Is your AI app legal in Europe?
One command tells you which EU AI Act risk tier your code is in, why, and what to fix — in 30 seconds, free, no account.
$ regula check . --explain Classification: HIGH-RISK Annex III, Category 5 WHY: scoring.py:23 — essential_services Code: score = model.predict(applicant) Legal basis: Annex III — Articles 9-15 False positive if: not a credit decision ROLE: DEPLOYER (confidence: high) - OpenAI API usage detected OBLIGATIONS: [HIGH] Art. 9 Risk management — 40-60h [HIGH] Art. 14 Human oversight — 16-24h Total: 160-324h | Deadline: Aug 2026 ⚠ Omnibus may delay to Dec 2027 (not yet law)
$ regula plan . COMPLIANCE PLAN · HIGH-RISK (Annex III, Category 5) Priority 1 — Risk Management System (Art. 9) Effort: 40–60h × No risk assessment file found × No model evaluation documented Priority 2 — Human Oversight (Art. 14) Effort: 16–24h × No review-before-action pattern detected × No override mechanism found Priority 3 — Technical Documentation (Art. 11) Effort: 8–12h ✓ Annex IV template: regula docs . Total: 64–96h estimated effort
$ regula gap . COMPLIANCE GAP ASSESSMENT Art. 9 Risk management ██░░░░░░░░ 20% FAIL Art. 10 Data governance ████░░░░░░ 40% WARN Art. 11 Documentation ██████░░░░ 60% WARN Art. 12 Record-keeping ████████░░ 80% PASS Art. 13 Transparency ░░░░░░░░░░ 0% FAIL Art. 14 Human oversight ███░░░░░░░ 30% FAIL Art. 15 Accuracy █████░░░░░ 50% WARN Run: regula plan . for a prioritised fix list
$ regula comply EU AI Act Compliance Checklist Overall compliance score: 42/100 × Article 9 Risk Management 20% NEEDS WORK ~ Article 10 Data Governance 40% PARTIAL ~ Article 11 Technical Documentation 60% PARTIAL ✓ Article 12 Record-Keeping 80% PASS × Article 13 Transparency 0% NOT FOUND × Article 14 Human Oversight 30% NEEDS WORK ~ Article 15 Accuracy & Robustness 50% PARTIAL 1/7 obligations have strong evidence Run: regula comply --article 9 for deep-dive
What Regula tells you
The EU AI Act sorts every AI system into a risk tier. Regula scans your code, tells you which tier applies, and gives you the fix list.
Regula tells you where your code lands — and exactly why.
How it works
Three steps. No account, no API key, no data leaves your machine.
Scan
regula
Compliance score, findings, and next steps.
Act
regula comply
Obligation checklist with pass/fail per article.
Who is this for?
Developers shipping AI products — and the businesses that use them.
Do you know your legal exposure?
If your team builds or uses AI, the EU AI Act may apply — even outside the EU. Most tools fall under limited or minimal risk. Building with Claude Code or Cursor? Paste regula assess in your chat. Have a developer? Send them this page.
EU users? The AI Act applies to you.
Article 2 is extraterritorial. Most chatbots and productivity tools are limited-risk — one transparency disclosure, nothing more. Scan to confirm.
- Works on AI-generated code (Cursor, Lovable, Bolt, Claude Code)
- Generates Annex IV documentation from your actual code
- CI/CD integration · JSON · SARIF · 12 compliance frameworks
Verifiable evidence, not self-attestation.
Regula generates signed, timestamped evidence packs with SHA-256 integrity manifests. Every finding is traceable to a file and line. Verify the chain yourself.
Beyond classification
Regula reads your code directly — not a questionnaire. It generates artefacts an auditor can review, not just findings.
What's missing?
Risk management, data governance, logging, transparency, human oversight, accuracy — scored per article with effort estimates.
regula gap .
Can you prove compliance?
Annex IV technical documentation generated from your actual code. Functions, dependencies, and logging coverage pre-populated.
regula docs . · regula conform .
Is your AI code secure?
Prompt injection, unsafe model loading, unvalidated AI output, hardcoded keys, and other AI-specific vulnerabilities.
regula check . · regula guardrails .
Conformity assessment pack
Article 43 evidence — 26 files mapped to Articles 9–15, per-article readiness scores, SHA-256 integrity hashes.
regula conform . · regula evidence-pack .
AI Bill of Materials
CycloneDX 1.7 AI-BOMs with model provenance, GPAI tier annotations per Art 51–55, and detected training datasets.
regula sbom --ai-bom .
Human review analysis
Traces AI outputs across files. Checks whether each path to a user-facing endpoint passes through a human review gate.
regula oversight .
Built for audit, not just scanning
Regula generates evidence an auditor can independently verify — not just a list of findings.
Tamper-evident evidence
Every evidence pack includes a SHA-256 manifest. Files are content-hashed at generation time. Any modification breaks the chain.
regula evidence-pack . · regula verify pack/
Cryptographic non-repudiation
Sign evidence packs with Ed25519 keys and RFC 3161 timestamps. Prove when the assessment was produced and that it has not been altered.
regula evidence-pack --sign --timestamp .
GDPR + DORA + NIS2 overlap
Each AI Act article is mapped to corresponding GDPR, DORA, and NIS2 obligations. One scan surfaces requirements across all four regulations.
regula gap .
Regulatory staleness warnings
regula regwatch compares your last scan against the current regulatory state and warns if your compliance posture may have drifted.
regula regwatch
Hash-chained event log
Append-only, hash-chained audit log. Every scan, finding, and suppression is recorded with a verifiable chain of integrity.
regula audit log · regula audit verify
Documentation, not just detection
Generate Annex IV technical documentation, model cards, QMS scaffolds, and SME-simplified conformity packs — free, from your actual code.
regula docs . · regula conform --sme .
55 commands
pipx install regula-ai, then run any of these on your project.
regula assess Yes/no questions — no code needed — get your tierregula check . Scan your codebase against 404 risk patternsregula comply EU AI Act obligation checklist with pass/fail status per articleregula plan . Prioritised to-do list with effort estimatesregula gap . Per-article compliance gap assessmentregula docs . Generate Annex IV documentationregula evidence-pack . Bundle everything for an auditorregula conform . Article 43 conformity evidence — 26 files, SHA-256 hashedregula oversight . Article 14 human oversight analysisregula sbom --ai-bom . AI Bill of Materials (CycloneDX 1.7)regula owasp-agentic . OWASP Top 10 for Agentic Applicationsregula gpai-check . Map GPAI code to Code of Practice chaptersregula bias Stereotype bias evaluation — CrowS-Pairs + BBQ benchmarks with confidence intervals (requires Ollama)regula verify pack/ SHA-256 integrity check for evidence packsPython, JS, TS, Java, Go, Rust, C, C++ · Cross-maps to ISO 42001, NIST AI RMF, OWASP LLM Top 10, EU CRA, and 7 other frameworks.
What Regula does not do
A compliance tool that overstates its capabilities is worse than no tool at all. Here is what Regula actually is — and isn't.
Not legal advice
Regula identifies risk indicators in code for developer review. It does not determine compliance. A qualified legal professional should review any classification before you act on it.
Pattern matching, not understanding
15.2% precision on open-source codebases at INFO tier. 0 false positives at BLOCK tier (the CI default). Published benchmark →
Scaffolds, not substance
Annex IV docs, evidence packs, and governance frameworks are pre-filled scaffolds. A human must complete them with substantive content. Regula cannot verify that a risk management system actually operates.
We scan ourselves
Regula's own codebase is scanned on every commit. Here is what happens.
71 of 85 source files suppressed
83.5% of Regula's own Python files require # regula-ignore comments. A compliance tool that discusses prohibited practices must contain the vocabulary of prohibited practices. This is structural, not a bug.
0 active findings, 31 suppressed
Five files contain prohibited-practice vocabulary (they explain, document, or detect those practices). All five are suppressed via # regula-ignore. The scan reports zero active prohibited findings — suppression works, and every suppression is a documented governance decision.
What this means
Having a tool is not the same as having governance. Each suppression is a micro-governance decision that requires human judgment about context, intent, and purpose — exactly what the EU AI Act requires.
Where Regula fits in the market.
A developer-side static scanner. One of several tools in the EU AI Act ecosystem — each solves a different part of the problem.
Credo AI, Saidot, Enzai, IBM watsonx.governance, Microsoft Purview. Evidence workflows, control libraries, continuous monitoring, legal-expert policy updates. Built for compliance departments, not developers. No published pricing.
Garak, Giskard, Promptfoo. Prompt-injection, jailbreak and bias red-teaming against running models. Complementary to Regula, not overlapping — they test behaviour, Regula reads code.
Static code scanner. Runs on your laptop in one command. Stdlib-only Python core, zero production dependencies, fully offline. pipx install regula-ai, scan your project, get a clear answer. MIT licence.
| Regula | AIR Blackbox | Systima Comply | EuConform | Enterprise SaaS | |
|---|---|---|---|---|---|
| Approach | Static code scan | Scan + runtime trust layers | AST-based scan | Questionnaire + bias eval | Platform / dashboard |
| Languages | 8 families | Python | JS/TS | N/A | N/A |
| Detection patterns | 404 | 48 checks | 37+ frameworks | Questionnaire | Varies |
| Dependencies | Zero (stdlib) | Multiple | npm | Next.js + Ollama | SaaS |
| Offline | Fully offline | Local | Local | Local + Ollama | Cloud |
| Evidence signing | Ed25519 + RFC 3161 | — | — | — | Varies |
| Framework mappings | 12 | 3 | EU AI Act | EU AI Act | Multiple |
| CI/CD integration | GitHub Action + SARIF | GitHub Action | GitHub Action | — | Native |
| Annex IV docs | Free | — | — | PDF reports | Built-in |
| Price | Free (MIT) | Free (Apache 2.0) | Free (OSS) | Free (MIT + EUPL) | $30K–$200K/yr |
Pick the tool whose language coverage and trade-offs fit your stack. Regula covers the most languages and framework mappings among the open-source options listed above. For runtime agent governance, see Microsoft’s Agent Governance Toolkit.
Latest from the blog
Analysis of AI regulation and compliance patterns.
The EU AI Act Omnibus Delay
Current deadline status and what developers should do while trilogue continues.
Does the EU AI Act Apply to Your AI App?
Five questions to check whether your product falls under EU AI Act scope.
EU AI Act Risk Tiers in Actual Code
What prohibited, high-risk, and limited-risk indicators look like in real code.
Most Startups Are Ignoring the AI Act
Why that's rational today, three triggers for when it stops being rational, and what preparing actually means.
Find out where you stand
One command. Takes 30 seconds. No account needed.
No spam. Major releases and EU AI Act deadline reminders only.