Pytest‑Based Validation Pipelines for AI‑Generated Creator Content to Meet UK Online Safety Act and EU AI Act Requirements in AWS Serverless Micro‑services

Overview

As AI‑driven creator platforms scale, ensuring that generated text, image, or video complies with the UK Online Safety Act (OSA) and the EU AI Act becomes a non‑negotiable gate before content reaches users. In a serverless micro‑service architecture on AWS, the most reliable way to enforce these regulations is to embed automated validation directly into the deployment pipeline using Pytest. This approach treats compliance as a testable contract: every Lambda function that produces or transforms creator content must pass a suite of statutory checks before it can be promoted to production. Below is a reproducible, copy‑pasteable pattern that combines AWS SAM (or Serverless Framework) configuration, a lightweight validation layer, and a Pytest test suite that validates against OSA prohibited‑content categories and AI‑Act risk‑tier thresholds.

Architecture Diagram (textual)

[API Gateway] --> [Content Generation Lambda] --> [Validation Layer (Lambda Layer)] --> [Storage (S3/DynamoDB)]
                               ^                                 |
                               |                                 v
                          [Pytest CI Job] <-- [Artifact Bundle (SAM build)]

The Validation Layer is a Lambda Layer that houses pure‑Python functions responsible for:

1. UK OSA checks – detection of illegal harms (e.g., child sexual exploitation, terrorism, extremist content) using keyword regex, hash‑matching against known‑bad databases, and optional integration with AWS Rekognition moderation.
2. EU AI Act checks – classification of the AI system’s risk tier (unacceptable, high, limited, minimal) based on model provenance, data‑source documentation, and output‑level metrics such as bias scores or hallucination rates.

Each function returns a boolean and a detailed error payload; the Pytest suite asserts that all functions return True for a given test artifact.

SAM Template (template.yaml)

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: >-
  Serverless micro‑service for AI‑generated creator content with compliance validation.

Globals:
  Function:
    Timeout: 30
    MemorySize: 512
    Layers:
      !Ref ValidationLayer

Resources:
  ValidationLayer:
    Type: AWS::Serverless::LayerVersion
    Properties:
      LayerName: content-validation-layer
      Description: Shared validation utilities for OSA and AI‑Act checks
      ContentUri: validation_layer/
      CompatibleRuntimes:
        - python3.11
      LicenseInfo: MIT

  GenerateContentFunction:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: generate-creator-content
      Handler: src/handlers.generate_content
      Runtime: python3.11
      CodeUri: src/
      Events:
        Api:
          Type: Api
          Properties:
            Path: /generate
            Method: post
      Environment:
        Variables:
          MODEL_ID: !Ref ModelBucket
          CONTENT_BUCKET: !Ref ContentBucket

  ContentBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Sub '${AWS::AccountId}-creator-content-${AWS::Region}'

Validation Layer (validation_layer/)

__init__.py

from .osa import check_uk_osa
from .ai_act import check_eu_ai_act

__all__ = ["check_uk_osa", "check_eu_ai_act"]

osa.py

import re
import hashlib
from typing import Tuple, Dict

# Simplified OSA prohibited‑content hash set (in production load from S3 or DynamoDB)
OSA_HASH_SET = {
    "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",  # example hash
}

UK_OSA_PATTERNS = [
    re.compile(r"child\s*sexual", re.I),
    re.compile(r"terrorism\s*propaganda", re.I),
    re.compile(r"extremist\s*ideology", re.I),
]

def _hash_content(content: str) -> str:
    return hashlib.sha256(content.encode("utf-8")).hexdigest()

def check_uk_osa(content: str) -> Tuple[bool, Dict]:
    """Return (passed, details)."""
    failures = []
    for pattern in UK_OSA_PATTERNS:
        if pattern.search(content):
            failures.append({"rule": pattern.pattern, "match": pattern.search(content).group()})
    content_hash = _hash_content(content)
    if content_hash in OSA_HASH_SET:
        failures.append({"rule": "known_bad_hash", "hash": content_hash})
    passed = len(failures) == 0
    return passed, {"failed_rules": failures} if not passed else {}

ai_act.py

from typing import Tuple, Dict

# Placeholder risk‑tier mapping – replace with actual model‑registry lookup
RISK_TIER_BY_MODEL = {
    "stable-diffusion-xl": "high",
    "gpt-4o": "limited",
    "bert-base-uncased": "minimal",
}

def check_eu_ai_act(model_id: str, output_metrics: Dict) -> Tuple[bool, Dict]:
    """Validate against EU AI Act prohibited/unacceptable risk and high‑risk obligations."""
    tier = RISK_TIER_BY_MODEL.get(model_id, "unacceptable")
    if tier == "unacceptable":
        return False, {"reason": f"Model {model_id} classified as unacceptable risk"}
    if tier == "high":
        # High‑risk systems require conformity‑assessment evidence; we check for required metrics
        required = ["bias_score", "hallucination_rate"]
        missing = [r for r in output_metrics if r not in required]
        if missing:
            return False, {"reason": f"Missing high‑risk evidence: {missing}"}
    return True, {"risk_tier": tier, "metrics": output_metrics}

Lambda Handler (src/handlers.py)

import json
import os
from validation_layer.osa import check_uk_osa
from validation_layer.ai_act import check_eu_ai_act

def generate_content(event, context):
    body = json.loads(event.get("body", "{}"))
    prompt = body.get("prompt", "")
    model_id = body.get("model_id", "stable-diffusion-xl")

    # 1️⃣ Invoke your actual generative model (omitted for brevity)
    generated = f"[SIMULATED OUTPUT FOR PROMPT: {prompt}]"

    # 2️⃣ Run compliance checks
    osa_passed, osa_details = check_uk_osa(generated)
    ai_passed, ai_details = check_eu_ai_act(model_id, {"bias_score": 0.02, "hallucination_rate": 0.01})

    if not (osa_passed and ai_passed):
        return {
            "statusCode": 400,
            "body": json.dumps({
                "error": "Content failed compliance validation",
                "osa": osa_details,
                "ai_act": ai_details,
            }),
        }

    # 3️⃣ Store compliant content (example: S3 put)
    # s3.put_object(Bucket=os.getenv("CONTENT_BUCKET"), Key=..., Body=generated)

    return {
        "statusCode": 200,
        "body": json.dumps({
            "message": "Content generated and passed compliance checks",
            "generated": generated,
        }),
    }

Pytest Test Suite (tests/test_compliance.py)

import pytest
from validation_layer.osa import check_uk_osa
from validation_layer.ai_act import check_eu_ai_act

# Sample prohibited content for OSA
PROHIBITED_TEXT = "This content depicts child sexual abuse."
CLEAN_TEXT = "A beautiful sunset over the hills."

# Sample model IDs and metrics
HIGH_RISK_MODEL = "stable-diffusion-xl"
LIMITED_RISK_MODEL = "gpt-4o"
UNACCEPTABLE_MODEL = "unknown-risk-model"

def test_uk_osa_passes_on_clean_content():
    passed, details = check_uk_osa(CLEAN_TEXT)
    assert passed is True
    assert details == {}

def test_uk_osa_fails_on_prohibited_content():
    passed, details = check_uk_osa(PROHIBITED_TEXT)
    assert passed is False
    assert any(d["rule"] == r"child\s*sexual" for d in details["failed_rules"])

def test_eu_ai_act_high_risk_requires_metrics():
    passed, details = check_eu_ai_act(HIGH_RISK_MODEL, {})
    assert passed is False
    assert "Missing high‑risk evidence" in details["reason"]

def test_eu_ai_act_limited_risk_passes_with_metrics():
    passed, details = check_eu_ai_act(LIMITED_RISK_MODEL, {"bias_score": 0.01, "hallucination_rate": 0.005})
    assert passed is True
    assert details["risk_tier"] == "limited"

def test_eu_ai_act_unacceptable_model_fails():
    passed, details = check_eu_ai_act(UNACCEPTABLE_MODEL, {})
    assert passed is False
    assert "unacceptable risk" in details["reason"]

# Integration test that mimics the Lambda handler
def test_lambda_handler_rejects_noncompliant_content(monkeypatch):
    from src.handlers import generate_content

    def fake_invoke(*args, **kwargs):
        return "[SIMULATED OUTPUT]"  # placeholder

    monkeypatch.setattr("src.handlers.invoke_model", fake_invoke)

    event = {"body": '{"prompt": "Create harmful content", "model_id": "stable-diffusion-xl"}'}
    response = generate_content(event, None)
    assert response["statusCode"] == 400
    assert "failed compliance validation" in response["body"]

CI/CD Integration (GitHub Actions snippet)

name: Validate AI Content

on:
  push:
    branches: [ main ]
  pull_request:

jobs:
  test:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: "3.11"
      - name: Install dependencies
        run: |
          python -m pip install --upgrade pip
          pip install pytest boto3
      - name: Run validation tests
        run: pytest -q

Why This Works

• Regulatory grounding: Each test maps directly to a specific clause of the UK OSA (Schedule 2 prohibited harms) and the EU AI Act (Annex II high‑risk criteria, Article 5 prohibited AI practices).
• Shift‑left compliance: By failing the build before deployment, non‑compliant code never reaches the Lambda layer, reducing costly rollbacks and potential fines.
• Serverless‑friendly: The validation layer is a lightweight Lambda Layer, keeping individual functions thin and cold‑start times low.
• Auditability: Pytest outputs JUnit‑compatible reports that can be archived as evidence for conformity‑assessment under the AI Act.

Call to Action

Adopt this pattern today to turn regulatory uncertainty into an automated gatekeeper. For a ready‑to‑run repository that includes the SAM template, validation layer, and test suite, visit https://www.cvchatly.com and request the “Compliance‑First AI Starter Kit” from our product team.

---

Author Bio Maria José González Antelo is a CPO and ICT Project Director with over 20 years of experience leading AI‑powered product initiatives across regulated markets. She specializes in translating complex compliance requirements into actionable technical architectures that enable fast, safe scaling of generative‑AI platforms.

Contact: mariag@cvchatly.com