precommiteu-models

The scanner itself is a separate pure-Python package on PyPI (pip install precommiteu); this repository holds only the model files it runs. One shared base model serves every role, orchestrator, detector and validator, with a small LoRA adapter per regulation swapped in for detection. Eight EU regulations are covered: GDPR, the EU AI Act, NIS2, DORA, the Cyber Resilience Act, the Digital Services Act, the Digital Markets Act and the Data Act.

A real scan, unedited: about 80 seconds on an M-series MacBook, played back at 5×. Replay it step by step at precommit.eu/try, including the cross-file lookup that turns a harmless-looking log line into a confirmed GDPR Art. 32 finding.

No finding without proof. The adapter here is only stage one: it proposes candidates. A validator then has to locate the quoted evidence verbatim in the file, or the candidate is dropped. Confirmed findings cite the line. Candidates that fail validation are reported as advisories and never fail a build.

The Zen of EU Code

1. Put purpose before collection.
2. Collect less than you could, and keep it for less time.
3. Let people know what the system knows.
4. Make consent a choice, not a trap.
5. Give people working controls over their data.
6. Protect what you keep, from design to update.
7. Children deserve stronger defaults.
8. Explain automated decisions before they become consequences.
9. Build systems that fail safely, recover clearly, and report harm responsibly.
10. Make switching, portability, and interoperability real.

Files

base.gguf: Qwen2.5-Coder-7B-Instruct, Q4_K_M, 4.36 GiB. Shared by every regulation and by all three roles.

Every adapter is 77 MiB. SHA256SUMS covers all seven files:

shasum -a 256 -c SHA256SUMS

Which adapters do I need?

cra_dma_nis2 is one adapter covering three related acts:

Everything above except NIS2 is a Regulation: it applies directly and identically in every member state from its date, with no national step. NIS2 is a Directive, so it binds each member state to legislate rather than applying on its own: what you comply with is your country's implementing act. Transposition was due 17 October 2024; most states have legislated, a few are still behind, so the detail varies by country.

The AI Act applies in stages: prohibitions and AI-literacy duties since 2 February 2025, general-purpose AI model obligations since 2 August 2025, most remaining provisions from 2 August 2026, and Article 6(1) high-risk duties from 2 August 2027.

gdpr is the sensible default for almost any product repo; the other five are opt-in when your sector or feature set matches.

Use each adapter only where its regulation applies. Every adapter is trained and evaluated on code its own regulation governs. Pointed at a codebase outside that scope it produces unreliable output, flagging code that is not a violation under that regulation. Loading all six is not more thorough: only noisier.

Download

pip install -U "huggingface_hub[cli]"

# everything, ~4.9 GB
hf download AlexandruGirlea/precommiteu-models --local-dir ~/.precommiteu/models

# or base + one regulation, ~4.5 GB
hf download AlexandruGirlea/precommiteu-models \
    base.gguf gdpr/detector-adapter.gguf \
    --local-dir ~/.precommiteu/models

Then:

export PRECOMMITEU_MODELS_DIR=~/.precommiteu/models
precommiteu scan src/

The directory names match the scanner's --regulations values; it resolves <models-dir>/<regulation>/detector-adapter.gguf. Full instructions in the installation guide.

Links

• precommit.eu, the project site
• Replay a real scan, a recorded GDPR scan step by step
• Documentation
• Source on GitHub

Runtime

Served by llama.cpp llama-server (build b4400+), which the scanner starts and stops itself. Every response is constrained by a formal grammar (GBNF), so the model can only produce the exact output shape the scanner expects. Runs on CPU, or faster with Metal on Apple Silicon and CUDA on NVIDIA GPUs.

16 GB of RAM is the practical minimum. A scan runs two servers side by side, one on the plain base model and one on the base model with a detector adapter, and each loads its own full copy of the weights. Measured peak is about 6.3 GiB per server, so roughly 12.6 GiB together.

Most of what sits on top of the 4.36 GiB model file is the context window: the model holds everything it has read so far in memory, at roughly 56 KiB per token, per server. Halving the window with --n-ctx 16384 (the default is 32768) brings the pair down to about 10.8 GiB. On an 8 GB machine the default will fall back to swapping to disk, or the scan will be killed for running out of memory.

These are not general-purpose chat models. The adapters are trained for one task, flagging candidate regulatory violations in source files, and they are used through the scanner, not directly.

Training

One LoRA fine-tune per regulation over the shared base weights, trained in-house on a private labelled dataset. Quality is measured against held-out labelled data rather than standard code benchmarks.

Limitations

Output is a compliance signal, not legal advice. Confirmed findings with source: "precommiteu" are backed by verbatim code evidence; findings with source: "retrieval" cite a matched violation pattern instead and carry no quoted line. Unconfirmed candidates are surfaced separately as advisories and should not gate a build. Coverage is limited to the articles in each regulation pack.

Disclaimer

These models are free and fully open source under the Apache License 2.0, and are provided as is, without warranty or condition of any kind, express or implied. Use is entirely at your own risk. There is no service level and no guarantee of accuracy or fitness for any purpose.

They produce a compliance signal, not legal advice: they can flag code that is not a violation and can miss violations that are present. No output establishes, certifies or evidences compliance with any regulation.

The author is not a lawyer and provides no legal, regulatory or compliance advice. These models do not replace legal analysis. To the maximum extent permitted by applicable law, Alexandru Girlea accepts no liability for any damages, losses, costs, regulatory outcome or misrepresentation arising from their use or from reliance on their output. Have findings reviewed by qualified legal counsel before acting on them.

License

Apache 2.0, for everything here: the adapters, and the quantized base.

base.gguf is derived from Qwen2.5-Coder-7B-Instruct (Copyright Alibaba Cloud / Qwen team, Apache-2.0), converted to GGUF and quantized to Q4_K_M with no other changes to the weights. The adapters are derivative works trained by Alexandru Girlea and are released under the same licence. See NOTICE.