Reproduce “Governance-as-Code: Translating EU AI Act Technical Requirements into Executable Compliance Pipelines for Generative AI Systems” on OpenResearch
Turn your favorite coding agents into research agents that review literature, develop hypotheses, and run experiments.
Universal app for Apple silicon and Intel. Requires macOS 11 or later.
About this paper
Rudrendu Kumar Paul, Sourav Nandy
Governance-as-Code (GaC) converts selected EU AI Act obligations for generative AI into executable policy checks that run across CI, deployment, and runtime monitoring. Implemented with 43 Open Policy Agent criteria, the framework reproduced all eight findings in an audit of a high-risk retrieval-augmented chatbot and four findings for a content-generation system, reducing the chatbot audit effort from 72 to 18 hours.
Key insights
- Compliance controls must track the full generative-AI lifecycle, including foundation-model documentation, deployer-controlled fine-tuning data, runtime retrieval corpora, prompt templates, model updates, and emergent capabilities.
- The framework treats compliance as both a deployment condition and a runtime monitoring problem: certain changes trigger re-evaluation, while action criticality determines whether approval, delayed review, or statistical sampling is required.
- Automated failures are evidence for expert assessment, not replacements for legal judgment; fairness dependence, robustness thresholds, and risk classifications still require domain and regulatory interpretation.
Summary by alphaXiv.
Tip: change arxiv.org to autoarxiv.org in any arXiv abstract link to open the paper here.