Compliance evidence, generated by the system that needs it
Your CI already runs your tests. Now it runs your Art. 10 evidence.
An enterprise Python toolkit that runs inside your codebase and your CI and produces the artefacts AI governance asks for — automatically, hash-chained, and without your data leaving the process.
pip install atheros-compliance-kit
atheros-kit init --ci github
Five-minute quickstartWhy it tells you what it could not measureSee a real report
Does atheros-compliance-kit have runtime dependencies?
Four numbers, no adjectives — each one measured from the product at build time rather than typed by hand.
0
runtime dependencies in the core. It installs in a locked-down CI image.
0
bytes of your data leave the process. There is nowhere to upload it to.
24
weighted vendor criteria, where unknown is penalised rather than skipped.
203
tests, no network, no API key, under a second.
Which EU AI Act obligations can be evidenced automatically?
Three gaps, and the module that closes each.
The evidence gap. Art. 11 and Annex IV want technical documentation; ISO/IEC 42001 §9.1 wants monitoring records. Both describe artefacts only the running system can produce — and both are usually produced by a person writing a document from memory, months late. euact generates the structure and fills what the other modules can evidence.
The black-box gap. The moment a prompt leaves for OpenAI, Anthropic or Mistral, you have exported data you are accountable for and imported output you cannot vouch for. There is no default place to mask, filter, log, or fall back. guard is that place.
The unknown-unknowns gap. RAG corpora drift, embeddings skew, and bias enters through the knowledge base rather than the model. Everybody audits the model. Nobody measures the corpus. rag measures the corpus.
What does each module do, and which article does it evidence?
Four modules, one dependency.
| Module | What it answers |
|---|
| M1 | atheros_kit.rag | Is our knowledge base biased, duplicated, drifting, or full of PII? |
| M2 | atheros_kit.guard | What leaves for a third-party LLM, and what comes back? |
| M3 | atheros_kit.euact | What is our EU AI Act tier, defensibly — and what does Annex IV still need? |
| M4 | atheros_kit.vendor | Third-party / vendor risk — can this supplier be used, and is the training opt-out actually enforced? |
| atheros_kit.cicd | Fail the build when any of the above regresses. |
Each module names the obligation it evidences, so a legal duty maps to a command an engineer can run. That mapping is why these are one product rather than four.
Read the module reference
Library or SaaS: which is better for EU AI Act evidence?
Why this, and not a governance platform.
It runs where the data is. A library in your process. No payload egress by default, nothing to upload, nothing to re-enter. A hosted platform structurally cannot offer this.
Tamper-evident by construction. Every assessment, block and mask lands on a SHA-256 hash-chained ledger with an independent verify command — and a second, independent verifier that recomputes the whole chain in your browser.
It degrades, never stalls. The core is stdlib-only. Every capability has a deterministic path that runs with no key and no network, and any run that fell back is marked degraded rather than quietly presenting the fallback as the real thing.
What does the Kit do when a check cannot be measured?
The part nobody else ships.
Every competitor's dashboard is green. Ours tells you what it could not establish.
| |
|---|
| A score with no measurement | renders unmeasured, and fails the gate |
| "No indicator matched" | is never rendered as "low risk" |
| An ambiguous classification | reports a grey zone with the conflict named, not a confident wrong tier |
| Machine evidence on an Annex IV section | makes it partial, never covered |
| An unanswered vendor question | is penalised, not skipped |
| A structural detector finding nothing | means nothing recognisable was found, never that nothing is there |
A gate that goes green when the measurement breaks is worse than no gate. That sentence is the product.
The full honesty contract
How do I fail a CI build on a compliance regression?
It fails your build.
# atheros.yml
fail_on:
fairness_score_below: 70
quality_score_below: 70
drift_verdict_in: [shifted]
risk_tier_in: [unacceptable]
residency_verdict_in: [non_compliant]
chain_violation: true
compliance gate — FAILED
⨯ fairness_score fail 0.0 0.0 < 70
⨯ quality_score fail 24.5 24.5 < 70
✓ corpus_drift pass stable
✓ eu_ai_act_tier pass high
– vendor skipped module not configured
✓ audit_chain pass intact
Note the skipped row. A gate that hides what it did not check reads as full coverage.
Does the vendor run this tool on its own product?
We run it on ourselves, and publish the result.
We assess our own product with our own tool and publish the result — including a 33% Annex IV completeness score and one deliberately red check. A compliance tool whose vendor cannot produce its own assessment is not one anybody should buy.
Doing it found a real bug in our own residency logic, which is in the changelog under its own heading.
Read it: our own compliance report — regenerated and staleness-checked on every CI build, so the page cannot quietly describe a version that no longer exists.
What does the AtherosAI Compliance Kit not do?
The limits, stated plainly.
- Give legal advice, certify, or perform a conformity assessment.
- Train, fine-tune or de-bias anything. It recommends remediation; a human runs it.
- Mutate your corpus, your prompts, or your vendor contracts.
- Store your data anywhere. Reports are files you own.
- Update the regulation text by itself. Legal content is versioned data shipped with releases, and every assessment records the version it ran under.
Can I see a real report before installing anything?
See what it produces.
The live console renders a real report — generated by running all four modules over a synthetic hiring corpus, with a failing gate, an unmeasured Fairness Score and a 33%-complete Annex IV file. Every screen exports to JSON, Markdown or PDF, and every exported file says in the file that it is a sample.
It is a static page. It has no server, no database and no write path — the browser's own content-security policy on that page forbids it from contacting anything at all.
How do I install it and get a first report?
Start here.
pip install atheros-compliance-kit # core, stdlib only
pip install 'atheros-compliance-kit[all]' # connectors, PDF export, narrative layer
The free tier — the guardrail wrapper, risk classification, and the full audit ledger — needs no activation, no key, and no network. It does not expire.
QuickstartPricing
·
AtherosAI B.V.