How the AI works
AI governing AI, with the guardrails visible
This page is the honest tour: what the model does, what it is prevented from doing, and where deterministic code takes over.
Design rules
- The model maps and explains. It never invents rules or facts.
- Everything it returns is schema-validated before storage.
- Unknowns become open questions, not assumptions.
- Model-agnostic: one thin layer, several providers.
01
Understand your AI use
The engine starts from your intake: use cases in your own words, where you operate, vendors, pasted policies. A language model normalizes this into structured use cases: category, audience, decision impact, oversight, disclosure.
Rule one is enforced here: the model may not invent facts about your company. If your answers do not say whether EU residents are in scope, the engine does not assume; it records an open question and maps only what your stated footprint supports.
02
Map obligations from the library
Regolyn maintains a curated obligation library: real rules summarized in plain language, each with the conditions that make it apply and the date it took effect. The library is versioned, and your assessment records which version it was mapped against.
The model maps each use case against this library and nothing else. It cannot cite a rule that is not in it, which is how invented law is kept out of your assessment by construction, not by hoping. Every mapping carries a status of met, partial, or gap, and a reason grounded in your answers.
- EU-ART-5Prohibited AI practicesEU AI Act, European UnionIn force since February 2, 2025
- EU-ART-4AI literacy for staffEU AI Act, European UnionIn force since February 2, 2025
- EU-ART-26Deployer duties for high-risk AIEU AI Act, European UnionApplies since August 2, 2026
- EU-ART-50Transparency to peopleEU AI Act, European UnionApplies since August 2, 2026
- EU-ART-27Fundamental rights impact assessmentEU AI Act, European UnionApplies since August 2, 2026
- GDPR-ART-22Solely automated decisionsGDPR, European UnionIn force since May 25, 2018
- CO-SB-205Duties for deployers of high-risk AIColorado AI Act, Colorado, United StatesTakes effect June 30, 2026
- NYC-LL-144Bias audit for hiring toolsNYC Local Law 144, New York City, United StatesEnforced since July 5, 2023
- IL-HB-3773AI in employment decisionsIllinois Human Rights Act amendment, Illinois, United StatesIn force since January 1, 2026
- UT-AIPADisclose generative AI useUtah AI Policy Act, Utah, United StatesIn force since May 1, 2024
- TX-TRAIGAProhibited intents and disclosuresTexas Responsible AI Governance Act, Texas, United StatesIn force since January 1, 2026
- CA-ADMTAutomated decision-making rightsCCPA regulations, California, United StatesAdopted 2025, phased compliance by January 1, 2027
- CA-SB-942Provenance for generated contentCalifornia AI Transparency Act, California, United StatesIn force since January 1, 2026
- US-FTC-5Honesty about AIFTC Act, United States, federalLong standing, actively enforced against AI claims since 2024
03
Score readiness
Statuses roll up into a 0 to 100 score against a fixed rubric, with a written rationale. The score is designed to be honest rather than motivating: a company with unaudited AI hiring in three regulated states does not get a comfortable number.
The output is validated against a strict schema before anything is stored or shown. If the model returns something malformed, it gets one corrective retry with the validator's complaints; if that fails, you see an error, never a silently broken assessment.
// Nothing reaches your screen unvalidated (excerpt)
readiness_score: integer, 0 to 100
use_cases[]: id must exist in your intake
obligations[]: id must exist in the library // no invented law
status: "met" | "partial" | "gap"
gaps[]: severity, plain_language, first_step
open_questions[]: facts the engine refused to assume
drafts: register_entries, policy_sections,
vendor_questions // your facts only04
Draft the artifacts
Register entries, policy sections, and vendor questions are drafted from your company's own facts: your system names, your vendors, your oversight arrangements. Where a fact is missing, the draft says so instead of decorating.
Drafts are starting points with an owner line and a review line, written to be adopted after review. They are preparation for your judgment and your counsel's, and the interface says that where it matters.
Model-agnostic
Routing, not loyalty
Regolyn calls models through one thin provider layer with fallback chains per provider. Accounts are never tied to a single vendor's model, and workloads move when a better or safer option ships. Your data is sent to a provider only to produce your assessment, under terms that exclude training.
PROVIDERS
OpenAI and Anthropic today; the layer is a morning of work to extend.
FALLBACKS
Each provider has a model chain, so an account without the newest model still works.
HONESTY
If no provider is configured, the product says so on /status instead of pretending.
Limits, stated plainly: Regolyn does not give legal opinions, does not certify compliance, and does not know facts you did not provide. What it does is make the preparation work fast, grounded, and reviewable. More on the care page.
See where you stand this week
The free plan runs a real readiness check on two use cases: mapped obligations, a score, plain-language gaps, and drafted artifacts. Ten minutes of answers, no card.