Regula

Offline-capable, code-native AI governance scanning. The core scan runs locally, does not upload scanned file contents, and needs no account; telemetry is sent only with explicit opt-in consent. Regula flags patterns that may need review under the EU AI Act, South Korea's AI Basic Act, and Colorado SB 26-189, records the deployment facts code cannot show, and reports insufficient information rather than inventing a score.

Table of contents

• What it does
• Choose how to start
• Quick start
• What Regula tells you
• Key commands
• Who is this for?
• What Regula is (and isn't)
• Bias evaluation: methodology and ethics
• Important limitations
• Verified numbers
• Contributing
• Licence

$ regula check examples/cv-screening-app --scope all

Decision: insufficient_information
Jurisdiction: eu
Rule resolution: unresolved
Facts needed to resolve the next decision: 2
  - is_ai_system: Does the subject meet the governing law's definition of an AI system or regulated automated technology?
  - jurisdiction_in_scope: Does this jurisdiction's territorial and operator scope apply?

Detector observations (not legal facts):

  Detector summary: ANNEX III OR SECURITY PATTERNS
  The scanner found patterns relevant to Annex III or security review.
  Resolve the facts listed above before attaching Article 9 to 15 duties.
  Files scanned:      1
  High-risk:          1
  INFO tier:          1

  HIGH-RISK INDICATORS:
    [INFO] [ 43] app.py — Employment and workers management [plan]

  Detector priority: 0-100 (higher = more code patterns matched; not a correctness probability)

Excerpt from the real output of the command shown, against the tracked fixture examples/cv-screening-app. The per-category counts that read zero and the next-steps footer are omitted for length; nothing else is edited. scripts/verify_transcripts.py re-runs this command on every check and fails if any line above stops appearing in its output.

What it does

Regula scans a local source-code folder for patterns that may need AI governance review. A questionnaire records facts that code cannot show, such as where and how a system will be used. Results identify candidate risk categories and link to provisions that may be relevant. Regula does not determine legal classification, compliance, or the obligations that apply to a real deployment.

Reference material covers the EU AI Act, South Korea's AI Basic Act (Act No. 20676), and Colorado SB 26-189. The core install has no required third-party runtime dependencies. Optional extras add dependencies, and some optional commands or configured features can contact external services. Assess territorial scope and data-processing duties independently.

In plain English: give Regula a source-code folder and answer questions about how the system will be used. It returns possible issues and a review trail so a developer, governance lead, or adviser can decide what to investigate next. A scan with no findings does not prove that a system is compliant or low risk.

Choose how to start

Quick start

pipx install git+https://github.com/kuzivaai/getregula.git@main

PyPI distribution is currently unavailable. The command above installs a moving public source reference; pin a reviewed commit hash for reproducible use. See docs/installation.md for the verified status and alternatives.

Not sure if the AI Act applies? No code needed:

regula assess               # record declared context for human review
regula assess --save-facts  # and write the answers where `regula check` reads them

The scan tells you which facts it needs and cannot get from code. You supply them, and the decision moves:

regula check . --list-facts                     # every fact id the model defines
regula check . --fact is_ai_system=yes \
               --fact jurisdiction_in_scope=yes # declare them for one run

Declared facts are yours, not Regula's. Each is stored with who declared it, through which command, in answer to which question, and when, in .regula/facts.json, and the scan prints that provenance beside the decision. unknown is an answer and is never read as no. A declared fact can move a decision from insufficient_information to an indication; it does not produce a risk tier, a compliance score, a readiness percentage or an effort estimate.

Want to scan your code?

regula check .              # 423 tier patterns, 8 language families; runtime varies
regula check . --jurisdictions eu,korea,colorado  # selected reference mappings

Need a review pack?

regula evidence-pack --project .   # reviewer-completable evidence scaffold
regula conform --sign --timestamp  # integrity metadata (requires regula[signing])

Generated files are inputs to human review, not an audit opinion, certification, or proof of compliance.

Just want to see it work? (requires the cloned repo : examples/ is not bundled in the pip package)

git clone https://github.com/kuzivaai/getregula && cd getregula
regula demo                 # scan a bundled example project

Install details

The recommended install is pipx : it isolates Regula from your system Python and avoids the externally-managed-environment error on Ubuntu 22.04+, Debian 12+, Fedora, Arch, and Homebrew Python.

If you don't have pipx yet, install it first (one-time):

Already using uv? uvx --from git+https://github.com/kuzivaai/getregula.git@main regula runs the public source without a persistent install. Or install it with uv tool install git+https://github.com/kuzivaai/getregula.git@main.

Running inside a venv or conda env? Use pip install git+https://github.com/kuzivaai/getregula.git@main. The PEP 668 restriction applies to managed system Python, not an activated virtual environment.

See docs/installation.md for troubleshooting (externally-managed-environment, command not found: regula after install, PATH setup per shell).

Try it against a known high-risk fixture:

regula check examples/cv-screening-app --scope all

The --scope all flag is needed because Regula's default scope (production) skips example directories. This fixture intentionally contains employment-related code indicators that exercise the Annex III Category 4 detector; the resulting label is a detector observation, not a legal determination.

See examples/ for runnable reference projects covering prohibited-practice, high-risk, transparency, and no-elevated-indicator scenarios, or walk through the full 10-minute evaluation journey in examples/cv-screening-app/ : install, scan, plan, gap, conform, verify, handoff to red-team tooling.

For a deeper first-time-user walk-through (policy tuning, CI integration, baselining) see docs/QUICKSTART.md. The full documentation is indexed by type (tutorials / how-to / reference / explanation) in docs/README.md.

CI/CD

# .github/workflows/regula.yaml
name: AI Governance Check
on: [push, pull_request]
jobs:
  regula:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: kuzivaai/getregula@v1
        with:
          path: '.'
          upload-sarif: 'true'
          fail-on-prohibited: 'true'

What Regula tells you

The EU AI Act defines four risk tiers. Regula maps code patterns to each: