Compliance as Code: A Study of Linux Distributions and Beyond

• URL: http://arxiv.org/abs/2603.01520v1
• Date: Mon, 02 Mar 2026 06:50:28 GMT
• Title: Compliance as Code: A Study of Linux Distributions and Beyond
• Abstract summary: The paper presents an empirical analysis of a compliance as code project addressing open source software (OSS) projects and products.<n>The dataset examined covers a little over 1,500 unique compliance rules designed and implemented for 14 Linux distribution releases from five vendors.
• Score: 0.5735035463793009
• License: http://creativecommons.org/licenses/by-nc-nd/4.0/
• Abstract: Compliance as code is an emerging idea about automating compliance through programmed compliance controls and checks. Given scant existing research thus far, the paper presents an empirical analysis of a compliance as code project addressing open source software (OSS) projects and products. The dataset examined covers a little over 1,500 unique compliance rules designed and implemented for 14 Linux distribution releases from five vendors. According to the results, (1) the coverage of the rules varies across the five vendors. Then, (2) the brief rationales provided for the rules do not exhibit statistical similarities but the short code snippets for these do show similarities to some extent. Furthermore, (3) as many as 24 controls are covered from over 10 different organizations, among them governmental agencies, standardization organizations, and non-profit associations. Finally, (4) the rules can be mapped to the essential cyber security requirements of the Cyber Resilience Act (CRA), although only modest agreement exists among the three authors regarding individual mappings. This observation supports an argument that the compliance as code project studied could be updated with new compliance checks. Given that also operating systems are in the CRA's scope when used in a network-connected product, such an updating would have also practical relevance in the nearby future.

Related papers

• AspisAI: A Canonical, Machine-Interpretable Governance Framework for Automated Multi-Standard Compliance Monitoring [0.0]
  This paper presents emphAspisAI, a bounded, standard-agnostic governance framework that translates selected requirements into a canonical, machine-interpretable control model.<n>Within a bounded scope of 26 representative requirements, the framework is evaluated in a controlled simulation against five governance-oriented criteria.<n>Results include full requirement encoding, 88.5,% mapping coverage, complete traceability, and correct detection of all introduced gaps.
  arXiv  Detail & Related papers  (2026-09-09T22:37:12Z)
• Citation-Closure Retrieval and Per-Rule Attribution for Real-World Regulatory Compliance Question Answering [54.97384993676565]
  We formalize Regulatory Compliance QA with RegOps-Bench, a novel benchmark featuring an Operational Knowledge Graph derived from complex national R&D regulations.<n>RefWalk traverses cross-document citations, fuses multi-view candidates via max-based aggregation, and enforces per-rule attribution to explicitly map claims to sources.
  arXiv  Detail & Related papers  (2026-05-28T10:38:38Z)
• Who judges the judges? Governance from metrics: a runtime framework for continuous LLM compliance monitoring [0.0]
  Current approaches to AI compliance treat conformity as a binary, audit-time verdict.<n>We argue that this compliance fiction is structurally ill-suited to the requirements of the EU AI Act.<n>We introduce governance from metrics, a principle whereby regulatory compliance is derived as a continuous signal from behavioural observability.
  arXiv  Detail & Related papers  (2026-05-23T21:21:33Z)
• Type-Checked Compliance: Deterministic Guardrails for Agentic Financial Systems Using Lean 4 Theorem Proving [0.0]
  This paper presents the Lean-Agent Protocol, a formal-verification-based AI guardrail platform.<n>Every proposed agentic action is treated as a mathematical conjecture.<n>This architecture provides cryptographic-level compliance certainty at microsecond latency.
  arXiv  Detail & Related papers  (2026-04-01T23:39:43Z)
• NERFIFY: A Multi-Agent Framework for Turning NeRF Papers into Code [49.610331036334316]
  We introduce NERFIFY, a framework that reliably converts NeRF research papers into trainable Nerfstudio plugins.<n>Code, data and implementations will be publicly released.
  arXiv  Detail & Related papers  (2026-02-28T20:57:32Z)
• Self-Evolving Coordination Protocol in Multi-Agent AI Systems: An Exploratory Systems Feasibility Study [0.0]
  Self-Evolving Coordination Protocols (SECP)<n>SECP: coordination protocols that permit limited, externally validated self-modification.<n>This paper presents an exploratory systems feasibility study of Self-Evolving Coordination Protocols.
  arXiv  Detail & Related papers  (2026-02-02T14:45:04Z)
• BRIDGE: Building Representations In Domain Guided Program Verification [67.36686119518441]
  BRIDGE decomposes verification into three interconnected domains: Code, Specifications, and Proofs.<n>We show that this approach substantially improves both accuracy and efficiency beyond standard error feedback methods.
  arXiv  Detail & Related papers  (2025-11-26T06:39:19Z)
• Subject Roles in the EU AI Act: Mapping and Regulatory Implications [0.0]
  The European Union's Artificial Intelligence Act (Regulation) 2024/1689) establishes the world's first comprehensive regulatory framework for AI systems.<n>This paper provides a structured examination of the six main categories of actors - providers, deployers, authorized representatives, importers, distributors, and product manufacturers.<n>We map the complete governance structure and analyze how the AI Act regulates these subjects.
  arXiv  Detail & Related papers  (2025-10-15T14:21:30Z)
• Safe and Certifiable AI Systems: Concepts, Challenges, and Lessons Learned [45.44933002008943]
  This white paper presents the T"UV AUSTRIA Trusted AI framework.<n>It is an end-to-end audit catalog and methodology for assessing and certifying machine learning systems.<n>Building on three pillars - Secure Software Development, Functional Requirements, and Ethics & Data Privacy - it translates the high-level obligations of the EU AI Act into specific, testable criteria.
  arXiv  Detail & Related papers  (2025-09-08T17:52:08Z)
• CoQuIR: A Comprehensive Benchmark for Code Quality-Aware Information Retrieval [44.39462689088926]
  CoQuIR is the first large-scale, multilingual benchmark designed to evaluate quality-aware code retrieval.<n>CoQuIR provides fine-grained quality annotations for 42,725 queries and 134,907 code snippets in 11 programming languages.
  arXiv  Detail & Related papers  (2025-05-31T13:00:17Z)
• Compliance-to-Code: Enhancing Financial Compliance Checking via Code Generation [36.166087396386445]
  We present Compliance-to-Code, the first large-scale Chinese dataset dedicated to financial regulatory compliance.<n> Covering 1,159 annotated clauses from 361 regulations across ten categories, each clause is modularly structured with four logical elements-subject, condition, constraint, and contextual information-along with regulation relations.<n>We provide deterministic Python code mappings, detailed code reasoning, and code explanations to facilitate automated auditing.
  arXiv  Detail & Related papers  (2025-05-26T10:38:32Z)
• Do Not Trust Licenses You See: Dataset Compliance Requires Massive-Scale AI-Powered Lifecycle Tracing [45.6582862121583]
  This paper argues that a dataset's legal risk cannot be accurately assessed by its license terms alone.<n>It argues that tracking dataset redistribution and its full lifecycle is essential.<n>We show that AI can perform these tasks with higher accuracy, efficiency, and cost-effectiveness than human experts.
  arXiv  Detail & Related papers  (2025-03-04T16:57:53Z)
• Code Compliance Assessment as a Learning Problem [0.15229257192293197]
  We formulate code compliance assessment as a machine learning (ML) problem. We generate a prediction on the code's compliance, non-compliance, or irrelevance. Our tool Policy2Code achieves classification accuracies of (59%, 71%) and search MRR of (0.05, 0.21) In a user study, 24% Policy2Code detections were accepted compared to 7% for CodeBERT.
  arXiv  Detail & Related papers  (2022-09-10T05:41:04Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.