A Solo-Developer ran straight into the EU AI Act
Hey IH, first post here so some background on why this exists.
I'm a solo developer, and about a year ago I ran straight into the EU AI Act — the EU's AI regulation that's now actually in force, not just proposed. If you're building or shipping AI features, you're likely in scope more often than you'd guess: HR tools, credit scoring, insurance pricing, plenty of things people don't file under "regulated AI" turn out to be exactly that. High-risk systems need real evidence — risk classification, technical documentation, an audit trail — not just a good intention.
I looked at what handling this the normal way would cost me: a compliance consultant, tens of thousands of euros, months of back-and-forth, for one system. I didn't have that as a solo founder. The other option — becoming an EU regulatory law expert on the side while still shipping my actual product — wasn't realistic either, and I'd probably still get it wrong without legal training. Neither path exists for someone building alone.
So I looked at what a consultant or a compliance questionnaire actually asks for: what does the system do, how does it decide things, what oversight and logging exist. And I realized — that information already lives in the codebase. Nobody should have to redescribe it from memory in a form. It just needs to be read out of the code that's already there.
That's what I built. Scanara scans a repo — code with Semgrep, docs/policies with OPA — and shows where it stands against the EU AI Act's requirements, straight from what's actually in the codebase. It's rule-based, not some black-box AI making the call for you — the rules are generated from the regulation's own text, and the actual judgment on what's high-risk stays with you, the developer, not the tool.
Free to scan a real repo, no credit card, no sales call: https://scanara.io/en/
I'm early and solo, so genuinely asking rather than pitching: if you build AI products and have run into this (or expect to — it applies even if you're a US/UK company selling into the EU), how are you handling it today? And what would make an automated compliance tool actually feel trustworthy to you, versus just another box-ticking exercise?
As we already posted on LinkedIn and X "... no automated tool can guarantee legal accuracy, and any that claims otherwise is overselling.", so i dont think a developer should trust any tool's output as the sole basis for a real compliance decision. What I think actually earns trust for the parts it can carry weight on:
1. It's deterministic, not probabilistic. The scan path is a rule-based static analysis, no LLM anywhere in it. Same repo in, same findings out, every time. That's a much lower trust bar to clear than "trust the model's judgment."
2. Every finding traces to a specific statutory citation, not a vibe. A finding says "Article 12, record-keeping — missing X" with the actual requirement text behind it, not "this looks risky." You can go read Article 12 yourself and check whether the rule's interpretation is right — the reasoning is inspectable, not opaque.
3. The website is honest about the tools boundary. It splits code-detectable requirements, handled by a scan, from document/organizational-level requirements, handled by questionaires. With the code-detectable and the document/orgnaization-level requirements all the 100 actionable EU AI Act articles are covered. It does not claim that the whole Act is covered by the scan.
4. The audit trail is immutable and reproducible — hash-chained, so you can show a regulator or a lawyer exactly what was checked, when, against which version of the law.
The realistic trust model isn't "developer trusts the tool instead of a lawyer" — it's "developer trusts the tool enough that the lawyer's job shrinks from starting-from-zero to reviewing-a-structured-package." That's a real trust threshold to clear (most compliance tooling doesn't clear it), just a different one than "replaces legal judgment."
On the website it is mentioned several times that the application does not certificates you, guarantees compliance or replacing a laywer (because not every article could be covered by a scan) but the goal of the application is to minize the costs for laywers and keep your code compliant over the development process.
Thanks! I’ve just sent it over.
Looking forward to hearing your thoughts whenever you have a chance.