AtherosAI Compliance Kit

Compliance evidence, generated by the system that needs it.

An enterprise Python toolkit that runs inside your codebase and your CI, and produces the artefacts AI governance asks for — bias scores, PII-masking logs, risk classifications, vendor assessments — automatically, hash-chained, and without your data leaving the process.

pip install atheros-compliance-kit
atheros-kit init --ci github

Four modules over one core. Use one or all four.

Why this and not a governance SaaS

• It runs where the data is. A library in your process. No payload egress by default, nothing to upload, nothing to re-enter. A hosted platform structurally cannot offer this.
• Tamper-evident by construction. Every assessment, block and mask lands on a SHA-256 hash-chained ledger with an independent verify command.
• It is honest under uncertainty. "No indicator matched" is never rendered as "low risk"; ambiguity produces a grey zone rather than a confident wrong tier; an unmeasured score is None and renders grey, never green.
• It degrades, never stalls. The core is stdlib-only. Every capability has a deterministic path that runs with no key and no network — and any run that fell back says degraded.

It does not certify. The Kit assesses and evidences. It is not a conformity assessment and not legal advice, and the copy never implies otherwise — there is a test that enforces that.

Five minutes

Classify a system

from atheros_kit import classify, SystemSpec

result = classify(SystemSpec(
    name="TalentFlow", sector="hr",
    use_cases=["cv screening", "candidate ranking"],
))
result.tier          # "high"
result.articles      # ["Annex III", "Art. 6(2)"]
result.grey_zone     # False — ambiguity would be True with the reason attached
result.obligations   # each duty, and which module produces its evidence

atheros-kit euact classify --name TalentFlow --sector hr --use-case "cv screening"
atheros-kit euact dossier --spec system.json --out annex-iv.md

Wrap a third-party LLM

from atheros_kit import GuardedClient, GuardPolicy, CustomEntity

client = GuardedClient(
    call=lambda prompt: openai_client.responses.create(...).output_text,
    policy=GuardPolicy(
        custom_entities=[CustomEntity("CODENAME", literals=["Project Northwind"])],
        static_fallback="We could not complete that request safely.",
    ),
    model_name="gpt-5-2025-08-07",
)

result = client.invoke("Summarise the case for ali@example.com, IBAN NL91ABNA0417164300")
result.text              # PII masked outbound, restored inbound
result.degraded          # True if anything fell back — never silent
result.masked_entities   # {"EMAIL": 1, "IBAN": 1} — classes and counts, never values
client.summary()         # token governance for the session

It wraps a callable, not an SDK, so it works with any provider — and keeps working when that provider changes its client object.

Three presets:

Audit a RAG corpus

from atheros_kit.rag import RAGAuditEngine

audit = RAGAuditEngine.from_store("chroma", collection_name="knowledge-base").run()
audit.quality_score          # duplicates, orphans, sizing, PII, mixed dimensions
audit.fairness_score         # 0-100, harmonic across the dimensions it could assess
audit.bias.unassessable      # ← read this one: what could NOT be measured
print(audit.remediation_markdown())

Connectors ship for chroma, pgvector, pinecone, milvus (in the rag extra). For anything else, read the corpus yourself — that path is first-class, not a fallback:

from atheros_kit.rag import RAGAuditEngine, Chunk
RAGAuditEngine(chunks=[Chunk(id, text, vector) for ...]).run()

The connection is read-only by design. Remediation produces recipes for a human to run; the Kit never mutates your corpus.

Assess a vendor

from atheros_kit.vendor import assess

a = assess("openai", required_regions=["EU"],
           contract_flags={"training_optout_enabled": True,
                           "training_optout_contractual": True})
a.score.value          # weighted 0-100 across 24 criteria
a.residency.verdict    # compliant | requires_scc | non_compliant | unknown
a.optout.verdict       # enforced | available_not_evidenced | not_available | unknown

Two things this does that a questionnaire does not:

• unknown is penalised, not skipped (20% credit). A vendor cannot score well by declining to answer, which is what "score only what they told us" quietly rewards.
• Available ≠ enabled ≠ contractual. A training opt-out that exists and is switched off protects nothing, and this reports the difference.

The seeded provider facts are dated and go stale after 180 days. They are a prompt for what to verify, not a substitute for verifying — pass your own answers via overrides=.

Fail the build

# atheros.yml
fail_on:
  fairness_score_below: 70
  quality_score_below: 70
  vendor_score_below: 60
  drift_verdict_in: [shifted]
  risk_tier_in: [unacceptable]
  residency_verdict_in: [non_compliant]
  guard_blocks_above: 0
  chain_violation: true

atheros-kit ci gate            # exit 0 pass · 1 failed · 2 error

atheros-kit init --ci github writes a working GitHub Actions workflow (GitLab too). It comments the summary on the PR and uploads the evidence — including on failure, which is when it matters.

An unmeasured check fails. A gate that goes green when the measurement breaks is worse than no gate.

The audit chain

Every module writes to one hash-chained JSONL ledger.

atheros-kit audit verify     # recomputes every digest
atheros-kit audit show --module guard

from atheros_kit import default_trail
intact, violations = default_trail().verify_chain()

Two properties are load-bearing and each was a real defect once: the chain head is read from the file under an exclusive lock (a module global restarts the chain in the middle of an existing one, and four workers then write four forks), and the writer and verifier hash exactly the same field set (when they disagreed, an intact file and a forged one verified identically).

The ledger records entity classes and counts, never values. A compliance ledger that stores the PII it found is the failure it exists to prevent.

Which model runs which check

Checks name a tier; the tier names a provider and model. Re-pricing everything is one edit.

# atheros-models.yaml
tiers:
  cheap:  { provider: gemini, model: models/gemini-3.5-flash-lite }
  strong: { provider: openai, model: gpt-5-2025-08-07 }
checks:
  RiskRationale: { tier: strong, fallback: cheap }

Precedence: ATHEROS_MODEL__RiskRationale → ATHEROS_TIER__STRONG → the file → built-in default.

The built-in default is none:deterministic — with no key configured, everything runs its deterministic path and nothing silently degrades. Unpinned model names (-latest, -preview) are detected and warned about: an alias means "which model produced this assessment" cannot be answered six months later.

atheros-kit doctor    # what is installed, what is configured, what will therefore run

Install

pip install atheros-compliance-kit           # core — stdlib only, no network needed
pip install 'atheros-compliance-kit[rag]'    # vector-store connectors + numpy
pip install 'atheros-compliance-kit[llm]'    # optional narrative layer
pip install 'atheros-compliance-kit[pdf]'    # PDF report export
pip install 'atheros-compliance-kit[all]'

Python 3.10+. The core imports no third-party package, so a CI image stays small and a pip install in a locked-down build environment does not fail on a driver you were not going to use.

The ISO/IEC 42001 evidence pack

$ atheros-kit iso export --out ./evidence
wrote evidence/iso-42001-evidence.md, evidence/iso-42001-evidence.json
4 of 5 clauses hold records · 8 ledger entries

One document for an auditor: every ledger record filed under the ISO/IEC 42001 clause it evidences, the chain verification, the clauses that hold no records, and the full list of what this product does not cover. Nothing is generated — each row traces back to a ledger line by its digest.

It is a pure function of the ledger. No generation timestamp, no run id: re-running it against an unchanged ledger produces a byte-identical file, so a reader checks the document by reproducing it rather than by trusting it. A chain that does not verify is reported above the evidence and exits 1, with no flag to silence it. An empty ledger exits 1 too.

Five clauses, and one of them is qualified. Clause 6.1.2 is labelled input only: an EU AI Act risk classification is a regulatory categorisation, while the clause asks for your own AI risk criteria, analysis and evaluation. The pack says so on the clause itself.

What it deliberately does not do

• Give legal advice, certify, or perform a conformity assessment.
• Cover ISO/IEC 42001 as a standard. It produces records for five named clauses; the management-system clauses — 4 to 7, 10, the 9.2 internal audit programme, the 9.3 management review, the Statement of Applicability and the Annex A controls — are yours, and every evidence pack says so in writing.
• Train, fine-tune, or de-bias anything. It recommends remediation; a human runs it.
• Mutate your corpus, your prompts, or your vendor contracts.
• Store your data anywhere. Reports are files you own.
• Update the regulation text by itself. Regulation content is versioned data shipped with releases, and every classification records the version it was produced under.

Development

pip install -e '.[dev]'
pytest                       # full suite, no network, no key, under a second
ruff check src tests

© AtherosAI B.V. Commercial licence.