Skip to content

init

Create a system manifest and set up the local signing keypair.

Synopsis

Bash
opencomplai init --system-id <id> --intended-purpose <purpose> [OPTIONS]
opencomplai init --interactive [--skip-checker] [OPTIONS]
PowerShell
opencomplai init --system-id <id> --intended-purpose <purpose> [OPTIONS]
opencomplai init --interactive [--skip-checker] [OPTIONS]

Options

Option Default Description
--system-id (required unless --interactive) Unique identifier for the AI system.
--intended-purpose (required unless --interactive) Primary intended purpose — maps to EU AI Act Annex III categories.
--interactive False Run the EU AI Act applicability checker wizard, then prompt for manifest fields.
--skip-checker False With --interactive, skip the checker wizard.
--compliance-target EU_AI_ACT Single framework target: EU_AI_ACT or NIST_AI_RMF. To assess several, see Targeting several frameworks.
--high-risk-presumption / --no-high-risk-presumption False Set to True if the provider presumes the system is high-risk pending classification.
--training-data-description (none) Annex IV §2 free-text training-data summary. Required for HIGH-risk systems.
--model-architecture (none) Annex IV §2 free-text architecture description. Required for HIGH-risk systems.
--monitoring-approach (none) Annex IV §3 production monitoring summary.
--incident-response-procedure (none) Annex IV §3 incident-response pointer or summary.
--section-extras-file (none) Path to a JSON file with structured Section 2/3 inputs (performance_metrics, known_limitations, human_oversight_measures) merged into the manifest.
--from-model-card (none) Path to a Hugging Face model card (README.md). Offline import of its front matter; values are recorded as attested, not verified. See Import a Hugging Face model card.
--output / -o system-manifest.json Output path for the manifest file.
--scan False After the manifest is written, run the code corroboration scan on --repo-root and print its human report, with a note to confirm --intended-purpose when discrepancies are found. Writes no ledger event, runs no AI intent analysis and does not change the exit code. Ignored with --interactive. See scan
--repo-root . Repository root that --scan reads; the first scan creates a default .ocignore there when none exists. No effect without --scan

Import a Hugging Face model card

--from-model-card README.md reads the YAML front matter of a Hugging Face model card and fills three manifest fields, so you do not retype them:

Card field Manifest field
datasets training_data_description
base_model, library_name, pipeline_tag model_architecture
model-index[*].results[*].metrics[*] (numeric values only) performance_metrics, keyed <dataset type>/<metric type>
  • The values are provider-declared. Each filled field is recorded in the manifest's imported_evidence as attested, not verified, with the card's file name (never its path), a SHA-256 of the front matter and the import date. check and gaps do not read this record, so verdicts and exit codes are the same with or without the import.
  • Nothing is fetched. The card is read from the file you give; there is no Hub lookup.
  • Explicit flags and --section-extras-file win: a field you already set is left alone and not recorded as imported.
  • known_limitations is not imported, because it lives in the card body rather than the front matter. Other front matter keys (license, tags, language) are ignored.
  • A card with no front matter, invalid YAML, or more than 262144 characters exits 2 and writes no manifest. --from-model-card cannot be combined with --interactive.

Examples

Bash
# Interactive onboarding with EU AI Act checker
opencomplai init --interactive

# Flag-based init
opencomplai init \
  --system-id "credit-scoring-v2" \
  --intended-purpose "automated credit scoring for retail lending" \
  --high-risk-presumption
PowerShell
# Interactive onboarding with EU AI Act checker
opencomplai init --interactive

# Flag-based init
opencomplai init --system-id "credit-scoring-v2" --intended-purpose "automated credit scoring for retail lending" --high-risk-presumption

What it does

  1. On first run, generates an Ed25519 signing keypair in ~/.opencomplai/ and writes a config file (~/.opencomplai/config.yaml) containing the install_id and the gateway URL.
  2. Writes a SystemManifest JSON to --output (default system-manifest.json).

Output format (system-manifest.json)

init always writes the full SystemManifest, including the optional Annex IV Section 2/3 fields (with null/empty defaults when not supplied):

JSON
{
  "system_id": "credit-scoring-v2",
  "intended_purpose": "automated credit scoring for retail lending",
  "compliance_target": "EU_AI_ACT",
  "high_risk_presumption": true,
  "commit_ref": "HEAD",
  "training_data_description": null,
  "model_architecture": null,
  "performance_metrics": {},
  "known_limitations": [],
  "human_oversight_measures": [],
  "monitoring_approach": null,
  "incident_response_procedure": null,
  "operator_role": "deployer",
  "checker_session": {
    "checker_version": "checker-2026-10-26",
    "session_id": "uuid",
    "completed_at": "2026-06-09T12:00:00+00:00",
    "report_json_path": "./eu-ai-act-result.json",
    "verdict": "high_risk_ai_system"
  }
}

When present, checker_session records an EU AI Act applicability checker run. See checker.

Targeting several frameworks

init writes the single compliance_target. To assess several frameworks side by side, add compliance_targets (and, if needed, framework_inputs) to the manifest, either by editing it or by putting them in the --section-extras-file JSON:

JSON
{
  "compliance_targets": ["EU_AI_ACT", "NIST_AI_RMF"]
}

compliance_targets then takes precedence over compliance_target. Neither key is written when unset, so the manifest above is unchanged for a single target. Run validate-manifest to check the framework keys; see Frameworks for exclusions and attestations.

Next step

Run opencomplai check to assess compliance using the manifest.

Exit codes

Code Meaning
0 Manifest written successfully.
2 Invalid input — bad --section-extras-file JSON, or manifest field validation failed.