EUResearch
Governance-as-Code paper encodes EU AI Act duties as CI/CD compliance checks
Rudrendu Kumar Paul and Sourav Nandy posted Governance-as-Code to arXiv on September 17, 2026, proposing 43 machine-checkable acceptance criteria across six modules that run in a CI/CD pipeline against EU AI Act technical duties for generative systems. Validated on two enterprise deployments against a manual expert audit, the ICML 2026 AI4Law workshop paper reported reproducing all findings, including three penalty-triggering violations, while cutting audit labor by about 75%.
Key points
- Authors identify seven technical gaps when applying AI Act Articles 8–15 to generative systems.arXiv
- Framework supplies 43 machine-checkable criteria and shows Rego policy code for CI/CD audit evidence.arXiv
- Validation covered a high-risk advisory chatbot and a limited-risk content generator versus manual audit.arXiv
- GaC reportedly reproduced all manual-audit findings, including three penalty-triggering violations.arXiv
- Authors reported roughly 75% lower audit labor versus the manual expert baseline.arXiv
- Paper is camera-ready for the AI4Law Workshop at ICML 2026.arXiv