Repository navigation
EU AI Act first tranche: opt-in face recognition, Social mode gates, the Avenkin AI cue (Plan HP) - #680
Merged
Conversation
…d plan the first tranche The review takes the positions the September governance plan left open: face recognition is a remote biometric identification system, the Assistive Social mode is an emotion recognition system, Article 50 has applied since 2 August 2026, and TestFlight is real-world use. Plan HP is the first tranche: nothing taken away from any user, everything disclosed, and the storefront boundary built dormant. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…o already had it The default moves from on to off. A once-only launch migration seeds the switch on where onboarding was finished before this build or a face is enrolled, seeds it off on a fresh install, and leaves a value the wearer already set alone. An organisation profile can now pin face recognition off, never on. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…st edition A request about a person is answered as a scene instead, so no emotional-state prompt is sent where the app is a work tool. Social mode gets its own switch, on by default for personal users, and joins the AI feature inventory as a biometric feature that keeps nothing. The service publishes why Social mode was refused so the screens can say so. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
vision_assess refuses the first-aid triage kind while the first-aid switch is off, in the same words the other switched-off tools use, so the inventory's claim that the switch covers triage is now true. Other assessment kinds are unaffected. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…tched on The batch transcriber used to upload whenever a key was present and HIPAA mode was off. It now takes the same gate as every other diarization path: the opt-in, a key, and HIPAA mode off. Speaker naming is screened as not biometric, with the reason recorded beside it: a typed name on a per-session cluster id, and no voiceprint. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
… report says so A dormant market policy decides whether face recognition, emotion inference or business first-aid triage is offered on a storefront. Its restriction table is empty, so every capability stays available everywhere until it is filled in before December 2027. The storefront is read from StoreKit and, for now, only printed as one line in the support report. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…once per session Two new surfaces join the assessment one, each with its own sentence and its own once-per-session mark. Nothing speaks them yet. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…op body Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…nrolled and Forget Settings, Devices & Privacy, Glasses, Enrolled Faces holds the face recognition switch (read-only with the organisation's name when a profile pins it off), says the person isn't told and that lawful use is the wearer's responsibility, lists each enrolled person with when they were last seen, forgets one by swiping and everyone after a confirmation. The near-tie message now names this screen instead of "Settings". Row and copy formatting is a pure type, tested headless. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…told face_recognition remember is classed as biometric enrolment, a new effect class that needs a bound approval on every seam whatever agent mode says, so the shared approval card and the spoken prompt ask "Remember this face as Maria? They won't be told." before anything is stored. Forget, list and switching recognition on or off stay unasked. A summary that already ends its sentence no longer gets a second full stop before "Approve?". The tool description now says recognition runs only after it is switched on and only for people the wearer enrolled. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…anslated words The translator returned "[es→en]" and the original sentence, and the app spoke that to the person in front of the wearer as a translation. Each recognised sentence now goes through an injected translator; the app gives it the on-device Apple Translation engine the translated captions already use, so nothing leaves the phone. With no translator, or when translation fails or lands after the session stopped, nothing is spoken. The service also reports when a session starts, for the translation disclosure. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
… it is AI to both people Once per launch, Direct mode says "Connecting to Avenkin AI." before its first answer (before any thinking sound), and Gemini Live and OpenAI Realtime say it through the app's voice before the session takes the audio route. The install's first conversation ever gets a longer introduction behind its own done-marker. A translation start says "Starting Avenkin AI translation." Both short lines follow a new switch under Voice, on by default, which an organisation profile can pin on but never off; the introduction ignores it. Lines are mirrored to the HUD. When a live translation plays from the phone's loudspeaker, the other person hears once per launch, in the translation's target language where the catalog has it and in English otherwise, that it is a live AI translation. Their half of the two-way caption split is labelled "AI translation" the same way. The default system prompt says the assistant confirms it is an AI whenever asked, whatever its name or voice; the persona editor says a name doesn't change that; agent onboarding introduces an Avenkin AI assistant. Face recognition pinned off and the cue pinned on are shown read-only rather than hidden on a managed phone. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…n a work phone The Assistive Mode settings gain a Social Mode switch and a standing footer: Social mode describes how a person in front of you seems to feel, and is for personal use, not at work or at school. On a phone managed by an organisation, or in a Field Assist edition, the switch is locked and both the settings and the Assistive toggle say Social mode isn't available there. The refusal-to-copy mapping is a pure type, tested. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…e and the AI cue privacy.html (effective 7 October 2026) says face recognition is off by default, approved per enrolment and that the person isn't told, and points deletion at the Enrolled Faces screen. New paragraphs cover Social mode, first-aid triage, the Clinical Assistant persona, a pasted ElevenLabs voice, and the "Connecting to Avenkin AI" cue and its switch. First-aid coaching and triage had only a release switch, so the switch the notice names now exists: "First-Aid Coaching and Triage" under Devices & Privacy, Hardware & Privacy. The privacy manifest is unchanged on purpose: face prints never leave the phone, and it covers only data that does. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
… decisions Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…seconds" Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
…ith its reason It writes two booleans and reads the face database, whose owner is already registered. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This was referenced Oct 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
First tranche of the October 2026 EU AI Act review (
docs/eu-ai-act-review-2026-10.md, Plan HP). Nothing is taken away from any user; what the law asks for now is disclosed; and the storefront boundary the December 2027 items will need is built, tested and dormant.Face recognition is opt-in. The switch now defaults off, with a one-time migration that keeps it on for any install that completed onboarding before this build or has a face enrolled, so an existing user loses nothing. There is finally a Settings screen for it (Devices & Privacy › Glasses › Enrolled Faces): the switch, who is enrolled with last-seen, swipe to forget, Forget Everyone. Enrolling a face now goes through the bound-approval card ("Remember this face as Maria? They won't be told."). An organisation profile can pin the feature off. The tool description now says what the feature actually does.
Social mode is never offered on a managed phone or under a Field Assist edition. A pure
AssistiveModePolicyroutes Social to Scene when refused; the Accessibility settings and the Assistive toggle say why, and the standing copy says it is for personal use, not work or school. It is registered inAIFeatureRegistrywith its own switch.Two switches now do what they claimed. Turning first aid off also stops camera triage (
vision_assess kind:first_aid_triage), and a saved recording goes to Deepgram only when cloud diarization is actually on. Speaker identification is no longer tagged biometric: it is a typed name on a per-session cluster id and no voiceprint exists."Connecting to Avenkin AI." Said once per launch before the first answer in Direct mode and as a Gemini Live or OpenAI Realtime session connects, mirrored to the HUD. The first conversation an install ever has gets the longer introduction. A Voice setting can turn the cue off (an organisation can pin it on); the introduction, and the line for the other person, cannot be. A translation says "Starting Avenkin AI translation." to the wearer, and when it plays from the phone's loudspeaker the other person also hears, in the language they are being translated into, that this is a live AI translation. Two-way captions label the other person's half "AI translation". The system prompt now says to confirm being an AI whenever asked, whatever persona name or voice is set.
Live translation translates.
LiveTranslationService.translate()was a stub that returned the untranslated words with a tag; it now goes through the on-device Apple translation engine the caption tier already uses, and speaks nothing when it cannot translate.Dormant boundary.
MarketAvailabilityPolicy(storefront country × capability × date, EEA list, every restrictionnil) and a StoreKitStorefrontReaderthat today only adds "App Store region" to the support report. Nothing consults the policy yet.Notice.
privacy.htmlcovers opt-in face recognition, Social mode, first-aid triage, the Clinical Assistant persona, a pasted voice ID, and the cue.PrivacyInfo.xcprivacyis deliberately unchanged: face prints never leave the phone and the manifest covers only data that does.Verification
OpenGlassesTestson the iPhone 17 Pro simulator: 9,545 executed, 13 skipped, 0 failures after one fix (the store-ownership scrape caught the new migration file; it is on the exempt list with its reason). Thesecurity-regressionclasses fromtests.ymlran inside that run.-configuration Releasesimulator build: succeeded, no warnings in changed files. The phone was paired but not plugged in, so the device Release install is owed.Scripts/check-privacy-logging.sh: passes.gitleaksoverf3d90a0d..HEAD(CI form, 16 commits): no leaks.Transport/andContracts/untouched.Localizable.xcstringsuntouched (every build ran withSWIFT_EMIT_LOC_STRINGS=NO); the new strings are English-only until the next catalog sync.Owed after merge
🤖 Generated with Claude Code