EU AI Act compliance for Python developers

Python frameworks that trigger risk patterns

Regula scans Python files for import patterns, function calls, and variable names that map to EU AI Act obligations. Here is what it looks for in each major framework.

PyTorch and TensorFlow

Model loading (torch.load(), tf.saved_model.load()), prediction calls (model(input), model.predict()), and training pipelines (loss.backward(), model.fit()). These indicate an AI system exists. The risk tier depends on what the model does — a cat classifier and a loan scorer both use model.predict(), but only one is high-risk.

scikit-learn

Classification (RandomForestClassifier, LogisticRegression), regression, and clustering on personal data. scikit-learn models are common in employment screening, credit scoring, and insurance pricing — all Annex III high-risk categories.

Hugging Face transformers

Sentiment analysis pipelines, named entity recognition, text generation, and zero-shot classification. A pipeline("sentiment-analysis") call on customer reviews is limited-risk (Article 50 transparency). The same call on job applications is high-risk (Annex III Category 4).

LangChain and LlamaIndex

Agent autonomy patterns, tool use, and retrieval-augmented generation. Regula flags agent chains where an LLM decides which tools to invoke, because autonomous decision-making raises the risk tier when it affects people.

OpenAI and Anthropic SDKs

API calls (openai.chat.completions.create(), anthropic.messages.create()) and chat completion patterns. Using an API does not exempt you from the AI Act — Article 26 places obligations on deployers, not just providers. If you build on top of a foundation model, you inherit obligations based on your use case.

Important: not every match is high-risk. A PyTorch import in a research notebook and a PyTorch import in a production hiring tool are different things. Regula reports what it finds; you decide whether the context makes it relevant.

Quick start: scanning a Python project

pipx install regula-ai
regula check .                      # scan current directory
regula check . --domain healthcare  # activate domain-specific patterns
regula assess                       # interactive: does the AI Act apply?

regula check scans all Python files in the directory tree. It does not execute your code, install dependencies, or send data anywhere. Everything runs locally.

The --domain flag activates domain-specific risk patterns. Without it, Regula only flags patterns that are high-risk regardless of domain (biometric identification, social scoring, etc.). With --domain healthcare, it also flags medical triage, diagnostic, and treatment recommendation patterns.

regula assess is a guided questionnaire that helps you determine whether the AI Act applies to your product at all. No code scanning required — just answer the questions.

Understanding the output

A scan produces a verdict and a list of findings. Here is what a typical result looks like:

$ regula check .

Regula Scan: /home/dev/myproject
============================================================

Decision: insufficient_information
Jurisdiction: eu
Rule resolution: unresolved
Facts needed to resolve the next decision: 2
  - is_ai_system: Does the subject meet the governing law's definition of an AI system or regulated automated technology?
  - jurisdiction_in_scope: Does this jurisdiction's territorial and operator scope apply?

Detector observations (not legal facts):

  Detector summary: ANNEX III OR SECURITY PATTERNS
  The scanner found patterns relevant to Annex III or security review.
  Resolve the facts listed above before attaching Article 9 to 15 duties.

  Files scanned:      34
  High-risk:          1
  Limited-risk:       0

  HIGH-RISK INDICATORS:
    [INFO] [ 43] app.py — Employment and workers management [plan]

============================================================
  Detector priority: 0-100 (higher = more code patterns matched; not a correctness probability)
  Tiers: BLOCK (>=80 or prohibited), WARN (50-79), INFO (<50)
  Suppress findings: add '# regula-ignore' to file

The three tiers:

• BLOCK (confidence 80+, or prohibited practice): high confidence this is a regulated AI pattern. You need to act on this before deployment.
• WARN (confidence 50-79): moderate confidence. Worth investigating. May be a regulated pattern or may be a false positive depending on context.
• INFO (confidence below 50): low confidence indicator. Regula found something that could be relevant but likely needs more context to determine.

The number in brackets (e.g. [ 95]) is the confidence score. The lifecycle tag ([plan], [develop], [deploy]) indicates which phase of development the finding is most relevant to.

Common Python patterns Regula flags

Deserialisation with no input validation

# Flagged: pickle.load() / joblib.load() with no validation
model = pickle.load(open("model.pkl", "rb"))
model = joblib.load("classifier.joblib")

Article 15 (accuracy, robustness, and cybersecurity) requires that AI systems are resilient to errors and attacks. Loading serialised models without validation is a known attack vector — an adversary can craft a pickle file that executes arbitrary code. Regula flags this as a robustness concern.

Predictions with no logging

# Flagged: model.predict() with no record-keeping
result = model.predict(user_data)
send_decision(result)  # no log of what was predicted or why

Article 12 requires high-risk AI systems to have automatic logging of events during operation. If your model makes predictions that affect people and you are not logging the inputs, outputs, and timestamps, that is a gap.

Sentiment analysis without disclosure

# Flagged: sentiment analysis on user content
from transformers import pipeline
classifier = pipeline("sentiment-analysis")
result = classifier(user_message)

Article 50 (transparency obligations for certain AI systems) requires that people are told when they are interacting with an AI system or when AI is being used to analyse their content. Running sentiment analysis on user messages without telling the user is a transparency gap.

CV screening and candidate ranking

# Flagged: employment screening patterns
candidates = rank_candidates(applications, model)
shortlist = [c for c in candidates if c.score > threshold]

Annex III Category 4 covers AI systems used in employment, specifically for screening applications, evaluating candidates, and making recruitment decisions. Variable names like candidates, applications, and function names like rank_candidates combined with model scoring patterns trigger this category.

What Regula does not check in Python

Regula is a static analysis tool. There are things it cannot do, and you should know what they are.

• Runtime model behaviour. Regula reads your source files. It does not execute your code, load your models, or observe inference behaviour. A model that discriminates at runtime will not be caught by static analysis.
• Training data quality. Regula can detect whether training data loading patterns exist (e.g. pd.read_csv("training_data.csv")), but it cannot assess whether your training data is representative, balanced, or free of bias. Article 10 (data and data governance) requires this, but it is beyond code scanning.
• Model fairness metrics. regula bias exists as a separate command, but it is limited. It does not compute fairness metrics across protected groups. Use dedicated tools like Fairlearn or AI Fairness 360 for that.
• Dependency vulnerabilities. Regula does not scan your requirements.txt or pyproject.toml for known CVEs. Use pip-audit or safety for that. Article 15 cares about cybersecurity, but dependency scanning is a separate concern.

CI/CD integration for Python projects

Add Regula to your GitHub Actions pipeline so every pull request gets scanned. Here is a minimal workflow:

# .github/workflows/regula.yml
name: EU AI Act Scan

on:
  pull_request:
    paths:
      - '**.py'

jobs:
  regula-check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.12'

      - name: Install Regula
        run: pipx install regula-ai

      - name: Scan for AI Act risk patterns
        run: regula check . --format json > regula-report.json

      - name: Upload report
        uses: actions/upload-artifact@v4
        with:
          name: regula-report
          path: regula-report.json

The --format json flag outputs structured JSON, which you can parse in subsequent steps or feed into dashboards. Regula also supports --format sarif for GitHub Code Scanning integration.

If you want the workflow to fail on findings, add --ci to the check command. Regula returns a non-zero exit code when it finds WARN or BLOCK-tier indicators.

---

Related

• Article 14: human oversight requirements for AI systems
• Article 9: risk management system requirements
• EU AI Act risk tiers explained with code examples
• How to classify your AI system under the EU AI Act
• Does the EU AI Act apply to you?
• Static analysis for AI compliance

---

Last reviewed: 14 August 2026 · Author: Kuziva Muzondo · Not legal advice. Regula identifies risk indicators in code for developer review. It does not determine compliance or replace professional legal counsel.