7 April 2026 · 10 min read · The Implementation Layer

Regula in the AI Governance Landscape

Mapping Regula’s actual capabilities against the gaps documented in the UNESCO + Thomson Reuters Foundation AI Company Data Initiative (AICDI) 2025 Global Insights Report — Responsible AI in practice: 2025 global insights from the AI Company Data Initiative, published 2026 (ISBN 978-92-3-100863-4, DOI 10.54678/YJWP8855). The initial AICDI target was 3,000 companies; the final analysed dataset is 2,972 companies across 11 GICS sectors and 7 regions (p.24, p.26, p.27). Data was collected July–November 2025.

All percentages below are quoted verbatim from the published PDF with page references. The PDF is available at unesdoc.unesco.org — see references/FETCH.md for the file hash and local path.

The point of this page is honesty. Regula is a static code scanner. It addresses some of the gaps the report measures. It does not address others — and we are explicit about which is which. The previous version of this section (in the README) listed competitor names without primary sources and was removed in commit dbbd57b. This page replaces it with a per-gap mapping anchored to a published external study.

Honest scoring legend

Each AICDI gap is scored as Yes (Regula directly addresses it with shipped functionality), Partial (Regula addresses one component but the rest needs human or organisational work), or No (the gap is not in scope for a static code scanner). We document every No explicitly so it is clear we are not selling functionality we do not have.

Yes — Regula directly addresses this gap with shipped functionality. File and command listed.
Partial — Regula addresses one component of a multi-part gap. The rest needs human or organisational work.
No — Regula does not address this gap. It is not in scope for a static code scanner. We document it here so it is clear we are not selling functionality we do not have.

Mapping

Of the 18 governance gaps measured in the AICDI report, Regula directly or partially addresses 6: framework alignment, human oversight verification, model registry, human rights impact assessment, DPIA, and privacy impact assessment. The remaining 12 are organisational, policy, or structural gaps that a static code scanner cannot address. The table below maps each gap with its coverage status and method.

AICDI gap	% of companies	Page	Regula coverage	How
Publicly communicates having an AI strategy	43.7%	p.10	No	Regula is a code scanner, not a strategy framework.
Aligns strategy with a formal AI governance framework	13%	p.10	Indirect	Regula maps findings to 13 frameworks (EU AI Act, ISO 42001, NIST AI RMF, NIST CSF 2.0, SOC 2 TSC, ISO 27001, OWASP LLM Top 10, OWASP Top 10 for Agentic Applications, MITRE ATLAS, CRA, ICO/DSIT, LGPD, Marco Legal IA), plus the NIST AI 600-1 GenAI Profile risk set. Of the 13% that align with a framework, 53% cite the EU AI Act — Regula’s primary reference. See `references/framework_crosswalk.yaml`.
Board- or committee-level AI oversight	40%	p.10	No	Governance structure, not a code property.
Has an AI ethics committee	3.8%	p.36	No	Org structure.
Has an AI safety and security taskforce	2.5%	p.36	No	Org structure.
Has a policy ensuring human oversight of AI systems	12.4%	p.10	Partial	`regula oversight` does cross-file Article 14 detection — traces AI model outputs through the codebase and flags whether a human-review function gates the output. This is verification of oversight in code. The policy itself is a written document. See `scripts/cross_file_flow.py`.
Publicly reports having a formal AI model registry	2.7%	p.37	Yes (narrow)	`regula sbom --ai-bom` produces a CycloneDX 1.7 ML-BOM (`scripts/sbom.py`) with detected ML model files, AI dependencies, GPAI tier annotations, and GPAI Code of Practice signatory status for each detected vendor. This is a technical registry. Separately, `regula register` generates Annex VIII Section A/B/C registration packets locally with auto-fill from existing scan artifacts and an explicit gap list.
Can trace ethical impacts to a responsible person at each lifecycle stage	15.4%	p.37	No	Accountability mapping, not a code property.
Has policies to mitigate negative impacts on workers	14%	p.46	No	Organisational policy, not a code property.
Offers AI training programmes (any)	31%	p.10	No	Training programme, not a code scanner.
Offers structured AI training with comprehensive coverage	12%	p.10	No	Training programme.
Evaluates environmental impact	11%	p.10	No	Regula has zero environmental scanning. Not in scope. NIST AI 600-1 GenAI Profile flags this as a known cross-framework gap — see `references/framework_crosswalk.yaml`.
Conducts Human Rights Impact Assessments	7%	p.10	Partial (narrow)	`regula bias` checks for protected-class features in ML training data per Article 10(5). That is one component of an HRIA. The wider HRIA (worker impact, downstream uses, vulnerable groups) is not in code.
Conducts Ethical Impact Assessments	5%	p.53	No	Not in scope.
Conducts Data Protection Impact Assessments (DPIA)	18%	p.38	Partial	`regula gap` scores DPIA-adjacent evidence under Article 10 data governance.
Conducts Privacy Impact Assessments	14%	p.38	Partial	Same as DPIA row.
Do not report conducting any impact assessment with regard to AI	72%	p.10	—	(headline gap)
Has an internal complaints mechanism for AI-related employee concerns	2.3%	p.47	No	Operational mechanism, not a code property. (98% show no evidence.)
Has policies governing data sharing with third-party AI providers (of those with AI strategies)	~1 in 5 (≈20%)	p.59	No	Org policy.
Has evidence of policies to evaluate training-data quality	24% (76% show no evidence)	p.10	No	Regula detects training data pipelines but does not audit their quality.

What Regula adds beyond the AICDI gaps

Beyond the AICDI-measured gaps, Regula provides capabilities the report does not track but that are relevant to developer-facing compliance: Article 5 prohibited practice detection, EU AI Act high-risk classification across all Annex III and Annex I categories, Articles 9–15 gap assessment, Annex IV conformity evidence packs, Annex VIII registration packets, cross-file Article 14 oversight detection, and an AI Bill of Materials.

Things Regula does that the AICDI report does not specifically measure but that are objectively useful for a developer-facing compliance baseline:

Article 5 prohibited practice detection — pattern-based detection of subliminal manipulation, social scoring, criminal-prediction-by-profiling, untargeted facial scraping, and 4 other Article 5 categories. Fires regardless of whether the file imports an AI library (fixed in commit fd1910c). On the prohibited tier of the synthetic corpus, precision and recall are both complete: every one of the 5 prohibited fixtures is detected and no negative fixture fires. That is the prohibited tier only; the high-risk tier is not complete and is reported separately in benchmarks/synthetic/RECALL.json.
EU AI Act high-risk classification — pattern-based classification across all 8 Annex III areas (Regulation (EU) 2024/1689 Annex III points 1–8: biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice + democratic processes) plus 2 Annex I categories referenced by Article 6(1) (medical devices, machinery safety components) — 10 high-risk pattern categories in total.
Articles 9–15 gap assessment — regula gap produces per-article 0–100 scores against the EU AI Act risk-management lifecycle.
Annex IV conformity evidence pack — regula conform generates structured per-article evidence packs with SHA-256 manifest, ready for an audit.
Annex VIII registration packet — regula register builds Sections A/B/C packets, branches by provider/deployer role and Annex III area (incl. Art. 49(4) non-public for biometrics/law enforcement/migration and Art. 49(5) national-level routing for critical infrastructure), auto-fills from existing scan data, lists gaps, and dual-annotates the 2026-08-02 vs Omnibus-proposed 2027-12-02 deadlines. Three-source-verified schema in references/annex_viii_sections.json.
Cross-file Article 14 oversight detection — regula oversight traces AI model outputs through call chains to detect missing human-in-the-loop gates.
AI Bill of Materials (CycloneDX 1.7 ML-BOM) — see model registry row above.
Audit trail with hash chain — regula audit maintains a tamper-evident log of compliance scans.
Pre-commit scanning — regula install pre-commit or regula install git-hooks configures the tracked scanner to run before commits. This is pattern-based detection, not a legal determination.
MCP server — regula mcp-server exposes regula_check, regula_classify, and regula_gap as tools an AI coding assistant can call directly. Documented for Claude Code, Cursor, and Windsurf.

Honest baselines (measured, reproducible)

Regula's current benchmarks are 15.2% precision on 257 hand-labelled findings from 5 open-source projects, and 100% precision on 38 synthetic fixtures covering Article 5 prohibited practices and Annex III high-risk categories. Recall on the synthetic corpus is reported per condition in benchmarks/synthetic/RECALL.json rather than as a single figure here, for the reason given below. The 15.2% comes from the five-project library subset of benchmarks/labels.json; the synthetic 100% is the runner's own output. Both benchmarks are reproducible from the repository with a single command. Scan times are published in the benchmarks directory.

Correction, August 2026. This section previously read “100% precision and recall on 13 synthetic fixtures”. That was measured on a 13-fixture corpus. The high-risk set was expanded from 5 fixtures to 30 on 28 July 2026 and re-measured, and 100% high-risk recall does not reproduce on the current corpus. It is withdrawn. Prohibited-tier recall still holds and the precision figures are unchanged. The replacement is deliberately not a single number: recall on this corpus differs by more than twenty percentage points depending only on which code path runs and which opt-in gates are satisfied, so every condition, with the fixtures it misses named, is generated from an actual run into benchmarks/synthetic/RECALL.json. Read it there and note which condition you are reading.

OSS benchmark precision: 15.2% on 257 hand-labelled findings sampled from 5 OSS projects (instructor, pydantic-ai, langchain, scikit-learn, openai-python). Re-validated against current patterns 2026-04-07: 252 of 257 labels still match (98%). See benchmarks/labels.json. Reproduce the 15.2% overall library-corpus precision with python3 benchmarks/label.py score --corpus library. The --corpus library flag is load-bearing: that file now holds 446 labels across 12 projects, so the same command without it scores the whole set and reports 36.8%, which is a different corpus and not this figure.
Synthetic benchmark precision and recall: 38 hand-crafted fixtures covering 5 prohibited (Article 5 categories a–e), 30 high-risk (Annex III categories), and 3 negative cases. Precision is 100%: no fixture produces a false positive. Recall is condition-dependent and is published per condition in benchmarks/synthetic/RECALL.json, not as one number. Reproduce the 100% precision result with python3 benchmarks/synthetic/run.py, which names the condition beside every figure it prints.
Scan time: see benchmarks/results/SUMMARY.json for current numbers across all five OSS projects.

Things we are explicit about NOT building

Regula will not build AI governance maturity scoring, environmental impact estimation, AI ethics ratings, policy generators, public commitment tools, or vendor SaaS auditing. Each of these requires organisational, runtime, or behavioural data that a static code scanner does not have. Pretending otherwise would be inflation, not measurement.

These come up when people ask “can you make Regula do X?” The answer is no, and here is why each is out of scope rather than a future feature:

AI governance maturity scoring from a code scan. The AICDI report measures organisational signals that are not in code (board oversight, training programmes, complaints mechanisms). Pretending to score those from static analysis would be inflation, not measurement.
Environmental impact estimator. Out of scope. Would require runtime telemetry and electricity-grid data we don’t have.
AI ethics rating. Not measurable from static code. Behavioural tools (e.g. red-teaming) are different products.
Policy generator that writes governance policies for companies. Anyone using such a tool to satisfy a regulator would fail an audit. Form-letter output is worse than no policy.
Public commitment to a framework. That’s a board statement, not a code property. Regula can show the technical implementation matches a framework’s expectations; it cannot make the public commitment for you.
Vendor SaaS audit. Regula detects that your code calls a vendor and surfaces the vendor’s published GPAI Code of Practice signing status. It does not audit the vendor’s actual practices.

Sources

All statistics in this post are drawn from the UNESCO + Thomson Reuters Foundation AICDI 2025 Global Insights Report (ISBN 978-92-3-100863-4), with page references for each figure. Regulatory references cite specific articles of Regulation (EU) 2024/1689. The full report is available from UNESCO's digital library.

Last reviewed: 7 April 2026. Re-verify gap percentages against the AICDI report’s published methodology before each Regula release.

Not legal advice. Regula identifies regulatory risk indicators in code for developer review. It does not constitute legal advice, and its output should not be relied upon as a definitive compliance determination. The EU AI Act requires contextual assessment that no automated tool can fully provide. For high-risk systems, consult a qualified legal professional. All Article references are to Regulation (EU) 2024/1689 as published in the Official Journal of the European Union on 12 July 2024.