ByTheLaw

Spectrum 0.2 beta · Public tier · read 2026-11-10 · not reviewed by its vendor yet

Chat assistant that answers legal questions with citations to official Portuguese and EU sources, analyses uploaded documents, drafts contracts, emails and translations, and organises work in projects. The site menu names it 'ByTheLaw: Legal research and knowledge'; the help centre calls it 'Legal Chat'.

What each level rests on

This card rates a product as its vendor documents it, not anyone's deployment of it. A feature the operator has to turn on counts, and is marked as available. Levels are computed from the evidence below by published rules. A dimension with no evidence reads "not yet evidenced".

Autonomy: level 1, Assists

What does the agent do on its own? Answers, drafts, summarises; a person does each step.

• I15 The person operates: every action is prompted and controlled by them. In the chat as shipped, the lawyer writes each request and the assistant returns an answer to it; this credit is for the chat only, since in the optional Citius configuration ByTheLaw reads Citius on its own schedule without a prompt (see not credited). "ByTheLaw interprets the request and returns an answer grounded in official sources." Source (read, documented, captured 2026-11-10T18:45Z, sha256 d975dcaa530f859f) · π Moderate · S1·R5·A1 ×3

This evidence touches 1 provision: EAAMM.

Next unlock: level 2, Suggests. Public evidence that the agent suggests; the person reviews and approves each action.

Reach: level 2, Integrated

How connected is it? Documented connectors to common tools. This level holds with: Citius. As shipped, with nothing turned on, it is level 1, Contained.

• I11 It connects to external tools or services across a trust boundary. The Citius integration uses the lawyer's own Citius credentials to read the courts system automatically, and Citius can be a source of the chat on request and approval; experimental, granted by ByTheLaw to selected users. "utilizar as Credenciais Citius para aceder ao Citius de forma automatizada" Source (read, documented, available, captured 2026-11-10T18:45Z, sha256 8cdb661d2a779f7d) · π Moderate · S1·R5·A1 ×3

This evidence touches 3 provisions: OWASP, NIST AI RMF.

Next unlock: level 4, Ecosystem. Public evidence that agents operate across organisational boundaries or disparate stacks; and that others build on it: third parties publish integrations, skills or agents for it.

Control: level 1, Stated

Can people stay in command? Documents say how people approve, override or stop it. This level holds with: Citius. As shipped, with nothing turned on, it is not yet evidenced.

• I47 A limit on it is a rule in prose. The Citius terms state in prose that the authorisation covers only consulting and reading. "A autorização prevista no número anterior é limitada às operações de" Source (read, documented, available, captured 2026-11-10T18:45Z, sha256 8cdb661d2a779f7d) · π Moderate · S1·R5·A1 ×3
• I38 High-impact actions need a person's approval. In the Citius integration, an unread notification is opened (which marks it read in Citius, irreversibly) only after the user's prior express action, preceded by a warning. "após ação prévia e expressa do Utilizador na Plataforma" Source (read, documented, available, captured 2026-11-10T18:45Z, sha256 8cdb661d2a779f7d) · π Moderate · S1·R5·A1 ×3

This evidence touches 7 provisions: OWASP, EU AI Act, AAGMM, NIST AI RMF, Salesforce, Microsoft.

Next unlock: level 2, Configurable. Public evidence that what it can reach is enumerated: scopes, permissions, tools.

Openness: level 2, Documented

Does it show its work? Public documents on how it works, its data, its models and its limits.

• I22 Its limits and known failure cases are documented for those who use it. Help pages document limits of use, such as upload limits and that files attached inside an email are not opened. "Files attached inside the email are not opened" Source (read, documented, captured 2026-11-10T18:45Z, sha256 1ce90174b97b213c) · π Moderate · S1·R5·A1 ×3
• I58 The data it uses is described. The help centre lists the legislative, case-law and regulatory databases answers are drawn from. "ByTheLaw draws on the legislative, case-law and regulatory databases in this list" Source (read, documented, captured 2026-11-10T18:45Z, sha256 ba9211ba0a9d771e) · π Moderate · S1·R5·A1 ×3

This evidence touches 7 provisions: NIST AI RMF, EU AI Act, AAGMM, EAAMM, Salesforce.

Next unlock: level 3, Measured. Public evidence that test or evaluation results are published.

How far to trust this card

Status: Draft. Draft means the facts were found in public pages and reviewed by agents. The company has not confirmed them and no customer has gone on record. FACT-Ray says how far each fact can be trusted: who says it (Source), how firmly it is recorded (Record) and who stands behind it (Accountability). It never changes a level.

• The facts: 16 facts: 16 π Moderate. Each is written beside its evidence above.
• The chain: found by an agent, captured and hashed, checked by 2 other agents (same model family, shared repository); no human has signed it.
• Who: produced by gamma.studio@web-summit.dinis; checked by gamma.review@web-summit.dinis and gamma.approve@web-summit.dinis. The actors.
• What would raise it: the company's own file at /.well-known/fact-ray.json (Source 2), a customer's statement of use (Source 3), or a named person signing the card (how).

The standards constellation

One piece of public evidence can speak to several frameworks at once. "Touched" never means "complies". The share is of the provisions that can be read from outside.

The 40 provisions lit

Each line item, with the facts that reach it. "Evidenced" is a link of the kind same: the fact is what the provision asks. "Partly" is a link of the kind part: the fact is one piece of it. "Its absence" points the other way. Each provision has its own page with its text and its place in the source.

Upper layers

The public card is the front door. The same evidence, read with the governance rules, is this agent's GAMMA-Ray rating: freedom, governance, the level held, the grant and a work order. That layer is written for an operator.

The vault

Every source behind this card was captured and hashed into a public sgit vault (dllzmbc3): captures.json lists each URL with the SHA-256 of what was fetched and when. Read key:

sgit_public_read_7f528ecd6fbd9c2d0f293f8361fd3ad93d4ea63fd8b1f1a70ec77feb04110bb6:dllzmbc3

With sgit: sgit clone sgit_public_read_7f528ecd6fbd9c2d0f293f8361fd3ad93d4ea63fd8b1f1a70ec77feb04110bb6:dllzmbc3.