What Regula does
The detail behind the five questions on the front page: what the scanner looks for, what it reports, how it runs, and where it sits next to other tools. None of it changes what the tool can establish. Regula indicates where to look; it does not decide your risk tier, your obligations, or whether you comply.
Who is this for?
Developers shipping AI products, and the businesses that use them.
Start with deployment context
If your team builds or uses AI, jurisdiction, intended purpose, role and deployment context determine which rules may apply. Record that context in regula assess, then have the result reviewed by the appropriate technical and legal owners.
Review patterns found in the code
Article 2 includes circumstances in which the Act applies outside the EU, but applicability and risk classification cannot be settled from source code alone. Use the scan to locate evidence and questions for contextual review.
- Works on AI-generated code (Cursor, Lovable, Bolt, Claude Code)
- Generates Annex IV documentation from your actual code
- CI/CD integration · JSON · SARIF · 13 compliance frameworks
Reviewable evidence scaffolds
Regula can generate evidence-pack scaffolds with SHA-256 manifests; optional commands can add signatures or timestamps when their prerequisites are configured. Packs require human completion and do not establish legal sufficiency. See a sample report → · Evidence pack tiers →
What Regula tells you
The EU AI Act uses risk-based rules whose application depends on intended purpose and deployment context. Regula reports candidate indicators and related provisions for human review; it does not decide the legal tier.
Regula shows which code evidence triggered a candidate indicator and what context a reviewer still needs.
How it works
Three steps. Core scanning requires no account or API key; optional network-enabled features have separate boundaries.
Install
pipx install regula-ai
Requires Python 3.10 or later; see the tested installation paths. Installation guide ↗
Scan
regula
Indicator summary, findings, and suggested next steps.
Act
regula comply
Checklist of documentation and controls found for each article.
What it does
Regula combines code scanning with governance questionnaires. It reads your code for risk patterns, and provides structured self-assessments for the organisational obligations code cannot verify. It generates artefacts an auditor can review, not just findings.
What's missing?
Separates code observations from legal decisions. When applicability facts are unresolved, it names the facts needed next instead of emitting article scores or effort estimates.
regula gap .
Is your AI code secure?
Prompt injection, unsafe model loading, unvalidated AI output, hardcoded keys, and other AI-specific vulnerabilities.
regula check . · regula guardrails .
Human review analysis
Traces AI outputs across files. Checks whether each path to a user-facing endpoint passes through a human review gate.
regula oversight .
Need evidence for review?
Annex IV technical documentation generated from your actual code. Functions, dependencies, and logging coverage pre-populated.
regula docs . · regula conform .
Conformity assessment pack
Reviewer-completable evidence pack with a reliance gate, unresolved-facts list, and SHA-256 integrity hashes. Article duties are attached only after the decision kernel resolves applicability. Evidence-pack specification.
regula conform . · regula evidence-pack .
Integrity checks and optional signatures
SHA-256 manifests, Ed25519 signatures, and RFC 3161 timestamps can help reviewers check when an assessment was produced and whether files changed afterward.
regula conform --sign --timestamp .
3 jurisdictions, one scan
Beyond the EU AI Act: the same scan maps findings to South Korea's AI Basic Act (Act No. 20676, in force 22 January 2026) and Colorado SB 26-189 (disclosure-focused, duties from 1 January 2027), each with its own domain-to-obligation mapping and questionnaire.
regula check . --jurisdictions eu,korea,colorado
13 framework mappings
Each AI Act article is mapped to ISO 42001, NIST AI RMF, SOC 2, OWASP, and 8 other framework obligations. One scan surfaces requirements across all 13 frameworks.
regula gap .
62 commands total · Python, JS, TS, Java, Go, Rust, C, C++ · Cross-maps to ISO 42001, NIST AI RMF, OWASP LLM Top 10, EU CRA, and 9 other frameworks. Full CLI reference →
Runs where you work
Terminal, CI/CD, editor, pre-commit. One tool, every workflow.
Terminal
pipx install regula-ai && regula check .
CI/CD
GitHub Action: kuzivaai/getregula@v1 with SARIF upload
VS Code
Inline WARN/BLOCK decorators. Scan on save.
Claude Code / Cursor
MCP server: regula mcp-server
Pre-commit
regula install pre-commit
GDPR dual-compliance
regula gdpr : GDPR-related code indicators and AI Act/GDPR hotspots. Pattern source.
Where Regula fits in the market
Code scanning plus governance questionnaires. One of several tools in the EU AI Act ecosystem. Each solves a different part of the problem.
Credo AI, Saidot, Enzai, IBM watsonx.governance, Microsoft Purview. Evidence workflows, control libraries, continuous monitoring, legal-expert policy updates. Built for compliance departments, not developers. No published pricing.
Garak, Giskard, Promptfoo. Prompt-injection, jailbreak and bias red-teaming against running models. Complementary to Regula, not overlapping. They test behaviour; Regula reads code.
Code scanning plus governance questionnaires. The stdlib-only core scans local files without uploading them; optional features have separate dependency and network boundaries. pipx install regula-ai, inspect the indicators, then complete contextual human review. Apache 2.0 / EUPL 1.2; detection rules under DRL 1.1.
| Feature | Regula | Legalithm | EC AI Act Compliance Checker (official beta) | Future of Life Institute checker | Prighter | Big four and AI governance platforms |
|---|---|---|---|---|---|---|
| Price | Tool free. Starter assessment GBP 950 fixed; advisory GBP 650 per day | Free tier EUR 0. Starter EUR 17/mo, Pro EUR 47/mo, Business EUR 119/mo at launch pricing (list EUR 29, 79, 199). Free-launch mode active | No price stated on the page | No charge stated on the page | EU AI Act GPAI representation from EUR 39/mo (EUR 35/mo, EUR 420/yr billed annually) to EUR 440/mo (EUR 396/mo, EUR 4,752/yr billed annually), excluding VAT | not verified |
| Licence | Apache-2.0 OR EUPL-1.2, with detection rules under DRL-1.1 | MIT, for the npm package legalithm 0.6.0 | not verified | not verified | Not applicable, this is a service rather than software | not verified |
| Runs fully offline with no upload | Scanner runs locally and does not upload code. Optional commands (news feed, vocabulary refresh, RFC 3161 timestamping) make outbound requests; timestamping sends hashes | Partly. Its README states guard and verify-record run offline with no key and no network; generating the compliance record requires an API key | No, it is a hosted web tool | No, it is a hosted web tool | Not applicable, this is a service rather than software | not verified |
| Account required | No | A free API key is required to generate the compliance record; guard and verify need no key | not verified | No | not verified | not verified |
| Source code scanning, or declaration and questionnaire only | Source code scanning across eight language families, with a Python AST engine and tree-sitter for JavaScript and TypeScript, alongside a questionnaire | Both. Its npm description states it detects AI dependencies and marks and verifies AI-generated content, alongside an assessment workflow | not verified | Question-based form, not a code scanner | No code scanning is mentioned on the page | not verified |
| Jurisdictions covered | EU AI Act, South Korea AI Basic Act, Colorado SB 26-189 | EU AI Act and GDPR | EU AI Act, Regulation (EU) 2024/1689 | EU AI Act, Regulation (EU) 2024/1689 | European Union, including its extraterritorial scope | not verified |
| Names the facts that remain unknown, or returns a score or tier | Reports insufficient_information and names the facts a person must still settle | Its site states it produces a dated, cited record classifying the system by risk level with article references | not verified | Its page recommends seeking professional legal advice and following national guidance | Not applicable, this is a representation service | not verified |
| Self serve or sales led | Self serve for the tool. Paid work starts with an email, as no checkout exists | Self serve. Its site states the free assessment starts in the browser with no signup | Self serve, a public web tool | Self serve, a public web tool | Prices are published, and its AI Act page routes to a contact form | not verified |
| Positioning | Developer tool, run at the point code is written | Developer tool producing a compliance record | Official Commission tool, marked beta, operated by DG CONNECT and the AI Office | Independent tool maintained by the Future of Life Institute, which states it is not affiliated with the European Union | Authorised representative service | not verified |
| Sources checked | pypi.org/pypi github.com/kuzivaai | legalithm.com legalithm.com/pricing registry.npmjs.org/legalithm | ai-act-service-desk.ec.europa.eu/en | artificialintelligenceact.eu/assessment | prighter.com/eu-ai-act prighter.com/pricing | none checked this round |
Verified: 2026-08-15
This comparison reflects our reading of publicly available information from each provider's own website, PyPI and GitHub as at 2026-08-15. Features and prices change; verify the current position with each provider before relying on it. We compare only tools that address development-time or organisational EU AI Act readiness. Where we could not verify a cell from a primary source, it is marked not verified.
These tools do different jobs, so the useful question is which one fits where you are rather than which scores highest. A code scanner reads what you have written; a questionnaire records what you declare; an authorised representative is a legal role, not a tool. Several of the entries above are complementary to each other rather than alternatives. For runtime agent governance, which none of the above covers, see Microsoft’s Agent Governance Toolkit.