What Regula does
The detail behind the five questions on the front page: what the scanner looks for, what it reports, how it runs, and where it sits next to other tools. None of it changes what the tool can establish. Regula indicates where to look; it does not decide your risk tier, your obligations, or whether you comply.
Who is this for?
Developers shipping AI products, and the businesses that use them.
Start with deployment context
If your team builds or uses AI, jurisdiction, intended purpose, role and deployment context determine which rules may apply. Record that context in regula assess, then have the result reviewed by the appropriate technical and legal owners.
Review patterns found in the code
Article 2 includes circumstances in which the Act applies outside the EU, but applicability and risk classification cannot be settled from source code alone. Use the scan to locate evidence and questions for contextual review.
- Works on AI-generated code (Cursor, Lovable, Bolt, Claude Code)
- Generates Annex IV documentation from your actual code
- CI/CD integration · JSON · SARIF · selected references across 13 framework identifiers
Reviewable evidence scaffolds
Regula can generate evidence-pack scaffolds with SHA-256 manifests; optional commands can add signatures or timestamps when their prerequisites are configured. Packs require human completion and do not establish legal sufficiency. See a sample report → · Evidence pack tiers →
What Regula tells you
The EU AI Act uses risk-based rules whose application depends on intended purpose and deployment context. Regula reports candidate indicators and related provisions for human review; it does not decide the legal tier.
Regula shows which code evidence triggered a candidate indicator and what context a reviewer still needs.
How it works
Three steps. Core scanning requires no account or API key; optional network-enabled features have separate boundaries.
Install
pipx install git+https://github.com/kuzivaai/getregula.git@main
Requires Python 3.10 or later; see the tested installation paths. Installation guide ↗
Scan
regula
Indicator summary, findings, and suggested next steps.
Act
regula comply
Checklist of documentation and controls found for each article.
What it does
Regula combines code scanning with governance questionnaires. It reads your code for risk patterns, and provides structured self-assessments for the organisational obligations code cannot verify. It generates artefacts an auditor can review, not just findings.
What's missing?
Separates code observations from legal decisions. When applicability facts are unresolved, it names the facts needed next instead of emitting article scores or effort estimates.
regula gap .
Is your AI code secure?
Prompt injection, unsafe model loading, unvalidated AI output, hardcoded keys, and other AI-specific vulnerabilities.
regula check . · regula guardrails .
Human review analysis
Traces AI outputs across files. Checks whether each path to a user-facing endpoint passes through a human review gate.
regula oversight .
Need evidence for review?
Annex IV technical documentation generated from your actual code. Functions, dependencies, and logging coverage pre-populated.
regula docs . · regula conform .
Conformity assessment pack
Reviewer-completable evidence pack with a reliance gate, unresolved-facts list, and SHA-256 integrity hashes. Article duties are attached only after the decision kernel resolves applicability. Evidence-pack specification.
regula conform . · regula evidence-pack .
Integrity checks and optional signatures
SHA-256 manifests, Ed25519 signatures, and RFC 3161 timestamps can help reviewers check when an assessment was produced and whether files changed afterward.
regula conform --sign --timestamp .
3 jurisdictions, one scan
Beyond the EU AI Act: the same scan maps findings to South Korea's AI Basic Act (Act No. 20676, in force 22 January 2026) and Colorado SB 26-189 (disclosure-focused, duties from 1 January 2027), each with its own domain-to-obligation mapping and questionnaire.
regula check . --jurisdictions eu,korea,colorado
13 framework reference sets
Selected AI Act obligation areas link to selected ISO 42001, NIST AI RMF, SOC 2, OWASP, and other references. The crosswalk helps a reviewer navigate; it does not test equivalence, applicability, or implementation.
regula gap .
62 commands total · Python, JS, TS, Java, Go, Rust, C, C++ · Selected references across 13 framework identifiers. Full CLI reference →
Runs where you work
Terminal, CI/CD, editor, pre-commit. One tool, every workflow.
Terminal
pipx install git+https://github.com/kuzivaai/getregula.git@main && regula check .
CI/CD
GitHub Action: kuzivaai/getregula@v1 with SARIF upload
VS Code
Inline WARN/BLOCK decorators. Scan on save.
Claude Code / Cursor
MCP server: regula mcp-server
Pre-commit
regula install pre-commit
GDPR dual-compliance
regula gdpr : GDPR-related code indicators and AI Act/GDPR hotspots. Pattern source.
Where Regula fits in the market
Code scanning plus governance questionnaires. One of several tools in the EU AI Act ecosystem. Each solves a different part of the problem.
Credo AI, Saidot, Enzai, IBM watsonx.governance, Microsoft Purview. Evidence workflows, control libraries, continuous monitoring, legal-expert policy updates. Built for compliance departments, not developers. No published pricing.
Garak, Giskard, Promptfoo. Prompt-injection, jailbreak and bias red-teaming against running models. Complementary to Regula, not overlapping. They test behaviour; Regula reads code.
Code scanning plus governance questionnaires. The stdlib-only core scans local files without uploading them; optional features have separate dependency and network boundaries. pipx install git+https://github.com/kuzivaai/getregula.git@main, inspect the indicators, then complete contextual human review. Apache 2.0 / EUPL 1.2; detection rules under DRL 1.1.
These tools do different jobs, so the useful question is which one fits where you are rather than which scores highest. A code scanner reads what you have written; a questionnaire records what you declare; an authorised representative is a legal role, not a tool. Several of the entries above are complementary to each other rather than alternatives. For runtime agent governance, which none of the above covers, see Microsoft’s Agent Governance Toolkit.