Governance Posture

EU AI Act readiness at a glance. Scan your project to populate.
First time? Start with "Run Scan" to scan a project, then review findings and complete the Self-Assessment.
Regula is a risk indication tool, not a legal opinion. Classification results require human review. See what Regula does not do.
--
Prohibited
--
High-Risk
--
Limited-Risk
--
Minimal-Risk
Risk Distribution
Prohibited
High-Risk
Limited-Risk
Minimal-Risk
Compliance Readiness (Articles 9-15)

Run a scan to see compliance readiness per article.

Recent Findings

No scan results yet. Use the "Run Scan" tab to scan a project.

Run Scan

Scan a project directory for EU AI Act compliance indicators.
▶

Enter a project path and press Scan. Results will appear here.

Requires the API server: regula api-server

Keyboard shortcut: Ctrl+Enter to scan

Findings

All risk indicators detected in the last scan.
⚐

No findings yet. Run a scan first.

Compliance Gap Analysis

Assessment against EU AI Act Articles 9-15 obligations.
Gap analysis covers code-verifiable obligations only. Organisational obligations (risk management system, quality management, fundamental rights impact assessment) require the self-assessment questionnaire.
☑

Run a scan to generate the compliance gap analysis.

Governance Self-Assessment

Organisational readiness questionnaire for EU AI Act obligations that code scanning cannot verify.
This is a structured questionnaire, not a compliance certificate. Answers are self-reported and must be independently verified by an auditor, notified body, or internal governance function.

Enforcement Timeline

Key EU AI Act compliance dates.
2 Feb 2025 — Prohibited practices (Article 5) ENFORCED
2 Aug 2025 — GPAI obligations (Articles 51-55) ENFORCED
2 Dec 2027 — High-risk obligations, Annex III (Regulation (EU) 2026/1744) ENACTED
Regulation (EU) 2026/1744 entered into force on 27 Jul 2026. It sets 2 Dec 2027 for Annex III and 2 Aug 2028 for Annex I high-risk obligations.
2 Aug 2028 — Annex I product-embedded high-risk obligations PLANNED
Applicable Fines
ViolationMaximum Fine
Prohibited AI practices (Article 5)35M EUR or 7% global revenue
High-risk obligations (Articles 9-15)15M EUR or 3% global revenue
Incorrect information to authorities7.5M EUR or 1% global revenue

Audit Trail

SHA-256 hash-chained, tamper-evident scan history.
How it works

Every regula check scan is automatically logged to ~/.regula/audit/ as a hash-chained JSONL file. Each entry includes a SHA-256 hash of the previous entry, creating a tamper-evident chain (the same construction used by Certificate Transparency).

If a single byte of any past entry is altered, the chain breaks and verification fails.

Verify integrity
regula audit verify

Expected output: "Audit chain verified (N entries, no tampering detected)"

View recent entries
regula audit show --format json | head -20

Each entry records: timestamp, command, file paths scanned, findings count, and the SHA-256 hash linking it to the previous entry.

Third-party timestamping (optional)

Anchor the current audit log head to a public RFC 3161 Time Stamp Authority. This creates an independent, cryptographic proof that the audit log existed in its current form at a specific time.

regula audit anchor --tsa https://freetsa.org/tsr

Regula does not require trust in any specific TSA. Set REGULA_TSA_URL to the authority of your choice.

Dashboard scan history (this session)

No scans run this session. Scans from the "Run Scan" tab will appear here.

Export Reports

Generate compliance artefacts for auditors and procurement teams.
Scan Report

Full findings with article mapping and remediation guidance.

Conformity Evidence Pack

Annex IV technical documentation scaffold with scan evidence.

Run from terminal: regula conform /path/to/project

AI BOM

CycloneDX 1.7 SBOM with GPAI signatory annotations.

Run from terminal: regula sbom --ai-bom

Self-Assessment Export

Governance questionnaire answers as structured evidence document.