Weights for precommitEU,
a local-first EU regulatory compliance scanner for source code.
The scanner itself is a separate pure-Python package on PyPI
(pip install precommiteu); this repository holds only the model files it
runs. One shared base model serves every role, orchestrator, detector and
validator, with a small LoRA adapter per regulation swapped in for detection.
Eight EU regulations are covered: GDPR, the EU AI Act, NIS2, DORA, the Cyber
Resilience Act, the Digital Services Act, the Digital Markets Act and the Data
Act.
precommitEU scanning a Python project for GDPR violations
A real scan, unedited: about 80 seconds on an M-series MacBook, played back at
5×. Replay it step by step at precommit.eu/try,
including the cross-file lookup that turns a harmless-looking log line into a
confirmed GDPR Art. 32 finding.
No finding without proof. The adapter here is only stage one: it proposes
candidates. A validator then has to locate the quoted evidence verbatim in the
file, or the candidate is dropped. Confirmed findings cite the line.
Candidates that fail validation are reported as advisories and never fail a
build.
The Zen of EU Code
Put purpose before collection.
Collect less than you could, and keep it for less time.
Let people know what the system knows.
Make consent a choice, not a trap.
Give people working controls over their data.
Protect what you keep, from design to update.
Children deserve stronger defaults.
Explain automated decisions before they become consequences.
Build systems that fail safely, recover clearly, and report harm responsibly.
Make switching, portability, and interoperability real.
Files
base.gguf: Qwen2.5-Coder-7B-Instruct, Q4_K_M, 4.36 GiB. Shared by every
regulation and by all three roles.
--regulations value
Regulation
Adapter
gdpr
General Data Protection Regulation
gdpr/detector-adapter.gguf
eu_ai_act
EU AI Act
eu_ai_act/detector-adapter.gguf
eu_data_act
EU Data Act
eu_data_act/detector-adapter.gguf
dora
Digital Operational Resilience Act
dora/detector-adapter.gguf
dsa
Digital Services Act
dsa/detector-adapter.gguf
cra_dma_nis2
Cyber Resilience Act / DMA / NIS2
cra_dma_nis2/detector-adapter.gguf
Every adapter is 77 MiB. SHA256SUMS covers all seven files:
belongs to a designated gatekeeper: interoperability, self-preferencing, data reuse
NIS2, Network and Information Systems Directive 2 (EU-wide cybersecurity), Directive (EU) 2022/2555
via national law, due 17 Oct 2024
runs an essential or important entity in one of 18 critical sectors: risk management, incident reporting
Everything above except NIS2 is a Regulation: it applies directly and
identically in every member state from its date, with no national step. NIS2 is
a Directive, so it binds each member state to legislate rather than
applying on its own: what you comply with is your country's implementing act.
Transposition was due 17 October 2024; most states have legislated, a few are
still behind, so the detail varies by country.
The AI Act applies in stages: prohibitions and AI-literacy duties since
2 February 2025, general-purpose AI model obligations since 2 August 2025, most
remaining provisions from 2 August 2026, and Article 6(1) high-risk duties from
2 August 2027.
gdpr is the sensible default for almost any product repo; the other five are
opt-in when your sector or feature set matches.
Use each adapter only where its regulation applies. Every adapter is
trained and evaluated on code its own regulation governs. Pointed at a codebase
outside that scope it produces unreliable output, flagging code that is not a
violation under that regulation. Loading all six is not more thorough: only
noisier.
Download
bash
1pip install -U "huggingface_hub[cli]"23# everything, ~4.9 GB4hf download AlexandruGirlea/precommiteu-models --local-dir ~/.precommiteu/models
56# or base + one regulation, ~4.5 GB7hf download AlexandruGirlea/precommiteu-models \8 base.gguf gdpr/detector-adapter.gguf \9 --local-dir ~/.precommiteu/models
The directory names match the scanner's --regulations values; it resolves
<models-dir>/<regulation>/detector-adapter.gguf. Full instructions in the
installation guide.
Served by llama.cpp llama-server (build b4400+), which the scanner starts and
stops itself. Every response is constrained by a formal grammar (GBNF), so the
model can only produce the exact output shape the scanner expects. Runs on CPU,
or faster with Metal on Apple Silicon and CUDA on NVIDIA GPUs.
16 GB of RAM is the practical minimum. A scan runs two servers side by side,
one on the plain base model and one on the base model with a detector adapter,
and each loads its own full copy of the weights. Measured peak is about 6.3 GiB
per server, so roughly 12.6 GiB together.
Most of what sits on top of the 4.36 GiB model file is the context window: the
model holds everything it has read so far in memory, at roughly 56 KiB per
token, per server. Halving the window with --n-ctx 16384 (the default is
32768) brings the pair down to about 10.8 GiB. On an 8 GB machine the default
will fall back to swapping to disk, or the scan will be killed for running out
of memory.
These are not general-purpose chat models. The adapters are trained for one
task, flagging candidate regulatory violations in source files, and they are
used through the scanner, not directly.
Training
One LoRA fine-tune per regulation over the shared base weights, trained
in-house on a private labelled dataset. Quality is measured against held-out
labelled data rather than standard code benchmarks.
Limitations
Output is a compliance signal, not legal advice. Confirmed findings with
source: "precommiteu" are backed by verbatim code evidence; findings with
source: "retrieval" cite a matched violation pattern instead and carry no
quoted line. Unconfirmed candidates are surfaced separately as advisories and
should not gate a build. Coverage is limited to
the articles in each regulation pack.
Disclaimer
These models are free and fully open source under the Apache License 2.0, and
are provided as is, without warranty or condition of any kind, express or
implied. Use is entirely at your own risk. There is no service level and no
guarantee of accuracy or fitness for any purpose.
They produce a compliance signal, not legal advice: they can flag code that is
not a violation and can miss violations that are present. No output
establishes, certifies or evidences compliance with any regulation.
The author is not a lawyer and provides no legal, regulatory or compliance
advice. These models do not replace legal analysis. To the maximum extent
permitted by applicable law, Alexandru Girlea accepts no liability for any
damages, losses, costs, regulatory outcome or misrepresentation arising from
their use or from reliance on their output. Have findings reviewed by
qualified legal counsel before acting on them.
License
Apache 2.0, for everything here: the adapters, and the quantized base.
base.gguf is derived from
Qwen2.5-Coder-7B-Instruct
(Copyright Alibaba Cloud / Qwen team, Apache-2.0), converted to GGUF and
quantized to Q4_K_M with no other changes to the weights. The adapters are
derivative works trained by Alexandru Girlea and are released under the same
licence. See NOTICE.
