List every AI model the product depends on and its AI Act role

How to do it

A product built on one provider's model can lose its main feature when that model is retired or the price changes. Search the code and the invoices for every provider, including models called through a gateway. For each one, note whether the contract lets the provider train on customer data, as Record the data terms of every AI provider asks. Test the fallback from Keep working when the provider fails by blocking the provider in a test environment. Take the role and risk class from the company's register in Register every AI feature with role and risk. A missing register is itself a finding. A high-risk feature without its documents is a candidate deal-breaker.

Examples

Python example

import re
from pathlib import Path

PROVIDER_HOSTS = re.compile(r"api\.(openai|anthropic|mistral|cohere)\.(com|ai)|generativelanguage\.googleapis\.com")

def provider_calls(repo: Path) -> set[str]:
    found = set()
    for path in repo.rglob("*"):
        if path.is_file() and path.suffix in {".py", ".js", ".ts", ".env", ".yaml"}:
            found.update(match.group(0) for match in PROVIDER_HOSTS.finditer(path.read_text(errors="ignore")))
    return found

JavaScript example

import { globSync, readFileSync } from 'node:fs'

const PROVIDER_HOSTS = /api\.(openai|anthropic|mistral|cohere)\.(com|ai)|generativelanguage\.googleapis\.com/g

export function providerCalls(repo) {
  const found = new Set()
  for (const file of globSync('**/*.{py,js,ts,env,yaml}', { cwd: repo })) {
    for (const match of readFileSync(`${repo}/${file}`, 'utf8').matchAll(PROVIDER_HOSTS)) found.add(match[0])
  }
  return found
}

How to check

The report has one row per model with provider, model version, training terms, retention, monthly cost and a fallback test result. Every AI feature has an AI Act role and risk class, or a finding that says it has none.

Sources

• AI Act, Regulation (EU) 2024/1689

Related rules

• CMP-19 Record the data terms of every AI provider in Compliance and governance
• AIF-44 Keep working when the provider fails in AI features
• CMP-40 Register every AI feature with role and risk in Compliance and governance