v0.3: phone check (iPhone, Android) as the Space front page, catalog 0.3 (74 checks), shared vulnerability rules, real-CVE training data
6ccf48e verified | { | |
| "library_version": "0.3.0", | |
| "note": "Default classifications assume general office use by a deployer. Under the AI Act the risk class depends on the purpose of use, not on the tool alone. Not legal advice.", | |
| "purpose_rules": { | |
| "prohibited": [ | |
| "Emotion recognition of employees or students (except for medical or safety reasons)", | |
| "Social scoring of people", | |
| "Manipulative or exploitative techniques that cause significant harm", | |
| "Untargeted scraping of facial images to build face recognition databases", | |
| "Biometric categorisation inferring sensitive traits such as political views or sexual orientation" | |
| ], | |
| "high_risk_examples": [ | |
| "Screening or ranking job applicants, or making promotion, task allocation or dismissal decisions", | |
| "Assessing creditworthiness or credit scores of individuals", | |
| "Deciding access to education or grading students", | |
| "Assessing eligibility for public benefits or essential services", | |
| "Risk assessment and pricing in life and health insurance", | |
| "Biometric identification of people" | |
| ], | |
| "limited_risk": "Chatbots and AI-generated content: people must be told they are dealing with AI, and published deepfakes or AI-written public-interest text must be labelled (Art. 50).", | |
| "minimal_risk": "Drafting, summarising, translation, coding help and similar general productivity use." | |
| }, | |
| "tools": { | |
| "Microsoft Copilot": { | |
| "kind": "Cloud AI assistant", | |
| "provider": "Microsoft (US)", | |
| "data_location": "Microsoft cloud; enterprise plans keep data under Microsoft's commercial data protection terms", | |
| "default_risk": "minimal", | |
| "gdpr_notes": "Use the Microsoft 365 work account version covered by the organisation's Microsoft data processing terms; consumer Copilot is not covered." | |
| }, | |
| "ChatGPT": { | |
| "kind": "Cloud AI assistant", | |
| "provider": "OpenAI (US)", | |
| "data_location": "Provider cloud outside the EEA unless an EU data residency plan is used", | |
| "default_risk": "minimal", | |
| "gdpr_notes": "Needs a business plan with a data processing agreement and a transfer basis (Art. 28, Art. 44); consumer accounts may use prompts for training unless opted out." | |
| }, | |
| "Claude": { | |
| "kind": "Cloud AI assistant", | |
| "provider": "Anthropic (US)", | |
| "data_location": "Provider cloud outside the EEA", | |
| "default_risk": "minimal", | |
| "gdpr_notes": "Needs a commercial plan with a data processing agreement and a transfer basis (Art. 28, Art. 44)." | |
| }, | |
| "Claude Code": { | |
| "kind": "AI coding assistant (command line)", | |
| "provider": "Anthropic (US)", | |
| "data_location": "Code and prompts sent to the provider's cloud", | |
| "default_risk": "minimal", | |
| "gdpr_notes": "Source code may contain personal data or secrets; use a commercial plan with a data processing agreement and keep secrets out of repositories." | |
| }, | |
| "Gemini": { | |
| "kind": "Cloud AI assistant", | |
| "provider": "Google (US)", | |
| "data_location": "Provider cloud", | |
| "default_risk": "minimal", | |
| "gdpr_notes": "Use the Workspace version under the organisation's Google data processing terms; consumer use is not covered." | |
| }, | |
| "Perplexity": { | |
| "kind": "Cloud AI search assistant", | |
| "provider": "Perplexity (US)", | |
| "data_location": "Provider cloud outside the EEA", | |
| "default_risk": "minimal", | |
| "gdpr_notes": "Needs an enterprise agreement and a transfer basis before work or personal data is entered." | |
| }, | |
| "Cursor": { | |
| "kind": "AI code editor", | |
| "provider": "Anysphere (US)", | |
| "data_location": "Code sent to the provider and its model providers unless privacy mode is enforced", | |
| "default_risk": "minimal", | |
| "gdpr_notes": "Enforce privacy mode through a business plan and sign a data processing agreement." | |
| }, | |
| "Windsurf": { | |
| "kind": "AI code editor", | |
| "provider": "US-based provider", | |
| "data_location": "Code sent to the provider's cloud", | |
| "default_risk": "minimal", | |
| "gdpr_notes": "Use a business plan with a data processing agreement and zero-retention settings." | |
| }, | |
| "Ollama": { | |
| "kind": "Local model runner", | |
| "provider": "Open source (runs locally)", | |
| "data_location": "On the device; nothing leaves unless a cloud model is selected", | |
| "default_risk": "minimal", | |
| "gdpr_notes": "No transfer to a provider, but check each model's licence and keep the local API (port 11434) closed to the network." | |
| }, | |
| "LM Studio": { | |
| "kind": "Local model runner", | |
| "provider": "Element Labs (runs locally)", | |
| "data_location": "On the device", | |
| "default_risk": "minimal", | |
| "gdpr_notes": "No transfer to a provider; check model licences and whether its local server is exposed." | |
| }, | |
| "GPT4All": { | |
| "kind": "Local model runner", | |
| "provider": "Nomic AI (runs locally)", | |
| "data_location": "On the device unless optional data sharing is enabled", | |
| "default_risk": "minimal", | |
| "gdpr_notes": "Keep the optional data lake sharing switched off." | |
| }, | |
| "Jan": { | |
| "kind": "Local model runner", | |
| "provider": "Open source (runs locally)", | |
| "data_location": "On the device unless a cloud model is connected", | |
| "default_risk": "minimal", | |
| "gdpr_notes": "Check whether remote API providers are configured; if so, the cloud provider rules apply." | |
| }, | |
| "Msty": { | |
| "kind": "Desktop AI client", | |
| "provider": "Desktop app (local and cloud models)", | |
| "data_location": "Local, or the cloud provider of any connected model", | |
| "default_risk": "minimal", | |
| "gdpr_notes": "Treat connected cloud models like the corresponding cloud assistant." | |
| }, | |
| "Alpaca (Ollama client)": { | |
| "kind": "Desktop client for local models", | |
| "provider": "Open source (runs locally)", | |
| "data_location": "On the device", | |
| "default_risk": "minimal", | |
| "gdpr_notes": "No transfer to a provider; check model licences." | |
| }, | |
| "Hugging Face models": { | |
| "kind": "Local model files", | |
| "provider": "Various model publishers", | |
| "data_location": "On the device", | |
| "default_risk": "minimal", | |
| "gdpr_notes": "Record which models are present and their licences; the risk class depends on what the models are used for." | |
| }, | |
| "Meta AI": { | |
| "kind": "Cloud AI assistant (built into WhatsApp, Instagram and Facebook apps)", | |
| "provider": "Meta (US)", | |
| "data_location": "Provider cloud outside the EEA", | |
| "default_risk": "minimal", | |
| "gdpr_notes": "Consumer service with no business data processing terms; do not share work or customer data in chats with Meta AI." | |
| }, | |
| "Grok": { | |
| "kind": "Cloud AI assistant", | |
| "provider": "xAI (US)", | |
| "data_location": "Provider cloud outside the EEA", | |
| "default_risk": "minimal", | |
| "gdpr_notes": "Consumer service; needs an enterprise agreement and a transfer basis before work or personal data is entered." | |
| }, | |
| "DeepSeek": { | |
| "kind": "Cloud AI assistant", | |
| "provider": "DeepSeek (China)", | |
| "data_location": "Provider cloud in the People's Republic of China", | |
| "default_risk": "minimal", | |
| "gdpr_notes": "No EU adequacy decision for China and no business data processing terms; EU data protection authorities have restricted or investigated it. Do not use with work or personal data." | |
| }, | |
| "Character.AI": { | |
| "kind": "AI companion chatbot", | |
| "provider": "Character Technologies (US)", | |
| "data_location": "Provider cloud outside the EEA", | |
| "default_risk": "limited", | |
| "gdpr_notes": "Consumer entertainment chatbot; not suitable for work use. Users must be told they are talking to an AI (AI Act Art. 50)." | |
| }, | |
| "Replika": { | |
| "kind": "AI companion chatbot", | |
| "provider": "Luka (US)", | |
| "data_location": "Provider cloud outside the EEA", | |
| "default_risk": "limited", | |
| "gdpr_notes": "Consumer companion app that collects sensitive personal conversations and has been subject to EU data protection enforcement; not suitable for work use." | |
| }, | |
| "Otter": { | |
| "kind": "AI meeting transcription", | |
| "provider": "Otter.ai (US)", | |
| "data_location": "Provider cloud outside the EEA", | |
| "default_risk": "minimal", | |
| "gdpr_notes": "Records and transcribes other people's voices: needs a lawful basis and notice to meeting participants, plus a data processing agreement." | |
| }, | |
| "Grammarly": { | |
| "kind": "AI writing assistant (keyboard and browser)", | |
| "provider": "Grammarly (US)", | |
| "data_location": "Provider cloud outside the EEA", | |
| "default_risk": "minimal", | |
| "gdpr_notes": "Reads everything typed where it is enabled, including personal data; use the business plan with a data processing agreement or disable it in work apps." | |
| } | |
| } | |
| } | |