Lexvibe

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "properties": {
    "usesAI": {
      "type": "boolean",
      "default": true,
      "description": "Does the product use AI at all (LLM calls, recommendations, computer vision…)? false ⇒ minimal risk, the AI Act does not apply."
    },
    "annexIII": {
      "type": "array",
      "items": {
        "enum": [
          "biometrics",
          "critical",
          "education",
          "employment",
          "essential",
          "law",
          "migration",
          "justice"
        ],
        "type": "string"
      },
      "default": [],
      "description": "Annex III high-risk domains that apply. Only these exact values count; anything else is not Annex III and must be left out."
    },
    "socialScoring": {
      "type": "boolean",
      "default": false,
      "description": "Does it score people's social behavior or traits causing detrimental treatment in unrelated contexts, or disproportionate to the behavior (art. 5.1.c)? Prohibited. A seller rating or fitness points app is NOT this."
    },
    "generatesContent": {
      "type": "boolean",
      "default": false,
      "description": "Does it generate text, images, audio or video shown to users? Triggers the art. 50 duty to label AI-generated content."
    },
    "automatedDecisions": {
      "type": "boolean",
      "default": false,
      "description": "Does it make automated decisions with legal or similarly significant effects on people (credit, hiring, admissions…)? Adds GDPR art. 22 duties; high risk only if an Annex III domain applies."
    },
    "interactsWithPeople": {
      "type": "boolean",
      "default": false,
      "description": "Do people interact directly with the AI (chatbot, voice assistant…)? Triggers the art. 50 duty to disclose they are talking to an AI."
    },
    "untargetedFaceScraping": {
      "type": "boolean",
      "default": false,
      "description": "Does it untargetedly scrape facial images from the internet or CCTV footage to build or expand a face-recognition database (art. 5.1.e)? Prohibited. Matching a user's own consented selfie against their own ID photo is NOT this."
    },
    "realtimeBiometricPublic": {
      "type": "boolean",
      "default": false,
      "description": "Real-time remote biometric identification in publicly accessible spaces (e.g. live face recognition)? High risk (Annex III biometrics) — prohibited only when combined with realtimeBiometricLawEnforcement."
    },
    "embeddedInRegulatedProduct": {
      "type": "boolean",
      "default": false,
      "description": "Is the AI a safety component embedded in an Annex I regulated product (toys, machinery, medical devices…)? High risk via art. 6.1, deadline Aug 2, 2028."
    },
    "manipulativeOrExploitative": {
      "type": "boolean",
      "default": false,
      "description": "Does it use subliminal techniques beyond a person's consciousness, or exploit a known vulnerability (age, disability, specific social or economic situation) to materially distort behavior and cause harm — e.g. dark patterns targeting a diagnosed gambling addiction (art. 5.1.a-b)? Prohibited. Ordinary persuasive marketing or UX nudges aimed at the general population are NOT this."
    },
    "individualPredictivePolicing": {
      "type": "boolean",
      "default": false,
      "description": "Predicting an individual's criminal risk based solely on profiling or personality traits (art. 5.1.d)? Prohibited."
    },
    "emotionRecognitionWorkEducation": {
      "type": "boolean",
      "default": false,
      "description": "Does it infer emotions (frustration, attention, mood…) from employees at work or students in education, e.g. to flag disengaged staff or bored students (art. 5.1.f)? Prohibited. Emotion inference on end users of a public consumer product (not their employees/students) is NOT this."
    },
    "realtimeBiometricLawEnforcement": {
      "type": "boolean",
      "default": false,
      "description": "Only if realtimeBiometricPublic: is it used FOR LAW ENFORCEMENT purposes? That combination is prohibited under art. 5.1.h and already in force; any other use of public real-time biometric ID is high risk instead. Without this the prohibition can never be reached."
    },
    "biometricCategorisationSensitive": {
      "type": "boolean",
      "default": false,
      "description": "Does it use biometric data (face, voice, gait…) to infer sensitive attributes — race, political opinion, religion, trade-union membership, sexual orientation (art. 5.1.g)? Prohibited. Ordinary face-unlock or liveness checks that don't infer these attributes are NOT this."
    }
  },
  "additionalProperties": false
}

{
  "type": "object",
  "$schema": "http://json-schema.org/draft-07/schema#",
  "properties": {
    "url": {
      "type": "string",
      "maxLength": 500,
      "minLength": 3,
      "description": "Public URL of the app: a website URL, or an App Store / Google Play listing URL for a mobile-only product. LexVibe scans whichever kind is provided on confirmation. If you don't have a listing URL yet, set `platform` explicitly instead."
    },
    "aiAct": {
      "type": "object",
      "description": "If you already ran check_ai_act for this product, pass the SAME answers object here. The EU AI Act classification is then saved against the app on confirmation and shown in the user's dashboard, instead of being lost when this conversation ends.",
      "additionalProperties": {
        "anyOf": [
          {
            "type": "boolean"
          },
          {
            "type": "array",
            "items": {
              "type": "string",
              "maxLength": 60
            },
            "maxItems": 8
          }
        ]
      }
    },
    "answers": {
      "type": "object",
      "description": "Compliance flags you already know (pass check_website's suggestedAnswers): usesAnalytics, processesPayments, usesGenerativeAI, collectsEmails, sharesWithThirdParties, platformType, companyEntity, contactEmail…",
      "additionalProperties": {
        "anyOf": [
          {
            "type": "string",
            "maxLength": 2000
          },
          {
            "type": "boolean"
          },
          {
            "type": "array",
            "items": {
              "type": "string",
              "maxLength": 200
            },
            "maxItems": 30
          }
        ]
      }
    },
    "appName": {
      "type": "string",
      "maxLength": 200,
      "minLength": 1,
      "description": "App / business name (required if no url is provided)."
    },
    "markets": {
      "type": "array",
      "items": {
        "enum": [
          "eu",
          "uk",
          "ch",
          "us",
          "ca",
          "latam",
          "apac",
          "india",
          "china",
          "mena",
          "africa",
          "global"
        ],
        "type": "string"
      },
      "maxItems": 12,
      "description": "Regions where the app has users; each market pack cites its own frameworks: eu → GDPR/ePrivacy, uk → UK GDPR/PECR, us → CCPA/CPRA, ca → PIPEDA, latam → LGPD…; 'global' is NOT a union of the others — it only cites generic OECD international privacy best practices, for users outside every listed market. To cover several specific frameworks, list each market explicitly, e.g. ['eu', 'us', 'latam']. Defaults to [eu]."
    },
    "platform": {
      "enum": [
        "web",
        "ios",
        "android"
      ],
      "type": "string",
      "description": "Target platform when there is no url to infer it from."
    }
  },
  "additionalProperties": false
}