Does the EU AI Act apply to AI code review tools?

Yes, when they're used inside the EU. Most AI code review tools fall under the general-purpose AI (GPAI) provisions because they wrap a foundation model. The obligations focus on transparency, technical documentation, copyright disclosures, and downstream user information.

Is AI code analysis high-risk under the AI Act?

Reviewing third-party code is not in Annex III, so it isn't high-risk by default. It becomes high-risk only when the output materially drives decisions in regulated domains (critical infrastructure, employment, essential services). Most engineering use is limited-risk with transparency duties.

What changes for GPAI providers in 2025–2026?

GPAI providers must publish a model card, a training-data summary, and an EU copyright policy. Downstream users (you, the engineering team) inherit the duty to keep humans in the loop and to disclose AI involvement to affected parties.

How does BYOK help with AI Act compliance?

BYOK keeps the model provider relationship under your existing DPA. The review tool becomes a thin client, your inference happens on the provider you already audited, and you can switch providers without re-papering contracts.

Decoder

Decoder Documentation

Decoder turns source code into human-readable knowledge. Read this page in your language using the switcher in the header.

Getting started

Sign in, create a project, then bring code in one of three ways: drop a single source file (.js, .ts, .py, .java, .go, .rs, .sql and 20+ more), upload a ZIP of a folder, or import any public GitHub repository. Pick a file in the tree, then click Explain. Choose your proficiency level and human or technical summary.

Bring your own AI key

In Settings → AI providers, paste a key for OpenAI, Anthropic, Google Gemini or OpenRouter. Keys are encrypted with AES-256-GCM server-side and decrypted only to forward your request — they are never returned to the browser.

Local mode (Ollama / LM Studio)

Install Ollama (https://ollama.com) or LM Studio, then in Settings → Local AI endpoints add the base URL (Ollama: http://localhost:11434, LM Studio: http://localhost:1234) and a default model. The browser calls your machine directly for inference — file bodies are not sent to AI providers. Uploaded files still live in your private server storage.

Security & ownership

You own your code, generated documentation and suggested comments. We never train on user repositories. Every database table uses Row-Level Security scoped to your account.