Arbiter

Know which AI systems you run, and be able to show it.

Arbiter is an open-source AI governance gateway and EU AI Act compliance toolkit. It links what an organisation declares about its AI systems with what their traffic shows, and reports what does not match.

Alpha. Not released yet, never run in production, and not legal advice: every classification is indicative until a person reviews it, and the AI Act rule pack has not been reviewed by a person with legal training. Read scope and limits first.

Contents: the problem · what it does · what it is not · try it · what is inside · documentation · status · questions · contributing

The problem

The EU AI Act, and most internal policies, ask an organisation to know which AI systems it runs, what they are for and how risky they are. That knowledge usually lives in a list someone wrote once. The list says what was remembered that day, not what happens today: a tool switched to another model, a retired system that still answers, a team using a model nobody declared.

Gateways for language models see the traffic and know nothing of the law. Governance tools hold the inventory and never see the traffic. Arbiter joins the two.

What Arbiter does

The gateway and the toolkit each work without the other. If you already run an LLM gateway, keep it: Arbiter imports its records.

What it is not

• Not legal advice, and not a certificate. It never says a system complies.
• Not a judge of whether a declaration is true. A tier follows from the answers given.
• Not all-seeing. It governs what passes through it or is imported. A service opened in a browser is not seen.
• Not for providers. It covers the obligations of those who deploy AI systems.
• Not a dashboard. A command line, an HTTP API, reports and a digest.

More, and what was and was not verified: scope and limits.

Try it in two minutes

No Docker, no cloud account, no real model: a mock answers in its place.

git clone https://github.com/ViciusLio/ai-arbiter && cd ai-arbiter
uv sync --all-extras                       # needs Python 3.12+ and uv
uv run arbiter init                        # a local workspace on SQLite
uv run arbiter demo tour --case consulting --report out/demo.html

The last command follows an invented firm that approved one family of models: it prints thirteen steps and writes the day as a page like this one.

Once the first release is published, the same without a clone:

pip install --pre "ai-arbiter[gateway,mcp]"   # --pre: the first release is an alpha
arbiter init && arbiter demo tour --case consulting --report out/demo.html

Your own systems, the gateway as a service, and a live session in front of people: getting started and giving a demonstration.

What is inside

The base install is the toolkit and the command line on SQLite. The rest is optional:

Documentation

Status and roadmap

Nothing is published on PyPI yet. Phase by phase, with what each one left open and every improvement that was noted: status and tracking.

Hard questions

"Another LLM gateway?", "Can a YAML file read the AI Act?", "Was this written by an AI?", "Is it safe in front of my keys?": the objections a careful reader will raise are answered, without varnish, in hard questions.

Contributing and security

Issues and pull requests are welcome: how to contribute. Report a vulnerability privately: security policy.

Licence and name

Apache-2.0: see LICENSE. The distribution is ai-arbiter, the command is arbiter. It is not related to arbiter-ai or arbiter on PyPI, which are other projects by other authors. Model and product names that appear in examples and documents are trademarks of their owners, who have no relation to this project.

Arbiter is a support tool. It does not provide legal advice.