{
  "report_version": "1.0",
  "ruleset_version": "ruleset-2024-1689-v1.0",
  "litmusai_version": "1.0.1",
  "generated_at": "2026-10-25T09:14:54.240743Z",
  "input_hash_sha256": "a427928684938c6fe4b245a43e76761e32c4bb994e1fffe60ce08510735dd0a0",
  "system": {
    "name": "MoodSync Workplace Wellbeing Suite",
    "version": "0.9.0-pilot",
    "provider": "MoodSync Technologies GmbH",
    "deployer": "Pilot enterprise customer (anonymised)",
    "purpose": "Real-time emotion / engagement / fatigue tracking for office workers during virtual meetings, surfaced to managers as an aggregated team wellbeing dashboard.\n",
    "system_description": "Webcam stream during scheduled meetings is processed by a VLM that infers emotional state (engagement, frustration, fatigue) per participant. Per-employee emotion vectors are aggregated into team- level dashboards visible to people-managers. No medical claim is made; the system is marketed as \"wellbeing analytics\", not as a medical / safety tool. There is no explicit safety use-case (e.g. drowsiness detection in heavy-machinery operators) \u2014 the deployment is regular knowledge-worker meetings.\n",
    "deployment_jurisdictions": [
      "EU"
    ],
    "output_consumed_in_eu": true,
    "subject_population": {
      "categories": [
        "workers"
      ],
      "notes": "Adult employees of the deploying organisation. Power asymmetry: employees cannot meaningfully refuse without career consequence, which is the central reason Article 5(1)(f) carves workplace emotion-recognition into the prohibited list.\n"
    },
    "inputs": {
      "biometric": true,
      "facial_images": true,
      "emotional_state_inference": true,
      "behaviour_history": true,
      "scraped_internet_data": false,
      "freetext_prompts": false,
      "other": null
    },
    "outputs": {
      "individual_scores": false,
      "behaviour_predictions": false,
      "criminal_risk_predictions": false,
      "emotion_inferences": true,
      "sensitive_attribute_classifications": false,
      "freetext_generations": false,
      "other": "team-level aggregate wellbeing dashboard"
    },
    "deployment_context": {
      "workplace": true,
      "education": false,
      "public_space": false,
      "real_time_operation": true,
      "law_enforcement_use": false,
      "healthcare": false,
      "financial_services": false,
      "other": null
    },
    "mitigations": [
      "Pseudonymised employee IDs in the dashboard layer (DOES NOT cure 5(1)(f))",
      "Opt-out toggle in employee settings (DOES NOT cure 5(1)(f); EDPB has been clear that workplace consent is rarely freely given)",
      "Data deleted after 90 days (DOES NOT cure 5(1)(f); the prohibition is on the practice, not on retention)"
    ],
    "metadata": {
      "last_reviewed": "2026-04-28",
      "owner": "VP Product, MoodSync Technologies GmbH",
      "reviewed_by": "External counsel (Smith & Co LLP) advised: redesign required"
    }
  },
  "categories": {
    "5.1.a": {
      "label": "Harmful manipulation",
      "verdict": "clear",
      "confidence": "high",
      "rationale": "No rules triggered for Harmful manipulation. No indicators of Article 5.1.a risk.",
      "triggered_rules": [],
      "regulation_citations": [],
      "remediation": []
    },
    "5.1.b": {
      "label": "Exploitation of vulnerabilities",
      "verdict": "clear",
      "confidence": "high",
      "rationale": "No rules triggered for Exploitation of vulnerabilities. No indicators of Article 5.1.b risk.",
      "triggered_rules": [],
      "regulation_citations": [],
      "remediation": []
    },
    "5.1.c": {
      "label": "Social scoring",
      "verdict": "clear",
      "confidence": "high",
      "rationale": "No rules triggered for Social scoring. No indicators of Article 5.1.c risk.",
      "triggered_rules": [],
      "regulation_citations": [],
      "remediation": []
    },
    "5.1.d": {
      "label": "Criminal risk prediction (individual)",
      "verdict": "clear",
      "confidence": "high",
      "rationale": "No rules triggered for Criminal risk prediction (individual). No indicators of Article 5.1.d risk.",
      "triggered_rules": [],
      "regulation_citations": [],
      "remediation": []
    },
    "5.1.e": {
      "label": "Untargeted facial image scraping",
      "verdict": "clear",
      "confidence": "high",
      "rationale": "No rules triggered for Untargeted facial image scraping. No indicators of Article 5.1.e risk.",
      "triggered_rules": [],
      "regulation_citations": [],
      "remediation": []
    },
    "5.1.f": {
      "label": "Emotion inference (workplace/education)",
      "verdict": "red",
      "confidence": "high",
      "rationale": "RED for Emotion inference (workplace/education). Rules triggered: rule_f_workplace_emotion, rule_f_emotion_general. System likely falls within Article 5.1.f prohibition.",
      "triggered_rules": [
        "rule_f_workplace_emotion",
        "rule_f_emotion_general"
      ],
      "regulation_citations": [
        {
          "article": "Art. 5(1)(f)",
          "recital": null
        },
        {
          "article": "Recital 44",
          "recital": null
        },
        {
          "article": "Art. 5(1)(f)",
          "recital": null
        }
      ],
      "remediation": [
        "Seek qualified EU AI Act counsel before deployment."
      ]
    },
    "5.1.g": {
      "label": "Biometric categorisation (sensitive attributes)",
      "verdict": "clear",
      "confidence": "high",
      "rationale": "No rules triggered for Biometric categorisation (sensitive attributes). No indicators of Article 5.1.g risk.",
      "triggered_rules": [],
      "regulation_citations": [],
      "remediation": []
    },
    "5.1.h": {
      "label": "Real-time remote biometric identification (public spaces)",
      "verdict": "clear",
      "confidence": "high",
      "rationale": "No rules triggered for Real-time remote biometric identification (public spaces). No indicators of Article 5.1.h risk.",
      "triggered_rules": [],
      "regulation_citations": [],
      "remediation": []
    }
  },
  "summary": {
    "overall_verdict": "red",
    "red_count": 1,
    "amber_count": 0,
    "clear_count": 7,
    "requires_legal_review": true,
    "highest_penalty_exposure": "\u20ac35M or 7% global turnover (Art. 99(3))"
  },
  "ruleset_provenance": {
    "ruleset_version": "ruleset-2024-1689-v1.0",
    "regulation": "Regulation (EU) 2024/1689",
    "effective_date": "2025-02-02",
    "signer_name": null,
    "signed_date": null,
    "signature_status": "unsigned",
    "display_label": "ruleset-2024-1689-v1.0 (UNREVIEWED \u2014 internal panel authored, no external legal review)"
  },
  "disclaimers": [
    "This is a screening tool, not legal advice.",
    "LitmusAI is not a notified body.",
    "Article 5 screening must be reviewed by qualified legal counsel.",
    "Screening does not confirm compliance with any other article of the EU AI Act.",
    "The ruleset is a good-faith interpretation of Regulation (EU) 2024/1689 and may not reflect the views of the European AI Office or national competent authorities."
  ],
  "overrides_applied": []
}