AI Act Compliance Navigator

A Codex-built compliance workspace that turns a startup’s AI profile into an explainable EU AI Act assessment and a prioritized, human-approved action plan.

Comment

Inspiration

The EU AI Act creates important obligations for organizations that develop, provide, or deploy artificial intelligence. Large companies can rely on specialized legal and compliance teams, while European startups and SMEs often have limited time, budget, and regulatory expertise.

I created AI Act Compliance Navigator to make the first stage of AI compliance assessment more understandable, explainable, and actionable.

The platform does not provide legal advice or certify compliance. Instead, it helps founders, product teams, and compliance professionals identify potential risk areas, missing controls, relevant regulatory evidence, and decisions that require qualified human review.

What it does

AI Act Compliance Navigator guides a company through a structured questionnaire covering:

  • its activities in the European Union;
  • how it develops, provides, or deploys AI;
  • potentially sensitive or high-risk use cases;
  • personal-data processing and GDPR indicators;
  • transparency and human-oversight measures;
  • governance and documentation controls;
  • international data transfers and external providers.

The platform transforms the answers into a company-specific assessment containing:

  • EU AI Act and GDPR relevance indicators;
  • potential high-risk and prohibited-practice warnings;
  • missing governance and compliance controls;
  • prioritized recommendations;
  • a personalized regulatory timeline;
  • links to official European sources;
  • multilingual PDF and DOCX reports;
  • a progress view showing implemented and missing controls.

A contextual assistant called Dr. A explains the assessment using the active company profile and available regulatory evidence.

Critical classifications and scores come from an auditable deterministic rules layer. The language model explains trusted results but cannot override them or independently declare that a company is legally compliant.

How it works

The application uses a modular agent architecture:

  1. The Company Profile Agent validates questionnaire answers and builds structured company memory.
  2. The Regulatory Monitoring Agent processes curated official and trusted regulatory sources.
  3. The Regulatory Matching Agent connects the company profile with relevant warnings, controls, deadlines, and evidence.
  4. Dr. A explains the assessment conversationally using question-specific context.
  5. A separate Policy Agent checks prompts and responses for prompt injection, regulatory evasion, fraud, and unsupported legal guarantees.

The backend is written in Python. The responsive frontend uses HTML, CSS, and vanilla JavaScript. The interface supports 25 languages through local translation dictionaries.

The repository also includes Docker execution, automated tests, continuous integration, reproducible evaluation cases, structured citations, persistent assessment snapshots, and multilingual report generation.

Building with Codex and GPT-5.6

During OpenAI Build Week, I used Codex with GPT-5.6 as my primary engineering partner.

Codex has helped me:

  • analyze and navigate a large multi-module codebase;
  • separate the Build Week edition into a clean repository;
  • evaluate architecture and product trade-offs;
  • design a stronger Work & Productivity workflow;
  • implement features across Python, JavaScript, HTML, and CSS;
  • create and expand automated tests;
  • investigate and fix CI failures from their actual logs;
  • review security boundaries and credential handling;
  • maintain technical documentation and a reproducible demo path.

The main Build Week development focused on evolving the existing assessment into a Compliance Action Workspace. It transforms identified warnings and missing controls into operational tasks with priorities, statuses, ownership, deadlines, evidence, and explicit human approval.

This creates a complete workflow from regulatory assessment to accountable execution.

Challenges

One of the main challenges was deciding which responsibilities should belong to the language model and which should remain deterministic.

Allowing a model to generate legal classifications freely would make results difficult to reproduce and audit. I therefore designed the model as an explanation layer operating over trusted structured context, while deterministic rules remain the source of truth for risk signals and applicability indicators.

Another challenge was grounding conversational answers in the active company assessment. Dr. A receives evidence selected for the specific question, and its responses are validated against the available legal references and controls.

Regulatory information can also have different reliability levels. The monitoring pipeline distinguishes official sources, cached results, and disclosed demonstration data rather than presenting every item as equally authoritative.

Finally, supporting 25 EU languages required separating assessment logic from presentation so that every localization uses the same rules and structured results.

Accomplishments that I’m proud of

I completed an end-to-end local compliance workflow that combines deterministic assessment, regulatory evidence, explainable AI assistance, operational planning, and human approval without allowing the language model to override trusted classifications.

The final application supports 25 locally translated languages, multilingual PDF and DOCX reports, persistent assessment snapshots, progress analytics, structured regulatory citations, and a Compliance Action Workspace.

The repository includes 134 automated tests, continuous integration, security checks, Docker support, reproducible evaluation scenarios, and locally protected OpenAI credentials using Windows DPAPI.

What I learned

I learned that responsible AI in compliance requires more than a capable model. It requires traceability, reproducibility, reliable evidence, explicit uncertainty, independent safeguards, and human checkpoints.

I also learned that Codex is most valuable when it participates in the complete engineering workflow: understanding architecture, implementing connected changes, validating behavior, investigating failures, and documenting the reasoning behind important decisions.

What's next

My goal is to make AI Act Compliance Navigator an open and transparent compliance-operations platform for European startups and SMEs.

Future development will include deeper article-level retrieval, secure multi-user persistence, reviewer workflows, continuous compliance-evidence collection, and broader integrations with product-development and governance systems.

Built With

Share this project:

Updates