Governance-as-Code: Translating EU AI Act Technical Requirements into Executable Compliance Pipelines for Generative AI Systems

AI summary

Overview

Research area: AI governance and regulatory compliance engineering — specifically, translating the EU AI Act's legal text into automated software checks for generative AI systems.

Technical level: Intermediate. The paper mixes regulatory analysis, policy-as-code (Rego/Open Policy Agent), and applied statistics, but explains each mechanism before using it.

Scope: The paper identifies seven ways the EU AI Act's high-risk requirements (Articles 8–15) break when applied to generative AI, then presents a 43-criterion, six-module compliance pipeline that runs in CI/CD and emits Article-indexed audit evidence.

What This Paper Is About

The EU AI Act requires high-risk AI providers to satisfy technical obligations in Articles 8–15, but that text was written with predictive machine learning in mind — bounded outputs, deterministic inference, tractable data provenance, interpretable decision boundaries. Generative systems violate all four assumptions at once, leaving real requirements legally binding but technically unverifiable. The authors' goal is to close the "last mile" between regulation and implementation by turning open-textured legal standards like "appropriate levels" of robustness and "possible biases" into declared, machine-checkable numbers that a deployment pipeline can enforce automatically.

Key Contributions

1. A systematic gap analysis. Seven technical gaps where Articles 8–15 break for generative AI, each grounded in specific regulatory language: output non-determinism (Art. 10), training-data provenance (Arts. 11/53), continuous conformity under updates (Art. 9), human oversight at machine speed (Art. 14), open-ended robustness (Art. 15), emergent capability risk (Art. 9), and generative fairness in framing (Art. 10).

2. The Governance-as-Code (GaC) framework. 43 machine-checkable acceptance criteria across six modules (Data Lineage, Output Monitoring, Oversight Hooks, Robustness Testing, Risk Registry, Audit Logging), implemented as Rego policies for Open Policy Agent and instrumented with OpenTelemetry and JSON-LD evidence records. The paper shows actual policy code rather than describing it.

3. Explicit operationalization of vague standards. Rather than hiding judgment calls in constants, the framework derives a robustness threshold from a provider-declared baseline, a declared tolerable degradation, and a state-of-the-art floor; and collapses "framing bias" into eight measurable output features tested by counterfactual demographic probing.

4. A correction to value-chain framing, plus empirical validation. Under Article 25 and Chapter V, a downstream deployer relies on the upstream provider's Article 53 training-data summary and documents only the layers it controls — a three-tier provenance model. This is validated on two enterprise deployments against a manual expert audit, reproducing every finding at roughly one-quarter the labor.

Main Findings

• Seven gaps, not one. The Act's requirements fail for generative systems in multiple distinct ways. Two articles carry double burdens: Article 9 appears in both continuous conformity and emergent risk, Article 10 in both non-determinism and fairness.

• The deployer rarely owns the training corpus. Article 11 asks for a general description of training data, and Article 53(1)(d) puts the "sufficiently detailed summary" obligation on the upstream model provider. The genuine downstream gap is narrower and layered: verify the upstream summary exists in machine-readable form, and document what the deployer actually controls — fine-tuning data, alignment data, and the retrieval corpus.

• Retrieval corpora are effective training data. The paper's opening example: a chatbot's retrieval index is rebuilt, hallucination rises from 4% to 9%, and no re-assessment fires because model weights are unchanged and Article 43's "substantial modification" threshold isn't tripped. The Risk Registry's corpus-drift check (hash comparison against the assessment-time snapshot) closes this blind spot.

• Vague standards become declared, contestable numbers. Robustness uses τ_deploy = max(τ_floor, τ_baseline − δ), where the baseline comes from the provider's own Article 11 documentation, δ is a declared tolerable degradation, and the floor comes from a published benchmark or harmonized standard. Every input is written to the evidence store with its source.

• Framing bias is collapsed into eight measurable proxies. Recommendation valence, risk-framing direction, hedging/certainty token rate, recommendation strength, register (Flesch–Kincaid grade level), claim density, qualification rate, and numeric specificity. Counterfactual probing varies one demographic attribute at a time, then tests for distributional dependence with Kruskal–Wallis (continuous) or chi-squared (categorical), Holm-corrected across the eight tests.

• Case study 1 (high-risk advisory chatbot, Annex III Area 5(b)). GaC reproduced all eight manual-audit findings, including three penalty-triggering violations: no effective human oversight (0.4% sampling against 12,000 daily responses, far below the statistically required rate), no continuous risk management, and no Article 50 marking. Other findings: retrieval corpus rebuilt weekly with no re-assessment (hallucination 3.2% to 7.1% over six weeks), unlogged sampling temperature, no adversarial testing (a 200-vector suite extracted the system prompt 23% of the time), 33% of fine-tuning pairs lacking annotator provenance, significant demographic dependence in three of eight framing features (Holm-corrected p < 0.001), and prompt-template edits that triggered no review.

• Case study 2 (limited-risk content generator, Article 50). Four issues reproduced: no machine-readable marking of generated content, demographic dependence in beauty-product description valence and claim density (p < 0.01 on two features after correction), a brand-voice adapter fine-tuned on 18 months of historical copy with no overrepresentation record, and a safety filter that blocked 99.2% of overtly harmful outputs but passed 34% of subtly misleading claims.

• Labor reduction with the right baseline. Against a 72-hour manual expert audit of the chatbot, GaC completed the work in 18 hours — about 75% less — of which 14 hours were human interpretation of flagged failures rather than evidence collection. Documentation artifacts (FactSheets, Model Cards) flagged zero failures because they were never designed or executed as enforcement checks.

• Operational cost is modest. The full pre-deployment suite adds roughly 45 minutes to the pipeline, 32 of them in Robustness Testing, which can run asynchronously behind a deployment hold.

Methodology in Plain English

The authors worked article by article through Articles 8–15, asking a single practical question for each: can an engineering team implement this requirement as written for an LLM-based system? Where the answer was no, they recorded the specific assumption that broke. That produced the seven gaps, which they treat as a deliberately operational set rather than a claim of exhaustiveness.

They then built the compliance framework as pipeline middleware that intercepts deployment at three points — pre-deployment (CI), the deployment gate (CD), and runtime. Each of the six modules registers its checks as Rego policy rules evaluated by Open Policy Agent, with OpenTelemetry carrying evidence records tied to specific article and sub-paragraph references. Three design principles govern everything: criteria must be boolean pass/fail tests rather than recommendations, every execution must produce a structured evidence record, and every threshold or proxy must be a declared input recorded with its justification rather than a hidden constant.

For validation, they deliberately changed the comparison baseline. Instead of benchmarking against Model Cards and FactSheets — which were designed to communicate, not to enforce — they benchmarked against a manual expert audit by a legal-plus-engineering team, which is the real status quo for organizations facing the compliance deadline. Documentation artifacts are reported only to show what information was already on hand.

Why This Matters

Impact on research. The paper reframes AI compliance as a compilation problem rather than a documentation problem: requirements become acceptance tests that produce machine-readable, article-indexed evidence. It also makes a methodological argument that matters for the field — operationalizing choices should be surfaced and contestable, not buried in an auditor's judgment or a magic constant. The authors position GaC as complementary to NIST AI RMF and ISO/IEC 42001, functioning as a concrete code-level realization of their "Measure" and "Manage" functions.

Real-world applications:

• High-risk regulated deployments in hiring, credit scoring, law enforcement, and critical infrastructure, where non-compliance carries penalties of up to €15 million or 3% of global annual turnover.
• Retrieval-augmented advisory systems, where the corpus changes faster than any point-in-time audit cycle can track.
• Agentic systems making multi-step tool calls in milliseconds, where the assumption that a human can intervene before the system acts simply does not hold — addressed by classifying actions into synchronous, asynchronous, and statistical oversight modes.
• Content generation platforms, where Article 50 marking and demographic bias in tone or framing carry limited-risk obligations.

Industry relevance. The Act's high-risk provisions take full effect on August 2, 2026. Engineering teams need to answer "does our system satisfy Articles 8–15?" with something more defensible than a PDF. GaC's design also anticipates harmonized standards: because thresholds are declared inputs rather than hardcoded values, adopting mandated measurement methods later is a configuration change, not a rewrite.

Future Directions

1. Broader validation across Annex III domains. The current evaluation covers two systems; healthcare, law enforcement, and education deployments are untested.

2. Calibration of declared thresholds. The robustness δ and floor, oversight confidence level, and fairness α currently rest on expert judgment. As enforcement actions, court decisions, and harmonized standards accumulate, these become empirically calibratable — and because they are declared inputs, updating them requires no architectural change.

3. Extending coverage beyond the pipeline. Articles 17 (quality management), 43 (conformity-assessment procedure), and 49 (registration) are organizational rather than pipeline duties and remain outside scope, as does any legal judgment on Article 6 risk classification.

4. Improving measurement fidelity. Robustness coverage depends on the quality and domain curation of the adversarial suite, and the eight fairness proxies are a deliberate simplification that will miss biases they do not measure — a floor on checkability, not a ceiling. The paper also flags Article 12 logging granularity and Article 13 explanation of stochastic outputs as gaps that current open-source tooling cannot yet check.

Target Audience

This paper is most valuable to ML platform and MLOps engineers who need to embed compliance checks into deployment pipelines, AI governance and compliance officers at organizations deploying high-risk or limited-risk systems, and regulatory technologists and policy researchers working on the interface between the EU AI Act and generative AI. Legal teams will find the value-chain analysis (Articles 25 and 53) directly useful for clarifying who owes what documentation. The paper's own impact statement is worth heeding: a passing pipeline certifies only the criteria encoded with the thresholds and proxies it was given, and is not a substitute for legal judgment on classification or contested interpretations.

Authors’ abstract

The EU AI Act (Regulation 2024/1689) imposes technical obligations on high-risk AI providers, yet Articles 8-15 were drafted for predictive AI and leave seven technical gaps when applied to generative systems, spanning non-deterministic data governance, training-data provenance, continuous conformity, human oversight, open-ended robustness, emergent risk, and generative fairness. We deliver Governance-as-Code (GaC), a framework of 43 machine-checkable acceptance criteria across six compliance modules that run in a CI/CD pipeline and emit Article-indexed audit evidence, and we show the actual Rego policy code rather than merely describing it. Our central commitment is that the Act's open-textured standards ("appropriate levels," "possible biases") become declared, auditable numbers: robustness thresholds are derived from the provider's documented baseline and a state-of-the-art floor, and framing bias is collapsed into eight measurable proxies tested by counterfactual demographic probing. We also correct who owes what, since under Article 25 and Chapter V a downstream deployer relies on the upstream provider's Article 53 training-data summary and documents only the layers it controls, so GaC verifies that summary rather than demanding per-sample documentation the deployer never had. We validate on two enterprise deployments, a high-risk advisory chatbot and a limited-risk content generator, benchmarking against a manual expert audit rather than documentation artifacts that were never designed to enforce compliance. GaC reproduces all of the manual audit's findings, including three penalty-triggering violations, while cutting audit labor by roughly 75%.