One Codebase. One Command. Three Articles.

What Consultants Charge $30K-$500K For

EU AI Act compliance for high-risk AI systems requires three things before you can place a system on the market: technical documentation (Article 11, Annex IV), automatic event recording (Article 12), and transparency about data flows (Article 13). GDPR Article 30 adds a fourth: a record of every processing activity. Companies building with LLMs have the raw materials. They have code. They have traces. They have deployment configs. What they don't have: any automated way to turn those artifacts into regulatory evidence. That gap is currently filled by consultants ($30K-$500K per engagement, 3-6 months) and questionnaire-based tools that don't read your code. The AI governance market is $492M in 2026, projected to exceed $1B by 2030 (Gartner). Nearly all of it is manual. We automated it.

One Command

aitrace comply ./your-codebase --traces traces.json --split -o compliance-package/

That produces a directory with:

article-11-docs.md — Annex IV technical documentation. 9 sections. Auto-populated from your codebase: detected AI SDKs, model identifiers, vector databases, training data references, evaluation metrics, deployment configs, API endpoints. Manual sections flagged with [MANUAL INPUT REQUIRED].
article-12-audit.md — Compliance gap report. Maps your LLM traces (OTel, Langfuse, Claude Code, raw API logs) against 18 regulatory requirements. Per-requirement coverage scores. Evidence samples. Actionable recommendations.
article-13-flows.md — Data flow diagram (Mermaid) showing every external service your application sends data to. Color-coded by GDPR role (controller, processor, sub-processor). PII risk annotations.
data-flow.mermaid — Raw diagram source for embedding in documentation or CI dashboards.
compliance-summary.md — Single document combining all three articles with a coverage table and next steps.

Tested Against Real Codebases

The scanner has been tested against five major open-source AI frameworks: LiteLLM, n8n, Haystack, CrewAI, and Dify. Each scan analyzed thousands of files, detecting model identifiers, vector DB connections, external services, and generating compliance documentation packages. Auto-population rates ranged from 33% to 56% of required Annex IV fields, with remaining sections flagged for human input.

Why Nobody Else Built This

We researched the full competitive landscape: 130+ tools across five categories. The answer is structural, not technical. AI providers won't build it. Anthropic, OpenAI, and Google ship usage APIs. Interpreting their own trace data against external regulations creates liability and is outside their core product. Observability tools won't build it. Langfuse and Arize sell dashboards to engineers. Compliance evidence for regulators is a different buyer, different product, different sales motion. GRC platforms might eventually. OneTrust and Vanta manage controls for SOC 2, GDPR, HIPAA. But they start from policy and work toward data. Adding AI-specific trace ingestion requires understanding OTel GenAI conventions, LangChain schemas, and the gap between what LLMs log and what regulators need. Questionnaire tools exist but don't read code. AiActo, ComplyAct, and Credo AI generate Annex IV documentation through guided forms. No tool auto-generates from your actual codebase. The closest open-source option (ark-forge MCP scanner) generates starter templates, not completed documentation. The regulatory mapping is the moat. Requirements are YAML, not code. Adding a regulation means adding a file. When ISO 42001 requirements crystallize or US states pass AI disclosure laws, each one is a new definition.

What the Scanner Finds

The codebase scanner uses Python AST parsing and regex (JS/TS) to detect:

10 AI SDKs: Anthropic, OpenAI, Google GenAI, LangChain, HuggingFace, Cohere, Mistral, LlamaIndex, AutoGen, CrewAI
8 vector databases: Pinecone, Weaviate, Qdrant, ChromaDB, Milvus, pgvector, FAISS, LanceDB
14 model identifier patterns: Claude, GPT-4, Gemini, Llama, Mistral, Mixtral, Command, embeddings, Whisper, DALL-E, Stable Diffusion
Training data loading: HuggingFace datasets, pandas readers, PyTorch loaders
Evaluation metrics: sklearn scorers, classification reports, BLEU/ROUGE
Deployment configs: Dockerfiles, docker-compose, Kubernetes manifests, Terraform
API endpoints: FastAPI, Flask, Express routes that serve AI
HTTP clients, databases, cloud SDKs: for data flow mapping

Each detection feeds into the appropriate Annex IV section and the data flow diagram. GDPR roles (controller vs. processor) are auto-classified based on whether the service is self-hosted or cloud.

Then We Pointed It at Ourselves

The compliance suite was the thesis. But once we had a trace parser, we built five more analysis layers on the same infrastructure: Usage insights (aitrace insights): Cross-project dashboard. 96.4% of input tokens are cache reads. Caching saved $11,562 vs. list price. Session health (aitrace health): Scores sessions on tool reliability, API stability, MCP health. 91 sessions averaged 85/100. Workflow optimization (aitrace workflow): Sessions under 30 minutes are 2x more token-efficient. 1% correction rate. Agent intelligence (aitrace agents): 195 agent delegations reconstructed. 14 plans parsed. Predictive analysis (aitrace predict): Cost forecasting. CLAUDE.md reduces edits per file by 24%. All analysis runs locally. The data never leaves your machine. That's the moat no competitor can replicate.

Technical Details

pip install ai-trace-auditor. Python >=3.11. Pydantic v2, Typer, Rich, Jinja2, PyYAML. 12 commands. 180 tests. Zero dependencies on any LLM framework. Zero cloud. Apache 2.0. Source: github.com/BipinRimal314/ai-trace-auditor