About Regula
Regula is an open-source command-line tool that scans codebases for EU AI Act risk indicators. It combines static code analysis with governance questionnaires to produce evidence a lawyer, auditor, or notified body can review. It is not an AI governance platform, not a compliance certificate, and not legal advice.
What Regula does
Regula scans source code in 8 language families for indicators associated with EU AI Act risk categories, maps findings to potentially relevant provisions, and generates reviewer-completable evidence scaffolds. It does not determine legal classification or compliance; human review of intended purpose and deployment context is required. The core install has no required third-party runtime dependencies; optional features may add dependencies or network access.
It works on two fronts:
- Code scanning : 423 regex patterns across Articles 5–15, with a 6-layer precision architecture (AST context gating, domain exclusions, library fingerprinting, confidence floors) to reduce false positives. The precision and recall measurements are under review and are not quoted here as current figures; the methodology and its limits are published in full.
- Governance questionnaires : structured self-assessments for organisational obligations that code cannot verify, including risk management (Article 9), quality management (Article 17), and fundamental rights impact assessments (Article 27).
62 CLI commands. Thirteen framework identifiers with selected references (EU AI Act, NIST AI RMF, ISO 42001, NIST CSF, SOC 2, ISO 27001, OWASP LLM Top 10, OWASP Top 10 for Agentic Applications, MITRE ATLAS, LGPD, pending Marco Legal da IA, EU CRA, and ICO/DSIT). Separate evidence-gated decision questionnaires cover three implemented jurisdictions: the EU AI Act, South Korea AI Basic Act, and Colorado SB 26-189. Crosswalk references are not applicability or compliance determinations. The current test count is generated and checked in site facts. Free under Apache 2.0 / EUPL 1.2.
What Regula does not do
Static code scanning addresses only part of AI governance. Risk management systems, quality management, impact assessments, post-market monitoring, accessibility, data protection, sector duties and legal applicability require deployment facts and human processes, not code analysis. Regula does not pretend to verify them.
Specifically, Regula does not:
- Determine whether a system is high-risk under Article 6 (this requires contextual assessment of intended purpose and deployment context)
- Verify that a risk management system is actually operated (Article 9)
- Run a fundamental rights impact assessment (Article 27)
- Replace legal advice or issue compliance certificates
The full scope statement is published at docs/what-regula-does-not-do.md. The project maintains a Trust Pack with security audit results, test counts, and verified numbers.
Who maintains it
Regula is maintained by a single project maintainer. That creates a bus-factor risk, documented in the public governance file. The project asks a practical question: if regulation creates obligations around software, which code-level signals can a developer-facing tool identify honestly?
Commits include a Co-Authored-By: Claude Opus 4.6 trailer where work was paired with Anthropic's Claude. This is standard pair-programming attribution : the maintainer is accountable for every merged change. The project's approach to honesty is documented in the codebase: no fabricated statistics, no overstated capabilities, no marketing claims that can't be verified against the code.
How it works
Regula's classification engine matches source code against regex patterns mapped to EU AI Act articles. A 6-layer precision architecture reduces false positives:
- Match-line context gating : AST analysis suppresses findings where all pattern matches occur inside docstrings or string literals
- Opt-in category expansion : categories with high false-positive rates require additional corroborating evidence
- Domain exclusion patterns : medical imaging libraries are excluded from biometrics findings, database migration tools from migration findings, etc.
- Project fingerprinting : scans
package.jsonand import graphs to identify AI library projects and suppress self-scan noise - Confidence floors : findings with confidence below a threshold and no corroborating evidence are suppressed
- Cross-file oversight enrichment : optional Article 14 analysis traces AI outputs across files to human review gates
Evidence packs are signed with SHA-256 integrity manifests and in-toto attestations. Every finding is traceable to a file and line number.
Accessibility, usability and performance
Regula targets WCAG 2.2 Level AA and uses the human-centred design principles in ISO 9241-210:2019 and the usability concepts in ISO 9241-11:2018. This is a design and evaluation target, not a claim of formal conformance or certification.
Automated accessibility checks are run as evidence, but they cannot establish full WCAG conformance. Manual keyboard, zoom, reflow, screen-reader and representative-user testing remain required. The current evidence, limitations and test procedure are published in the accessibility and human-centred quality record.
Performance is assessed against LCP, INP and CLS using the documented Core Web Vitals thresholds. Lab measurements are treated as diagnostics. They are not presented as real-user results when sufficient field data is unavailable.
Disambiguation
This is Regula, the open-source AI-governance evidence and source-code review CLI whose public source is published on GitHub. It does not determine compliance. It is not affiliated with Regula Forensics (regula.com), an identity-verification and document-authentication company.