商业产业 Hacker News AI 2026-08-14T09:29 正文 ok 878 words

Show HN：OpenComplAI——在 CI/CD 中进行开源欧盟《AI 法案》合规检查

英文标题：🔶 Show HN: OpenComplAI – open-source EU AI Act compliance checks in CI/CD

OpenComplAI 是一套将欧盟《AI 法案》合规要求直接嵌入 CI/CD 流水线的开源 Compliance-as-Code 工具，可在代码发布前自动给出通过或失败结果。该项目提供核心规则引擎、CLI、Python SDK，以及风险引擎、证据存储和文档生成等服务，并声称可在 15 分钟内完成首次合规检查。其社区版采用 AGPL-3.0 许可证，分类逻辑完全基于确定性规则，不在生产环境使用 LLM 或 ML 推理。对开发者而言，这意味着可以通过自动化检查、审计证据和 GitHub/GitLab 集成，将 AI 合规控制前移至开发流程。

打开原文相关 2 · 机会 2

1.2 KB

1.1 KB

69.9 KB

中文

OpenComplAI：面向 AI 流水线的 Compliance-as-Code

停止手动审计 → 开始持续交付。

OpenComplAI 将欧盟《AI 法案》合规要求直接带入你的 CI/CD 流水线，把零散的法律要求转化为自动化、机器可读的“发布前检查”。

视频/嵌入内容：观看 OpenComplAI 演示（MP4）

传统 GRC 工具往往是相互割裂的仪表盘，会造成“交付速度税”。我们将合规左移：

防止不合规： 通过阻止违反安全规则的构建，为发布设置门禁。
自动化证据： 为每次部署自动生成可供审计的日志。
框架无关： 可适应不断演进的全球标准（欧盟《AI 法案》、NIST RMF、ISO）。

工作原理（3 分钟完成设置）

定义： 为你的模型创建合规清单。
集成： 将 OpenComplAI Action 添加至 GitHub/GitLab 流水线。
发布： 在代码进入生产环境前获得自动化的“通过/失败”结果。

查看我们的 Dummy Repo（沙盒） —— 在不危及生产代码的情况下，测试我们如何捕捉 AI 错误。

opencomplai-core：用于评估控制项的规则引擎。
opencomplai-cli：在本地开发环境中运行检查。
opencomplai-sdk：以编程方式将合规能力嵌入自定义内部工具。

在不到 15 分钟内运行你的首次合规检查：

这将安装 CLI、核心规则引擎和 SDK，并提供稳定的 API 契约（关于退出代码和工件 schema 保证，请参阅 CHANGELOG）。

对于希望直接从检出代码工作的贡献者，请从源码安装——必须一并安装 core、cli 和 sdk-python 软件包：

git clone https://github.com/Opencomplai/opencomplai
cd opencomplai
pip install -e packages/core -e packages/cli -e packages/sdk-python
# or, with uv:  uv sync

随后运行首次评估：

opencomplai init --system-id my-model --intended-purpose "customer support chatbot"
opencomplai check

或者先零配置试用——opencomplai scan --quick . 会运行仅发现用途的扫描，无需清单，并且绝不会为你的构建设置门禁：

opencomplai scan --quick .

将 Opencomplai 添加至你自己的 .pre-commit-config.yaml，即可在每次提交时运行快速扫描（或在拥有清单后运行完整合规门禁）：

repos:
  - repo: https://github.com/Opencomplai/opencomplai
    rev: v0.1.2
    hooks:
      - id: opencomplai-quick-scan   # discovery only, never fails the commit
      # - id: opencomplai-check      # full EU AI Act gate — requires system-manifest.json

查看完整文档

完整的 Docker 部署文档见 docs/src/deployment/quickstart.md。

社区与反馈

我们目前处于封闭 Beta 试点阶段。如果你是 AI 工程师或 ML 平台负责人，我们希望获得你的反馈。

不确定欧盟《AI 法案》是否适用于你的系统，或者作为提供方与部署方分别需要承担哪些义务？请使用交互式 EU AI Act Checker——这是一个基于浏览器的向导，涵盖适用范围、高风险分类、GPAI 和相关义务。无需账户。你也可以在本地运行：

opencomplai checker --web          # opens the hosted docs page
opencomplai checker --web --local  # serves a self-contained copy offline

组件	类型	职责
core	软件包	风险评估原语与政策映射逻辑（无 HTTP）。
cli	软件包	用于运行本地检查并编排工作流的命令行界面。
sdk-python	软件包	封装 core 并提供稳定集成接口的 Python SDK。
gateway-api	服务	面向多服务部署的 HTTP 入口；负责请求验证和路由。
risk-engine	服务	作为服务提供风险分类执行与规则评估。
evidence-vault	服务	提供不可变性保证和内容寻址工件的证据存储。
doc-generator	服务	根据存储证据生成档案/文档（例如 Annex IV 风格输出）。
egress-proxy	服务	为受控外部连接执行允许列表式出口访问控制。

opencomplai/
├── packages/
│   ├── core/              # Risk assessment engine — Python, Pydantic v2, no HTTP
│   ├── cli/               # CLI tool — Typer + Rich, calls core or gateway-api
│   └── sdk-python/        # Python SDK — pip-installable, wraps core
├── services/
│   ├── gateway-api/       # REST API — Node.js + TypeScript + Fastify (OpenAPI-first)
│   ├── risk-engine/       # Risk classification service — Python + FastAPI
│   ├── evidence-vault/    # Immutable ledger + CAS — Python + FastAPI + PostgreSQL
│   ├── doc-generator/     # Annex IV dossier generator — Python + FastAPI
│   └── egress-proxy/      # Allowlisted egress enforcer — Python + FastAPI
├── tools/
│   └── verify-ledger/     # Evidence ledger chain verification tool
├── infra/
│   ├── docker/            # Dockerfiles (one per service)
│   ├── compose/           # Docker Compose reference deployment + .env.example
│   └── migrations/        # Alembic database migrations
├── docs/                  # MkDocs documentation (published via GitHub Actions)
├── examples/              # Working code examples
├── scripts/               # bootstrap.sh, doctor.py, verify-sbom.sh
└── .github/
    ├── workflows/         # GitHub Actions CI workflows
    ├── ISSUE_TEMPLATE/
    └── pull_request_template.md

Opencomplai 采用开放核心（open-core）模式：

社区版——即本仓库，采用 AGPL-3.0 许可证。包含完整风险评估引擎、CLI、SDK、服务和 EU AI Act Checker。
企业版——提供托管式高级仪表盘、单点登录、额外规则引擎和商业支持，采用商业许可证提供。详情请见 opencomplai.com。

开发环境设置、工作流约定和代码风格请参阅 CONTRIBUTING.md。可查找标有 good first issue 的问题，了解适合新贡献者的任务。所有贡献者均需签署贡献者许可协议。

Opencomplai 的分类逻辑完全是确定性的、基于规则的。生产环境中不使用 LLM 或 ML 推理。

CI 会扫描所有依赖文件，以执行这一政策。完整清单以及审批未来 AI 依赖项的流程，请参阅 docs/security/ai-inventory.md。

Opencomplai 社区版采用 GNU Affero General Public Licence v3.0（AGPL-3.0）许可证——详见 LICENSE。对于不适合使用 AGPL 的场景，可作为企业版的一部分获得商业许可证；请通过 opencomplai.com 联系我们。

English / 原文

OpenComplAI: Compliance-as-Code for AI Pipelines

Stop manual audits → Start shipping.

OpenComplAI brings EU AI Act compliance directly into your CI/CD pipeline, turning fragmented legal mandates into automated, machine-readable "Pre-Ship Checks."

Watch the OpenComplAI demo (MP4)

Traditional GRC tools are disconnected dashboards that create "velocity tax." We shift compliance left:

Prevent Non-Compliance: Gate releases by blocking builds that violate safety rules.
Automated Evidence: Generate audit-ready logs automatically for every deployment.
Framework-Agnostic: Built to adapt to evolving global standards (EU AI Act, NIST RMF, ISO).

How It Works (The 3-Minute Setup)

Define: Create a compliance manifest for your model.
Integrate: Add the OpenComplAI action to your GitHub/GitLab pipeline.
Ship: Get an automated "Pass/Fail" result before your code ever hits production.

Check out our Dummy Repo (Sandbox) – Test how we catch AI errors without risking your production code.

opencomplai-core: The rule engine that evaluates controls.
opencomplai-cli: Run checks locally in your dev environment.
opencomplai-sdk: Programmatically embed compliance into your custom internal tooling.

Get your first compliance check running in under 15 minutes :

This installs the CLI, core rule engine, and SDK with a stable API contract (see CHANGELOG for exit-code and artifact-schema guarantees).

For contributors who want to work from a checkout instead, install from source — the core, cli, and sdk-python packages must be installed together:

git clone https://github.com/Opencomplai/opencomplai
cd opencomplai
pip install -e packages/core -e packages/cli -e packages/sdk-python
# or, with uv:  uv sync

Then run a first assessment:

opencomplai init --system-id my-model --intended-purpose "customer support chatbot"
opencomplai check

Or try it with zero setup first — opencomplai scan --quick . runs a discovery-only scan with no manifest required and never gates your build:

opencomplai scan --quick .

Add Opencomplai to your own .pre-commit-config.yaml to run the quick scan (or the full compliance gate, once you have a manifest) on every commit:

repos:
  - repo: https://github.com/Opencomplai/opencomplai
    rev: v0.1.2
    hooks:
      - id: opencomplai-quick-scan   # discovery only, never fails the commit
      # - id: opencomplai-check      # full EU AI Act gate — requires system-manifest.json

View Full Documentation

Full Docker-based deployment is documented in docs/src/deployment/quickstart.md.

Community & Feedback

We are currently in a Closed Beta Pilot. If you are an AI engineer or ML platform lead, we want your feedback.

Not sure whether the EU AI Act applies to your system, or which obligations you carry as a provider versus a deployer? Use the interactive EU AI Act Checker — a browser-based wizard covering scope, high-risk classification, GPAI, and obligations. No account needed. Or run it locally:

opencomplai checker --web          # opens the hosted docs page
opencomplai checker --web --local  # serves a self-contained copy offline

Component	Kind	Responsibility
core	package	Risk assessment primitives and policy mapping logic (no HTTP).
cli	package	Command-line interface that runs local checks and orchestrates workflows.
sdk-python	package	Python SDK that wraps the core and provides a stable integration surface.
gateway-api	service	HTTP entrypoint for multi-service deployments; request validation and routing.
risk-engine	service	Risk classification execution and rules evaluation as a service.
evidence-vault	service	Evidence storage with immutability guarantees and content-addressed artifacts.
doc-generator	service	Dossier/document generation (e.g. Annex IV-style outputs) from stored evidence.
egress-proxy	service	Allowlisted egress enforcement for controlled external connectivity.

opencomplai/
├── packages/
│   ├── core/              # Risk assessment engine — Python, Pydantic v2, no HTTP
│   ├── cli/               # CLI tool — Typer + Rich, calls core or gateway-api
│   └── sdk-python/        # Python SDK — pip-installable, wraps core
├── services/
│   ├── gateway-api/       # REST API — Node.js + TypeScript + Fastify (OpenAPI-first)
│   ├── risk-engine/       # Risk classification service — Python + FastAPI
│   ├── evidence-vault/    # Immutable ledger + CAS — Python + FastAPI + PostgreSQL
│   ├── doc-generator/     # Annex IV dossier generator — Python + FastAPI
│   └── egress-proxy/      # Allowlisted egress enforcer — Python + FastAPI
├── tools/
│   └── verify-ledger/     # Evidence ledger chain verification tool
├── infra/
│   ├── docker/            # Dockerfiles (one per service)
│   ├── compose/           # Docker Compose reference deployment + .env.example
│   └── migrations/        # Alembic database migrations
├── docs/                  # MkDocs documentation (published via GitHub Actions)
├── examples/              # Working code examples
├── scripts/               # bootstrap.sh, doctor.py, verify-sbom.sh
└── .github/
    ├── workflows/         # GitHub Actions CI workflows
    ├── ISSUE_TEMPLATE/
    └── pull_request_template.md

Opencomplai is open-core:

Community Edition — this repository, licensed under AGPL-3.0. The full risk assessment engine, CLI, SDK, services, and EU AI Act checker.
Enterprise Edition — a hosted premium dashboard, single sign-on, additional rule engines, and commercial support, available under a commercial licence. See opencomplai.com for details.

See CONTRIBUTING.md for development setup, workflow conventions, and code style. Look for issues labelled good first issue to find starter-sized contributions. All contributors sign the Contributor Licence Agreement.

Opencomplai's classification logic is fully deterministic and rule-based. No LLM or ML inference is used in production.

All dependency files are scanned in CI to enforce this policy. See docs/security/ai-inventory.md for the full inventory and the process for approving future AI dependencies.

Opencomplai Community Edition is licensed under the GNU Affero General Public Licence v3.0 (AGPL-3.0) — see LICENSE. For use cases that the AGPL does not fit, a commercial licence is available as part of the Enterprise Edition; contact us via opencomplai.com.