AI assists the research; people own the decision.

Where AI is used

• Research reports, source summaries, competitor analysis, opportunity scoring, naming, requirements, blueprints, development documents, and concept images.
• Demand scanning and idea generation when enabled.
• Native or external web search used to retrieve candidate sources and citations.
• Local Runtime model tasks selected by an authorized user.

Disclosure, marking, and route visibility

AI-assisted actions are labeled through task, generation, research, score, or model language in the product. Hosted Web and mobile identify LabRat platform AI; LabRat Local identifies local execution and the locally configured provider. Hosted settings do not offer a personal or team BYOK route.

Supported generated Markdown and text carry signed metadata and an invisible text watermark. Concept images are delivered in an SVG wrapper with a visible AI label, signed metadata, and the original upstream image bytes preserved. Structured report, idea, demand, and package outputs include an ai_provenance record. A public detector and public signing key let recipients check the LabRat signature and content hash.

The executing provider receives the prompt, requested workspace context, and source material needed for the task. LabRat does not intentionally send unrelated workspace content.

Human oversight

Users choose whether to start a task, which project or context to use, whether to run from a hosted or eligible Local surface, and whether to accept, edit, reject, export, or act on an output. Requirements, blueprints, previews, and other consequential workflow steps expose explicit review or confirmation controls.

Limitations and verification

• AI outputs can be inaccurate, incomplete, biased, outdated, non-unique, or inconsistent.
• A citation can be wrong, stale, inaccessible, or insufficient to support a generated claim.
• Scores and recommendations are product heuristics, not factual guarantees.
• Generated images or text can resemble third-party material; users must check rights and intended use.
• Editing, copying through unsupported software, conversion, screenshots, or deliberate removal can damage a marker. A valid marker authenticates LabRat issuance and integrity; it does not prove the output is true, lawful, or suitable.
• Important legal, safety, financial, medical, security, market, and technical claims require independent review.

EU AI Act timing and publication boundary

EU AI Act Article 4 AI-literacy duties have applied since February 2, 2025. Relevant Article 50 transparency duties apply from August 2, 2026. LabRat labels its private research workflows as AI-assisted and exposes the selected route; the service does not currently auto-publish deepfakes or AI-generated public-interest content.

LabRat introduced signed, detectable marking for supported outputs before that date, while preserving upstream content inside marked concept-image wrappers. This is a technical control, not a claim that every third-party format, transformation, model route, or legal classification has been conclusively assessed. The voluntary EU Code was assessed as adequate in July 2026, but adherence and the final scope assessment require an authorized operator decision.

Before any public synthetic-media or public-interest publishing feature is enabled, LabRat will complete the applicable visible-disclosure assessment. Users remain responsible for disclosure when they independently publish an output in a context where law or platform rules require it.

AI literacy and responsible operation

People operating or supporting LabRat are expected to understand the available model routes, data flows, common failure modes, source-verification needs, privacy controls, security boundaries, and escalation process appropriate to their role. Operational guidance and incident reviews are updated when models or material AI features change.

Questions, rights, and incident reporting

Use the Privacy Request Center to ask about personal data used in an AI route, object where applicable, or request access or deletion. Report a harmful, misleading, rights-infringing, or security-sensitive output with the project and task context, but do not email secrets.