Does the EU AI Act apply to Python projects?

The EU AI Act does not regulate programming languages. It regulates AI systems that affect people in the EU. If your Python project uses machine learning to make or inform decisions about people — hiring, lending, content moderation, medical triage — and those people are in the EU, the Act applies regardless of the language your code is written in.

How do I scan my Python code for EU AI Act compliance?

Install Regula with pipx install regula-ai, then run regula check . in your project directory. Regula scans Python files for import patterns, function calls, and variable names that indicate AI system behaviour covered by the EU AI Act. It reports a risk tier (prohibited, high-risk, limited-risk, or minimal) and lists specific findings with article references.

What Python AI frameworks does Regula detect?

Regula detects patterns from PyTorch, TensorFlow, Keras, scikit-learn, Hugging Face transformers, LangChain, LlamaIndex, OpenAI SDK, Anthropic SDK, and other common Python AI/ML libraries. Detection is based on import statements, function calls such as model.predict() or pipeline(), and variable naming patterns that indicate AI system behaviour.

EU AI Act compliance for Python developers

Python dominates AI development. If you use PyTorch, TensorFlow, scikit-learn, Hugging Face transformers, LangChain, or any ML framework in a product that reaches EU users, the EU AI Act applies to you. The regulation does not care which language you write in. It cares what your code does to people.

25 June 2026 · Kuziva Muzondo

Python frameworks that trigger risk patterns

Regula scans Python files for import patterns, function calls, and variable names that map to EU AI Act obligations. Here is what it looks for in each major framework.

PyTorch and TensorFlow

Model loading (torch.load(), tf.saved_model.load()), prediction calls (model(input), model.predict()), and training pipelines (loss.backward(), model.fit()). These indicate an AI system exists. The risk tier depends on what the model does — a cat classifier and a loan scorer both use model.predict(), but only one is high-risk.

scikit-learn

Classification (RandomForestClassifier, LogisticRegression), regression, and clustering on personal data. scikit-learn models are common in employment screening, credit scoring, and insurance pricing — all Annex III high-risk categories.

Hugging Face transformers

Sentiment analysis pipelines, named entity recognition, text generation, and zero-shot classification. A pipeline("sentiment-analysis") call on customer reviews is limited-risk (Article 50 transparency). The same call on job applications is high-risk (Annex III Category 4).

LangChain and LlamaIndex

Agent autonomy patterns, tool use, and retrieval-augmented generation. Regula flags agent chains where an LLM decides which tools to invoke, because autonomous decision-making raises the risk tier when it affects people.

OpenAI and Anthropic SDKs

API calls (openai.chat.completions.create(), anthropic.messages.create()) and chat completion patterns. Using an API does not exempt you from the AI Act — Article 26 places obligations on deployers, not just providers. If you build on top of a foundation model, you inherit obligations based on your use case.

Important: not every match is high-risk. A PyTorch import in a research notebook and a PyTorch import in a production hiring tool are different things. Regula reports what it finds; you decide whether the context makes it relevant.

Quick start: scanning a Python project

pipx install regula-ai
regula check .                      # scan current directory
regula check . --domain healthcare  # activate domain-specific patterns
regula assess                       # interactive: does the AI Act apply?

regula check scans all Python files in the directory tree. It does not execute your code, install dependencies, or send data anywhere. Everything runs locally.

The --domain flag activates domain-specific risk patterns. Without it, Regula only flags patterns that are high-risk regardless of domain (biometric identification, social scoring, etc.). With --domain healthcare, it also flags medical triage, diagnostic, and treatment recommendation patterns.

regula assess is a guided questionnaire that helps you determine whether the AI Act applies to your product at all. No code scanning required — just answer the questions.

Understanding the output

A scan produces a verdict and a list of findings. Here is what a typical result looks like:

$ regula check .

Regula Scan: /home/dev/myproject
============================================================

  Verdict: HIGH-RISK
  Your project is classified as high-risk under EU AI Act Annex III.

  Files scanned:      34
  High-risk:          1
  Limited-risk:       0

  HIGH-RISK INDICATORS:
    [INFO] [ 43] app.py — Employment and workers management [plan]

============================================================
  Confidence scores: 0-100 (higher = more indicators matched)
  Tiers: BLOCK (>=80 or prohibited), WARN (50-79), INFO (<50)
  Suppress findings: add '# regula-ignore' to file

The three tiers:

BLOCK (confidence 80+, or prohibited practice): high confidence this is a regulated AI pattern. You need to act on this before deployment.
WARN (confidence 50-79): moderate confidence. Worth investigating. May be a regulated pattern or may be a false positive depending on context.
INFO (confidence below 50): low confidence indicator. Regula found something that could be relevant but likely needs more context to determine.

The number in brackets (e.g. [ 95]) is the confidence score. The lifecycle tag ([plan], [develop], [deploy]) indicates which phase of development the finding is most relevant to.

Common Python patterns Regula flags

Deserialisation with no input validation

# Flagged: pickle.load() / joblib.load() with no validation
model = pickle.load(open("model.pkl", "rb"))
model = joblib.load("classifier.joblib")

Article 15 (accuracy, robustness, and cybersecurity) requires that AI systems are resilient to errors and attacks. Loading serialised models without validation is a known attack vector — an adversary can craft a pickle file that executes arbitrary code. Regula flags this as a robustness concern.

Predictions with no logging

# Flagged: model.predict() with no record-keeping
result = model.predict(user_data)
send_decision(result)  # no log of what was predicted or why

Article 12 requires high-risk AI systems to have automatic logging of events during operation. If your model makes predictions that affect people and you are not logging the inputs, outputs, and timestamps, that is a gap.

Sentiment analysis without disclosure

# Flagged: sentiment analysis on user content
from transformers import pipeline
classifier = pipeline("sentiment-analysis")
result = classifier(user_message)

Article 50 (transparency obligations for certain AI systems) requires that people are told when they are interacting with an AI system or when AI is being used to analyse their content. Running sentiment analysis on user messages without telling the user is a transparency gap.

CV screening and candidate ranking

# Flagged: employment screening patterns
candidates = rank_candidates(applications, model)
shortlist = [c for c in candidates if c.score > threshold]

Annex III Category 4 covers AI systems used in employment, specifically for screening applications, evaluating candidates, and making recruitment decisions. Variable names like candidates, applications, and function names like rank_candidates combined with model scoring patterns trigger this category.

What Regula does not check in Python

Regula is a static analysis tool. There are things it cannot do, and you should know what they are.

Runtime model behaviour. Regula reads your source files. It does not execute your code, load your models, or observe inference behaviour. A model that discriminates at runtime will not be caught by static analysis.
Training data quality. Regula can detect whether training data loading patterns exist (e.g. pd.read_csv("training_data.csv")), but it cannot assess whether your training data is representative, balanced, or free of bias. Article 10 (data and data governance) requires this, but it is beyond code scanning.
Model fairness metrics. regula bias exists as a separate command, but it is limited. It does not compute fairness metrics across protected groups. Use dedicated tools like Fairlearn or AI Fairness 360 for that.
Dependency vulnerabilities. Regula does not scan your requirements.txt or pyproject.toml for known CVEs. Use pip-audit or safety for that. Article 15 cares about cybersecurity, but dependency scanning is a separate concern.

CI/CD integration for Python projects

Add Regula to your GitHub Actions pipeline so every pull request gets scanned. Here is a minimal workflow:

# .github/workflows/regula.yml
name: EU AI Act Scan

on:
  pull_request:
    paths:
      - '**.py'

jobs:
  regula-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Install Regula
        run: pipx install regula-ai

      - name: Scan for AI Act risk patterns
        run: regula check . --format json > regula-report.json

      - name: Upload report
        uses: actions/upload-artifact@v4
        with:
          name: regula-report
          path: regula-report.json

The --format json flag outputs structured JSON, which you can parse in subsequent steps or feed into dashboards. Regula also supports --format sarif for GitHub Code Scanning integration.

If you want the workflow to fail on findings, add --ci to the check command. Regula returns a non-zero exit code when it finds WARN or BLOCK-tier indicators.

Last verified: 25 June 2026 · Author: Kuziva Muzondo · Not legal advice. Regula identifies risk indicators in code for developer review. It does not determine compliance or replace professional legal counsel.