OpenComplAI：面向 AI 流水线的合规即代码工具

OpenComplAI: Compliance-as-Code for AI Pipelines

Stop manual audits → Start shipping.

OpenComplAI brings AI compliance directly into your CI/CD pipeline, turning fragmented legal mandates into automated, machine-readable "Pre-Ship Checks." The EU AI Act is evaluated natively; NIST AI RMF 1.0 is derived from the same evidence.

Demo

Watch the full narrated walkthrough (MP4) — the GIF above is the 30-second zero-setup scan; the MP4 is the deeper narrated tour.

Traditional GRC tools are disconnected dashboards that create "velocity tax." We shift compliance left:

Prevent Non-Compliance: Gate releases by blocking builds that violate safety rules.
Automated Evidence: opencomplai check writes compliance-artifact.json with evidence hashes for every run; it is signed only when you pass --sign and a local signing key exists.
Frameworks Side by Side: Assess one system against the EU AI Act and NIST AI RMF 1.0 side by side (compliance_targets in the manifest, or opencomplai gaps --target EU_AI_ACT --target NIST_AI_RMF). The EU AI Act is evaluated natively; NIST AI RMF is re-projected per subcategory from that same EU AI Act evidence through a built-in crosswalk, with no scanner of its own (see NIST AI RMF). ISO/IEC 42001 is a native pack of attestation rows that read Unverified until you record an attestation under framework_inputs (--target ISO_IEC_42001). DORA and EBA are mapped only: gaps --map-to DORA|EBA adds a low-confidence citation per EU AI Act article (see Mapped regimes). Standing line: EU AI Act evaluated; NIST AI RMF derived (partial, unreviewed); ISO 42001 native pack, attestation-led (partial, unreviewed); DORA and EBA mapped only. See Frameworks.

Who it is for

Teams that build, fine-tune or substantially modify AI systems and need a per-release EU AI Act check in CI. It is not a GRC platform or an eval tool; it runs beside them and stays offline unless you run opencomplai push. See Works alongside other tools.

How It Works (The 3-Minute Setup)

Define: Create a compliance manifest for your model.
Integrate: Copy the ready-made GitHub Actions/GitLab CI workflow into your pipeline, or use the GitHub Action for a sticky pull request comment.
Ship: Get an automated "Pass/Fail" result before your code ever hits production.

Check out our Dummy Repo (Sandbox) – Five fictional systems, one per gate outcome (exit codes 3, 4, 1, 1, 0). Illustrative sandbox, not legal advice. It does not scan code.

Core Components

opencomplai-core: The rule engine that evaluates controls.
opencomplai-cli: Run checks locally in your dev environment.
opencomplai: The Python SDK for embedding compliance into your own tooling — and the package pip install opencomplai actually installs. It depends on opencomplai-core and opencomplai-cli, so a single pip install opencomplai pulls in the whole stack (rule engine, CLI, and SDK) in one go.

Quick Start

Get your first compliance check running in under 15 minutes:

pip install opencomplai

This installs the CLI, core rule engine, and SDK with a stable API contract (see CHANGELOG for exit-code and artifact-schema guarantees).

opencomplai init --system-id my-model --intended-purpose "customer support chatbot"
opencomplai check

That's the local loop. For the full path — CI gate, optional dashboard push, pre-commit hook, and self-hosted Docker Compose — see the Deployment Journey.

opencomplai scan inventories files via a repo-root .ocignore (not .gitignore), bootstrapped once from .gitignore on first scan unless you pass --no-ocignore-bootstrap. opencomplai check --scan bootstraps and uses it the same way; plain opencomplai check never touches it. See .ocignore scan configuration.

Community & Feedback

OpenComplAI is free to use today — opencomplai scan --quick and the EU AI Act Checker below both work with zero setup. We're actively building with early adopters and want your feedback.

Join our Developer Discord — discuss EU AI Act workflows, pipeline integration, and stress-test the engine with other MLOps engineers
Report a bug · Request a feature
LinkedIn · Reddit research community

EU AI Act Checker

Not sure whether the EU AI Act applies to your system, or which obligations you carry as a provider versus a deployer? Use the interactive EU AI Act Checker — a browser-based wizard covering scope, high-risk classification, GPAI, and obligations. No account needed. Or run it locally:

opencomplai checker --web          # opens the hosted docs page
opencomplai checker --web --local  # serves a self-contained copy offline

Persistent control register & honest Annex IV documentation

Beyond the per-run pass/fail gate, Opencomplai maintains a persistent control register (requires an evidence vault): one control per EU AI Act article, tracked across runs with an owner, an evidence-freshness TTL, and a state (satisfied / evidence_missing / evidence_stale / pending_review / waived). opencomplai controls status gives you a CI-consumable summary of exactly what's missing or gone stale.

The Annex IV dossier generated by opencomplai docs generate never claims more than the code actually does: every field is either automated from your manifest and risk classification, wired evidence loaded from a real scan/eval report, or an explicit provider-attestation placeholder when nobody has supplied it yet. Opencomplai assembles supporting evidence — it does not certify that you are compliant, and a dossier still carrying placeholders for a HIGH-risk system fails the release gate rather than being presented as complete. See Controls Lifecycle and the Annex IV Coverage Ledger for the full breakdown.

Architecture overview

Component	Kind	Responsibility
core	package	Risk assessment primitives and policy mapping logic (no HTTP).
cli	package	Command-line interface that runs local checks and orchestrates workflows.
sdk-python	package	Python SDK that wraps the core and provides a stable integration surface.
gateway-api	service	HTTP entrypoint for multi-service deployments; request validation and routing.
risk-engine	service	Risk classification execution and rules evaluation as a service.
evidence-vault	service	Evidence storage with immutability guarantees and content-addressed artifacts.
doc-generator	service	Dossier/document generation (e.g. Annex IV-style outputs) from stored evidence.
egress-proxy	service	Allowlisted egress enforcement for controlled external connectivity.

Repository layout

opencomplai/
├── packages/
│   ├── core/              # Risk assessment engine — Python, Pydantic v2, no HTTP
│   ├── cli/               # CLI tool — Typer + Rich, calls core or gateway-api
│   └── sdk-python/        # Python SDK — pip-installable, wraps core
├── services/
│   ├── gateway-api/       # REST API — Node.js + TypeScript + Fastify (OpenAPI-first)
│   ├── risk-engine/       # Risk classification service — Python + FastAPI
│   ├── evidence-vault/    # Immutable ledger + CAS — Python + FastAPI + PostgreSQL
│   ├── doc-generator/     # Annex IV dossier generator — Python + FastAPI
│   └── egress-proxy/      # Allowlisted egress enforcer — Python + FastAPI
├── tools/
│   └── verify-ledger/     # Evidence ledger chain verification tool
├── infra/
│   ├── docker/            # Dockerfiles (one per service)
│   ├── compose/           # Docker Compose reference deployment + .env.example
│   └── migrations/        # Alembic database migrations
├── docs/                  # MkDocs documentation (published via GitHub Actions)
├── examples/              # Working code examples
├── sync/                  # bootstrap.sh, doctor.py, verify-sbom.sh, demo seed/reset scripts
├── scripts/               # generate_principle_docs.py
└── .github/
    ├── workflows/         # GitHub Actions CI workflows
    ├── ISSUE_TEMPLATE/
    └── pull_request_template.md

Editions

Opencomplai is open-core:

Community Edition — this repository, licensed under AGPL-3.0. The full risk assessment engine, CLI, SDK, services, and EU AI Act checker.
Enterprise Edition — a hosted premium dashboard and commercial support, available under a commercial licence. See opencomplai.com for details.

Contributing

See CONTRIBUTING.md for development setup, workflow conventions, and code style. Look for issues labelled good first issue to find starter-sized contributions. All contributors sign the Contributor Licence Agreement.

Maintainers

OpenComplAI is currently maintained by @OpenComplaiCTO. Pull requests are typically reviewed within a few business days — if you haven't heard back after a week, ping the PR directly or ask in GitHub Discussions.

AI use

The core rule engine (packages/core) and CLI are fully deterministic and rule-based — no LLM or ML inference. An optional packages/ai plugin adds intent classification (a deterministic code-signal matcher, plus an optional [deep] extra for local GGUF LLMs via llama-cpp-python, which are the only local model inference); it is not installed or used unless a maintainer or contributor explicitly opts in.

pyproject.toml, package.json, and requirements*.txt files are scanned in CI for unapproved AI/LLM packages (excluding tests/, examples/, fixtures/, node_modules/, .venv/, and dist/ paths). See docs/security/ai-inventory.md for the full inventory and the process for approving future AI dependencies.

Licence

Opencomplai Community Edition is licensed under the GNU Affero General Public Licence v3.0 (AGPL-3.0) — see LICENSE. For use cases that the AGPL does not fit, a commercial licence is available as part of the Enterprise Edition; contact us via opencomplai.com.