compliance-agent 0.1.3

EU AI Act compliance scanner for AI projects

ComplianceAgent

Check if your AI project follows EU rules.

The EU has new rules for AI. If you're building with OpenAI, Anthropic, LangChain, or any AI framework, you need to check whether you comply. This tool does it for you — one command, about 5 seconds.

30-Second Start · What It Does · How It Works · Examples · All Commands · FAQ

---

30-Second Start

# Install (isolated CLI tool)
uv tool install compliance-agent
# no uv? use:  pipx install compliance-agent

# Check your project
compliance-agent scan .

# Done. Read what it found.

What It Does (Simple Version)

1. Scans your code — finds where you use AI (OpenAI, LangChain, etc.).
2. Checks the rules — compares your code against EU AI Act requirements.
3. Tells you what's missing — shows exactly what you need to fix.
4. Gives you the code — provides copy-paste fixes for each problem.

What You'll See

When you run compliance-agent scan ., you get something like:

YOUR PROJECT STATUS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Risk Level: LIMITED (some rules apply)
AI Found:   OpenAI chatbot, LangChain agent
Issues:     3 things to fix

WHAT TO FIX
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
1. Add a "You're talking to AI" notice to your chat
   → Copy this file: templates/art50/transparency_notice.py

2. Log all AI conversations (EU requires record-keeping)
   → Copy this file: templates/art12/event_logging.py

3. Add error handling for AI failures
   → Add try/except blocks around AI calls

NEXT STEPS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Get the fix files:  compliance-agent recommend . --output ./fixes

Do I Need This?

Yes, if you:

• Use OpenAI, Anthropic, Google, or any AI API
• Build chatbots or AI assistants
• Use LangChain, CrewAI, AutoGen, or LangGraph
• Deploy AI in the EU or serve EU users
• Want to avoid fines (up to €35M)

No, if you:

• Don't use AI in your project
• Only use AI for personal projects (not a business)
• Don't operate in, or serve users in, the EU

Installation

ComplianceAgent is a command-line tool, so the cleanest way to install it is with a tool installer that keeps it in its own isolated environment.

Recommended (isolated CLI install)

uv tool install compliance-agent

or, with pipx:

pipx install compliance-agent

No uv or pipx yet? Install one:

brew install uv        # or: brew install pipx

Alternative: pip inside a virtual environment

On modern macOS/Linux, a bare pip install into the system Python is blocked (PEP 668, "externally-managed-environment"). Use a virtual environment:

python3 -m venv .venv
source .venv/bin/activate    # Windows: .venv\Scripts\activate
pip install compliance-agent

Latest unreleased version (from GitHub)

uv tool install git+https://github.com/latreon/compliance-agent.git
# or:  pipx install git+https://github.com/latreon/compliance-agent.git

Verify it worked

compliance-agent version
# ComplianceAgent v0.1.3

Trouble installing or running? See the Troubleshooting guide.

How It Works

Step 1: Scan your code

The scanner reads your project files and looks for AI-related patterns:

• import openai — you're using OpenAI
• from langchain — you're using LangChain
• AgentExecutor() — you're running an AI agent
• client.chat.completions.create() — you're calling an AI API

It uses AST parsing (not just text search) to avoid false positives. A comment that mentions "OpenAI" won't trigger a finding — only real code does.

Step 2: Classify risk

Based on what it finds, the tool assigns a risk level:

Risk Level	What It Means	Rules That Apply
MINIMAL	Basic AI usage, no user interaction	Almost none
LIMITED	AI interacts with users	Transparency rules (Art. 50)
HIGH	AI makes important decisions	Full compliance required
UNACCEPTABLE	Banned AI practices (Art. 5)	Cannot be deployed

Step 3: Check compliance

The tool checks 12 specific articles of the EU AI Act:

Article	What It Checks	When It Matters
Art. 50	"You're talking to AI" notice	Any user-facing AI
Art. 12	Logging AI conversations	All AI systems
Art. 14	Human oversight for decisions	High-risk / agentic AI
Art. 15	Error handling and robustness	All AI systems
...	see the full list	...

Step 4: Recommend fixes

For each issue found, the tool:

1. Explains what's wrong
2. Shows which rule requires the fix
3. Provides a code template you can copy
4. Tells you exactly where to put it

ISSUE: No "You're talking to AI" notice
RULE:  EU AI Act Article 50(1)
FIX:   Copy templates/art50/transparency_notice.py into your project
WHERE: Add it before your chat endpoint

Real Examples

Example 1: Simple chatbot (Limited risk)

A basic chatbot using OpenAI:

# chatbot.py
import openai

client = openai.OpenAI()

def chat(user_input):
    return client.chat.completions.create(
        model="gpt-4",
        messages=[{"role": "user", "content": user_input}],
    ).choices[0].message.content

Scan result:

RISK: LIMITED (Article 50 applies)
ISSUES: 2
  1. No "You're talking to AI" notice
  2. No logging of conversations
FIX: Add a transparency notice + logging.

Example 2: LangChain agent (Higher risk)

An agent that can search the web and send emails:

# agent.py
from langchain.agents import AgentExecutor
from langchain.tools import Tool

tools = [
    Tool(name="search", func=search_web, description="Search the web"),
    Tool(name="email", func=send_email, description="Send an email"),
]

executor = AgentExecutor(agent=agent, tools=tools)

Scan result:

RISK: HIGH (agent with tool access)
FRAMEWORKS: LangChain (agent, tools)
ISSUES: 5
  1. No human oversight before tool use
  2. No logging of tool calls
  3. No error handling for API failures
  4. No "You're talking to AI" notice
  5. No data governance documentation
FIX: Add human-in-the-loop, logging, error handling, transparency.

Example 3: CrewAI multi-agent (High risk)

A crew of agents researching and writing:

# crew.py
from crewai import Agent, Task, Crew

researcher = Agent(role="Researcher", tools=[search])
writer = Agent(role="Writer", tools=[write])

crew = Crew(
    agents=[researcher, writer],
    tasks=[Task(description="Research", agent=researcher),
           Task(description="Write", agent=writer)],
)
crew.kickoff()

Scan result:

RISK: HIGH (multiple autonomous agents)
FRAMEWORKS: CrewAI (agent, crew, task)
ISSUES: 4
  1. No oversight before crew execution
  2. No logging of agent actions
  3. No documentation of agent roles
  4. No incident reporting procedure
FIX: Add an approval workflow, logging, documentation, incident plan.

Command Reference

# Scan a folder (. means the current folder)
compliance-agent scan .

# Output types
compliance-agent scan . --format markdown   # for reading (default)
compliance-agent scan . --format json       # for computers / CI
compliance-agent scan . --format pdf         # for sharing

# Only show serious issues
compliance-agent scan . --severity high

# Skip folders
compliance-agent scan . --exclude "tests/*" --exclude "docs/*"

# Show how to fix each problem
compliance-agent scan . --fix

# Copy fix templates into your project
compliance-agent recommend . --output ./fixes

# Make a shareable report file
compliance-agent report . --output audit-2026.pdf

# For CI/CD: plain output, fail the build on serious issues
compliance-agent scan . --ci --fail-on high

# Upgrade to the latest (or a specific) version
compliance-agent upgrade
compliance-agent upgrade 0.1.2

# Show the installed version (and whether an update is available)
compliance-agent version

Run compliance-agent scan --help to see every option explained.

Staying up to date. After a scan, ComplianceAgent tells you if a newer version is on PyPI, then compliance-agent upgrade updates it in place (auto-detecting whether you installed with uv, pipx, or pip). The check is cached for a day, never blocks a scan, and is skipped in CI and JSON output. Disable it with --no-update-check or COMPLIANCE_AGENT_NO_UPDATE_CHECK=1.

Exit codes: 0 success · 1 --fail-on threshold met · 2 usage error. .gitignore is honored automatically, and vendored directories are always skipped.

JSON output is a versioned envelope — safe to parse in CI:

{
  "schema_version": "1.0",
  "tool_version": "0.1.3",
  "scan_result": { "files_scanned": 2, "risk_tier": "limited", "findings": ["..."] }
}

What It Detects

AI providers

• OpenAI (GPT-4, GPT-4o, o1)
• Anthropic (Claude)
• Google (Gemini)
• Mistral
• Local models (Ollama, vLLM, transformers, llama.cpp, torch)

Agent patterns

• MCP servers and tool definitions
• Tool calls and function calling
• Multi-agent orchestration (CrewAI, AutoGen, LangGraph)
• Prompt templates and system prompts

Framework-aware detection

Beyond generic provider detection, dedicated detectors understand what each framework construct means for compliance (only in files that actually import the framework — AST-verified):

Framework	Detection	Compliance Mapping
LangChain	Agents, tools, memory, chains	Art. 14 (oversight), Art. 9 (risk), Art. 12 (logging), Art. 50 (transparency)
CrewAI	Crews, agents, tasks, processes	Art. 14 (oversight), Art. 12 (logging), Art. 11 (docs)
AutoGen	Agents, group chat, function/code execution	Art. 50 (transparency), Art. 12 (logging), Art. 9 (risk)
LangGraph	State graphs, conditional edges, tool nodes, checkpoints	Art. 12 (logging), Art. 11 (docs), Art. 14 (oversight)

Compliance Coverage

ComplianceAgent checks the following EU AI Act articles and reports a per-article status (Met / Partial / Missing / Not applicable):

Article	Title	When Applicable
6	High-risk definition	High-risk tier
7	Conformity assessment	High-risk tier
9	Risk management	High-risk tier
10	Data governance	Data processing or high-risk tier
11	Technical documentation	Any AI usage
12	Record-keeping	Any AI usage
13	Transparency to deployers	User-facing systems
14	Human oversight	Agentic patterns or high-risk tier
15	Accuracy, robustness, cybersecurity	Any AI usage
26	Provider obligations	High-risk tier
28	Distributor obligations	Deployment artifacts present
50	User transparency	User-facing AI

Fix Templates

ComplianceAgent doesn't just find problems — it ships solutions. Every gap maps to a real, copy-pasteable template (index):

Article	Template	Purpose
50	transparency_notice.py	AI interaction disclosure (decorator + ASGI middleware)
50	content_marking.py	Machine-readable AI content marking
50	deepfake_disclosure.py	Synthetic media labeling
12	event_logging.py	AI event logging with retention + cleanup
14	human_oversight.py	Human-in-the-loop checkpoints with audit trail
9	risk_management.py	Risk register and review cycle
10	data_governance.py	Dataset provenance cards
11	technical_documentation.py	Annex IV technical documentation generator

Each template is fully working Python (compile-checked in CI), well-commented, and framework-agnostic (FastAPI, Flask, Streamlit).

PDF Reports

Generate an audit-ready PDF for compliance teams, legal, or auditors:

compliance-agent scan . --format pdf
# Report saved to: compliance-report-myproject.pdf

# Or the dedicated report command (PDF or Markdown, custom path)
compliance-agent report . --output audit-2026.pdf

The PDF includes a cover page, an executive summary with a risk-tier badge and metrics, a risk assessment with deadlines, a color-coded findings table, compliance gaps with remediation steps, fix recommendations with code snippets, and an EU AI Act reference appendix.

PDF generation uses WeasyPrint, which needs the pango native libraries: brew install pango (macOS — run with DYLD_FALLBACK_LIBRARY_PATH=/opt/homebrew/lib if needed) or apt install libpango-1.0-0 libpangoft2-1.0-0 (Debian/Ubuntu). Markdown and JSON formats work without it.

CI/CD Integration

GitHub Actions

- name: EU AI Act Compliance Check
  run: |
    pip install compliance-agent
    compliance-agent scan . --ci --fail-on high

Pre-commit hook

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/latreon/compliance-agent
    rev: v0.1.3
    hooks:
      - id: compliance-agent-scan
        args: [--fail-on, high]

Common Questions

Is this legal advice? No. It's a technical tool that checks your code. Consult a lawyer for legal advice.

Will this slow down my CI/CD? No. It takes about 5 seconds on most projects.

What if I'm not in the EU? If you serve EU users, you still need to comply. The EU AI Act applies to anyone providing AI to EU residents.

What if I find issues? The tool gives you exact code fixes. Copy the templates into your project and re-run the scan.

Can I use this in production? Yes. Add it to your CI/CD pipeline to catch issues automatically.

Troubleshooting

Common problems and fixes are in the Troubleshooting guide. Quick hits:

• command not found: compliance-agent → run python -m compliance_agent scan .
• PDF generation fails → brew install pango (macOS), or just use --format markdown / --format json
• Too many findings → --exclude "tests/*" or --severity high

Development

git clone https://github.com/latreon/compliance-agent.git
cd compliance-agent
uv sync
uv run pytest                     # tests with coverage
uv run compliance-agent scan .    # dogfood: scan this repo

Contributing

Contributions welcome! See CONTRIBUTING.md.

Priority areas:

• New detector patterns (LlamaIndex, Haystack)
• Additional templates for other articles
• Integration with more AI frameworks
• Documentation improvements

Roadmap

• PyPI release
• GitHub Action on the Marketplace
• Project config file (compliance.yaml) for declared posture and scan defaults
• SARIF output for GitHub code scanning integration
• JS/TS project scanning

Resources

• EU AI Act (Regulation (EU) 2024/1689) — full text
• EU AI Act explorer

License

MIT License — see LICENSE.

Disclaimer

This tool provides technical analysis, not legal advice. Consult qualified legal counsel for EU AI Act compliance decisions.