L

Luminos.AI

The evaluation engine is the headline product, beside workflows that would run without it. Luminos Evals send test probes to a customer's model and score the results against encoded legal standards, for classical models, generative AI and agents, and run again when a model changes. Around them sit approval workflows, a library of assessment forms written by outside counsel, and documentation generation, which work as software whether or not an eval runs.

Each test is tied to a named legal standard, and how often the tests are right is not published. The vendor says every eval maps a regulatory standard such as EEOC rules, GDPR, the EU AI Act, HIPAA or the CCPA to concrete system behaviors, uses statistical tests approved by regulators for classical models, and produces a structured result with a traceable chain of evidence. No false positive or false negative rate, validation study or sample of results is published, for a product whose findings clear most AI systems for release without human review.

The levels of automation and the points where people decide are published. Evals run automatically and run again when a model is updated, drifts or appears in a new context. Workflows route by risk: systems of low risk are documented with no review, those of medium risk go to in house legal, and those of high risk escalate to outside counsel, with a review queue showing which provisions were flagged and which cleared.

The vendor states that only work of genuinely high risk routes to people and says about 90 percent of approvals are automated, so a buyer should confirm where its own thresholds sit.

One named customer, without measured results. Red Ventures is named, with quotes from its chief privacy and AI governance officer and its head of product, neither identified by name. An unnamed customer's data scientist says a 3 to 6 month approval process became 3 to 6 days, and the use case pages describe outcomes such as zero regulatory investigations without naming the customers or giving a method. The vendor is also the first certified under the Ethical Tech Project's Applied AI Governance Certification.

Privilege is addressed directly, and the handling of customer data is not. Customers can assert attorney client privilege and work product protection over any test, evaluation or workflow, turned on per test, so documenting a risk need not create new exposure, and workflows can assign tasks to roles while keeping information confidential. Evals need no access to the model itself. What is not published is any term on how the data a customer points the platform at is used, kept or deleted, and the published site terms are silent on training.

Legal conclusions reach people who are not lawyers, and nothing says what the platform is or is not. Eval results mark a system as passing or flagged under laws such as the FTC Act, and they go to data science, product and security teams as well as to legal. Legal advice in the product is attributed to the law firm ZwillGen, and risky findings can be escalated to outside counsel, but no statement on the site or in the site terms says whether Luminos gives legal advice or who may rely on a result.

The vendor governs other companies' AI and says little about governing its own. Evals are written by a legal engineering team of lawyers and data scientists, are versioned, and are aligned with the NIST AI Risk Management Framework, and the platform is certified by the Ethical Tech Project for delivering AI governance. Nothing describes how Luminos tests its own evals for accuracy or bias, who is accountable when an eval clears a system that later causes harm, or what results that testing produced.

A general security page and privacy notice cover the platform without addressing what happens to the data evals run on. The security page describes encryption in transit and at rest, access restricted to authorized personnel, dependency scanning and continuous monitoring, and the privacy notice says Luminos acts as a processor for customer data. No retention period, deletion commitment, subprocessor list or incident notification term is published.

Only standard limits are published. The site terms, last updated April 16, 2024, exclude indirect and consequential damages, cap total liability at what the user paid for access to the website, and require the user to indemnify Luminos for use of the services. They note that a signed agreement governs where one exists, and no customer agreement is published, so nothing addresses an eval that clears a system that later breaks the law.

An API is documented by example and named systems are not. Evals run in the platform or through an API inside a customer's CI/CD, MLOps or testing infrastructure, and the platform page shows a Python client configuring evals against a model endpoint with a version and jurisdiction. The vendor says it integrates with workflow, ticketing and document tools but names none, and publishes no API reference.

Cloud delivery is described and location is not. The security page says the infrastructure is hosted on secure platforms using serverless systems and network segmentation, and the privacy notice covers transfers under the Data Privacy Framework. No hosting provider, region or tenancy option is named.

No independent security attestation is claimed. The security page says the company's practices align with frameworks such as GDPR, HIPAA and SOC 2, which describes alignment rather than a completed audit, and there is no trust center or report on offer.

The platform tests other companies' models and says nothing about its own. Evals are described as automated tests and statistical methods, but the vendor does not say whether language models score the results, which ones, or where they run, and nothing commits to notice of change.

No pricing is published. The site says there is no big setup fee and that the ZwillGen form library can be bought whole or form by form, but gives no price, tier or unit of charge, and every route leads to a demo or a request to run a first eval.

Coverage is described with substance, short of stated limits. The platform evaluates classical models, generative AI and agents, with a library covering more than 20 regulatory frameworks including EEOC rules, New York City, Illinois and California hiring laws, GDPR, CCPA, the EU AI Act, the Colorado AI Act and HIPAA, and use cases such as hiring tools and chatbots that face customers. It does not say which jurisdictions or laws are outside the library.