As of April 26, 2026, the AI industry is 98 days from the original August 2 enforcement deadline for high-risk systems. While the European Parliament’s March 26 vote (569-45) significantly increases the likelihood of a delay to December 2027 via the Digital Omnibus, the technical requirements of Articles 9–15 remain the fixed objective for engineering teams.

To quantify the readiness of the ecosystem, we conducted a source-code audit using Regula (v1.7.0). We analyzed 19,426 files across five cornerstone AI frameworks. The analysis identifies "compliance surface"—code patterns that trigger specific legal obligations under the Act.

The Framework Audit

Engineering Findings

Human Oversight (Article 14)
The highest density of agentic autonomy indicators was found in CrewAI. Under Article 14, high-risk systems must be designed for human intervention. Our scan identified 56 instances where autonomous loops lack native confirmation gates, shifting the compliance burden entirely to the end-implementer.

Cybersecurity and Weights (Article 15)
HuggingFace Transformers triggered 113 specific AI security patterns. These primarily involve model-loading and serialization risks. Article 15(4) mandates protection against model poisoning; using these frameworks requires a verified provenance chain for all external weights.

Data Governance (Article 10)
We identified 79 patterns in LlamaIndex indicating PII or sensitive data flowing into or out of LLMs without redaction. Article 10(5) requires training and testing data to be securely governed. Frameworks that facilitate RAG on sensitive datasets create a direct Article 10 surface and significant information disclosure risks.

Project Details
Regula is a zero-dependency Python CLI for AI governance. It uses 409 unique detection patterns to map code to the EU AI Act, OWASP LLM Top 10, and NIST AI RMF. It runs locally and generates signed evidence packs for regulatory submission.

*Source: https://github.com/kuzivaai/getregula
*