Regula

Offline-capable, code-native AI governance scanning. The core scan runs locally, does not upload scanned file contents, and needs no account; telemetry is sent only with explicit opt-in consent. Regula flags patterns that may need review under the EU AI Act, South Korea's AI Basic Act, and Colorado SB 26-189, records the deployment facts code cannot show, and reports insufficient information rather than inventing a score.

Table of contents

• What it does
• Choose how to start
• Quick start
• What Regula tells you
• Key commands
• Who is this for?
• What Regula is (and isn't)
• Bias evaluation: methodology and ethics
• Important limitations
• Verified numbers
• Contributing
• Licence

$ regula check examples/cv-screening-app --scope all

Decision: insufficient_information
Jurisdiction: eu
Rule resolution: unresolved
Facts needed to resolve the next decision: 2
  - is_ai_system: Does the subject meet the governing law's definition of an AI system or regulated automated technology?
  - jurisdiction_in_scope: Does this jurisdiction's territorial and operator scope apply?

Detector observations (not legal facts):

  Detector summary: ANNEX III OR SECURITY PATTERNS
  The scanner found patterns relevant to Annex III or security review.
  Resolve the facts listed above before attaching Article 9 to 15 duties.
  Files scanned:      1
  High-risk:          1
  INFO tier:          1

  HIGH-RISK INDICATORS:
    [INFO] [ 43] app.py — Employment and workers management [plan]

  Detector priority: 0-100 (higher = more code patterns matched; not a correctness probability)

Excerpt from the real output of the command shown, against the tracked fixture examples/cv-screening-app. The per-category counts that read zero and the next-steps footer are omitted for length; nothing else is edited. scripts/verify_transcripts.py re-runs this command on every check and fails if any line above stops appearing in its output.

What it does

Regula scans a local source-code folder for patterns that may need AI governance review. A questionnaire records facts that code cannot show, such as where and how a system will be used. Results identify candidate risk categories and link to provisions that may be relevant. Regula does not determine legal classification, compliance, or the obligations that apply to a real deployment.

Reference material covers the EU AI Act, South Korea's AI Basic Act (Act No. 20676), and Colorado SB 26-189. The core install has no required third-party runtime dependencies. Optional extras add dependencies, and some optional commands or configured features can contact external services. Assess territorial scope and data-processing duties independently.

In plain English: give Regula a source-code folder and answer questions about how the system will be used. It returns possible issues and a review trail so a developer, governance lead, or adviser can decide what to investigate next. A scan with no findings does no

... View full README on GitHub