Whitepaper — Draft v0.9 — July 2026
Automated Detection, Risk Classification, and Documentation of AI Systems under the EU AI Act
Ahmed Gharbi · Guardia AI
The EU AI Act (Regulation (EU) 2024/1689) makes organisations legally responsible for AI systems they may not know they operate: obligations attach to what is deployed in production, while the deployed reality of a modern codebase — LLM SDKs, ML frameworks, vector databases, cloud AI services, credentials in configuration files — is rarely captured in any inventory. With high-risk obligations becoming enforceable on 2 August 2026, the first and least-served compliance step is establishing what AI exists in the stack and what risk tier it occupies. We present Guardia AI, a pipeline that (1) statically detects AI usage in software repositories across six language ecosystems, including AI usage visible only in configuration files; (2) classifies systems against the Act's risk tiers using a deterministic, citation-bearing rule engine with an evidence-based confidence score; (3) measures group-fairness metrics on customer-supplied model outputs; and (4) generates the Act's required documentation artefacts from detection data rather than blank templates, with continuous re-verification in CI. We validate the approach by applying the full pipeline to our own product and publishing the unedited results, including a defect the scanner surfaced in our own configuration. This paper documents methodology; it is a self-assessment, not a certification, and nothing in it is legal advice.
§4
Static scanning of repositories for AI usage across Python, JavaScript/TypeScript, Go, Java/Kotlin, Ruby, and Rust, extended with a configuration-file analysis layer that catches AI usage invisible to manifest parsing.
§5
A deterministic rule engine mapping declared system properties to the Act's four tiers — prohibited, high-risk, limited, minimal — with per-verdict article citations and an evidence-based confidence score.
§6
Group-fairness metrics (demographic parity, equalized odds) computed on customer-uploaded prediction data via standard estimators — measurement of model behaviour, not automated inference about it.
§§7–8
The Act's documentary artefacts generated from detection and classification data rather than blank templates, re-verified on every CI run via the same engine shipped as a GitHub Action and GitLab CI/CD component.
We ran the full pipeline on our own repository and published the unedited results, including a real defect the scanner found in our own configuration. The full writeup — self-scan report, voluntary FRIA, and Annex III self-assessment — is public.
Ahmed Gharbi. "From Repository to Regulation: Automated Detection, Risk Classification, and Documentation of AI Systems under the EU AI Act." Guardia AI, Draft v0.9, July 2026. https://guardia-ai.com/whitepaper