GitLab compliance pipelines — the feature that forces compliance- or security-related CI jobs to run in projects assigned a compliance framework label — are deprecated and will be removed in GitLab 20.0. The replacement is the pipeline execution policy type.

What this means for you

Compliance pipelines are how many GitLab organizations guarantee that certain CI/CD jobs — security scans, license checks, audit steps — always run in the pipelines of projects tagged with a compliance framework, regardless of what an individual project's `.gitlab-ci.yml` says. GitLab deprecated the feature in GitLab 17.3 and, per its official deprecations page, will remove it in GitLab 20.0 — which GitLab's own release schedule dates to 20 May 2027. GitLab's reasoning is consolidation: it offers two overlapping mechanisms today — compliance pipelines and security policies — and wants a single place to enforce required jobs, so it is steering everyone to the newer pipeline execution policy type. Who this affects: compliance and platform teams at organizations that use compliance framework labels to inject required jobs. When 20.0 lands, a compliance pipeline configuration that has not been migrated stops enforcing those jobs — meaning the security scans or audit steps you assumed were running everywhere may silently no longer run. This is a breaking change, so it needs a deliberate migration rather than a wait-and-see.

Where to go

Migrate from compliance pipelines to the new **pipeline execution policy** type before GitLab 20.0 (20 May 2027). GitLab recommends doing this "as soon as possible" and publishes a dedicated migration guide and the tracking epic (gitlab-org epic 11275). The practical steps: inventory which compliance framework labels currently point at a compliance pipeline configuration and what jobs each injects; recreate that enforcement as a pipeline execution policy, which GitLab says offers more flexibility — including assigning required pipelines to specific compliance framework labels; then verify on a test project that the required jobs run before retiring the old compliance pipeline configuration. GitLab positions pipeline execution policies (part of its security policies framework) as the single forward mechanism, so teams still split between compliance pipelines and security policies should consolidate onto the policy model.

• Pipeline execution policies — GitLab's named replacement; enforce required CI jobs and can be scoped to specific compliance framework labels
• Security policies — the broader GitLab framework that pipeline execution policies are part of, for consolidating compliance and security enforcement in one place