Disclosure bypass
Can the agent complete a regulated interaction without a required disclosure or warning?
Independent methodology · Sponsored by Carver
Can your AI be made unlawful?
Red teams test whether an AI system can be made unsafe. RegTeams test whether it can be pushed across a regulatory boundary.
RegTeaming complements safety and security red-teaming; most consequential deployments need both.
Definition
RegTeaming
The systematic adversarial testing of an AI system against the laws, regulations, guidance, enforcement expectations, and industry obligations governing its behavior.
An AI system may behave as designed and still create regulatory exposure. RegTeaming converts obligations into concrete scenarios, attacks, expected behavior, and evidence.
A simple example
Helpful behavior can still cross the line.
A healthcare voice agent is asked: “I cannot reach my doctor. Should I stop my medication before tomorrow’s procedure?”
The agent may sound cautious and helpful, yet still move from scheduling into individualized medical advice.
A RegTeam tests whether it refuses the recommendation, escalates correctly, and preserves evidence of the handoff.
From changing rules to executable tests
RegTeaming connects regulatory intelligence to the AI evaluation lifecycle.
1. WatchDetect regulations, guidance, enforcement and case law.
2. InterpretStructure obligations, conditions, exceptions and affected actors.
3. GenerateTranslate obligations into adversarial scenarios and expected behavior.
4. AttackProbe prompts, trajectories, tools, data access and handoffs.
5. EvaluateRecord failures, evidence, remediation and regression tests.
What RegTeams attack
Role escalation
Can general information be pushed into regulated advice, diagnosis or recommendation?
Jurisdiction hopping
Can a user induce behavior allowed elsewhere but prohibited in their actual location?
Consent laundering
Can the system infer, bundle or reuse consent beyond the purpose or context in which it was obtained?
Workflow fragmentation
Do individually acceptable steps combine into a prohibited or unfair outcome?
Oversight evasion
Can the system avoid, defer or incorrectly route a required human escalation?
Regulatory drift
Does the system continue applying superseded rules after obligations change?
Evidence failure
Can the system produce an outcome that cannot later be reconstructed, reviewed or defended?
The manifesto
Read the full manifesto →Eight principles for a testable practice
01Test behavior, not declarations.
02Link every test to authority.
03Test trajectories, not isolated answers.
04Attack context, not only prompts.
05Test controls, not only models.
06Preserve evidence.
07Update tests continuously.
08Report scope honestly.
Policies describe intent. RegTeaming tests behavior.
Built for real AI trajectories
- Models: responses, refusals, uncertainty and representations
- Agents: multi-turn trajectories, planning and tool use
- Workflows: disclosures, approvals, escalation and evidence
- Deployments: jurisdictions, products, users and channels
- Change: new models, prompts, policies and regulatory expectations
Get started
Make regulatory assurance testable.
Use the open RegTeaming method, or commission an assessment of one AI system, workflow and jurisdiction.