Compliance as code is the practice of turning regulatory and industry requirements, such as CIS Benchmarks, PCI DSS or internal audit controls, into automated checks. Each control maps to one or more rules that run against code and systems, producing continuous, repeatable evidence instead of manual audit spreadsheets.
Compliance as code builds on policy as code. The difference is the source of the rules: policy as code covers any rule, while compliance as code maps rules to external frameworks and keeps the mapping for auditors.
For infrastructure teams, the strongest place to apply compliance as code is before deployment. Steampunk Spotter checks Ansible Playbooks and Terraform plans against CIS benchmarks and custom compliance policies at commit and in CI/CD. Non-compliant changes are blocked before they reach production, and each result becomes audit evidence of which code passed which control, and when. The same rules apply whether a person or an AI coding assistant wrote the code.
In short, compliance as code is policy as code where every rule traces back to a named regulation or standard.
