rotalabs-comply

AI compliance and audit logging infrastructure with multi-framework support.

Features

• Audit Logging: Encrypted, privacy-preserving audit trails for AI interactions
• 7 Compliance Frameworks: EU AI Act, SOC2, HIPAA, GDPR, NIST AI RMF, ISO 42001, MAS FEAT
• 96 Compliance Rules: Comprehensive coverage across all major AI regulations
• Report Generation: Customizable compliance reports in Markdown, JSON, or HTML
• Privacy-First Design: Hash-only mode or encrypted content storage
• Multiple Storage Backends: File, S3, or in-memory storage
• Async-First: Built for high-performance async applications

Installation

pip install rotalabs-comply

With S3 storage support:

pip install rotalabs-comply[s3]

Quick Start

Audit Logging

import asyncio
from rotalabs_comply import AuditLogger, EncryptionManager, MemoryStorage

async def main():
    # Set up encrypted audit logging
    encryption = EncryptionManager()
    storage = MemoryStorage()
    logger = AuditLogger(storage, encryption=encryption, store_content=True)

    # Log an AI interaction
    entry_id = await logger.log(
        input="What is the capital of France?",
        output="The capital of France is Paris.",
        provider="openai",
        model="gpt-4",
        safety_passed=True,
        latency_ms=245.5,
    )

    print(f"Logged entry: {entry_id}")

    # Retrieve the entry
    entry = await logger.get_entry(entry_id)
    print(f"Provider: {entry.provider}, Model: {entry.model}")

asyncio.run(main())

Privacy Mode (Hash-Only)

# Only store content hashes, not actual content
logger = AuditLogger(
    "/var/log/ai-audit",
    store_content=False,  # Only store SHA-256 hashes
    retention_days=365,
)

Compliance Checking

from rotalabs_comply import EUAIActFramework, SOC2Framework, HIPAAFramework
from rotalabs_comply.frameworks.base import AuditEntry, ComplianceProfile
from datetime import datetime

async def check_compliance():
    # Create frameworks
    eu_ai = EUAIActFramework()
    soc2 = SOC2Framework()

    # Create an audit entry to check
    entry = AuditEntry(
        entry_id="test-001",
        timestamp=datetime.utcnow(),
        event_type="inference",
        actor="user@example.com",
        action="Generated text response",
        human_oversight=True,
        user_notified=True,
    )

    # Create compliance profile
    profile = ComplianceProfile(
        profile_id="high-risk",
        name="High Risk AI System",
        risk_level="high",
    )

    # Check compliance
    result = await eu_ai.check(entry, profile)
    print(f"EU AI Act compliant: {result.is_compliant}")
    print(f"Violations: {len(result.violations)}")

    for violation in result.violations:
        print(f"  - {violation.rule_id}: {violation.description}")

asyncio.run(check_compliance())

Report Generation

from datetime import datetime, timedelta
from rotalabs_comply import ReportGenerator, MemoryStorage
from rotalabs_comply.core import ComplianceProfile, Framework

async def generate_report():
    storage = MemoryStorage()
    generator = ReportGenerator(storage)

    # Define compliance profile
    profile = ComplianceProfile(
        frameworks=[Framework.EU_AI_ACT, Framework.SOC2],
        risk_level="high",
    )

    # Generate report for last 30 days
    end = datetime.utcnow()
    start = end - timedelta(days=30)

    report = await generator.generate(
        period_start=start,
        period_end=end,
        profile=profile,
    )

    # Export to markdown
    markdown = generator.export_markdown(report)
    print(markdown)

asyncio.run(generate_report())

Compliance Frameworks

7 frameworks with 96 total compliance rules:

Framework	Description	Rules	Key Categories
EU AI Act	European AI regulation	8	transparency, oversight, risk_management
SOC2 Type II	AICPA Trust Service Criteria	10	security, availability, privacy
HIPAA	US healthcare data protection	8	access_control, audit, privacy
GDPR	EU data protection regulation	14	data_protection, consent, data_subject_rights
NIST AI RMF	US AI Risk Management Framework	15	governance, context, measurement, risk_treatment
ISO 42001	AI Management System standard	23	context, leadership, planning, operation
MAS FEAT	Singapore financial AI governance	18	fairness, ethics, accountability, transparency

from rotalabs_comply import (
    EUAIActFramework,
    SOC2Framework,
    HIPAAFramework,
    GDPRFramework,
    NISTAIRMFFramework,
    ISO42001Framework,
    MASFramework,
)

# Check against multiple frameworks
frameworks = [
    EUAIActFramework(),
    GDPRFramework(),
    MASFramework(),
]

for fw in frameworks:
    result = await fw.check(entry, profile)
    print(f"{fw.name}: {'PASS' if result.is_compliant else 'FAIL'}")

Storage Backends

File Storage

from rotalabs_comply import AuditLogger, FileStorage

# JSONL files with automatic rotation
storage = FileStorage("/var/log/ai-audit", rotation_size_mb=100)
logger = AuditLogger(storage)

S3 Storage

from rotalabs_comply import AuditLogger, S3Storage

# Requires: pip install rotalabs-comply[s3]
storage = S3Storage(
    bucket="my-audit-bucket",
    prefix="ai-audit/",
    region="us-east-1",
)
logger = AuditLogger(storage)

Memory Storage (Testing)

from rotalabs_comply import AuditLogger, MemoryStorage

storage = MemoryStorage(max_entries=10000)
logger = AuditLogger(storage)

Encryption

All audit content can be encrypted using Fernet symmetric encryption:

from rotalabs_comply import EncryptionManager, generate_key

# Auto-generate key
encryption = EncryptionManager()
key = encryption.get_key()  # Save this securely!

# Or provide your own key
key = generate_key()
encryption = EncryptionManager(key=key)

# Use with AuditLogger
logger = AuditLogger(
    storage,
    encryption=encryption,
    store_content=True,  # Store encrypted content
)

API Reference

Core Types

• RiskLevel - Enum: LOW, MEDIUM, HIGH, CRITICAL
• Framework - Enum: EU_AI_ACT, SOC2, HIPAA, GDPR, NIST_AI_RMF, ISO_42001, MAS
• AuditEntry - Audit log entry data model
• ComplianceProfile - Compliance configuration
• ComplianceViolation - Detected violation
• ComplianceCheckResult - Framework check result

Audit Module

• AuditLogger - Main audit logging interface
• EncryptionManager - Encryption utilities
• FileStorage - JSONL file storage
• MemoryStorage - In-memory storage
• S3Storage - AWS S3 storage

Frameworks

• EUAIActFramework - EU AI Act compliance (8 rules)
• SOC2Framework - SOC2 Type II compliance (10 rules)
• HIPAAFramework - HIPAA compliance (8 rules)
• GDPRFramework - GDPR compliance (14 rules)
• NISTAIRMFFramework - NIST AI RMF compliance (15 rules)
• ISO42001Framework - ISO 42001 compliance (23 rules)
• MASFramework - MAS FEAT compliance (18 rules)

Reports

• ReportGenerator - Generate compliance reports
• ComplianceReport - Report data model
• ReportSection - Report section

Links

• Documentation: https://rotalabs.github.io/rotalabs-comply/
• PyPI: https://pypi.org/project/rotalabs-comply/
• GitHub: https://github.com/rotalabs/rotalabs-comply
• Website: https://rotalabs.ai
• Contact: research@rotalabs.ai

License

Apache-2.0 License - see LICENSE for details.