For founders and people responsible for an AI product

Does AI regulation reach your business?

Five questions, in plain words. No account, nothing to install, and nothing you type here leaves your browser. At the end you get a list of what your answers point at and what a person still has to settle.

Regula indicates where to look. It does not decide your risk tier, your obligations, or whether you comply. This is not legal advice.

  1. Do you sell to, or have users in, the EU?

    The rules can reach a business based anywhere. What matters is whether your product, or what your product produces, is used by people in the EU.

  2. Does your product use AI at all?

    This includes AI you did not build: a chatbot, a model you call through someone else's service, or a feature a no-code tool added for you.

  3. Did you build the AI, or are you using someone else's?

    The rules place different duties on the organisation that puts an AI system on the market and on the organisation that uses one. You can be both.

  4. Do people see content your AI produced, or talk to it directly?

    Text, images, audio, video, or a chatbot. There are disclosure duties where someone might not realise they are dealing with AI, or with something AI made.

  5. Does AI help decide something about a person?

    Hiring, credit, insurance, a place on a course, access to healthcare, or a benefit. It counts even when a person signs the decision off at the end.

These five questions need JavaScript to work out what they point at.

The questions themselves are above and they are worth reading either way. To get the rest without JavaScript:

What happens after you answer

Three routes, and each one is described here as what it actually is.

  • Keep going, free. Free, in your browser or your terminal. No account, nothing uploaded.
  • A written assessment. A proposed written assessment with an unvalidated test price. It is not available yet.
  • Talk to a consultant. A conversation with an independent consultant. Not a certification, and not bookable yet.

What Regula does not do

A compliance tool that overstates its capabilities is worse than no tool at all. Here is what Regula actually is, and what it isn't.

Not legal advice

Regula identifies risk indicators in code for developer review. It does not determine compliance. A qualified legal professional should review any classification before you act on it.

Pattern matching, not understanding

Regula matches patterns in source code. It does not read intent, so it flags things that turn out to be fine and misses things a person would catch. Its own precision and recall measurements are under review and are not quoted here as current figures; the methodology and its limits are published in full. Benchmark methodology and limits →

Scaffolds, not substance

Annex IV docs, evidence packs, and governance frameworks are pre-filled scaffolds. A human must complete them with substantive content. Regula cannot verify that a risk management system actually operates.

Full limitations disclosure →

If you are comfortable with a terminal

The same indicators are available as a local command. It reads files on your machine and does not upload them. Below is real output from the committed test fixture, reproduced on every build by the project's own checks, not a mock-up. Note what it does with an unresolved question: it names the facts it needs rather than guessing a tier.

$ regula check tests/fixtures/sample_high_risk --explain

Decision: insufficient_information
Model: 2026-08-19.1
Jurisdiction: eu
Rule resolution: unresolved
Facts needed to resolve the next decision: 2
  - is_ai_system: Does the subject meet the legal definition?
  - jurisdiction_in_scope: Does the territorial and operator scope apply?

Detector observations are reported separately and do not create obligations.

Decision excerpt from real output. Bound to data/gap_demo.json and tests/test_gap_demo.py .

$ regula plan --project tests/fixtures/sample_high_risk

Decision: insufficient_information
Model: 2026-08-19.1
Jurisdiction: eu
Rule resolution: unresolved
Facts needed to resolve the next decision: 2
  - is_ai_system: Does the subject meet the legal definition?
  - jurisdiction_in_scope: Does the territorial and operator scope apply?

No obligation plan or effort estimate was emitted because applicability is unresolved.

Real output, not a mock-up. Bound to data/gap_demo.json and tests/test_gap_demo.py .

$ regula gap tests/fixtures/sample_high_risk

Decision: insufficient_information
Model: 2026-08-19.1
Jurisdiction: eu
Rule resolution: unresolved
Facts needed to resolve the next decision: 2
  - is_ai_system: Does the subject meet the legal definition?
  - jurisdiction_in_scope: Does the territorial and operator scope apply?

Evidence scan:
Article evidence is attached only where the decision kernel resolved the corresponding obligation.
Article observations emitted: 0; held pending applicability: 8

Real output, not a mock-up. Reproduce it from a clone with the command shown; the fixture is committed at tests/fixtures/sample_high_risk and this page is diffed against a fresh run by tests/test_gap_demo.py .

$ regula comply tests/fixtures/sample_high_risk --all

Decision: insufficient_information
Model: 2026-08-19.1
Jurisdiction: eu
Rule resolution: unresolved
Facts needed to resolve the next decision: 2
  - is_ai_system: Does the subject meet the legal definition?
  - jurisdiction_in_scope: Does the territorial and operator scope apply?

Evidence scan:
Article evidence is attached only where the decision kernel resolved the corresponding obligation.
Article observations emitted: 0; held pending applicability: 8

Real output, not a mock-up. No article table or readiness percentage is emitted until sourced facts resolve applicability. Bound to tests/test_gap_demo.py .

What the scanner looks for, what it reports, and how it runs →

Common questions

Answers grounded in the regulation. Every claim cites a specific Article.

Does the EU AI Act apply to my company if I'm outside the EU?

Potentially. Article 2(1)(c) covers providers and deployers established outside the EU where an AI system's output is used in the Union, subject to the Act's roles, exclusions, and other scope conditions. Location alone does not decide applicability.

Is my AI app prohibited under the EU AI Act?

Article 5 prohibits specified practices, including certain forms of social scoring, manipulation, biometric identification, and emotion inference. The exact scope, conditions, and exceptions matter. Regula flags related code patterns for review; it does not determine that a prohibited practice exists.

What makes an AI system high-risk?

Article 6 contains the classification routes and Annex III lists specified intended uses across eight areas. Conditions, exceptions, intended purpose, and deployment context matter. Regula reports related code indicators but does not determine high-risk status.

When does the EU AI Act start being enforced?

The original Article 5 prohibitions have applied since 2 February 2025. GPAI provisions began applying on 2 August 2025, subject to transition rules. Regulation (EU) 2026/1744 sets 2 December 2027 for Annex III and 2 August 2028 for the Annex I product path. Article 50 generally has applied since 2 August 2026, with a specific transition for providers of Article 50(2) systems already on the market.

What are the fines under the EU AI Act?

Article 99 provides for fines up to €35 million or 7% of global annual turnover for prohibited-practice infringements; up to €15 million or 3% for certain other infringements; and up to €7.5 million or 1% for supplying incorrect, incomplete, or misleading information. Read Article 99 in the primary legislation.

Is Regula free?

Yes. Regula is open-source under the Apache 2.0 or EUPL 1.2 licence. No account or API key is required for local use. Install with pipx install regula-ai and run it locally. The CLI reference and framework crosswalk document the shipped surface.

Does the EU AI Act overlap with GDPR, DORA, or NIS2?

Yes, significantly. High-risk AI systems that process personal data must also comply with GDPR, and other regulations like DORA and NIS2 may apply depending on your sector. Regula cross-maps AI Act obligations to ISO 42001, NIST AI RMF, SOC 2, OWASP, and 9 other frameworks in a single scan.

Does Regula work with AI-generated code?

Yes. Regula scans source files regardless of who or what wrote them. Authorship alone does not determine whether the EU AI Act applies: Article 2 scope, the actor's role, intended purpose, deployment context, and applicable exclusions still require review. Run regula check . for code-observable indicators and regula assess to record context.

What should I do right now to prepare?

Install with pipx install regula-ai, use regula assess to record declared context, then run regula check . for code-observable indicators. Human review is required; these outputs do not determine legal classification or compliance.

Guides & analysis

Technical guides for developers and analysis of AI regulation.

Guide

EU AI Act for Python Developers

Scan Python AI code for risk patterns. PyTorch, TensorFlow, scikit-learn, LangChain.
Guide

Article 9: Risk Management System

What the regulation requires, what code scanning can detect, and what needs human review.
Guide

EU AI Act for Healthcare AI

Medical devices, clinical decision support, and the MDR/IVDR intersection.
Guide

Article 5: Prohibited Practices

The 10 practices banned under Article 5, including the Omnibus additions.

All 8 guides & 15 articles →