Comply

Overview#

Anar Comply is an automated compliance engine that checks AI systems against multiple regulatory frameworks: UAE AI Ethics Guidelines, Saudi SDAIA AI Ethics Principles, Qatar National AI Ethics Framework, Oman AI & Digital Future, and the EU AI Act. It generates assessment reports, identifies compliance gaps with remediation guidance, and produces formal compliance certificates.

Government organizations deploying AI must demonstrate compliance with national and international regulations. Comply automates this process — instead of manual audits that take weeks, teams can run an assessment in seconds and receive a scored report with specific gaps and recommended fixes.

Key Capabilities#

Multi-Framework Assessment#

Assess an AI system against one or more regulatory frameworks simultaneously. Comply evaluates system features against each framework's requirements and produces per-framework scores along with an overall compliance score.

Gap Analysis#

When requirements are not met, Comply identifies the specific gap, its severity (critical, high, medium, low), and provides a concrete remediation recommendation. This turns a compliance report from a pass/fail checkbox into an actionable improvement plan.

Certificate Generation#

For systems that meet compliance thresholds, Comply generates formal compliance certificates with the organization name, assessed frameworks, scores, and a validity period.

Violations Tracking#

Track and manage compliance violations over time with severity classification, remediation status, and trend analysis. The violations dashboard provides filtering by framework, severity, and status for systematic resolution.

Remediation Workflow#

Each compliance gap includes actionable remediation recommendations with priority levels and estimated effort. Teams can track remediation progress and re-assess to verify fixes.

Guard Integration#

Comply integrates with Anar Guard to pull real-time governance data — policy enforcement status, PII detection coverage, audit trail completeness — into compliance assessments. This ensures assessments reflect the actual state of the deployed system, not just declared features.

Supported Frameworks#

Frameworks are defined as structured YAML/JSON files, making it straightforward to add new frameworks or update existing ones as regulations evolve.

Architecture#

Comply uses a FastAPI backend on port 8004 with a Next.js dashboard on port 3004. The backend consists of four engines:

• Framework Registry — Loads and serves compliance framework definitions from YAML/JSON files
• Assessment Engine — Scores system features against framework requirements using weighted scoring
• Gap Analysis Engine — Extracts unmet requirements with severity and remediation
• Certificate Generator — Produces compliance certificates for passing assessments

Quick Start#

cd comply/backend
uv sync
uv run uvicorn anar_comply.main:app --reload --port 8004

Run an assessment:

curl -X POST "http://localhost:8004/api/v1/comply/assess?framework_ids=uae-ai-ethics&framework_ids=sdaia-ai-ethics" \
  -H "Content-Type: application/json" \
  -d '{
    "system_name": "Anar Chat",
    "system_type": "conversational_ai",
    "risk_level": "medium",
    "data_types": ["personal_data", "government_data"],
    "deployment_region": "uae",
    "features": {
      "has_audit_trail": true,
      "has_bias_detection": true,
      "has_human_oversight": true,
      "has_data_encryption": true,
      "has_explainability": true
    }
  }'

Dashboard#

The Comply dashboard provides ten views:

• Overview — Aggregate compliance scores, gap distribution, and framework status
• Frameworks — Browse framework requirements with region filtering
• Reports — Detailed assessment results with per-requirement breakdowns
• Gap Analysis — Filterable gaps with severity and remediation recommendations
• Certificates — Generated compliance certificates
• Timeline — Score progression over time
• Violations — Track violations by framework, severity, and resolution status
• Remediation — Remediation workflow with progress tracking
• Settings — Assessment configuration and Guard integration settings
• Live Assessment — Real-time assessment with weighted scoring against connected systems

Observability#

Comply is instrumented with OpenTelemetry via anar_shared.setup_otel(). When OTEL_EXPORTER_OTLP_ENDPOINT is set, traces, logs, and metrics are exported to the OTel Collector.

MCP Server#

Comply exposes a Model Context Protocol server at /mcp via FastApiMCP, enabling AI assistants to run assessments, query frameworks, and generate certificates programmatically.

Gateway Integration#

When GATEWAY_URL is set, Comply routes LLM calls through Anar Gateway for unified cost tracking and safety scanning.

Test Suite#

216 tests cover framework loading, assessment scoring, gap analysis, certificate generation, violations tracking, remediation workflows, Guard integration, and live assessment.

cd comply/backend && uv run pytest

Next Steps#

• Frameworks — Detailed coverage of each supported regulatory framework
• Assessments — How weighted scoring and live assessment work
• Certificates — Generating and managing compliance certificates
• API Reference — Full endpoint documentation