---
title: "List every AI model the product depends on · Agent Wranglers"
url: https://agentwranglers.se/playbook/due-diligence/security-data-and-law/ai-dependency-review
id: TDD-18
level: Recommended
applies: ai-features
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1144
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# List every AI model the product depends on and its AI Act role

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Security, data and law](https://agentwranglers.se/playbook/due-diligence/security-data-and-law.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: TDD-18
- Level: Recommended
- Chapter: [Security, data and law](https://agentwranglers.se/playbook/due-diligence/security-data-and-law.md)
- Rule: List every model provider and model version the product calls, with the contract terms on training and data retention, the monthly cost and the fallback. Record the company's AI Act role and risk class for each AI feature.
- Check: The report has one row per model with provider, model version, training terms, retention, monthly cost and a fallback test result. Every AI feature has an AI Act role and risk class, or a finding that says it has none.
- Applies when: The project uses AI models.
- How: A product built on one provider's model can lose its main feature when that model is retired or the price changes. Search the code and the invoices for every provider, including models called through a gateway. For each one, note whether the contract lets the provider train on customer data, as [Record the data terms of every AI provider](https://agentwranglers.se/playbook/compliance/processors-and-transfers/ai-provider-terms.md) asks. Test the fallback from [Keep working when the provider fails](https://agentwranglers.se/playbook/ai-features/latency-cost-and-fallbacks/provider-fallback.md) by blocking the provider in a test environment. Take the role and risk class from the company's register in [Register every AI feature with role and risk](https://agentwranglers.se/playbook/compliance/ai-act/ai-register.md). A missing register is itself a finding. A high-risk feature without its documents is a candidate deal-breaker.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Python example

```python
import re
from pathlib import Path

PROVIDER_HOSTS = re.compile(r"api\.(openai|anthropic|mistral|cohere)\.(com|ai)|generativelanguage\.googleapis\.com")

def provider_calls(repo: Path) -> set[str]:
    found = set()
    for path in repo.rglob("*"):
        if path.is_file() and path.suffix in {".py", ".js", ".ts", ".env", ".yaml"}:
            found.update(match.group(0) for match in PROVIDER_HOSTS.finditer(path.read_text(errors="ignore")))
    return found
```

### JavaScript example

```js
import { globSync, readFileSync } from 'node:fs'

const PROVIDER_HOSTS = /api\.(openai|anthropic|mistral|cohere)\.(com|ai)|generativelanguage\.googleapis\.com/g

export function providerCalls(repo) {
  const found = new Set()
  for (const file of globSync('**/*.{py,js,ts,env,yaml}', { cwd: repo })) {
    for (const match of readFileSync(`${repo}/${file}`, 'utf8').matchAll(PROVIDER_HOSTS)) found.add(match[0])
  }
  return found
}
```

## Sources

- [AI Act, Regulation (EU) 2024/1689](https://eur-lex.europa.eu/eli/reg/2024/1689/oj)

## Related rules

- CMP-19 [Record the data terms of every AI provider](https://agentwranglers.se/playbook/compliance/processors-and-transfers/ai-provider-terms.md) in Compliance and governance
- AIF-44 [Keep working when the provider fails](https://agentwranglers.se/playbook/ai-features/latency-cost-and-fallbacks/provider-fallback.md) in AI features
- CMP-40 [Register every AI feature with role and risk](https://agentwranglers.se/playbook/compliance/ai-act/ai-register.md) in Compliance and governance

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/due-diligence/security-data-and-law/ai-dependency-review">Agent Wranglers technical due diligence playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Record the product's Cyber Resilience Act duties](https://agentwranglers.se/playbook/due-diligence/security-data-and-law/cra-duties-check.md)
- Next: [Time how long it takes to leave each sub-processor](https://agentwranglers.se/playbook/due-diligence/security-data-and-law/sub-processor-exit.md)
- [Security, data and law](https://agentwranglers.se/playbook/due-diligence/security-data-and-law.md)