DEV Community: LXSAIHUB

You're liable for your AI vendor's compliance. Here's the 5-minute check.

LXSAIHUB — Thu, 05 Nov 2026 08:02:19 +0000

When a company adopts an AI vendor, there's a quiet assumption that compliance travels with the contract. It doesn't. Under the EU AI Act, the deployer — that's you, the buyer — keeps obligations even when the model comes from someone else. The vendor's paperwork is your exposure.

I built VendorVet because the question "is this vendor safe?" is almost never asked before the signature, only after the audit letter.

30-second takeaway

Buying an AI system doesn't transfer your regulatory obligation — it multiplies the things you have to track.
The useful questions are boring: documentation, risk classification, incident reporting, transparency. Vendors hate them; buyers skip them.
A screener turns "trust me" into a checklist you can actually send.

The contract doesn't close the loop

Most procurement processes score vendors on price, features, and a security questionnaire written before AI was the risk. None of that touches whether the vendor can produce the documentation the Act expects, or whether their classification of their own system matches yours. When those two disagree, you're the one standing in front of the regulator.

A vetting step that lives in the buying process — not the legal review three months later — is the difference between a one-line question and a six-month cleanup.

What a screen actually surfaces

Not a verdict. A structured read of what the vendor should be able to show you: their own risk classification, the documentation they ship, whether they handle incident reporting, what transparency they build in. Some of those answers are "we don't have that yet," and that answer is the most valuable output of the whole exercise.

VendorVet runs in the browser, no account, no key. Walk through the vendor and it tells you what to ask before you sign.

FAQ

What is VendorVet?

A screening tool that maps an AI vendor against the questions EU AI Act deployers are expected to answer about their suppliers. No account, no key.

Does passing mean the vendor is compliant?

No. It tells you what to ask and where the gaps are. The vendor's actual compliance is still their responsibility — and now, partly, yours.

Is this legal advice?

No. Decision-support for procurement, not a legal opinion.

Author's Process

This product was built with AI coding tools. The work was mostly turning the Act's deployer obligations into questions a buyer can actually send, instead of a PDF nobody reads.

The transparency notice your AI owes users — draft it before launch.

LXSAIHUB — Thu, 05 Nov 2026 08:01:18 +0000

Article 50 of the EU AI Act is deceptively simple: if users are interacting with AI, they should know. The simplicity hides the work — "tell them" means specific notice language at specific moments, and most products ship without ever writing it down.

I built TransparaKit because the notice is the kind of thing that's "obviously someone's job" and therefore nobody's until launch week.

30-second takeaway

Transparency isn't a single banner; it's notice at each touchpoint where AI shows up.
The notice language and its placement are both part of the duty.
A draft you can place beats a principle nobody implemented.

The notice nobody owns

A chatbot, an image generator, a summarizer — each is a moment a user might not realize a machine is in the loop. Article 50 wants those moments marked. In practice the copy gets written ad hoc, if at all, and placement is an afterthought bolted onto one screen.

Drafting the notice from the real touchpoint — and a checklist for where it goes — turns a vague duty into a shippable artifact.

What the tool does

You paste a user touchpoint. It returns Article 50 notice lines and a placement checklist. The output is a draft you can implement, not a compliance certificate — open the tool and try it, no signup.

TransparaKit runs in the browser, no account, no key.

FAQ

What is TransparaKit?

A tool that drafts Article 50 transparency notice language and a placement checklist from a described user touchpoint. No account, no key.

Does drafting the notice make me compliant?

It gives you the words and the placement plan to start from. Sufficiency is still a human call — this is decision-support.

Is this legal advice?

No. It drafts from your description; it doesn't interpret the law for your situation.

Author's Process

This product was built with AI coding tools. The discipline was keeping it a draft a team can implement, not a promise of clearance.

Your LLM app regresses silently. Version-guard it before the next ship.

LXSAIHUB — Thu, 05 Nov 2026 08:00:17 +0000

LLM-powered features have a failure mode traditional software doesn't: they degrade without breaking. The output is still valid JSON, still 200 OK, just worse — and the regression hides until a user complains about something that "used to work."

I built TestPilot because "it worked in testing" is the most common and least useful sentence in LLM QA.

30-second takeaway

LLM regressions don't throw errors — they drift, and drift is invisible to normal tests.
The guard is an eval checklist tied to a version, run before every ship.
Catching the drift at commit time beats catching it in a support ticket.

The regression nobody's watching

A prompt change, a model swap, a system-message tweak — any of them can move behavior in a way unit tests never see. The app still runs. The answers just get softer, or wrong, or off-brand. By the time it's a pattern, it's shipped to everyone.

An eval tied to the version turns that invisible drift into a visible diff you can block on, the way you'd block a failing unit test.

What the tool does

Paste a prompt and its expected behavior; get an eval checklist and a version regression guard. Built for dev and QA teams shipping LLM-powered features. Open it and try — no signup.

TestPilot runs in the browser, no account, no key.

FAQ

What is TestPilot?

A tool that turns a prompt and expected behavior into an eval checklist and a version regression guard for LLM apps. No account, no key.

Does it replace my test suite?

No. It covers the behavior-drift your normal tests can't see. The two are teammates.

Will it call the model for me?

It helps you define what to check; the runs are yours to wire into your pipeline.

Author's Process

This product was built with AI coding tools. The design fight was against turning it into another agent — it stays a guard, not a chatbot.

MRR, churn, LTV — without the spreadsheet you'll abandon.

LXSAIHUB — Thu, 05 Nov 2026 07:59:15 +0000

Every SaaS founder has a metrics spreadsheet they swear they'll update weekly. Most of those spreadsheets are abandoned by the third Monday, because updating them is a chore that competes with everything else. The numbers go stale, and stale metrics are worse than none — they're confidently wrong.

I built SubMetrics for the version of me that never opened the spreadsheet again.

30-second takeaway

The metric isn't the hard part; the maintenance is.
Paste the numbers once and you get MRR, ARPU, churn, LTV — and a plain-English read on what they mean.
A tool you actually use beats a model you guilt-trip yourself about.

The spreadsheet is a tombstone

Spreadsheets are where metrics go to die. They require a ritual — export, format, remember the formula you wrote — and the ritual is exactly what breaks. The result is a file that says "last updated 4 months ago" sitting in a drive, quietly misleading every decision made from it.

Removing the ritual is the whole product. Paste the current numbers and get the read now, while they're real.

What the tool does

Paste your subscription numbers and get MRR, ARPU, churn, LTV, and a plain-English interpretation of what's moving. Open it and try — no signup.

SubMetrics runs in the browser, no account, no key.

FAQ

What is SubMetrics?

A browser tool that turns pasted subscription numbers into MRR, ARPU, churn, LTV, and a plain-English read. No account, no key.

Do I have to connect Stripe?

No. You bring the numbers you already have; it does the math client-side.

Will it store my data?

No. It runs in your browser; nothing is uploaded.

Author's Process

This product was built with AI coding tools. The real feature was resisting dashboards and keeping it to one paste and one read.

Subject lines decide open rates. Score them before you send.

LXSAIHUB — Thu, 05 Nov 2026 07:58:14 +0000

The subject line is the whole game for an email. Same body, different subject, completely different open rate — and most campaigns ship the subject on a hunch because writing and scoring several takes longer than the deadline allows.

I built SubjectLab for the A/B test you keep meaning to run but never set up.

30-second takeaway

The subject line is the only part most recipients ever decide on.
A brief → 6-8 variants with length and spam-risk scores, in one pass.
Scoring before sending beats arguing about it in a thread.

The hunch that ships

Teams pick one subject line because producing five and comparing them is a project. So the highest-leverage decision in the campaign gets the least thought, and the open rate pays for it. The spam-risk score is the part nobody checks until a provider throttles them.

Generating variants with scores turns the hunch into a small, comparable set — pick by evidence, not by who spoke last.

What the tool does

Turn a campaign brief into 6-8 email subject variants with length and spam-risk scores. For indie marketers who A/B before they send. Open it and try — no signup.

SubjectLab runs in the browser, no account, no key.

FAQ

What is SubjectLab?

A tool that generates scored email subject-line variants from a campaign brief. No account, no key.

Does it send the email for me?

No. It gives you variants and scores; you pick and send through your own provider.

Will the spam-risk score guarantee deliverability?

It flags risky patterns; deliverability depends on your sender reputation too. It's one input, not a promise.

Author's Process

This product was built with AI coding tools. The discipline was scoring, not just generating — the scores are the feature.

When is an AI incident 'serious' enough to report? Draft the report before you need it.

LXSAIHUB — Thu, 05 Nov 2026 07:57:13 +0000

Article 73 of the EU AI Act says providers must report serious incidents. The word "serious" does a lot of work there — and most teams only learn what it meant after they've already missed a window they didn't know was open.

I built SeriousKit because the report is easier to write when you're calm, not when a regulator is already asking why it's late.

30-second takeaway

"Serious" is defined, not vibes — which means an incident either qualifies or it doesn't.
The report is a structure, not a confession. Drafting it early de-risks the panic version.
Most teams have no template until they need one at 2am.

The window you don't see closing

An incident happens — a model output caused harm, a system went down in a high-risk context, a user was affected in a way the Act cares about. The clock starts, and nobody on the team has a draft, a definition they've agreed on, or a clear sense of whether this one counts. By the time they decide it does, the easy version of the report is gone.

A serious-incident draft isn't paperwork for its own sake. It's the artifact that turns "we think this might be reportable" into "here is what happened and what we did."

What the tool does

You describe the event. It drafts the incident report against Article 73's expectations — what to include, what counts as serious, what the timeline should capture. The output is a draft your incident team can edit, not a substitute for owning the response.

SeriousKit runs in the browser, no account, no key. Describe the event and get a report draft.

FAQ

What is SeriousKit?

A tool that drafts a serious-incident report aligned with Article 73 of the EU AI Act from a described event. No account, no key.

Does drafting mean I've reported?

No. It produces the draft; the actual report goes through your own process. This just removes the blank-page problem.

Is this legal advice?

No. Decision-support for drafting, not a legal interpretation of your duty.

Author's Process

This product was built with AI coding tools. The discipline was keeping it a draft, not a verdict — the team still owns the call.

We were paying for 40 SaaS tools. We used 9.

LXSAIHUB — Thu, 05 Nov 2026 07:56:13 +0000

Every team I've worked with has a graveyard of SaaS subscriptions. They start as a free trial someone forgot to cancel, become a monthly charge nobody questions, and end the year as line items nobody can defend in a budget review. The number on the invoice is precise. The number that matters — are we using this? — is almost never measured.

I built SaaSpend to make that second number as easy to see as the first.

30-second takeaway

The problem isn't the price of any one tool. It's the aggregate of tools nobody owns.
"We might need it" is how spend compounds. A tracker turns that guess into a number.
The useful output isn't a report — it's the three tools you cancel this week.

The invoice is a lagging indicator

A finance dashboard will happily show you total SaaS spend trending up and call it "growth." It won't tell you that the design tool licensed for the whole company is used by two people, or that the monitoring plan you tripled last incident season is still triple. Usage data exists; it's just never put next to the bill in the same view.

That's the whole product, really: put the bill and the usage in one place and let the contradiction do the talking.

Where it earns its keep

The win isn't a fancy chart. It's the conversation it forces: "why are we paying for this?" Most teams find the answer is "we're not sure," which is itself the answer. Cancelling the unambiguous zombies funds the tools people actually open.

SaaSpend runs in the browser, no account, no key. Paste your subscription list and it shows you what you're paying for versus what's clearly dead weight.

FAQ

What is SaaSpend?

A browser tool that helps you see SaaS spend next to actual usage, so you can spot subscriptions nobody uses. No account, no key.

Do I have to connect my bank or Stripe?

No. You bring the list you already have — a spreadsheet, an invoice export — and it does the analysis client-side.

Will it tell me exactly what to cancel?

It flags the obvious zombies and the outliers. The final call is yours, but it removes the "I don't know if anyone uses it" fog that keeps money leaking.

Author's Process

This product was built with AI coding tools. The interesting part wasn't the math — it was resisting the urge to add dashboards nobody asked for and keeping it to one honest question: paid-for vs used.

The EU AI Act bans 11 things outright. Most teams can't name three.

LXSAIHUB — Thu, 05 Nov 2026 07:55:11 +0000

Article 5 of the EU AI Act is the part you don't want to be on the wrong side of. It lists the AI practices banned in the EU — social scoring, untargeted facial-image scraping, manipulation that bypasses human judgement, and so on. It's short, stark, and easy to read past if your product doesn't feel like it's doing anything dramatic.

The danger isn't the obvious cases. It's the feature that quietly crosses a line because nobody mapped it to the banned list. I built ProhibScan to make that mapping a five-minute check instead of a panicked one.

30-second takeaway

Article 5 is a fixed list of bans, not a vibe — which means it's checkable.
The risk is the feature that "doesn't feel like" a banned practice but maps to one.
A pass today doesn't mean a pass forever; the list and your product both move.

"It doesn't feel illegal" is not a control

Most prohibited-practice violations I've seen weren't reckless. They were a growth experiment, a clever onboarding trick, a scoring widget — each innocent in isolation, each landing squarely in a banned category once you read the actual text. The teams building them weren't reckless; they were unread.

That's the whole problem with compliance work that lives in a PDF nobody opens. The law is precise enough to check against, and that's exactly why it should be a checklist you run, not a document you signed.

What a scan actually gives you

Not a legal opinion — a structured read of your system against each banned practice, with the ones you're clearly clear of, the ones that need a human look, and the ones that should scare you. Pair it with the broader AI Act and DPIA tooling; Article 5 is the first gate, not the only one.

ProhibScan runs in the browser, no account, no key. Walk through your AI system and it tells you where you sit relative to the bans.

FAQ

What is ProhibScan?

A scanner that maps your AI system against Article 5 of the EU AI Act — the list of prohibited practices — and flags where you might be exposed. No account, no key.

Does a clean scan mean I'm compliant?

It means you're clear on Article 5 specifically. The Act has more gates (risk classification, DPIAs, transparency). Treat this as the first check, not the last.

Should legal still review?

Yes. This is a triage signal that tells you where to point a human, not a replacement for one.

Author's Process

This product was built with AI coding tools. The worthwhile part was encoding the banned-practice list as checkable criteria instead of prose nobody re-reads.

Your privacy policy says one thing. Your code does another.

LXSAIHUB — Thu, 05 Nov 2026 07:54:10 +0000

There's a genre of document every SaaS product ships and almost no engineer reads after the day it's written: the privacy policy. It lists what you collect, who you share it with, and what rights users have. Then the product ships a new analytics script, a new third-party SDK, a new "just this once" data field — and the policy is now a promise the code doesn't keep.

I built PrivScan because I kept being the person who noticed the gap after the fact, not before.

30-second takeaway

A privacy policy is a static claim; your dependency list is a moving target. They drift apart by default.
The highest-risk items are the ones nobody owns: a marketing tag that quietly added a cookie, a vendor SDK with its own sub-processors, a form field that stores more than the policy describes.
Scanning is cheap, but only if it's a step you actually run — not a PDF you signed once.

The gap isn't malice, it's drift

Almost every policy-vs-code mismatch I've seen came from a normal engineering decision: "we'll add this analytics tool," "this vendor needs this field," "legal said add a checkbox." None of those are evil. But each one widens the distance between what you told users and what your system does, and nobody closes the loop because the policy lives in legal's drive, not in the repo.

A scanner that only checks the policy is useless. A scanner that only checks the code is worse — it can't tell you what you promised. The job is to hold both up side by side and surface the contradictions: a tracker the policy doesn't mention, a data category collected but not disclosed, a right offered but not implemented.

Where this fits in a real workflow

If you ship to Europe, this is the kind of check that belongs before a release, not after a complaint. It pairs naturally with the AI Act and DPIA work a lot of teams are suddenly doing — same root cause, different regulator.

PrivScan runs in the browser, no account, no key. Point it at what you ship and it tells you where your policy and your code disagree. If it misses something your audit caught, that's my bug.

FAQ

What is PrivScan?

A scanner that compares your stated privacy commitments against what your product actually loads and collects, and flags the gaps. It runs in the browser, no account, no key.

Why not just update the policy when we add a tool?

You can — if someone owns that step. In practice the tracker ships on a Tuesday and the policy update is "next sprint" forever. Scanning makes the drift visible on a schedule instead of at audit time.

Does this replace a DPO or legal review?

No. It's a first-pass signal that tells you where to look. The judgement about what's actually compliant still belongs to people who do that for a living.

Author's Process

This product was built with AI coding tools — exploring the codebase, finding the mismatch patterns, and wiring up the scan logic. You can build the same way; the honest part is that the value is in the checklist, not the model.

Your team needs AI literacy training. Here's a draft, not a seminar.

LXSAIHUB — Thu, 05 Nov 2026 07:53:09 +0000

Article 4 of the EU AI Act asks deployers to ensure people using AI understand what they're using. Sounds like a training mandate; in practice it's a curricula problem nobody owns until an auditor asks what your staff actually knows.

I built LiteracyKit because the deliverable is a curriculum draft, not a webinar you'll never schedule.

30-second takeaway

AI literacy isn't one course; it's role-specific understanding of the systems people touch.
The Act wants evidence you did it — which means a curriculum with gaps named, not a slide deck.
A draft you can assign beats a policy that says "training TBD."

The training that never gets scheduled

Every compliance checklist has an AI-literacy box. Almost none has a curriculum. So when the question comes, the answer is "we'll do something," and "something" never ships because nobody was assigned to define it for each role.

Drafting the curriculum from the actual staff roles and the actual AI systems turns the box into content. Naming the evidence gaps honestly is the part that survives audit.

What the tool does

You paste your staff roles and the AI systems they touch. It drafts an Article 4 literacy curriculum with modules and the evidence gaps to close. Open the tool and try it — no signup.

LiteracyKit runs in the browser, no account, no key.

FAQ

What is LiteracyKit?

A tool that drafts an Article 4 AI-literacy curriculum from your staff roles and AI systems, including evidence gaps. No account, no key.

Does a curriculum mean we've met Article 4?

It gives you the draft to assign and the gaps to close. Actually delivering and recording it is the human part.

Is this legal advice?

No. Decision-support for curriculum drafting, not a legal interpretation.

Author's Process

This product was built with AI coding tools. The point was a draft teams can assign, not a compliance theater slide deck.

Extraction is easy. Knowing when to trust it is the product.

LXSAIHUB — Thu, 05 Nov 2026 07:51:28 +0000

Extracting transactions from a bank statement or line items from an invoice is the kind of task that looks solved — until the parser quietly swaps a decimal, merges two rows, or invents a balance. The output looks clean. The numbers are wrong.

I built LedgerLens around the unglamorous truth: the value isn't extraction, it's knowing which extractions to trust.

30-second takeaway

A parser that always says "done" is lying some of the time — and you can't see which times.
The useful output is a confidence score per field, not a confident grid.
"Verify before use" is the feature, not a disclaimer.

The silent error is the real one

Most extraction tools hand you a table and call it a win. The error rate lives in the rows that look fine — the amount that's off by a factor of ten because of a comma, the line item that got dropped, the balance that was inferred instead of read. You find those in reconciliation, which is the worst place to find them.

Scoring every field means the tool tells you "this one I'm sure of, this one you check" — which is what a human would do if they had time.

What the tool does

Paste a statement or invoice, or upload a text-layer PDF/DOCX. LedgerLens extracts structured transactions, balances, and line items — each with a confidence score and a clear flag on the ones to verify before you use them.

LedgerLens runs in the browser, no account, no key.

FAQ

What is LedgerLens?

A tool that extracts transactions, balances, and line items from statements and invoices, with a confidence score on every field. No account, no key.

Does it reconcile the numbers for me?

It flags the low-confidence fields so you verify before use. The human still owns the final numbers — that's the point.

Will it read a scanned PDF with no text layer?

It works best with a text layer; for pure scans, the extraction quality depends on what the file actually contains.

Author's Process

This product was built with AI coding tools. The honest design choice was to surface uncertainty instead of hiding it.

GPAI obligations have tiers. Most teams don't know which they're in.

LXSAIHUB — Thu, 05 Nov 2026 07:50:27 +0000

General-purpose AI models — the foundation models everyone builds on — sit under their own section of the EU AI Act. Articles 53 and 55 don't ask "are you a GPAI provider?" as a yes/no. They sort you into tiers based on what your model is and how it's released, and each tier carries different duties.

I built GpaiWatch because the tier you're in is a function of decisions you've already made, not a label you chose.

30-second takeaway

GPAI isn't one obligation — it's a set of tiers keyed to model capability and release practice.
The tier is determined by choices you've already made (scale, openness, downstream use).
Mapping it early beats discovering your tier from a customer's questionnaire.

The tiers hide in your release plan

A team releasing a model often thinks "we're not one of the big labs, so this doesn't apply to us." But the Act keys obligations to specific triggers — capability thresholds, whether you're upstream or downstream, how the model is distributed. Those triggers are in your architecture and go-to-market, whether or not anyone has mapped them.

Picking your tier after the fact means retrofitting documentation and duties you could have planned for.

What the tool gives you

You describe the model and how you release it. It maps you to the Article 53 and 55 obligation tiers and lists what each requires. Not a legal opinion — a structured read that tells you which duties to plan for before you ship.

GpaiWatch runs in the browser, no account, no key. Describe the model and see your tier.

FAQ

What is GpaiWatch?

A mapper that takes a described general-purpose AI model and release practice and shows the Article 53/55 obligation tier it lands in. No account, no key.

Which tier means I'm done?

No tier means done. Each adds duties; the tool lists them so you can plan, not so you can stop.

Is this legal advice?

No. Decision-support for mapping, not a legal interpretation of your obligations.

Author's Process

This product was built with AI coding tools. The useful part was encoding the tier triggers as questions a release owner can answer.