ComplianceLint

Compliance in your IDE. Not in a meeting.

From EU AI Act code to audit-ready evidence — in one workflow, inside the tools you already use.

Scan, attest, and document EU AI Act compliance without leaving your IDE. The scanner catches code-verifiable violations; Human Gates capture human attestations (with AI-assisted evidence collection along the way) — all with audit trail. ComplianceLint never receives your code.

EU AI Act application dates (Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, consolidated text of 2026-07-27):

• 2025-02-02 — Chapters I and II apply, except Art. 5(1), first subparagraph, points (ba) and (bb), and Art. 5(1a) and (1b), which apply from 2026-12-02
• 2025-08-02 — Chapter III Section 4, Chapters V, VII and XII and Art. 78 apply (except Art. 101)
• 2026-08-02 — General application date: all provisions not listed under another date apply
• 2026-12-02 — Art. 5(1), first subparagraph, points (ba) and (bb) and Art. 5(1a) and (1b) apply; Providers of AI systems generating synthetic audio, image, video or text content placed on the market before 2 August 2026 must comply with Art. 50(2)
• 2027-12-02 — Chapter III Sections 1-3 (except Art. 6(5)) apply to Annex III high-risk AI systems
• 2028-08-02 — Chapter III Sections 1-3 (except Art. 6(5)) apply to Annex I high-risk AI systems

Track current status in-app: compliancelint.dev/dashboard/regulations/eu-ai-act.

Note: ComplianceLint is a compliance engineering tool, not a law firm. It gives you a structured, evidence-based path toward compliance — but final legal decisions should always involve qualified legal counsel.

See it in action

Watch the overview (1:37): one demo project, a credit-scoring API, from setup to the export pack. Each step in its own short video:

Step	Video
1. Install the scanner in your AI coding assistant	0:38
2. Connect the project to the dashboard	0:43
3. Company profile: the SME size test and the Article 99 fine caps	0:49
4. Profiling Wizard: role first, the risk class follows from the answers	1:34
5. Scan and sync: your assistant reads the code, ComplianceLint never receives it	1:09
6. Findings and tasks, with the text of the law and the application dates	1:02
7. Human Gates: what code alone cannot settle needs a person's answer	0:35
8. Compliance All-in-One Pack: one zip for your legal counsel or auditor	1:09

All videos, with their transcripts, on one page: compliancelint.dev/videos · this series as a YouTube playlist.

Walkthrough: fixing an AI chatbot, from findings to evidence

Watch the overview (1:29): a fictional customer-support chatbot that is not high-risk, taken from its first scan to the Compliance Pack under Article 50 (transparency), Article 4 (AI literacy) and Article 5. One point stays open for review, with its reason and a review date.

Episode	Video
1. The first scan: three open Article 50 findings, and a to-do list	3:46
2. Article 50(1): tell people they are chatting with an AI	3:32
3. AI images: marked, checked and labelled	2:15
4. AI-generated text: what is marked, and what stays open	3:05
5. AI-written press releases and the Human Gate	2:29
6. Article 4 AI literacy and prohibited practices under Article 5	2:47
7. The record: the Compliance Pack and the open Article 50(2) point	1:58

Also as a YouTube playlist.

Walkthrough: preparing a high-risk recruiting AI

Watch the overview (1:12): a fictional recruiting AI, high-risk under Annex III, point 4(a), and not yet on the market, being prepared for the EU AI Act: an emotion-recognition feature removed, logs and human oversight, bias safeguards, the documents, and a record of what is still open before launch. It ends with a plan, not with a declaration of conformity.

Episode	Video
1. The first scan: high-risk under Annex III, and no Article 6(3) exemption	1:15
2. Article 5(1)(f): removing emotion recognition from a recruiting AI	1:40
3. High-risk classification: the Profiling Wizard and the readiness view	1:49
4. Articles 12 and 14: event logs and human oversight	2:24
5. Log retention and Article 10 bias safeguards	3:22
6. Articles 9 and 13: risk management, instructions for use, Human Gates	1:55
7. The record: what is still open before launch	2:05

Also as a YouTube playlist.

Walkthrough: using a high-risk recruiting AI as an employer

Watch the overview (1:11): a fictional employer prepares to use the recruiting AI of the previous series, before first use. A scan of its own integration code finds problems that are the employer's to fix; the Profiling Wizard sets the role: a deployer of a high-risk system and, as a private employer that does not provide public services, outside the fundamental rights impact assessment of Article 27. It ends with a documented plan, not a statement of compliance.

Episode	Video
1. The first scan as the employer	2:31
2. Article 25: when a deployer can become the provider	1:50
3. The role of a private employer: deployer, high-risk, no Article 27 FRIA	2:33
4. Article 26(2): a person decides, and is trained for it	1:18
5. Article 26: input data, logs and monitoring	2:01
6. Telling people: candidates, the works council, explanations	1:58
7. The record: a documented plan before first use	2:02

Also as a YouTube playlist.

Try the live demo at compliancelint.dev/demo — pre-loaded with three AI systems (a chatbot that is not high-risk but has an Article 50 transparency trigger, a high-risk finance system, a high-risk medical system) so you can browse a real scan, attestation flow, and Compliance Journey trend without setting up a project of your own.

Dashboard

Track compliance across all your AI systems. Export audit-ready PDF reports.

Documentation

Full user manual at compliancelint.dev/docs — 35 chapters covering setup, daily use, persona-specific reference (Provider / Product Manufacturer / Deployer / Importer / Distributor / Authorised Representative), and troubleshooting.

---

Who Needs This

• AI product teams — building chatbots, recommendation engines, content generation, or any AI-powered feature
• Solo developers & founders — shipping AI products and need to know if they comply before enforcement begins
• CTOs & engineering leads — need compliance visibility without hiring a legal team
• Compliance officers — want code-level evidence, not just checkbox questionnaires

If your software uses AI and you serve EU customers, the EU AI Act applies to you.

---

Quick Start

Prerequisites: Python 3.10+ is required.

Option A: npx (recommended)

npx compliancelint init

Auto-detects your environment, installs dependencies, and configures everything. Then reload your IDE window.

Option B: pip install

pip install compliancelint
python -m scanner.cli init

After setup, reload your IDE window so it picks up the new MCP server, then ask:

"Scan my project for EU AI Act compliance."

No extra API key needed — uses your existing AI subscription.

Connect for full scanning (free)

"Connect to ComplianceLint dashboard."

Opens browser, links your scanner to compliancelint.dev with a free account. Free sign-up enables full scanning — the 5 detection-related fields (detection_method, what_to_scan, confidence, human_judgment_needed, rationale) live SaaS-side and are fetched per article at scan time. Until your scanner is connected to the dashboard, it runs in degraded mode: obligation list + automation level browsable, but no detection logic. The BSL source remains usable as an obligation browser; sign-up unlocks the methodology layer.

Track over time (optional, paid tiers)

"Sync my compliance results."

Uploads findings to your dashboard. ComplianceLint never receives your code: your source files are not uploaded — only compliance findings with their evidence notes, evidence submissions, remediation progress, and attestation records are synced. This builds an auditable compliance trail that demonstrates your ongoing compliance efforts to regulators and legal counsel.

---

What You Get

Art. 12 — Record-keeping                            NON-COMPLIANT

┌──────────────┬────────────┬──────────────────────────────────────────┐
│ Obligation   │ Status     │ Description                              │
├──────────────┼────────────┼──────────────────────────────────────────┤
│ ART12-OBL-1  │ COMPLIANT      │ Logging detected (structlog)         │
│ ART12-OBL-2a │ NON_COMPLIANT  │ Risk event logging not found         │
│ ART12-OBL-4  │ NON_COMPLIANT  │ No retention policy documented       │
│ ART12-OBL-3a │ NOT_APPLICABLE │ Not a biometric system               │
└──────────────┴────────────┴──────────────────────────────────────────┘

Legal citation: Art. 12(1): "High-risk AI systems shall technically allow
for the automatic recording of events (logs)..."

Every finding includes:

• Exact legal citation — verbatim from EUR-Lex
• Obligation ID — traceable to our structured obligation database
• AI evidence — what the AI found (or didn't find) in your code
• Remediation steps — how to fix it

---

From Non-Compliant to Compliant

ComplianceLint doesn't just find problems — it helps you fix them.

1. Get a remediation plan

"Give me an action plan to fix my compliance issues."

The AI generates a prioritized plan with effort estimates — what to fix first, what code to change, and what documentation to add.

2. Fix and re-scan

Make the changes, then scan again. ComplianceLint tracks what improved and what's still open.

3. Record evidence

"I've fixed the logging issue. Please re-check and update the finding."

The AI verifies your fix, updates the finding status, and records who made the change and when — ready for auditors.

4. Track your journey

Each scan is a snapshot. Over time, your dashboard shows the full compliance journey — from first scan to fully compliant. Export a PDF for your auditor or investor at any point.

---

Dashboard

Track compliance over time at compliancelint.dev:

• Compliance Journey — visualize progress from non-compliant to compliant over time
• Findings by article — bar chart of issues per EU AI Act article
• Tasks — prioritized remediation to-do list with severity and effort estimates
• Scan History — full audit trail of every scan, with diff between consecutive scans
• Audit-ready PDF exports — every PDF carries verbatim EUR-Lex citations + obligation IDs:
  • Declaration of Conformity (Art. 47, Annex V) — provider attestation document for high-risk AI systems
  • Technical Documentation (Art. 11, Annex IV §1–§8) — full system dossier covering data governance, risk management, accuracy / robustness, post-market monitoring
  • Per-article Compliance PDF — one per attested article, generated after Save with all findings + evidence + Human Gate answers for that article
  • Compliance Journey PDF — visual progress export for stakeholders, investors, or board reporting
  • Compliance All-in-One Pack ZIP (Business+) — audit-grade snapshot bundling all of the above plus an embedded offline HTML viewer that mirrors the live dashboard
• Attestation — record human review decisions with evidence directly in the dashboard, or ask your AI to submit evidence via natural-language conversation
• Evidence stays in your repo — upload files from the dashboard; bytes commit to .compliancelint/evidence/ in your git repo. We relay transiently, never hold your files.
• Profiling Wizard — role-first questions that follow the EU's official AI Act Compliance Checker: what is assessed, your role(s), scope (Art. 2), prohibited practices (Art. 5), high-risk classification (Annex I, Annex III, Art. 6(3)), transparency (Art. 50), general-purpose AI model. The risk class is concluded from your answers; filters the 255-obligation matrix down to the ones that actually apply to you
• Human Gates — guided questionnaires for obligations that need human judgment (FRIA, Art. 14 human oversight, Art. 26(7) worker notifications); each answer saved as attestation evidence with full audit trail
• Penalty Exposure — live € estimate per non-compliant finding using Art. 99 caps (€35M or 7% turnover for Art. 5 prohibitions; €15M or 3% for high-risk violations); applies the Art. 99(6) SME min-fine formula for microenterprise / small / medium organisations
• Role-based filtering — Provider / Product Manufacturer / Deployer / Importer / Distributor / Authorised Representative; combined with Art. 2 carve-outs auto-narrows the obligation set so you don't see noise from articles that don't apply

"Connect to ComplianceLint dashboard and sync my scan results."

---

Human Oversight (design principle)

ComplianceLint is designed with human oversight at every stage:

1. Human initiates scans — the AI never scans autonomously; the user explicitly requests each scan
2. Human reviews findings — all findings are presented for human judgment before any action
3. Human submits evidence — users acknowledge, rebut, defer, or provide evidence for any finding via natural-language conversation with their AI (which invokes cl_update_finding on their behalf)
4. Human controls sync — scan results are only uploaded to the dashboard when the user explicitly asks the AI to sync
5. No autonomous decisions — ComplianceLint never makes compliance determinations without human review

The user can stop any MCP tool call at any time by pressing Stop in their IDE.

This is the architectural principle — distinct from Human Gates in the Dashboard section above, which are guided questionnaires for specific EU AI Act obligations (FRIA, Art. 14 oversight, Art. 26(7) worker notifications). Human Oversight here means AI never acts compliance-decisively without your approval; Human Gates is the dashboard feature that captures your judgment for obligations the scanner can't determine from code alone.

---

Why ComplianceLint

	Other tools	ComplianceLint
Method	Check if RISK_MANAGEMENT.md exists	AI reads entire codebase, checks against 255 decomposed legal obligations
Citations	"You need logging"	Art. 12(1): "High-risk AI systems shall technically allow for the automatic recording of events..."
False positives	Keyword matching → many	AI understands context → fewer than keyword matching
Privacy	Cloud upload	ComplianceLint never receives your code — it is read by the AI assistant you already use; only findings and their evidence notes sync to your dashboard
Cost	Separate subscription	Free + source-available (BSL 1.1) — uses your existing AI IDE

---

"Can't I just ask Claude / ChatGPT to check my compliance?"

You can ask any AI to review your code. But here's the difference:

	AI chat (Claude, ChatGPT, etc.)	ComplianceLint
Legal structure	"You probably need logging" — vague, based on general knowledge	255 specific obligations decomposed from actual EU AI Act articles
Consistency	Ask twice, get two different answers	Deterministic engine — same code, same result, every time
Completeness	AI decides what to check (and what to skip)	Every obligation is checked — nothing is missed
Citations	May hallucinate article numbers	Every finding traced to verbatim EUR-Lex source text
Evidence trail	Chat transcript (not audit-ready)	Per-obligation findings with timestamps and attestation records
Progress tracking	Start from scratch every conversation	Persistent history — scan today, compare with last month
Team visibility	Stuck in one person's chat window	Dashboard for your whole team (PMs, lawyers, auditors)

ComplianceLint uses your AI too — Claude, GPT, or any AI reads the code. But instead of relying on the AI's general knowledge of the law, your answers go through a verified obligation engine built from the actual legal text. The AI is the eyes. The engine is the brain.

---

Coverage

EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744) — 46 articles, 255 obligations:

Article	Topic	Obligations
Art. 4	AI literacy	1
Art. 4a	Special categories of personal data for bias detection (permissions only)	2
Art. 5	Prohibited AI practices	10
Art. 6	Risk classification	8
Art. 8	Compliance with requirements	2
Art. 9	Risk management system	19
Art. 10	Data governance	10
Art. 11	Technical documentation	9
Art. 12	Record-keeping (logging)	11
Art. 13	Transparency	4
Art. 14	Human oversight	6
Art. 15	Accuracy & robustness	8
Art. 16	Provider obligations	12
Art. 17	Quality management system	16
Art. 18	Documentation keeping	2
Art. 19	Automatically generated logs	3
Art. 20	Corrective actions	3
Art. 21	Cooperation with authorities	2
Art. 22	Authorised representatives	4
Art. 23	Obligations of importers	8
Art. 24	Obligations of distributors	8
Art. 25	Value chain responsibilities	7
Art. 26	Deployer obligations	11
Art. 27

All obligations verified against EUR-Lex source text. The table has 258 rows for 255 obligations: three records (ART19-OBL-1b, ART19-OBL-2, ART26-OBL-6) are listed under two articles.

What the 255 counts. The 255 are 207 obligations and 12 prohibitions, plus 36 related provisions that decide whether and how they apply: permissions, exceptions, classification rules and similar clauses. 13 of them are addressed to the Commission or to notified bodies and never appear as your tasks.

Why 46 of the Act's articles? The EU AI Act, as amended by Regulation (EU) 2026/1744, contains Articles 1-113 plus six inserted articles (Art. 4a, 60a, 75a-75d), for 119 articles in the consolidated text. ComplianceLint currently covers 46 selected articles with operator-facing compliance requirements, permissions or related procedures. This is a product-scope selection, not an exhaustive statement that only those 46 articles can create operator obligations or permissions.

Not all 46 articles apply to every project. The applicable obligations depend on the role(s) you state (provider, product manufacturer, deployer, importer, distributor, authorised representative) and on the risk class concluded from your Profiling Wizard answers. Run the Profiling Wizard in the dashboard for accurate scoring.

---

MCP Tools

Tool	Purpose
cl_scan	Scan article(s) — cl_scan(regulation="eu-ai-act", articles="12") or articles="all"
cl_scan_all	Scan all articles in a regulation at once (summary report)
cl_analyze_project	Understand project structure before scanning
cl_explain	Plain-language explanation of any article
cl_action_plan	Prioritized remediation plan with effort estimates
cl_update_finding	Submit evidence, rebuttals, acknowledgements
cl_update_finding_batch	Batch-update multiple findings at once
cl_get_ai_observation	Fetch the AI's prior observation for an obligation (read-back of what your IDE AI told the dashboard last scan)
cl_verify_evidence	Verify submitted evidence
cl_interim_standard	Generate interim compliance standard for an article
cl_connect	Link to dashboard (browser OAuth)
cl_sync	Upload scan results to dashboard
cl_disconnect	Remove dashboard connection (preserves local data)
cl_delete	Delete with scope — target="local" (scan cache only, preserves evidence + rc), target="all" (local + evidence + rc), target="dashboard" (server-side purge) — all require explicit confirm=true
cl_action_guide	Get guidance for Human Gate obligations (directs to dashboard)
cl_check_updates	Enforcement deadlines and regulation status
cl_version	Show ComplianceLint version
cl_report_bug	Generate privacy-scrubbed bug-report bundle for GitHub issues

All scanning tools accept a regulation parameter (default: "eu-ai-act"), designed to support multiple regulations as they are added.

Auto-discoverable — zero-config setup

Point any MCP-compatible client at compliancelint.dev and it auto-detects our MCP server via the standard discovery endpoint:

https://compliancelint.dev/.well-known/mcp/server-card.json

Returns server metadata, tool catalogue, transport types, and auth flow — the same pattern OAuth uses (/.well-known/oauth-authorization-server). Implementation per SEP-2127.

No manual JSON config required for clients that support discovery (Claude Desktop, Claude Code, Cursor, Windsurf, Cline, ChatGPT, Goose). Verify the endpoint yourself:

curl https://compliancelint.dev/.well-known/mcp/server-card.json | jq .

---

Project Structure

scanner/
├── server.py                 MCP Server entry point
├── core/
│   ├── obligation_engine.py  Obligation-driven analysis
│   ├── context.py            AI-to-scanner bridge
│   ├── config.py             Project configuration
│   └── state.py              Scan persistence + project identity
├── modules/                  Per-article scanning modules
├── obligations/              Obligation JSONs (structured legal requirements)
└── tests/                    Unit + integration tests

---

Git-native by design

ComplianceLint treats your git repository as the primary evidence store, not our SaaS. Five architectural commitments:

1. Evidence commits to your repo. Bytes land at .compliancelint/evidence/{finding_id}/{filename} — you own them, you can grep them, they survive if we vanish. A sibling manifest.json under the same directory records who uploaded what, when, and at which sha — the audit-trail primary record. Scan cache (state.json, per- article results, baselines) lives in .compliancelint/local/ and is gitignored; only evidence and the .compliancelintrc project binding are committed.

2. MCP never runs git on your behalf. No auto-commit, no auto-push, no auto-revert. Every commit is your decision. If you commit locally without pushing, the next sync waits until you push.

3. Git-host neutral. Works with GitHub, GitLab, Bitbucket, Gitea, Azure DevOps, self-hosted, or a purely local repo. MCP commits locally using your existing git config + SSH agent — no credentials shared with our SaaS. Planned OAuth integration for GitHub and GitLab (post-launch) will offer direct SaaS commits as an opt-in convenience; the MCP path always remains supported.

4. Force-push aware. If you rewrite history and erase an evidence commit, the next sync detects the missing file and flags it on the dashboard (health_status='broken_link'). The forensic record stays — who uploaded, when, at which sha — even after the bytes are gone from git.

5. Snapshot ledger is your integrity anchor. Every scan writes a deterministic hash (sort_keys + UTC ISO + fixed-precision floats) of findings + evidence state. Reproduce on any machine; compare to catch silent mutations. Git history is not the audit trail — the snapshot ledger is.

---

Pricing

The scanner is free and source-available (BSL 1.1). The dashboard is freemium:

	Free	Starter	Pro	Business	Enterprise
Monthly	€0 forever	€29/mo	€99/mo	€199/mo	Custom
Annual (per-month rate · billed yearly)	—	€25/mo · €300/yr (Save €48/yr)	€79/mo · €948/yr	€149/mo · €1,788/yr	—
Projects	1	2	10	Unlimited	Unlimited
Scan history	7 days	Unlimited	Unlimited	Unlimited	Unlimited
PDF reports	Watermarked	Clean	Clean	Clean	Clean
All 255 obligations visible (worst-case)	✓	✓	✓	✓	✓
Penalty display (worst-case Art. 99 caps)	✓	✓	✓	✓	✓
Team members	Unlimited	Unlimited	Unlimited	Unlimited	Unlimited
Scope narrowing — see only obligations applicable to your AI system	—	✓	✓	✓	✓
Risk class concluded from your Profiling Wizard answers (Art. 5 / 6 / 50)	—	✓	✓	✓	✓
SME relief (Art. 11 simplified tech-doc per Recommendation 2003/361/EC)	—	✓	✓	✓	✓
Per-obligation questionnaires (anchor AI answers to verbatim legal text)	—	✓	✓	✓	✓
Art. 2 carve-outs (territorial / military / research / open-source)	—	✓	✓	✓	✓
Penalty configuration (precise — based on your headcount + turnover + balance sheet)	—	✓	✓	✓	✓
Evidence — declarations + pointers (captured: content saved in DB or git)

Evidence stays in your repo. Upload files from the dashboard — bytes commit to .compliancelint/evidence/ in your git repo. We relay transiently. We never hold your files.

Team members are free + unlimited. Invited members inherit the owner's tier — Pro members get Human Gates, Business members get Compliance All-in-One Pack exports. No per-seat billing. All actions are audit-logged with the actor's identity.

---

Roadmap

Shipped

• MCP Server with full EU AI Act tool surface — 46 articles, 255 obligations
• SaaS Dashboard with Compliance Journey tracking
• Audit-ready PDFs — Compliance Journey, Declaration of Conformity (Art. 47), Technical Documentation (Art. 11), per-article evidence packs, and the Compliance All-in-One Pack ZIP
• npx compliancelint init — one-line setup for Claude Code, Cursor, Windsurf, Claude Desktop, ChatGPT (zero-config auto-discovery via SEP-2127)
• Role-based obligation filtering — Provider, Product Manufacturer, Deployer, Importer, Distributor, Authorised Representative
• Profiling Wizard — guided questions about your AI system + organisational role; filters the 255-obligation matrix down to what actually applies to you
• Human Gates — guided questionnaires for obligations that need human judgment (FRIA, Art. 14 oversight, Art. 26(7) worker notifications)
• Evidence trail — attestations, rebuttals, acknowledgements, deferrals with full audit history
• EU AI Act browser at /dashboard/regulations/eu-ai-act — full text of 46 articles + 13 annexes + searchable across 255 obligations (free after sign-up, no credit card)
• Tamper-evident audit trail — deterministic state hashing, evidence health sweeps, cross-OS CI tested (Ubuntu, macOS, Windows × Python 3.10–3.13)

Up next

• OAuth direct-commit — dashboard commits evidence to your cloud git without MCP running (GitHub → GitLab)
• GitHub Marketplace App — discovery + one-click install
• Multi-regulation expansion — same scanner + Human Gates architecture, next regulations prioritised by customer demand. Likely candidates: GDPR, CRA, NIS2, DORA, ISO 27001
• Incremental scanning — only re-scan obligations whose underlying code changed since the last full scan
• Human Gates evidence verifier — AI cross-checks questionnaire answers against source_quote requirements before promoting evidence to COMPLIANT
• Enterprise integrations — OSCAL export, signed All-in-One Pack, SSO / SAML, on-prem (built per engagement)
• MCP Apps — interactive UI widgets inside Claude / Cursor / ChatGPT conversations, per the MCP Apps spec

---

Accuracy & Testing

Metric	Value
Legal obligations covered	255 (from 46 EU AI Act articles)
Test coverage	Unit + integration + e2e (scanner pytest, dashboard Vitest, Playwright)
Archetype test fixtures	Biometric systems to CRUD apps
Test pass rate	100%
Obligation engine	Deterministic — same code, same result, every time
Source quote verification	All quotes verified verbatim against EUR-Lex

All obligation logic is tested against 12 synthetic project archetypes — simulated compliance profiles covering diverse scenarios: open-source biometric libraries, commercial chatbots, medical device AI, military/defense systems, CRUD apps with no AI, research prototypes, deployers using third-party APIs, emotion recognition systems, deepfake generators, fully compliant systems, systems with no answers, and out-of-EU-scope systems. Mutation testing verifies that test assertions are meaningful.

---

Limitations

• Not a legal opinion. ComplianceLint provides AI-assisted compliance assessments, not legal advice. All findings require review by qualified legal counsel.
• AI-dependent scanning. Scan quality depends on the AI model used (Claude, GPT, etc.). The scanner's obligation engine is deterministic, but the AI's code understanding may vary.
• EU AI Act only (currently). Additional regulations are on the roadmap.
• High-risk focus. Many obligations (Art. 9–27) apply primarily to high-risk AI systems. Non-high-risk systems may show NOT_APPLICABLE for those obligations.
• No runtime monitoring. ComplianceLint scans source code and documentation. It does not monitor running AI systems. For ongoing compliance assurance, schedule periodic scans via CI/CD and ask your AI to sync results after each scan to maintain an auditable trail of compliance progress over time.
• English legal citations. Obligation definitions and source quotes are in English (from the official EUR-Lex publication). However, since ComplianceLint runs inside AI-powered IDEs, the AI will naturally converse, explain regulations, and generate reports in your preferred language.

---

License

Business Source License 1.1 — free to use for your own projects. Cannot be used to build a competing hosted compliance scanning service. Converts to Apache 2.0 on 2030-04-11.

---

Contributing

Issues and PRs welcome. See the GitHub Issues page to report bugs or request features.