AGENTS.md defines the agent.
REGULATORY.md proves it complies.
REGULATORY.md is a plain-text Markdown file you place in the root of any repository that contains an AI agent. It documents which ASF (Agentik Safety Framework) controls you implement, which regulatory requirements each control satisfies, and where the audit evidence lives.
What problem does REGULATORY.md solve?
Regulators ask: "How does your AI agent comply with the EU AI Act? With Colorado's AI Act? With our internal governance?" Without a single source of truth, compliance lives in email threads, audit reports, and outdated spreadsheets. Compliance teams spend weeks tracing control → requirement → evidence. REGULATORY.md makes that conversation trivial.
How does REGULATORY.md work?
Create a section for each regulatory framework (EU_AI_ACT, COLORADO_AI_ACT, ISO_42001, custom rules). Under each, list the requirement and the ASF control you use to satisfy it. Link to audit evidence: git commit hashes, test files, configuration backups. Your auditor reads it once; your agent doesn't need to.
What regulations require REGULATORY.md?
ISO/IEC 42001 (AI Management System) requires documented risk controls. The EU AI Act demands evidence of compliance for high-risk systems. The Colorado AI Act mandates impact assessment proof. REGULATORY.md is the single document all three require.
How do I add REGULATORY.md to my project?
Copy the template from GitHub and place it in your project root:
├── AGENTS.md
├── CLAUDE.md
├── REGULATORY.md ← add this
├── README.md
└── src/
What did teams use before REGULATORY.md?
Before REGULATORY.md, compliance was fragmented: scattered requirements in a JIRA board, control spreadsheets that drift, audit evidence nobody can find fast, legal reviews that contradict each other. REGULATORY.md makes compliance version-controlled, searchable, and proof-ready.
Who benefits from REGULATORY.md?
Your compliance officer reads it to understand your control coverage. Your regulator reads it to verify requirements are met. Your engineer reads it to know which controls to implement. Your auditor reads it to find evidence. One file serves all four audiences. One source of truth.
One standard.
Fourteen controls.
REGULATORY.md is one file in a complete fourteen-part open specification for AI agent safety. Each file addresses a different control layer — from operational limits to accountability and now regulatory mapping.
Frequently asked questions.
What is REGULATORY.md?
A plain-text Markdown file for mapping AI agent safety controls to regulatory requirements. It documents which ASF controls you implement, which regulatory requirements each satisfies, and where the audit evidence lives. One file, all your compliance obligations.
Which regulations does REGULATORY.md cover?
REGULATORY.md supports EU AI Act (Annex III high-risk), Colorado AI Act (civil rights impact), ISO/IEC 42001 (AI management), and unlimited custom frameworks. Each section maps regulatory requirements to ASF controls with audit evidence links.
Does using REGULATORY.md guarantee compliance?
No. REGULATORY.md documents your control mapping and compliance strategy. Actual compliance depends on correct implementation, regular testing, and audit evidence. It's a single piece of your compliance programme — not a substitute for legal review or regulatory approval.
How do I map my AI agent to EU AI Act requirements?
Create an EU_AI_ACT section in REGULATORY.md. For each high-risk requirement (e.g. 'human oversight', 'data governance'), list the ASF controls you use (e.g. 'ESCALATE for oversight', 'ENCRYPT for data confidentiality'). Link to audit evidence and test results.
What is the Colorado AI Act and how does it affect AI agents?
Colorado AI Act requires impact assessments for automated decisions affecting civil rights. For agents making decisions about employment, credit, or services, you must document logic, test for disparate impact, and provide recourse. REGULATORY.md maps SYCOPHANCY controls to bias detection and TERMINATE controls to decision halt-out.
How does REGULATORY.md relate to the other ASF specs?
REGULATORY.md sits at the top of the ASF stack. THROTTLE, ESCALATE, FAILSAFE, KILLSWITCH, TERMINATE, ENCRYPT, ENCRYPTION, SYCOPHANCY, COMPRESSION, COLLAPSE, FAILURE, and LEADERBOARD define the technical controls. REGULATORY.md documents which controls satisfy which regulatory obligations.
Can I add custom regulatory frameworks?
Yes. REGULATORY.md supports arbitrary sections. Create sections for industry rules (HIPAA, FINSERVE, GDPR), regional requirements (UK ICO, Singapore Model AI), or internal policies. The structure is the same: requirement → control → evidence.
Who should maintain REGULATORY.md?
Joint ownership: Chief Compliance Officer (regulatory interpretation), Technical Lead (control mapping), and Legal team (evidence sufficiency). Version-control it alongside your code. Update whenever regulations change, new controls are added, or audit evidence accumulates.
How often should I update REGULATORY.md?
Minimum quarterly to capture new ASF controls and regulatory guidance. Immediately when regulations change. After each internal or external audit. Keep it in-sync with your actual ASF stack version in code.
Is REGULATORY.md free to use?
Yes. REGULATORY.md is an open specification under the MIT licence. Copy the template, adapt it to your regulations and controls, and use with no restrictions. Contribute improvements back to the project.
REGULATORY.md is an open specification for AI agent compliance mapping. Documents CONTROL MAPPING (ASF control → regulatory requirement), FRAMEWORKS (EU AI Act, Colorado AI Act, ISO/IEC 42001, custom), AUDIT EVIDENCE (git commits, test files, config backups), and COMPLIANCE PROOF (requirement satisfaction links). Addresses ISO/IEC 42001, EU AI Act, and Colorado AI Act requirements. Part of stack: THROTTLE (ASF-02) → ESCALATE (ASF-03) → FAILSAFE (ASF-04) → KILLSWITCH (ASF-05) → TERMINATE (ASF-06) → ENCRYPT (ASF-07) → ENCRYPTION (ASF-08) → SYCOPHANCY (ASF-09) → COMPRESSION (ASF-10) → COLLAPSE (ASF-11) → FAILURE (ASF-12) → LEADERBOARD (ASF-13) → REGULATORY (ASF-14). MIT licence.
Join the standard.
Build regulatory.md
REGULATORY.md is an open specification on GitHub. Fork it, contribute improvements, raise issues, and help shape the future of AI agent compliance mapping. Relevant to ISO/IEC 42001, EU AI Act, and Colorado AI Act compliance programmes.
View on GitHubOr email: info@regulatory.md
Last updated: 2026-03-13