precommitEU model bundle

Weights for precommitEU, a local-first EU regulatory compliance scanner for source code.

The scanner itself is a separate pure-Python package on PyPI (pip install precommiteu); this repository holds only the model files it runs. One shared base model serves every role, orchestrator, detector and validator, with a small LoRA adapter per regulation swapped in for detection. Eight EU regulations are covered: GDPR, the EU AI Act, NIS2, DORA, the Cyber Resilience Act, the Digital Services Act, the Digital Markets Act and the Data Act.

precommitEU scanning a Python project for GDPR violations

A real scan, unedited: about 80 seconds on an M-series MacBook, played back at 5ร—. Replay it step by step at precommit.eu/try, including the cross-file lookup that turns a harmless-looking log line into a confirmed GDPR Art. 32 finding.

No finding without proof. The adapter here is only stage one: it proposes candidates. A validator then has to locate the quoted evidence verbatim in the file, or the candidate is dropped. Confirmed findings cite the line. Candidates that fail validation are reported as advisories and never fail a build.

The Zen of EU Code

  1. Put purpose before collection.
  2. Collect less than you could, and keep it for less time.
  3. Let people know what the system knows.
  4. Make consent a choice, not a trap.
  5. Give people working controls over their data.
  6. Protect what you keep, from design to update.
  7. Children deserve stronger defaults.
  8. Explain automated decisions before they become consequences.
  9. Build systems that fail safely, recover clearly, and report harm responsibly.
  10. Make switching, portability, and interoperability real.

Files

base.gguf: Qwen2.5-Coder-7B-Instruct, Q4_K_M, 4.36 GiB. Shared by every regulation and by all three roles.

--regulations value Regulation Adapter
gdpr General Data Protection Regulation gdpr/detector-adapter.gguf
eu_ai_act EU AI Act eu_ai_act/detector-adapter.gguf
eu_data_act EU Data Act eu_data_act/detector-adapter.gguf
dora Digital Operational Resilience Act dora/detector-adapter.gguf
dsa Digital Services Act dsa/detector-adapter.gguf
cra_dma_nis2 Cyber Resilience Act / DMA / NIS2 cra_dma_nis2/detector-adapter.gguf

Every adapter is 77 MiB. SHA256SUMS covers all seven files:

shasum -a 256 -c SHA256SUMS

Which adapters do I need?

Adapter Regulation Applies since Use it when your codeโ€ฆ
gdpr General Data Protection Regulation, Regulation (EU) 2016/679 25 May 2018 touches personal data: user records, auth, profiles, logging, exports, analytics
eu_ai_act Artificial Intelligence Act, Regulation (EU) 2024/1689 2 Aug 2026 (phased) builds, serves or calls AI models; automated decisions, biometrics
eu_data_act Data Act, Regulation (EU) 2023/2854 12 Sep 2025 is a connected/IoT product, or does data sharing, access requests, cloud switching
dora Digital Operational Resilience Act, Regulation (EU) 2022/2554 17 Jan 2025 belongs to a financial entity: payments, trading, ICT risk, incident reporting
dsa Digital Services Act, Regulation (EU) 2022/2065 17 Feb 2024 runs a platform with user content: moderation, recommenders, ads

cra_dma_nis2 is one adapter covering three related acts:

Regulation Applies since Use it when your codeโ€ฆ
CRA, Cyber Resilience Act, Regulation (EU) 2024/2847 11 Dec 2027 (reporting duties 11 Sep 2026) ships a product with digital elements: vulnerability handling, secure updates, SBOM
DMA, Digital Markets Act, Regulation (EU) 2022/1925 2 May 2023 belongs to a designated gatekeeper: interoperability, self-preferencing, data reuse
NIS2, Network and Information Systems Directive 2 (EU-wide cybersecurity), Directive (EU) 2022/2555 via national law, due 17 Oct 2024 runs an essential or important entity in one of 18 critical sectors: risk management, incident reporting

Everything above except NIS2 is a Regulation: it applies directly and identically in every member state from its date, with no national step. NIS2 is a Directive, so it binds each member state to legislate rather than applying on its own: what you comply with is your country's implementing act. Transposition was due 17 October 2024; most states have legislated, a few are still behind, so the detail varies by country.

The AI Act applies in stages: prohibitions and AI-literacy duties since 2 February 2025, general-purpose AI model obligations since 2 August 2025, most remaining provisions from 2 August 2026, and Article 6(1) high-risk duties from 2 August 2027.

gdpr is the sensible default for almost any product repo; the other five are opt-in when your sector or feature set matches.

Use each adapter only where its regulation applies. Every adapter is trained and evaluated on code its own regulation governs. Pointed at a codebase outside that scope it produces unreliable output, flagging code that is not a violation under that regulation. Loading all six is not more thorough: only noisier.

Download

pip install -U "huggingface_hub[cli]"

# everything, ~4.9 GB
hf download AlexandruGirlea/precommiteu-models --local-dir ~/.precommiteu/models

# or base + one regulation, ~4.5 GB
hf download AlexandruGirlea/precommiteu-models \
    base.gguf gdpr/detector-adapter.gguf \
    --local-dir ~/.precommiteu/models

Then:

export PRECOMMITEU_MODELS_DIR=~/.precommiteu/models
precommiteu scan src/

The directory names match the scanner's --regulations values; it resolves <models-dir>/<regulation>/detector-adapter.gguf. Full instructions in the installation guide.

Links

Runtime

Served by llama.cpp llama-server (build b4400+), which the scanner starts and stops itself. Every response is constrained by a formal grammar (GBNF), so the model can only produce the exact output shape the scanner expects. Runs on CPU, or faster with Metal on Apple Silicon and CUDA on NVIDIA GPUs.

16 GB of RAM is the practical minimum. A scan runs two servers side by side, one on the plain base model and one on the base model with a detector adapter, and each loads its own full copy of the weights. Measured peak is about 6.3 GiB per server, so roughly 12.6 GiB together.

Most of what sits on top of the 4.36 GiB model file is the context window: the model holds everything it has read so far in memory, at roughly 56 KiB per token, per server. Halving the window with --n-ctx 16384 (the default is 32768) brings the pair down to about 10.8 GiB. On an 8 GB machine the default will fall back to swapping to disk, or the scan will be killed for running out of memory.

These are not general-purpose chat models. The adapters are trained for one task, flagging candidate regulatory violations in source files, and they are used through the scanner, not directly.

Training

One LoRA fine-tune per regulation over the shared base weights, trained in-house on a private labelled dataset. Quality is measured against held-out labelled data rather than standard code benchmarks.

Limitations

Output is a compliance signal, not legal advice. Confirmed findings with source: "precommiteu" are backed by verbatim code evidence; findings with source: "retrieval" cite a matched violation pattern instead and carry no quoted line. Unconfirmed candidates are surfaced separately as advisories and should not gate a build. Coverage is limited to the articles in each regulation pack.

Disclaimer

These models are free and fully open source under the Apache License 2.0, and are provided as is, without warranty or condition of any kind, express or implied. Use is entirely at your own risk. There is no service level and no guarantee of accuracy or fitness for any purpose.

They produce a compliance signal, not legal advice: they can flag code that is not a violation and can miss violations that are present. No output establishes, certifies or evidences compliance with any regulation.

The author is not a lawyer and provides no legal, regulatory or compliance advice. These models do not replace legal analysis. To the maximum extent permitted by applicable law, Alexandru Girlea accepts no liability for any damages, losses, costs, regulatory outcome or misrepresentation arising from their use or from reliance on their output. Have findings reviewed by qualified legal counsel before acting on them.

License

Apache 2.0, for everything here: the adapters, and the quantized base.

base.gguf is derived from Qwen2.5-Coder-7B-Instruct (Copyright Alibaba Cloud / Qwen team, Apache-2.0), converted to GGUF and quantized to Q4_K_M with no other changes to the weights. The adapters are derivative works trained by Alexandru Girlea and are released under the same licence. See NOTICE.

Downloads last month
56
GGUF
Model size
8B params
Architecture
qwen2
Hardware compatibility
Log In to add your hardware

We're not able to determine the quantization variants.

Inference Providers NEW
This model isn't deployed by any Inference Provider. ๐Ÿ™‹ Ask for provider support

Model tree for AlexandruGirlea/precommiteu-models

Base model

Qwen/Qwen2.5-7B
Adapter
(734)
this model