The EU AI Act Explorer exposes the same official-text data to AI assistants through a free, read-only MCP (Model Context Protocol) server. It answers from Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, always citing the Official Journal source. It provides legal information, not legal advice.
Endpoint: https://mcp.euaiactlaw.com/mcp - plain JSON-RPC 2.0 over HTTPS POST, supporting protocol versions 2026-07-28 and 2025-03-26 (legacy). No account, no API key, no authentication. GET is not used; a plain HTTPS POST works directly.
Something wrong or missing? AI clients can report it with the send_feedback tool.
Generic client configuration:
{"mcpServers": {"eu-ai-act": {"url": "https://mcp.euaiactlaw.com/mcp"}}}
| Tool | Required arguments | What it returns |
|---|---|---|
| get_article | number | Full article text with citation |
| get_recital | number | Full recital text |
| get_annex | number (Roman numeral) | Full annex text |
| get_definition | term | Article 3 definition with reference |
| search_text | query | Ranked matching passages with article references |
| get_obligations | role (provider, deployer, ...) | Obligation list mapped to application phases |
| get_deadlines | (none) | Application timeline as of today, with in-force status |
| send_feedback | category, message | Records a feedback message for the maintainer (the only tool that writes anything; no reply) |
Roles accepted by get_obligations: provider, deployer, importer, distributor. These are the Article 3 operators the obligation data covers today. Optional risk_tier filter: unacceptable, high, transparency, minimal (maps to the Obligation Matrix's scenario risk classes). One role per call; an entity can hold several roles at once (Recital 83), so call once per role. GPAI-specific provider obligations are included in the provider results.
An agent helping a fictional startup, "Acme Hiring" (made up for this example), checks first duties for a CV-screening tool. Two real calls and their real outputs:
1. search_text({query: "recruitment or selection of natural persons"}) returns, verbatim:
1. Article 3 - Definitions For the purposes of this Regulation, the following definitions apply: (1) 'AI system' means a machine-based system that is designed to operate with varying levels of autonomy and t... 2. Article 5 - Prohibited AI practices 1. The following AI practices shall be prohibited: (a) the placing on the market, the putting into service or the use of an AI system that deploys ...
2. get_obligations({role: "deployer"}) returns, verbatim:
Obligations for role "deployer" (Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, consolidated text of 27 July 2026): 1. Ensure staff and contractors have a sufficient level of AI literacy - Article 4, "AI literacy" - In force since 2 Feb 2025; current wording applies from 27 Jul 2026 - https://euaiactlaw.com/article/4 2. Immediately stop using and withdraw any AI system performing a prohibited practice - Article 5, "Prohibited AI practices" - In force since 2 Feb 2025; points (ba)-(bb) apply from 2 Dec 2026 - https://euaiactlaw.com/article/5 3. Use system in accordance with instructions of use - Article 26(1), "Obligations of deployers of high-risk AI systems" - Applies from 2 Dec 2027 (Annex III systems) / 2 Aug 2028 (Annex I-embedded systems) - https://euaiactlaw.com/article/26 ... (17 more obligations in the live response)
The example is fictional; the outputs are real server responses from 22 October 2026.
Fair use: free tier; automated clients should keep request rates modest (a zone rate limit applies). The server stores no queries and answers only from the official texts.
Privacy: calls to this endpoint are counted anonymously (tool name, result status, response time, country, client type and time only) so the operator can judge whether the service is useful. No IP addresses, query text or search terms are stored. Statistics are kept by Cloudflare for up to three months and then deleted. If you use the send_feedback tool, your message text, category and optional tool/client names are stored for up to 90 days so the maintainer can review them; no IP address or other identifiers are stored with it.
The server is dual-era: it speaks the current MCP revision (2026-07-28, per-request _meta protocol fields, MCP-Protocol-Version / Mcp-Method / Mcp-Name headers, server/discover) and the legacy initialize-handshake revisions (2025-03-26 through 2025-11-25), selected per request. server/discover lists the supported versions.
Two deliberate deviations from a strict reading of the 2026-07-28 spec:
https Origin is accepted and non-https Origins are rejected.