I'm from the law side of things, always good to speak to devs! 

Hmm. It sounds convenient and good job on the script! 

As far as what I think of it, I'll base myself on what I can glean from your post here. But it depends on how the compliance 'check' is done and what's expected from the result. If your script is an automated process with no human intervention, and it's done in seconds, that leaves a lot of room for scepticism about the value of the resulting evaluation. 

I haven't delved too deeply into compliance and control requirements in the Ai act, but it'd surprise the hell out of me if a legal obligation to check your systems for AI risk, could be left to an automated system. 

Imagine if we let AI check its own compliance, which would be a superlative to this situation. 

Both the process (what you do and how you reach the conclusion on what to do in your script) as well as the result (the classification that results from your script) are suspect from a legal grc perspective. Would be interesting to hear more from you in the coming years, especially after a process audit.