Regula

Regula

Offline-capable, code-native AI governance scanning. The core scan runs locally, does not upload scanned file contents, and needs no account; telemetry is sent only with explicit opt-in consent. Regula flags patterns that may need review under the EU AI Act, South Korea's AI Basic Act, and Colorado SB 26-189, records the deployment facts code cannot show, and reports insufficient information rather than inventing a score.

---

Table of contents

• What it does
• Choose how to start
• Quick start
• What Regula tells you
• Key commands
• Who is this for?
• What Regula is (and isn't)
• Bias evaluation: methodology and ethics
• Important limitations
• Verified numbers
• Contributing
• Licence

---

$ regula check examples/cv-screening-app --scope all

Decision: insufficient_information Jurisdiction: eu Rule resolution: unresolved Facts needed to resolve the next decision: 2

• is_ai_system: Does the subject meet the governing law's definition of an AI system or regulated automated technology?
• jurisdiction_in_scope: Does this jurisdiction's territorial and operator scope apply?

Detector observations (not legal facts):

Detector summary: ANNEX III OR SECURITY PATTERNS The scanner found patterns relevant to Annex III or security review. Resolve the facts listed above before attaching Article 9 to 15 duties. Files scanned: 1 High-risk: 1 INFO tier: 1

HIGH-RISK INDICATORS: [INFO] [ 43] app.py — Employment and workers management [plan]

Detector priority: 0-100 (higher = more code patterns matched; not a correctness probability)

*Excerpt from the real output of the command shown, against the tracked fixture examples/cv-screening-app. The per-category counts that read zero and the next-steps footer are omitted for length; nothing else is edited. scripts/verify_transcripts.py re-runs this command on every check and fails if any line above stops appearing in its output.*

---

What it does

Regula scans a local source-code folder for patterns that may need AI governance review. A questionnaire records facts that code cannot show, such as where and how a system will be used. Results identify candidate risk categories and link to provisions that may be relevant. Regula does not determine legal classification, compliance, or the obligations that apply to a real deployment.

Reference material covers the EU AI Act, South Korea's AI Basic Act (Act No. 20676), and Colorado SB 26-189. The core install has no required third-party runtime dependencies. Optional extras add dependencies, and some optional commands or configured features can contact external services. Assess territorial scope and data-processing duties independently.

In plain English: give Regula a source-code folder and answer questions about how the system will be used. It returns possible issues and a review trail so a developer, governance lead, or adviser can decide what to investigate next. A scan with no findings does not prove that a system is compliant or low risk.

Choose how to start

Quick start

pipx install git+https://github.com/kuzivaai/getregula.git@main

PyPI distribution is currently unavailable. The command above installs a moving public source reference; pin a reviewed commit hash for reproducible use. See docs/installation.md for the verified status and alternatives.

Not sure if the AI Act applies? No code needed:

regula assess               # record declared context for human review

regula assess --save-facts # and write the answers where regula check reads them

The scan tells you which facts it needs and cannot get from code. You supply them, and the decision moves:

regula check . --list-facts                     # every fact id the model defines

regula check . --fact is_ai_system=yes \ --fact jurisdiction_in_scope=yes # declare them for one run

Declared facts are yours, not Regula's. Each is stored with who declared it, through which command, in answer to which question, and when, in .regula/facts.json, and the scan prints that provenance beside the decision. unknown is an answer and is never read as no. A declared fact can move a decision from insufficient_information to an indication; it does not produce a risk tier, a compliance score, a readiness percentage or an effort estimate.

Want to scan your code?

regula check .              # 423 tier patterns, 8 language families; runtime varies

regula check . --jurisdictions eu,korea,colorado # selected reference mappings

Need a review pack?

regula evidence-pack --project .   # reviewer-completable evidence scaffold

regula conform --sign --timestamp # integrity metadata (requires regula[signing])

Generated files are inputs to human review, not an audit opinion, certification, or proof of compliance.

Just want to see it work? (requires the cloned repo : examples/ is not bundled in the pip package)

git clone https://github.com/kuzivaai/getregula && cd getregula

regula demo # scan a bundled example project

Install details

The recommended install is pipx : it isolates Regula from your system Python and avoids the externally-managed-environment error on Ubuntu 22.04+, Debian 12+, Fedora, Arch, and Homebrew Python.

If you don't have pipx yet, install it first (one-time):

Already using uv? uvx --from git+https://github.com/kuzivaai/getregula.git@main regula runs the public source without a persistent install. Or install it with uv tool install git+https://github.com/kuzivaai/getregula.git@main.

Running inside a venv or conda env? Use pip install git+https://github.com/kuzivaai/getregula.git@main. The PEP 668 restriction applies to managed system Python, not an activated virtual environment.

See docs/installation.md for troubleshooting (externally-managed-environment, command not found: regula after install, PATH setup per shell).

Try it against a known high-risk fixture:

regula check examples/cv-screening-app --scope all

The --scope all flag is needed because Regula's default scope (production) skips example directories. This fixture intentionally contains employment-related code indicators that exercise the Annex III Category 4 detector; the resulting label is a detector observation, not a legal determination.

See examples/ for runnable reference projects covering prohibited-practice, high-risk, transparency, and no-elevated-indicator scenarios, or walk through the full 10-minute evaluation journey in examples/cv-screening-app/ : install, scan, plan, gap, conform, verify, handoff to red-team tooling.

For a deeper first-time-user walk-through (policy tuning, CI integration, baselining) see docs/QUICKSTART.md. The full documentation is indexed by type (tutorials / how-to / reference / explanation) in docs/README.md.

CI/CD

# .github/workflows/regula.yaml

name: AI Governance Check on: [push, pull_request] jobs: regula: runs-on: ubuntu-latest steps:

• uses: actions/checkout@v4
• uses: kuzivaai/getregula@v1 with: path: '.' upload-sarif: 'true' fail-on-prohibited: 'true'

What Regula tells you

The EU AI Act defines four risk tiers. Regula maps code patterns to each:

Every finding includes the relevant Article reference and explains when exceptions may apply. Regula flags patterns -- it does not make legal determinations.

Coverage has explicit levels. Regula has an evidence-gated questionnaire and decision model for the EU AI Act, South Korea's AI Basic Act (Act No. 20676), and Colorado SB 26-189. It separately maps findings to selected control or provision references in 13 frameworks, and publishes dated regional trackers. A crosswalk or tracker is not an executable applicability decision or a compliance assessment. See product coverage and user journeys for the current capability matrix and claim boundary. Use --jurisdictions on regula check to filter selected reference mappings; that option also accepts uk, brazil, nist, and iso, but it does not run an applicability decision. Use --jurisdiction eu, korea, or colorado on regula assess for the three implemented decision-support configurations.

Developer guide sources: Python | JavaScript | Healthcare | Recruitment | Article 5 | Article 9 | [Article 14](site/gu