/data-governance.md
      technical_docs: docs/lending/technical-documentation.md
      transparency: docs/lending/transparency-notice.md
      human_oversight: docs/lending/human-oversight-protocol.md

  - id: support-chatbot
    name: "Customer Support Chatbot"
    scope:
      paths: [src/chatbot/**]
    classification:
      risk_level: limited
      rationale: "AI chatbot interacting with users; transparency obligations"
    documentation:
      transparency: docs/chatbot/ai-disclosure.md

Detects biometric processing frameworks (face_recognition, deepface, insightface) that may indicate prohibited uses: untargeted facial recognition scraping, biometric categorisation for protected attributes, or workplace/education emotion recognition.

For high-risk systems, checks documentation existence and completeness for:

• Flags biometric frameworks in systems declared as limited or minimal risk
• Detects undeclared AI systems outside any configured scope
• Suggests Annex III categories based on domain analysis of code paths

Traces AI API call return values through assignments, destructuring, and property access chains to detect:

• Conditional branching on AI output (automated decision-making)
• Database persistence of AI classifications (scoring of natural persons)
• UI rendering without AI disclosure (Article 50 gap)
• Downstream API calls with AI output (integration into regulated decision chain)

import { scan, formatGitHubPRComment, formatJsonReport } from '@systima/comply'

const result = await scan({
  path: '/path/to/repo',
  scanMode: 'full',
  outputFormat: 'json',
  failOn: 'critical',
  verbose: false,
})

// Access scan results programmatically
console.log(result.summary.overallComplianceScore)
console.log(result.summary.findingsBySeverity)

// Format as GitHub PR comment
const comment = formatGitHubPRComment(result)

// Format as JSON report
const json = formatJsonReport(result)

Comply detects 37+ AI/ML frameworks across Python and TypeScript/JavaScript:

Comply works alongside Systima's other open-source EU AI Act compliance tools:

• @systima/aiact-audit-log: Article 12 compliant structured, tamper-evident audit logging. Comply detects whether it is installed and configured.

Contributions are welcome. Please open an issue first to discuss what you would like to change.

git clone https://github.com/systima-ai/comply.git
cd comply
pnpm install
pnpm build
pnpm test

packages/
  core/           # @systima/comply npm package + CLI
    src/
      scanner/    # File walker, import/dependency/config scanners
      classifier/ # Risk classification validation, domain detection
      tracer/     # Call-chain analysis, sink detection
      obligations/# Obligation check functions per EU AI Act article
      reporters/  # Output formatters (PR comment, JSON, SARIF, Markdown, badge)
      diff/       # Baseline comparison engine
      config/     # .systima.yml schema and loader
      knowledge/  # Framework patterns, Annex III, obligation mappings
  action/         # GitHub Action wrapper
knowledge/        # Regulatory knowledge base (JSON)
  eu-ai-act/      # Articles, Annex III, obligations, deadlines
  frameworks/     # AI framework detection patterns
examples/         # Reference .systima.yml configurations

Apache 2.0. See LICENSE.

Built by Systima, an agentic AI consultancy for regulated industries.