Governance-as-code
for the AI in your repo
Janus scans your codebase for AI features and control gaps, maps each one to the regulations that apply, and gives legal, engineering, and security one shared surface to review and sign off.
It reads your actual code — not a questionnaire — and shows every obligation in three languages: legal, plain, and code.
Local-first by default. Runs on your own models (Ollama / vLLM). Your source and policies never leave your infrastructure — cloud analysis is off unless you opt in.
Detect, map, then review
One pass over your repository turns raw code into a governance position a person can actually sign.
Detect the AI
Scan for every model call, endpoint, and data flow — and for missing controls: no auth, no rate limiting, no AI disclosure, unsafe model loading.
An AI Bill of Materials of what you actually run.
Map to policy
Each finding is tied to the exact obligation it implicates — across the EU AI Act, NIST, ISO 42001, OWASP LLM Top 10, and your own policies — with the source text.
Policy-as-code: one repo, every framework at once.
Review as a team
Findings become a shared surface — like a pull request — where legal, engineering, and security each get their own lens and a human sign-off of record.
The decision is a person's, backed by evidence.
One obligation, two faces
The hard part was never scanning code — it's the translation between what a lawyer means and what a developer builds. Janus holds both in view, at once.
Providers must ensure AI systems intended to interact with people are designed so those people are informed they are interacting with an AI system.
EU AI Act · Article 50(1)
Look for a user-facing disclosure near the AI call — a banner, a system message, or an "AI-generated" label on the response.
actions/message_summary.py:80
People are told, clearly, that they're talking to an AI and not a human — so they aren't misled.
Neither a questionnaire nor a scanner
GRC platforms ask you to self-attest. Security scanners read code but stop at threats. Janus reads the code, maps it to regulation, and adds the human review layer.
Findings are AI-generated flags for human review — not legal advice or a certification.
Auditor-ready, generated from evidence
Not just a report — the paperwork a regulator can act on, every claim traceable back to a line of code.
AI Bill of Materials
A CycloneDX inventory of every AI model, service, and endpoint in your code — each linked to the obligations it triggers.
EU AI Act Annex IV draft
A technical-documentation draft in the Annex IV structure, generated deterministically so it reproduces exactly.
Evidence package
One zip: Annex IV doc, model card, translation report, framework-coverage matrix, AI-BOM, and findings.
Findings, not verdicts
Each control is flagged — addressed, partial, or a potential gap — with the evidence, for a human to confirm. Honest about uncertainty.
Shift-left in CI
Run a governance check on every pull request and fail the build on a gap above your severity threshold.
Suggested fixes
For each gap, a concrete code edit is drafted and checked so it applies cleanly — a patch to review, not a generic note.
Every finding, self-contained
The obligation, its two faces, the real regulation text, the actual source, and your sign-off — on one card.
def do_summarize_narrow(user, messages):
summary = make_message_summary(
formatted, model, max_tokens,
)
# returned to the client with no
# user-facing AI disclosure
return SummaryResult(summary=summary)Six real applications loaded · runs on your own models · no account needed to start
Pressure-test Janus with us
We're working with legal, compliance, and security experts to test Janus on real applications. If that's you, we'd love to talk.