What this document describes
This document describes the architecture of the EU AI Act Compliance Management System and the relationships between its components — how the repository is structured, how each module is built, and how everything traces back to evidence.
Six principles the system is built on
Compliance by Design
Documentation by Design
Evidence by Design
Traceability by Design
Inspection Readiness by Design
Continuous Improvement
How the repository is laid out
Every module sits at the same level, alongside the root governance documents that apply across all of them.
The model every module follows
Every one of the 10 modules follows the same seven-stage engineering model, without exception:
What the system consists of
Alongside the 10 modules and 70 controlled documents, the system includes Repository Governance Documents, Version Control, Audit Documentation, and Inspection Documentation.
Every document links to the next
What governs the repository
- README
- DOCUMENT_INDEX
- DOCUMENT_TRACEABILITY_MATRIX
- COMPLIANCE_MATRIX
- CHANGELOG
- AUDIT_PLAN
- INSPECTION_GUIDE
How an inspector navigates the repository
What each release includes
Git Tag
GitHub Release
Zenodo DOI
CHANGELOG Update
Current status
Frequently asked questions
How many modules does the Compliance Management System have?
10 modules, together forming 70 controlled documents, plus repository governance, version control, audit, and inspection documentation.
What is the document model inside each module?
Every module follows the same seven-stage model: Policy, Procedure, Work Instruction, Checklist, Register, Evidence, and Declaration, each linked to the next.
Can a Declaration exist without supporting Evidence?
No. No declaration exists without supporting evidence — this is a structural rule of the traceability architecture, not a style preference.
In what order does an inspector navigate the repository?
README, then DOCUMENT_INDEX, then the relevant Module, then its Register, Evidence, and Declaration, then the Traceability Matrix, then the Compliance Matrix.
What governs the repository itself?
README, DOCUMENT_INDEX, DOCUMENT_TRACEABILITY_MATRIX, COMPLIANCE_MATRIX, CHANGELOG, AUDIT_PLAN, and INSPECTION_GUIDE.
What does each release include?
A Git Tag, a GitHub Release, a Zenodo DOI, and a CHANGELOG update.
What are the core architectural principles?
Compliance by Design, Documentation by Design, Evidence by Design, Traceability by Design, Inspection Readiness by Design, and Continuous Improvement.