The Implementation Layer
Newsletter on the gap between AI governance theory and organisational reality. Practical frameworks, implementation lessons, and honest analysis.
When AI Systems Don't See You
Bias testing gaps · 35-year paper trail · peer-reviewed evidence
Switching from ChatGPT to Claude
What you're actually moving · data governance · prompt translation
From AI hype to AI governance
The gap between governance theory and organisational reality
Article 14: human oversight requirements for high-risk AI
High-risk AI systems must let a person watch, understand, and intervene. How cross-file flow analysis checks your codebase for review-before-action patterns.
Article 9: risk management system requirements
Article 9 requires a documented risk management system for high-risk AI. What code scanning covers, what it does not, and where to start.
EU AI Act for recruitment and hiring AI
Recruitment AI is high-risk under Annex III Category 4. What code patterns trigger classification, what Articles 9-15 require, and how to scan your code.
EU AI Act compliance for Python developers
Python AI frameworks like PyTorch, TensorFlow, and scikit-learn trigger EU AI Act risk patterns. How to scan your Python code and what the findings mean.
Article 5: prohibited AI practices under the EU AI Act
Eight categories of AI are banned outright, with two more added by the Omnibus. What each prohibition covers, the narrow exceptions, and how to check your code.
Article 50: transparency obligations for AI systems
Chatbots, deepfakes, emotion recognition, and synthetic content all trigger Article 50 disclosure requirements. What the obligations are and how Regula detects them.
EU AI Act and healthcare AI
AI in medical devices is high-risk under the EU AI Act via the MDR cross-reference. What healthcare AI must comply with and how to scan for risk patterns.
EU AI Act compliance for JavaScript and TypeScript developers
JavaScript AI tools like OpenAI SDK, LangChain.js, and TensorFlow.js trigger EU AI Act risk patterns. How to scan your JS/TS code and what the findings mean.
EN 18228 and EN 18282: what Regula can evidence against draft AI standards
Two CEN-CENELEC harmonised standards for Articles 9 and 15 are in public enquiry. Traceability mapping of what a code scanner can and cannot evidence — based on secondary commentary, with revision planned when the standards publish.
What the Art 50 Code of Practice means for your codebase
The Code of Practice on AI content marking was published 10 June 2026. A mapping of what Regula can evidence (watermarking, C2PA, provenance metadata) and what requires runtime infrastructure it cannot scan.
How to classify your AI system under the EU AI Act
Classification depends on intended purpose and deployment context, not just code. A developer guide to Article 6, the four risk tiers, and what code scanning can and cannot tell you.
Static analysis for AI compliance: why code scanning complements questionnaires
Code scanning and questionnaires each cover different parts of EU AI Act compliance. Neither alone is sufficient. An evidence-based comparison with honest precision figures.
The Omnibus Trilogue Failed. The August 2026 Deadline Is Back.
The first political trilogue on the Digital Omnibus ended without agreement on 28 April after 12 hours. The sticking point was conformity assessment for AI in regulated products. The follow-up trilogue succeeded on 7 May; Parliament and Council approved the December 2027 deferral in June 2026.
Questionnaires tell you what you said. Code scanning shows what you did.
Questionnaires and code scanning cover different halves of the EU AI Act. Neither replaces the other. Together, they produce something closer to defensible compliance.
We scanned 5 AI frameworks for EU AI Act compliance. Here’s what 389 patterns found.
562 findings across PyTorch, HuggingFace Transformers, LangChain, LlamaIndex, and CrewAI. The framework you pick shapes your compliance surface before you write a line of code.
EU AI Act Article 5 is already live: scanning your code for prohibited AI practices
Article 5 has been enforceable since February 2025 with fines up to EUR 35 million. Most developers don’t know this. Here is what the 8 prohibited categories look like in code, what Regula flags, and what to do about it.
August 2026 or December 2027? A developer’s guide to the Omnibus uncertainty
Two dates, one law, nobody knows which applies. A three-track framework for deciding what to build now, what can wait, and why planning for August is the engineering-rational choice even if December wins.
Most startups are ignoring the EU AI Act. Here’s when that stops being rational.
The dominant Reddit/HN sentiment is to ignore it until fines land. For now, that’s defensible. Three specific triggers change the calculus — and two have nothing to do with enforcement.
I scanned 10 open-source AI apps for EU AI Act compliance
553 findings across 218,000-star projects — what compliance actually looks like in real codebases.
What EU AI Act risk tiers look like in your code
Zero code examples exist in the top-ranking content for EU AI Act risk classification. This post fills that gap: real Python snippets for each of the four tiers — prohibited, high-risk, limited-risk, minimal-risk — with actual regula check output showing what gets flagged and why. Includes the grey zones and honest precision figures.
Does the EU AI Act apply to your AI app? A developer’s guide
A five-step decision tree for developers: does your product use AI, do you have EU users, are you a provider or deployer, what risk tier, what are your obligations? Every legal reference cites a specific Article. Ends with the automated version: regula assess.
The EU AI Act Omnibus delay: what developers actually need to know
The Digital Omnibus defers high-risk deadlines from August 2026 to December 2027 — approved by Parliament and Council in June 2026, pending OJ publication. Here is what is actually happening, what it means for each risk tier, and whether you should wait or act now. Every claim is primary-source linked.
South Africa's draft National AI Policy: what Cabinet approved, and what it means for code
Cabinet approved the draft National Artificial Intelligence Policy for public comment on 2 April 2026. The gazette has not yet published the text, but the direction is clear: a sector-specific multi-regulator governance model, a 60-day comment window, and sector-specific regulations in 2027/2028. Live tracker plus POPIA and King V baseline plus five things South African organisations should do now.
How Regula maps to the AICDI corporate AI governance gaps
The 2026 UNESCO and Thomson Reuters Foundation AI Company Data Initiative report analysed 2,972 global companies across 11 GICS sectors and 7 regions, and found large gaps between AI adoption and AI governance. This piece maps each AICDI gap to what Regula actually does — honest about what a static code scanner can address (model registry, human oversight verification, Article 9–15 gap assessment, conformity evidence) and what it cannot (board oversight, worker protection policies, training programmes, environmental impact assessments).
South Africa draft National AI Policy — markdown version
The same South Africa content as the live landing page, rendered as markdown on GitHub. Useful if you want to diff the page against the git history, or if you are reading in a context where the live site is not convenient.