Quick Start¶

Run your first Opencomplai compliance check in under 15 minutes.

Prerequisites¶

Python 3.11+ and pip.

python3 --version  # must be 3.11 or higher

python --version   # must be 3.11 or higher

Install the SDK and CLI¶

pip install opencomplai

pip install opencomplai

The install provides the opencomplai command. Verify it (there is no --version flag — use --help):

opencomplai --help

opencomplai --help

Initialise your system manifest¶

opencomplai init \
  --system-id "my-model" \
  --intended-purpose "customer support chatbot"

opencomplai init --system-id "my-model" --intended-purpose "customer support chatbot"

This creates system-manifest.json in the current directory and sets up ~/.opencomplai/ (Ed25519 signing keypair + config) on first run. Expected output:

Signing keypair generated C:\Users\you\.opencomplai
  install_id: 7f3c...
Manifest written to system-manifest.json
  system_id:         my-model
  intended_purpose:  customer support chatbot
  compliance_target: EU_AI_ACT

Next step: run opencomplai check to assess compliance.

On subsequent runs the first line instead reads Signing keypair already exists at ... — that is expected and harmless.

Run your first compliance check¶

opencomplai check

opencomplai check

Expected output for the customer support chatbot purpose (a MINIMAL-risk use case, so the check passes):

Evals: no eval sample set supplied (skipped)

Opencomplai Compliance Check
  system_id:    my-model
  commit_ref:   HEAD
  result:       PASS
  duration_ms:  0
  signed:       no (OSS unsigned)

  Artifact written to compliance-artifact.json

The Evals: no eval sample set supplied (skipped) line appears only when you do not pass --sample-set (see Run pipeline evaluators below).

A compliance-artifact.json is written to the current directory — this is the machine-readable ScanStatusArtifact consumed by CI gates.

Try the other compliance outcomes¶

The result is driven by the manifest's intended_purpose. Re-run init with a different purpose, then check, to see each EU AI Act outcome. (Each init overwrites system-manifest.json in the current directory.)

Example — the high-risk case:

opencomplai init --system-id "hiring" \
  --intended-purpose "recruitment screening of candidates"
opencomplai check

opencomplai init --system-id "hiring" --intended-purpose "recruitment screening of candidates"
opencomplai check

Opencomplai Compliance Check
  system_id:    hiring
  commit_ref:   HEAD
  result:       CONTROL_FAIL
  duration_ms:  0
  signed:       no (OSS unsigned)
  failed_controls: EU_AIA_ART6_HIGH_RISK

  Artifact written to compliance-artifact.json

Run pipeline evaluators on your own data¶

To check safety, bias, and data-leakage against real model outputs, pass an EvalSampleSet JSON with --sample-set. Its system_id must match the manifest. A clean sample passes; outputs containing toxic text, prompt injection, or PII (SSN, secrets, credit cards) fail.

Create eval-set.json:

{
  "eval_set_id": "demo-clean-v1",
  "system_id": "my-model",
  "commit_ref": "HEAD",
  "outputs": [
    "The system classified the request as low risk.",
    "No sensitive data was included in the model response."
  ],
  "prompts": ["Summarize the compliance status for this release."],
  "declared_output_fields": ["answer", "confidence", "risk_class"]
}

opencomplai check --sample-set eval-set.json

opencomplai check --sample-set eval-set.json

Opencomplai Compliance Check
  system_id:    my-model
  commit_ref:   HEAD
  result:       PASS
  duration_ms:  0
  signed:       no (OSS unsigned)
  eval_outcome:      pass

  Artifact written to compliance-artifact.json

If an output contained, say, SSN 123-45-6789 or ignore previous instructions, the result would be CONTROL_FAIL with failed_controls: EVAL_SAFETY_LEXICAL_V1, EVAL_DATA_LEAKAGE_V1 (exit 1).

JSON output for CI¶

opencomplai check --output json

opencomplai check --output json

The --output json flag prints the full ScanStatusArtifact to stdout:

{
  "install_id": "a1b2c3d4-...",
  "system_id": "my-model",
  "commit_ref": "HEAD",
  "result": "pass",
  "failed_controls": [],
  "evidence_hashes": [],
  "rationale_hash": "sha256:...",
  "duration_ms": 0,
  "pending_verifications_count": 0,
  "signature": null,
  "eval_summary": null
}

eval_summary is null unless you passed --sample-set; signature is null unless you passed --sign.

Use in GitHub Actions¶

- name: Opencomplai compliance check
  run: |
    pip install opencomplai
    opencomplai init \
      --system-id "${{ env.MODEL_NAME }}" \
      --intended-purpose "${{ env.USE_CASE }}"
    opencomplai check --scan-mode ci

A non-zero exit code automatically fails the CI step.

Full Docker deployment¶

For the full platform (Evidence Vault, Documentation Generator, badges, and service-backed workflows including TRAP_DETECTED), see Deployment Quickstart.

Next steps¶

• CLI reference: check · init · exit codes
• Deployment guide: Deployment Quickstart
• Extending rules: Adding Rules
• Not sure which EU AI Act obligations apply? EU AI Act Checker
• Cross-check your manifest's declared purpose against code signals: Detect AI in your code