opencomplai-core

The EU AI Act compliance risk engine at the heart of Opencomplai. opencomplai-core turns a declared system-manifest.json and your source tree into a deterministic, rule-based risk classification — no LLM calls, no network access, fully reproducible.

It powers risk classification (UnacceptableRiskRule, AnnexIIIClassifierRule, ProfilingDetectionRule, SubstantialModificationRule) and the code-corroboration scan engine that cross-checks what a manifest claims against what the code actually does.

Install

pip install opencomplai-core

For PDF report generation, install the optional extra:

pip install "opencomplai-core[reports]"

Most users want the opencomplai meta-package (engine + CLI) or the opencomplai-cli command-line tool. Install opencomplai-core directly when you are embedding the engine in your own application.

Quick start

Classify a model from a declared manifest

from opencomplai import assess, AssessmentInput, ModelMetadata

result = assess(AssessmentInput(
    model=ModelMetadata(
        name="loan-scorer",
        version="1.0.0",
        modality="tabular",
        use_case="creditworthiness scoring for consumer loans",
        deployment_context="production",
    )
))

print(result.risk_level)        # e.g. RiskLevel.HIGH
for rule in result.rule_results:
    print(rule.rule_id, "PASS" if rule.passed else "FAIL")

Corroborate a manifest against the code

from pathlib import Path
from opencomplai_core.scan_engine import run_scan

report = run_scan(
    repo_root=Path("."),
    commit_ref="HEAD",
)

print(report.summary.result)            # PASS / CONTROL_FAIL / ...
for finding in report.findings:
    print(finding.finding_id, finding.mapped_taxonomy)

The scan engine extracts features from the repository, fuses evidence across detectors, and maps findings to EU AI Act taxonomy (Annex III high-risk areas, Article 5 prohibited practices, profiling under Article 6).

What you get

• Deterministic risk classification — same inputs always produce the same output, so results are auditable and CI-gateable.
• Code corroboration — detect when a manifest under-declares (claims minimal risk while the code does biometric identification, profiling, etc.).
• Merkle-linked evidence — findings carry verifiable evidence items for audit trails.

Documentation

Full docs, the EU AI Act concepts guide, and the SDK reference live at docs.opencomplai.com.

License

AGPL-3.0-only. See LICENSE.