Lints a Hugging Face model card against the Hub metadata spec and the EU AI Act GPAI documentation duties. Line numbers, the article, the fix. Runs entirely in your browser — nothing is uploaded.
Same engine as the VS Code extension, byte for byte.
Free for the file open in your editor - no key, no limit. The workspace sweep and the report ask for a key.
VS Code MarketplaceOpen VSX (Cursor, VSCodium)npmMCP server (npx)Docker Hubext install ReadyStack.model-card-lint-gpai npx @readystack/model-card-lint-gpai <file> npx @readystack/model-card-lint-gpai --mcp
Team? One key for every ReadyStack linter, 5 seats, $149 once
Lint every model card in the repository in one pass and export the dated audit as a file you keep: Markdown for the reviewer, JSON a CI step can fail on.
One payment, one licence key for this tool. The key is shown right after payment.
An hour of an EU AI Act compliance consultant starts near $200; the Act's own ceiling for a GPAI provider is EUR 15,000,000 or 3% of worldwide annual turnover (Art. 101).
Buy the full version — $29· ReadyStack
Real numbers from this tool, line by line.

Six lines in a 34-line German clinical model card, and an EU reviewer has enough to send it back. The card belonged to a Berlin ML engineer who was one commit from publishing: run the check over it and 29 findings come back, 12 of them errors, across 25 of the 28 rules.
None of the six were hard. license: other was declared with neither license_name nor license_link, so the Hub has terms it cannot resolve. tags: sat there with nothing under it. Four lines still read [More Information Needed] — the Hugging Face template's own placeholder, saying in writing that the section was never filled in. One line still carried an unrendered {{ base_model }}. ## Uses had another heading directly beneath it. And nowhere in the file was there a summary of training content.
That last one is the one with a date on it. The EU AI Act's obligations for providers of general-purpose AI models sit in Article 53: a policy to comply with Union copyright law, including honouring machine-readable text-and-data-mining rights reservations, and a sufficiently detailed public summary of the content used for training, written on the Commission's template. As of 12 September 2026 that duty has been in force for 41 days. Models placed on the EU market before 2 August 2025 have until 2 August 2027 — 324 days from today — and everything after that is already due. A model card that never states when the model was placed on the market never says which of the two clocks it is on.
The obvious move is to paste the card into a chatbot and ask it to improve the documentation. It returns better prose. It does not count. It will not tell you there are four [More Information Needed] lines left, because counting is not what it is doing; it will not know that license: other needs two more keys, because that is a Hub rule and not a language rule; and asked which article carries the training-content summary, it will give you an article number in a confident sentence that may simply be wrong. A compliance checklist has to be reproducible; a generated answer is not.
Nine are Hub metadata: the frontmatter block itself, license, the license_name + license_link pair that license: other drags in, pipeline_tag, library_name, language, datasets, tags, model-index. Five are template leftovers: [More Information Needed], unrendered {{ ... }}, TODO markers, your-username/ placeholders, and a heading with nothing under it. A line that is still a placeholder is also struck out before every other rule reads the file, so Developed by: [More Information Needed] does not count as having named a provider.
Eleven are the AI Act GPAI duties: training-content summary, copyright policy, provider identity, intended use, out-of-scope use, evaluation, limitations and bias, energy consumption, training compute against the Article 51 presumption at 10^25 FLOP, the authorised representative Article 54 asks of a provider established outside the Union, and the placing-on-the-market date. Three are provenance and staleness, including an "as of 2025" line that has outlived its year.
Two fixtures ship with it. _fixtures/clean.md returns 0 findings; _fixtures/dirty.md, 34 lines, returns 29 findings and 12 errors. Change the date in the box and the two date-aware rules change with it.
Linting the card you have open is free, every rule, nothing uploaded. The licence buys scope: every card in the repository in one pass, exported as Markdown and as JSON a CI step can fail on.
It reads the Markdown model card you have open and applies 28 rules: 9 on Hugging Face Hub frontmatter, 5 on template leftovers such as [More Information Needed], 11 on EU AI Act general-purpose AI duties, and 3 on provenance and staleness. Each finding carries a line number, the rule id, the article behind it, and the line to write instead.
ML engineers and MLOps leads who publish models on the Hugging Face Hub or fine-tune one for a product that reaches EU users, and the person who has to sign the model off. If you have ever pasted the Hub template and shipped it with the sections half filled, this is aimed at you.
A general model rewrites your prose and leaves the gaps. It does not count the four [More Information Needed] left in the file, it does not know that license: other needs license_name and license_link too, and it invents article numbers with total confidence. This runs 28 fixed rules and returns the same count every time.
Linting the card you have open is free forever, every rule, no key and no account, in the editor or in the browser. The licence is for scope and ownership: sweeping every model card in a repository in one pass, and exporting the dated audit as Markdown and as JSON a CI step can fail on.
An hour of an EU AI Act compliance consultant starts near $200, and a documentation review covers one model. The extension is $29 once, one licence key per person or CI seat,. The Act's own ceiling for a GPAI provider is EUR 15,000,000 or 3% of worldwide annual turnover.
A general AI chat answers from training data with a cutoff date, cannot read your repository and names no rule version. Model Card Lint - Hugging Face model card and EU GPAI (Art. checks the file you open against 28 rules from a rule set dated 2026-09-20, and points at the exact line. For a filing, an audit or a client you need that dated result on your own files.
One question, answered by the person who built it. Your email only if you want the answer sent.
Paste this code into your page. It runs in your visitor’s browser and stays up to date. Nothing your visitors type is stored.
For businesses: your name and logo instead of ours, and each visitor’s result + e-mail in your inbox (only when they tick consent) — Pro from $19/month. See Pro →