Governance-as-Code: Translating EU AI Act Technical Requirements into Executable Compliance Pipelines for Generative AI Systems

arXiv:2609.20016v1 Announce Type: new Abstract: The EU AI Act (Regulation 2024/1689) imposes technical obligations on high-risk AI providers, yet Articles 8-15 were drafted for predictive AI and leave seven technical gaps when applied to generative systems, spanning non-deterministic data governance, training-data provenance, continuous conformity, human oversight, open-ended robustness, emergent risk, and generative fairness. We deliver Governance-as-Code (GaC), a framework of 43 machine-checkable acceptance criteria across six compliance modules that run in a CI/CD pipeline and emit Article-indexed audit evidence, and we show the actual Rego policy code rather than merely describing it. Our central commitment is that the Act's open-textured standards ("appropriate levels," "possible biases") become declared, auditable numbers: robustness thresholds are derived from the provider's documented baseline and a state-of-the-art floor, and framing bias is collapsed into eight measurable proxies tested by counterfactual demographic probing. We also correct who owes what, since under Article 25 and Chapter V a downstream deployer relies on the upstream provider's Article 53 training-data summary and documents only the layers it controls, so GaC verifies that summary rather than demanding per-sample documentation the deployer never had. We validate on two enterprise deployments, a high-risk advisory chatbot and a limited-risk content generator, benchmarking against a manual expert audit rather than documentation artifacts that were never designed to enforce compliance. GaC reproduc

Item discusses a framework for compliance with EU AI Act, but implications for human flourishing are uncertain.

The Governance-as-Code framework improves compliance transparency and auditing efficiency for the EU AI Act, enabling more precise accountability in generative AI systems. While it reduces audit labor and could enhance safety, reliance on automated audit processes carries some risk if misapplied or incomplete in scope. The approach promotes regulatory clarity but does not eliminate AI risks inherent in generative technologies.

This is a technical governance tool paper, not a claim about AI's societal trajectory itself. It suggests modest positive implications for regulatory enforceability of AI systems, but validation is limited to two case studies and the approach risks oversimplifying qualitative legal standards into narrow metrics.

This paper presents a concrete, executable framework for AI governance that significantly reduces the cost of compliance for high-risk generative AI. By translating abstract legal requirements into measurable, auditable code, it streamlines regulatory processes and promotes adherence to safety and ethical standards. The framework's validation against manual audits demonstrates its effectiveness in identifying compliance violations.

SOURCE     arXiv cs.CY (Computers and Society) (tier 1)
   ↓
DOCUMENT   53d9e8a3-e868-4b70-afc6-b2d39fb5462e
           https://arxiv.org/abs/2609.20016
   ↓
EVIDENCE   2 extracted excerpts
   ↓
MODEL RUN  4 runs, methodology 1.0.1
   ↓
SCORE      -10  (Mixed or uncertain)
   ↓
CONFIDENCE 54%