The regex provided is not validating the GSTIN correctly.
The correct regex is: r'^\d{2}[A-Z]{5}\d{4}[A-Z]{1}[A-Z\d]{1}[Z]{1}[A-Z\d]{1}$' (ofcourse python)
The original one provided accepts any string of any length with any no. of spaces etc.
the same can be verified here.
https://regex101.com/