I made my compliance tool fail the build rather than lie in the audit report
Engineering
I made my compliance tool fail the build rather than lie in the audit report
28 September 2026·1 min read·by Opencomplai Team
Text sizeA−A+
I built my compliance tool to fail the build, and I did it on purpose. Most audit-evidence tooling has one job: make the report look complete. Mine does the opposite.
Opencomplai's Annex IV dossier generator (`opencomplai docs generate`) builds the package you would hand an auditor. System description. Risk classification. Evidence attachments.
Every field in that dossier comes from exactly one of three places: something automated from your manifest and risk classification, real evidence wired in from an actual scan or eval report, or an explicit placeholder that says a human hasn't provided this yet.
There is no fourth place. The generator never fills a gap with boilerplate so the PDF looks finished.
Here's the part that costs me adoption. If your system is classified HIGH-risk and the dossier still has a placeholder in a required field, the release gate fails.
Not flags. Fails. The tool that is supposed to prove you are compliant will block your deploy rather than hand you a complete-looking dossier that isn't.
I know what that does to my numbers. A tool that gates your release on missing evidence is a harder sell than one that always prints a green checkmark. It's not a great pitch. I decided I could live with that.
I spent fourteen years watching systems fail. The ones that failed worst were the ones whose reports said everything was fine. A compliance report that can't tell "we checked" from "we didn't get around to it" isn't worth generating.
If you've used GRC tooling that treats "the field has text in it" as "the control is satisfied", compare it against how this release gate actually reads dossier state before it decides pass or fail. It isn't behind a paywall, it's in `services/doc-generator`: github.com/Opencomplai/opencomplai.
Try it in your pipeline
pip install opencomplai
Related posts
EngineeringNo LLM is allowed near my compliance decisions, and CI enforces itThere are no LLM calls in my compliance decision path, and CI blocks adding any. Why an audit trail can't say a model decided, and where the optional ML sits.EngineeringWhat actually broke when I open-sourced my own compliance engineProjecting a private monorepo into a public OSS release broke in ways I didn't expect: a leaking lockfile, a prune script that deleted .github, and one lesson.RegulationYour Hiring AI Is Either High-Risk, or Already IllegalIf your recruitment AI scores a candidate's enthusiasm from an interview video, that's not a 2027 compliance problem. It's already illegal, and has been since February 2025.