About Regula
Regula is an open-source command-line tool that scans codebases for EU AI Act risk indicators. It combines static code analysis with governance questionnaires to produce evidence a lawyer, auditor, or notified body can review. It is not an AI governance platform, not a compliance certificate, and not legal advice.
What Regula does
Regula scans source code in 8 language families for indicators associated with EU AI Act risk categories, maps findings to potentially relevant provisions, and generates reviewer-completable evidence scaffolds. It does not determine legal classification or compliance; human review of intended purpose and deployment context is required. The core install has no required third-party runtime dependencies; optional features may add dependencies or network access.
It works on two fronts:
- Code scanning : 419 regex patterns across Articles 5–15, with a 6-layer precision architecture (AST context gating, domain exclusions, library fingerprinting, confidence floors) to reduce false positives. The precision and recall measurements are under review and are not quoted here as current figures; the methodology and its limits are published in full.
- Governance questionnaires : structured self-assessments for organisational obligations that code cannot verify, including risk management (Article 9), quality management (Article 17), and fundamental rights impact assessments (Article 27).
62 CLI commands. 13 compliance framework mappings (EU AI Act, NIST AI RMF, ISO 42001, NIST CSF, SOC 2, ISO 27001, OWASP LLM Top 10, OWASP Top 10 for Agentic Applications, MITRE ATLAS, LGPD, Marco Legal da IA, EU CRA, ICO/DSIT). Multi-jurisdiction risk indication across 3 jurisdictions (EU AI Act, South Korea AI Basic Act, Colorado SB 26-189). The current test count is generated and checked in site facts. Free under Apache 2.0 / EUPL 1.2.
What Regula does not do
Static code scanning addresses only part of the EU AI Act. Risk management systems, quality management, fundamental rights impact assessments, post-market monitoring and conformity assessments are organisational obligations that require human processes, not code analysis. Regula does not pretend to verify them.
Specifically, Regula does not:
- Determine whether a system is high-risk under Article 6 (this requires contextual assessment of intended purpose and deployment context)
- Verify that a risk management system is actually operated (Article 9)
- Run a fundamental rights impact assessment (Article 27)
- Replace legal advice or issue compliance certificates
The full scope statement is published at docs/what-regula-does-not-do.md. The project maintains a Trust Pack with security audit results, test counts, and verified numbers.
Who maintains it
Regula is maintained by Kuziva Muzondo, a software engineer based in the UK who explores AI governance outside his day job. The project started as a practical question: if the EU AI Act creates obligations that apply to code, what would a developer-facing compliance tool actually look like?
Commits include a Co-Authored-By: Claude Opus 4.6 trailer where work was paired with Anthropic's Claude. This is standard pair-programming attribution : the maintainer is accountable for every merged change. The project's approach to honesty is documented in the codebase: no fabricated statistics, no overstated capabilities, no marketing claims that can't be verified against the code.
Kuziva also writes The Implementation Layer, a newsletter on the gap between AI governance theory and organisational reality.
How it works
Regula's classification engine matches source code against regex patterns mapped to EU AI Act articles. A 6-layer precision architecture reduces false positives:
- Match-line context gating : AST analysis suppresses findings where all pattern matches occur inside docstrings or string literals
- Opt-in category expansion : categories with high false-positive rates require additional corroborating evidence
- Domain exclusion patterns : medical imaging libraries are excluded from biometrics findings, database migration tools from migration findings, etc.
- Project fingerprinting : scans
package.jsonand import graphs to identify AI library projects and suppress self-scan noise - Confidence floors : findings with confidence below a threshold and no corroborating evidence are suppressed
- Cross-file oversight enrichment : optional Article 14 analysis traces AI outputs across files to human review gates
Evidence packs are signed with SHA-256 integrity manifests and in-toto attestations. Every finding is traceable to a file and line number.
Accessibility, usability and performance
Regula targets WCAG 2.2 Level AA and uses the human-centred design principles in ISO 9241-210:2019 and the usability concepts in ISO 9241-11:2018. This is a design and evaluation target, not a claim of formal conformance or certification.
Automated accessibility checks are run as evidence, but they cannot establish full WCAG conformance. Manual keyboard, zoom, reflow, screen-reader and representative-user testing remain required. The current evidence, limitations and test procedure are published in the accessibility and human-centred quality record.
Performance is assessed against LCP, INP and CLS using the documented Core Web Vitals thresholds. Lab measurements are treated as diagnostics. They are not presented as real-user results when sufficient field data is unavailable.
Disambiguation
This is Regula the EU AI Act compliance CLI, published at getregula.com and pypi.org/project/regula-ai. It is not affiliated with Regula Forensics (regula.com), which is an identity verification and document authentication company.