LitmusAI

Free, deterministic Article 5 screener for the EU AI Act.

LitmusAI 1.2.1 ships with the AiExponent reference ruleset ruleset-2024-1689-v1.2 (UNREVIEWED: internal panel authored, no external lawyer review). Apache 2.0, AS IS.

The package's CLI surface, JSON/SARIF schema, and BYO-ruleset contract are stable for production integration. The reference ruleset has been authored and reviewed by an internal AiExponent panel (six engineering + governance roles) but has not been reviewed by a qualified EU AI Act practising lawyer. Every screening report carries this disclosure prominently. Customers who require lawyer-reviewed output can supply their own signed ruleset via the BYO mechanism; see docs/ruleset-authoring.md.

The legal-review status is not tied to a version number. litmus --version prints ruleset_legal_status: REVIEWED when the active ruleset carries a signature block, and UNREVIEWED when it does not. LitmusAI checks that the block is well formed; it does not verify the signature cryptographically or check who the signer is, so that line records what the ruleset author declared, not proof of a qualified legal review. Tracked under Legal review status below.

The Problem

On February 2, 2025, Article 5 of the EU AI Act (Regulation (EU) 2024/1689) entered into active legal enforcement across all 27 EU member states.

Placing a prohibited AI practice on the market or putting it into service is strictly illegal and carries statutory administrative fines of up to €35,000,000 or 7% of total worldwide annual turnover.

Most engineering and product teams do not have an in-house EU AI Act counsel to review every model prompt, feature iteration, or system deployment. LitmusAI answers one critical question in your terminal or CI pipeline before you deploy:

"Is this AI practice prohibited under Article 5?"

Screen your system against all ten statutory categories of Article 5(1): the original eight, points (a) to (h), and the two inserted by Regulation (EU) 2026/1744, points (ba) and (bb), which apply from 2 December 2026. Receive a per-category Red / Amber / Clear verdict with exact legal citations, confidence levels, and concrete remediation advice, in under 60 seconds, completely offline, and without uploading sensitive system descriptions to any third-party server.

Built by AI Exponent LLC. Apache 2.0. Runs entirely offline after pip install.

Quick Start

pip install litmus-screener   # the brand is "LitmusAI"; the PyPI distribution is "litmus-screener"

# 1. Quick screen from a plain-text prompt
litmus screen --describe "a chatbot for mental health support for teenagers"

# 2. Or initialize a structured declaration for your system
litmus init                                         # creates system.yaml starter template
litmus screen system.yaml --output report.json      # full ten-category evaluation

# 3. Export audit-ready reports for legal or security teams
litmus export report.json -o report.sarif --format sarif

Why LitmusAI

System Architecture

LitmusAI operates as a deterministic, offline static-analysis pipeline:

graph TB
    subgraph Inputs ["1. Input Specifications"]
        INP1["Prompt Description<br/><code>litmus screen --describe '...'</code>"]
        INP2["Declarative YAML<br/><code>system.yaml</code>"]
        INP3["CI/CD Gate<br/><code>GitHub Actions / Pre-commit</code>"]
    end

    subgraph Core ["2. Deterministic Screening Engine"]
        AST["Safe AST Evaluator<br/><em>(Constrained expressions, zero eval, zero Python execution)</em>"]
        RULE["Article 5 Reference Ruleset<br/><em>(38 rules covering 5.1.a to 5.1.h, 5.1.ba and 5.1.bb)</em>"]
        BYO["Bring-Your-Own Ruleset<br/><em>(Optional lawyer-signed JSON via litmus use-ruleset)</em>"]
    end

    subgraph Integrity ["3. Verification & Scoring"]
        CONF["Confidence Scorer<br/><em>(Conservative: Amber preferred on ambiguity)</em>"]
        HASH["RFC 8785 Canonical Digest<br/><em>(SHA-256 tamper-evident input hash)</em>"]
    end

    subgraph Outputs ["4. Audit-Ready Artifacts"]
        OUT1["Rich Terminal UI<br/><em>(Color-coded Red / Amber / Clear table)</em>"]
        OUT2["SARIF 2.1.0 Report<br/><em>(GitHub Security tab & GitLab SAST)</em>"]
        OUT3["JSON / Markdown<br/><em>(Reports for legal and security review)</em>"]
    end

    INP1 & INP2 & INP3 --> AST
    RULE & BYO --> AST
    AST --> CONF
    CONF --> HASH
    HASH --> OUT1 & OUT2 & OUT3

    style Inputs fill:#F5F4EF,stroke:#E4E2DC,color:#0F1419
    style Core fill:#E6F4F1,stroke:#0D5463,color:#0D5463
    style Integrity fill:#FAF0E6,stroke:#B68A2E,color:#0F1419
    style Outputs fill:#F5F4EF,stroke:#E4E2DC,color:#0F1419

What LitmusAI Does

• All ten Article 5 points: The reference ruleset has rules for every prohibited practice under Article 5(1), points (a) to (h) plus (ba) and (bb) from Regulation (EU) 2026/1744. A report run before 2 December 2026 says that the two new points apply from that date. How well each point is detected is measured, and limited; see Known limits.
• Deterministic by Design: Same input + same ruleset = identical output, guaranteed across platforms.
• Zero Network Calls (NFR-8): 100% offline execution. No telemetry, no telemetry pings, no crash reports. Your architecture and prompts never leave your local machine (enforced in CI via pytest-socket).
• Cryptographic Tamper-Evidence: Generates a canonical RFC 8785 SHA-256 digest on every report. Verify report integrity anytime via litmus verify <report>.
• Bring-Your-Own-Ruleset (BYO): Legal counsel can author, sign, and distribute custom rulesets. Once activated (litmus use-ruleset), reports show (SIGNED by: Counsel) rather than UNREVIEWED in the provenance line.
• Multi-Format Export: Native support for rich console output, machine-readable JSON, Markdown documentation, and SARIF 2.1.0.

Article 5 Categories Covered

Known limits

LitmusAI screens what a system.yaml declares, and a rule can only use a field that exists. An independent test screens 175 worked examples from the European Commission's Guidelines on prohibited AI practices (C(2025) 5052) and the recitals of Regulation (EU) 2026/1744, with expected answers written before any run by a tester who never saw the rules. The cases, the expected answers, the scripts, the scorecards and a report giving the cause of every miss and false alarm are in verification/, and anyone can re-run them with verification/run.sh.

The 1.2.0 run used the tester's answers to the new influence and scope questions. The author of the 1.2.0 rules saw the 1.1.x results, and the template's comments say what each answer does to the verdict, so the 1.2.0 result is weaker evidence than the first run. The report says how.

What this means in practice:

• Answer the influence questions. A file that leaves them at not_answered keeps the 1.1 verdict on points (a) and (b), which missed 6 of 7 expected prohibitions there, and reports low confidence.
• Exceptions: facts that take a system outside a point clear it; exceptions that need evidence (human assessment, medical or safety reasons, dataset labelling, the (h)(i) to (iii) objectives) give AMBER for a reviewer. Most of the 29 over-cautious results are of this kind.
• Still not modelled in 1.2.0 (the 9 false alarms): accidental generation, emergency medical use and the red-teaming defence for (ba) and (bb); relevance and proportionality under sectoral law for (c); emotion recognition used only for a person's own training. A RED on those needs a reviewer.
• Every answer is self-declared. LitmusAI cannot check that a declared exception holds, and two results in the test turned on a not_sure.
• deployment_context.workplace and education describe where the system is used. Whose emotions are inferred is the scope.emotions_of_workers_or_students question.
• The quick screen (--describe) infers fields from keywords, does not answer the new questions, and misses more: 27 of 51 expected prohibitions came back clear.

Interactive Artifact Previews

# LitmusAI System Description
# Edit the fields below to describe your AI system.
# Then run: litmus screen system.yaml

name: "My AI System"
version: "1.0.0"
provider: "My Organisation"
deployer: "My Organisation"
purpose: "Describe what the system does in one sentence."
system_description: |
  A more detailed description of the system: what inputs it takes,
  what outputs it produces, and how those outputs are used.

deployment_jurisdictions:
  - EU

output_consumed_in_eu: true

subject_population:
  categories:
    - general_public
  notes: null

inputs:
  biometric: false
  facial_images: false
  emotional_state_inference: false
  behaviour_history: false
  social_behaviour_data: false        # conduct outside the service: social media, associations
  scraped_internet_data: false
  freetext_prompts: false
  other: null

outputs:
  individual_scores: false
  behaviour_predictions: false
  criminal_risk_predictions: false
  emotion_inferences: false
  sensitive_attribute_classifications: false
  freetext_generations: false
  detrimental_treatment_unrelated_context: false   # score used against the person elsewhere
  other: null

deployment_context:
  workplace: false
  education: false
  public_space: false
  real_time_operation: false
  law_enforcement_use: false
  healthcare: false
  financial_services: false
  other: null

# Article 5(1)(ba) and (bb), inserted by Regulation (EU) 2026/1744 and
# applicable from 2 December 2026. Leave everything false for a system
# that does not generate or manipulate realistic images, video or audio.
generative_media:
  realistic_media_generation: false   # realistic images, video, audio or similar material
  identifiable_persons: false         # outputs can depict identifiable real people
  intimate_depictions_possible: false # intimate parts or sexual activity, without major modification
  intimate_depictions_intended: false # that output is the system's purpose
  minors_depictions_possible: false   # outputs can depict children in such material
  manipulation_within_1b_only: false  # edits that neither increase exposure nor change the activity
  safeguards:                         # each one: in place, in force and verifiable
    consent_demonstrable: false       # explicit consent of each depicted person, collected and provable
    intimate_output_prevention: false # filters, refusal training, guardrails against intimate outputs
    csam_prevention: false            # measures against child sexual abuse material
    misuse_correction: false          # abuse detection, notice and action, follow-up on circumvention
    documented: false                 # the measures above are written down and testable

# Article 5(1)(a) and (b). Answer every question for every system, "yes",
# "no" or "not_sure", from what the system does or can do, whether or not
# anyone intends it. A system that does not influence what people decide
# answers "no". "not_answered" means the question was not considered;
# the report then marks (a) and (b) as low confidence. What each answer does
# to a verdict is in the README, not here, so answer the facts.
influence:
  # Stimuli a person cannot consciously perceive: flashed images, inaudible audio.
  subliminal_techniques: not_answered
  # Techniques that subvert a person's autonomy or free choice, or deceive them
  # with false or misleading content. "yes" also when nobody intended it, for
  # example behaviour the system learned in training; not for merely
  # incidental behaviour that the provider has measures against.
  manipulative_or_deceptive_techniques: not_answered
  # Exploits a vulnerability due to age (children or older people), a
  # disability, or a specific social or economic situation (for example
  # extreme poverty). Other weak points, such as loneliness or emotional
  # dependency, belong under manipulative_or_deceptive_techniques.
  exploits_vulnerability: not_answered
  # Has the objective or the effect (intent is not needed) of appreciably
  # impairing people's ability to make an informed decision, so that they
  # decide what they would not otherwise have decided.
  materially_distorts_behaviour: not_answered
  # That behaviour causes, or is reasonably likely to cause, significant
  # physical, psychological or financial harm to them or to others.
  significant_harm_likely: not_answered

# Exceptions and limits in Article 5(1), points (d) to (h). Answer the
# questions about what your system does and leave the others at
# "not_answered". What each answer does to a verdict is in the README.
scope:
  # provider_only: you place the system on the market or put it into service
  # and do not use it. deployer: you use it (also a private person using a
  # tool). both: you build and use it, or you are not sure.
  role: both
  # (d) The system only supports a human's assessment of a person's
  # involvement in a criminal activity, and that assessment already rests on
  # objective and verifiable facts directly linked to the activity.
  human_assessment_on_verifiable_facts: not_answered
  # (e) Facial images are collected without a target. "no" when the system
  # looks for one specific person or a specific, defined group.
  untargeted_collection: not_answered
  # (e) The system creates or expands a database used to recognise faces.
  builds_facial_recognition_database: not_answered
  # (f) The emotions inferred are those of workers (employees, contractors,
  # trainees, volunteers, job candidates) or of pupils and students. "no"
  # when only customers, patients or the public are analysed.
  emotions_of_workers_or_students: not_answered
  # (f) The system is intended to be put in place for medical or safety
  # reasons, such as a therapy aid or fatigue detection at dangerous machines.
  medical_or_safety_reasons: not_answered
  # (g) The system only labels or filters lawfully acquired biometric
  # datasets, or categorises biometric data in the area of law enforcement.
  dataset_labelling_or_filtering_only: not_answered
  # (h) People are identified at a distance without their active
  # involvement, such as cameras in a street. "no" when each person takes
  # part, such as stepping up to a gate or presenting a document.
  remote_identification: not_answered
  # (h) Used by or for a law enforcement authority to prevent, investigate,
  # detect or prosecute crime or to execute criminal penalties (Art. 3(46)).
  law_enforcement_purpose: not_answered
  # (h) Each use is strictly necessary for one of: (i) a targeted search for
  # victims of abduction, trafficking or sexual exploitation, or for missing
  # persons; (ii) preventing a specific, substantial and imminent threat to
  # life or physical safety, or a terrorist attack; (iii) locating or
  # identifying a suspect of an Annex II offence punishable by at least
  # four years, for an investigation, prosecution or penalty.
  article_5_1_h_objective: not_answered

mitigations: []

metadata:
  last_reviewed: null
  owner: null
  reviewed_by: null

{
  "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json",
  "version": "2.1.0",
  "runs": [
    {
      "tool": {
        "driver": {
          "name": "LitmusAI",
          "version": "1.2.1",
          "informationUri": "https://aiexponent.com/products/litmusai",
          "rules": [
            {
              "id": "litmusai/5.1.b",
              "name": "Vulnerability Exploitation",
              "shortDescription": {
                "text": "Article 5(1)(b) Exploitation of age, disability, or specific social vulnerability"
              },
              "helpUri": "https://aiexponent.com/eu-ai-act/article-5"
            }
          ]
        }
      },
      "results": [
        {
          "ruleId": "litmusai/5.1.b",
          "level": "warning",
          "message": {
            "text": "Conversational agent targets minors experiencing psychological distress without clinician escalation safeguards."
          }
        }
      ]
    }
  ]
}

CI/CD Integration & Exit Codes

Add LitmusAI to your GitHub Actions workflow as an automated pre-merge compliance gate:

# .github/workflows/article5.yml
name: EU AI Act Article 5 Screening
on: [pull_request, push]

jobs:
  article5-gate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
      - uses: aiexponent/litmusai/.github/actions/litmusai-screen@v1.2.1   # pin a release tag
        with:
          path: system.yaml
          fail-on: amber       # fail CI if overall verdict is RED or AMBER
          output-format: sarif

Exit Code Contract

LitmusAI implements deterministic UNIX exit codes for scripting and CI gates:

CLI Command Reference

Documentation

• Getting Started Guide
• Article 5 Statutory Coverage
• Bring Your Own Ruleset (BYO) Guide
• CI/CD Integration Guide

Important Disclaimers

Legal Review Status

UNREVIEWED REFERENCE RULESET

The default LitmusAI ruleset (ruleset-2024-1689-v1.2) is a good-faith engineering interpretation of Article 5, as amended by Regulation (EU) 2026/1744, authored by AiExponent's internal compliance panel. It has not been reviewed or signed by a qualified EU AI Act lawyer and is not legal advice. The panel's review records ship with the package under litmusai/_data/ruleset/.

The package version (litmusai 1.2.1) reflects API and CLI stability. The legal-review status rides on the ruleset itself: litmus --version prints ruleset_legal_status: REVIEWED when the active ruleset carries a signature block and UNREVIEWED when it does not. That check is structural. LitmusAI does not verify the signature cryptographically and cannot vouch for the signer's qualifications, so the line reports what the ruleset's author declared; whether the review behind it was qualified is for you to confirm with the signer. No version number of the reference ruleset implies an external review.

If your organisation needs a lawyer-signed ruleset today, see docs/ruleset-authoring.md for the BYO-ruleset path. A complete dummy-signed example ships in tests/fixtures/rulesets/acme-corp-signed-v1.0.json.

Every screening is a screening, not a certification. Not legal advice. Not a notified body.

Privacy & Zero-Network Guarantee

LitmusAI makes zero network calls during screening. No telemetry, no usage analytics, no error reporting. Your prompts, proprietary architecture, and system declarations never leave your local machine.

Enforced in automated CI via pytest-socket --disable-socket (NFR-8).

License

Apache 2.0; see LICENSE.

Part of the AiExponent open-source AI governance toolchain:
litmusai (Art. 5) · license-compliance-checker (Art. 53) · rag-benchmarking (Art. 15) · riskforge (Art. 9) · agentic-document-analyser (Art. 9 / Annex IV)