Validating Runtime Compliance for AI Agents with ComplyEdge

Practical Summary and Core Functionality

ComplyEdge is a specialized governance platform designed to enforce compliance with the EU AI Act and other global regulations at runtime. Unlike periodic scanners that analyze static repositories, ComplyEdge operates on every request, providing a deterministic, audit-ready decision for each interaction. By utilizing a combination of OPA/Rego policies and a YAML-based rule corpus, the platform blocks non-compliant prompts or outputs before they reach the user. Every decision is accompanied by a specific article citation, rule ID, and timestamp, transforming compliance from a probabilistic estimate into a verifiable audit trail. The platform is intended for developers and organizations needing to ensure their AI agents adhere to legal requirements such as Article 5 and Article 50 of the EU AI Act.

Prerequisites and Installation

To begin using ComplyEdge, you must have a Python environment configured. The platform offers three primary delivery methods: a Python SDK for direct integration, an offline CI linter called TrustLint, and an MCP server for integration with AI hosts like Claude or Cursor. For standard Python projects, you can install the core SDK using pip install complyedge. If you intend to use the MCP server capabilities, you should install the relevant extras using pip install 'complyedge[mcp]'. For CI/CD pipelines, the TrustLint package can be installed independently via pip install trustlint. Ensure your environment is prepared to handle the specific requirements of your chosen integration path, such as setting the COMPLYEDGE_API_KEY environment variable for hosted API features.

Implementing the Python SDK Decorator

The most straightforward way to integrate ComplyEdge into an existing AI agent is through the provided Python decorator. This approach ensures that every input and output of your agent is evaluated against the rule corpus. By wrapping your generation function with @compliance_check, you enable automatic enforcement. The decorator requires a jurisdiction parameter, such as "EU", to map the request against the appropriate regulatory framework. If a violation is detected, the system blocks the request and provides the necessary legal context. You can disable the enforcement temporarily without removing the decorator by setting the COMPLYEDGE_ENABLED environment variable to false, which is particularly useful for CI/CD environments.

from complyedge import compliance_check

@compliance_check(jurisdiction="EU", agent_id="my-agent")
def my_agent(prompt):
    return llm.generate(prompt)  # every input and output checked

Utilizing the MCP Server for AI Hosts

ComplyEdge provides an MCP server that allows AI agents to perform compliance checks as tools. This server is built on the official MCP Python SDK and runs fully offline, requiring no API key or network calls for its core operations. It exposes three primary tools: check_compliance for validating text against the rule corpus, list_rules for viewing available regulations by jurisdiction, and scan_prompt for pre-generation risk detection. To configure this for local hosts like Claude Desktop or Cursor, you must add the server to your MCP configuration file. This setup allows your agent to query the compliance engine directly, receiving article-cited feedback instead of simple probability scores.

Offline Compliance with TrustLint

For scenarios where network connectivity is restricted or where you need to integrate compliance checks into a CI/CD pipeline, TrustLint serves as an offline regex-based linter. It operates independently of the main SDK and does not require an API key. By scanning text against the bundled YAML rule corpus, TrustLint identifies potential violations and returns specific rule IDs and article citations. This tool is designed to return standard exit codes, where 0 indicates a pass and 1 indicates that violations were found. This makes it an ideal choice for automated testing, ensuring that code or prompts do not violate regulatory standards before they are deployed to production environments.

Understanding Rule Namespaces and Audit Trails

ComplyEdge manages rules through two distinct namespaces, which are important for maintaining an accurate audit trail. The Runtime API, which utilizes OPA/Rego, returns IDs such as rego-art5-1c-001. These IDs are logged by your production system to provide a clear record of compliance decisions. Conversely, the TrustLint offline linter uses IDs like EU_AI_ACT_ART5_SOCIAL_SCORING_001. While the namespaces differ based on the engine used, both systems cite the same legal articles. You can map between these namespaces using the article reference carried in every rule. This dual-engine approach ensures that whether you are performing real-time production checks or offline CI scans, the underlying legal logic remains consistent and traceable.

Limitations and Evidence Classification

It is critical to understand that not all compliance findings carry the same weight. ComplyEdge categorizes its rules based on whether the engine can definitively verify the act. For 21 rules, the text itself constitutes the regulated act, such as prohibited practices under Article 5, making the block load-bearing and definitive. However, 43 other rules fire on text that describes a state—such as the existence of a quality management system or human oversight—which a text matcher cannot independently verify. These are useful for triage but do not constitute a definitive compliance finding. Users should consult the official documentation regarding the corpus evidence classification to understand the scope of each rule.

Choosing When to Use ComplyEdge

ComplyEdge is intended for organizations that must demonstrate compliance with the EU AI Act and other frameworks at runtime. It is most effective when integrated into production systems where binary pass/block decisions are required to mitigate legal risk. The platform is not a general-purpose scanner but a specialized tool for runtime enforcement. If your requirements include maintaining a detailed, cited audit trail of every AI interaction, ComplyEdge provides the necessary infrastructure. Before implementation, review the official repository to ensure your specific regulatory needs align with the current rule corpus, which covers jurisdictions including the EU, US, and global standards like PCI DSS.