Scanara Turns AI Act Evidence Into Working Dossiers

An AI team can have working software, a set of internal policies and a growing pile of questions about the EU AI Act, yet still lack the evidence needed to explain what its system is and what obligations apply. The difficult part is not only interpreting the regulation. It is connecting that interpretation to the code, documents and decisions behind a real product.

Scanara is built around that connection. It scans GitHub repositories, evaluates technical documentation and collects structured answers from the people responsible for an AI system. It then uses those inputs to map a possible risk category and assemble a compliance dossier. The target users are AI providers and deployers, particularly teams that cannot justify repeated, expensive manual review cycles.

The problem is scattered evidence

Compliance work often starts with information in different places. Source code may show how a system uses models or handles data. Technical documentation may describe intended use. A product team or legal adviser may hold the answers to questions about deployment, affected people and the system's role in a larger workflow.

Scanara's approach is to bring those sources into one assessment. Its code scanner looks for patterns it considers relevant to the AI Act. A policy evaluation covers technical documentation. Questionnaires add structured assessments that code alone cannot provide.

That last part matters. A repository cannot reliably answer every question about intended purpose, deployment context or fundamental rights. Scanara includes assessments for Annex III high-risk screening, a Fundamental Rights Impact Assessment, a Data Protection Impact Assessment and prohibited-practice screening. It also identifies workflows for deployers, GPAI providers and systems that may fall within the general-purpose AI rules.

The result is not simply a scan report. The product is intended to turn technical and organisational evidence into a record that a team can continue working on.

From repository scan to risk classification

Scanara says it derives a classification across four broad AI Act categories: minimal, limited, high and prohibited risk. It also includes dedicated support for General-Purpose AI and systemic-risk models.

This is the part of the product that answers the first practical question for a team: what kind of regulatory path might this system require? A repository scan can surface relevant implementation patterns, while the documentation review and questionnaires add context that static analysis cannot see. Taken together, those inputs are meant to give a more useful starting point than treating every AI feature as the same compliance problem.

The wording is important, though. A classification produced from scans and submitted answers is an assessment aid, not proof that a system is legally compliant. Its usefulness depends on the repository being connected, the documentation being accurate and the questionnaires being answered with enough detail. Teams will still need to check the findings and supply evidence that an automated process cannot infer.

The dossier is the actual deliverable

The product's central output is a compliance dossier. Scanara says it can populate fields from scan and assessment data where the available source supports it. Remaining evidence and engineering details are written in the platform.

That division reflects the reality of this kind of work. Automation can collect findings and reduce repetitive entry, but it cannot invent missing design decisions, test results or explanations of how a system is governed. The developer describes the dossier as covering technical documentation associated with Article 11 and Annex IV, along with related obligations.

When the record is complete, it can be exported as PDF, DOCX, HTML or Markdown. Those formats make the result easier to share with reviewers, auditors or other people who do not work inside the platform. Scanara also offers merge gates and monitoring plans, according to the developer, so teams can check compliance as features change rather than treating the dossier as a one-time document.

That makes the product more than a one-off questionnaire. Its intended workflow is recurring: connect a repository, review the findings, answer the relevant assessments, complete the evidence, export the dossier and monitor later changes.

Where Scanara fits, and where it does not

Scanara has a free plan and a paid upgrade. It runs on the web, with GitHub repositories as a core input. That makes it a plausible fit for an AI startup or engineering team already keeping source and technical material in structured digital workflows and looking for a shared starting point for AI compliance.

It is a poorer fit for teams expecting an automated verdict with no manual work. The product does not remove the need to provide evidence, resolve ambiguous findings or decide whether its assessment reflects the system's real use. It also cannot help a team that has no usable repository, weak technical documentation or no owner for the resulting dossier. The web-only delivery may be another constraint for organisations that require a desktop or self-hosted compliance workflow.

The practical value of Scanara is therefore narrower than “make the system compliant.” It addresses the administrative and investigative gap between an AI codebase and the documentation needed to discuss its regulatory risk. For providers and deployers willing to review automated findings and finish the record themselves, that is a concrete problem to solve. For anyone looking for legal sign-off in a button press, it is the wrong tool.