Scanara

Hey IH, first post here so some background on why this exists.

I'm a solo developer, and about a year ago I ran straight into the EU AI Act — the EU's AI regulation that's now actually in force, not just proposed. If you're building or shipping AI features, you're likely in scope more often than you'd guess: HR tools, credit scoring, insurance pricing, plenty of things people don't file under "regulated AI" turn out to be exactly that. High-risk systems need real evidence — risk classification, technical documentation, an audit trail — not just a good intention.

I looked at what handling this the normal way would cost me: a compliance consultant, tens of thousands of euros, months of back-and-forth, for one system. I didn't have that as a solo founder. The other option — becoming an EU regulatory law expert on the side while still shipping my actual product — wasn't realistic either, and I'd probably still get it wrong without legal training. Neither path exists for someone building alone.

So I looked at what a consultant or a compliance questionnaire actually asks for: what does the system do, how does it decide things, what oversight and logging exist. And I realized — that information already lives in the codebase. Nobody should have to redescribe it from memory in a form. It just needs to be read out of the code that's already there.

That's what I built. Scanara scans a repo — code with Semgrep, docs/policies with OPA — and shows where it stands against the EU AI Act's requirements, straight from what's actually in the codebase. It's rule-based, not some black-box AI making the call for you — the rules are generated from the regulation's own text, and the actual judgment on what's high-risk stays with you, the developer, not the tool.

Free to scan a real repo, no credit card, no sales call: https://scanara.io/en/

I'm early and solo, so genuinely asking rather than pitching: if you build AI products and have run into this (or expect to — it applies even if you're a US/UK company selling into the EU), how are you handling it today? And what would make an automated compliance tool actually feel trustworthy to you, versus just another box-ticking exercise?