Governance-as-Code: Translating EU AI Act Technical Requirements into Executable Compliance Pipelines for Generative AI Systems

The EU AI Act (Regulation 2024/1689) imposes technical obligations on high-risk AI system providers, yet its requirements were drafted for predictive AI. Applying Articles 8–15 to generative AI systems reveals seven technical gaps where the regulation's requirements are ambiguous or infeasible for LLM-based systems: output non-determinism breaks data governance assumptions (Article 10), foundation model training data resists per-sample documentation (Article 11), model updates evade the substantial modification trigger for re-assessment (Article 9), autonomous agents outpace human oversight capacity (Article 14), open-ended generation has no bounded output space for robustness testing (Article 15), emergent capabilities defy component-level risk identification (Article 9), and generative outputs lack the fixed classification targets that fairness metrics require (Article 10). For each gap, we propose an engineering solution implementable in a CI/CD pipeline. We deliver Governance-as-Code (GaC), a framework comprising 43 machine-checkable acceptance criteria organized into six compliance modules: data lineage, output monitoring, human oversight hooks, robustness testing, risk registry, and audit logging. We validate on two enterprise deployments: a regulated-domain advisory chatbot (high-risk under Annex III) and a content generation system (limited-risk under Article 50). GaC identifies 12 compliance failures that existing governance tooling (IBM AI FactSheets, Google Model Cards) missed, including three that would trigger enforcement penalties under the Act's provisions. The framework reduces manual compliance audit time by 75% while maintaining full Article 8–15 coverage.