The EU AI Act Explorer exposes the same official-text data to AI assistants through a free MCP (Model Context Protocol) server with eight read-only tools and one optional feedback-writing tool. It answers from Regulation (EU) 2024/1689 as amended by Regulation (EU) 2026/1744, always citing the Official Journal source. It provides legal information, not legal advice.
Endpoint: https://mcp.euaiactlaw.com/mcp - plain JSON-RPC 2.0 over HTTPS POST, supporting protocol versions 2026-07-28 and 2025-03-26 (legacy). No account, no API key, no authentication. GET is not used; a plain HTTPS POST works directly.
Something wrong or missing? AI clients can report it with the send_feedback tool.
This page is a self-contained reference for all nine tools. Step IDs, option IDs and types below match the live tools/list schema checked 26 October 2026. Never invent IDs or fill in unknown facts. Refresh the schema after connecting to detect future changes.
Read this reference or call tools/list to discover parameters. A normal MCP client handles its protocol handshake; legacy clients use initialize, notifications/initialized, then tools/list.
Choose the tool below. If you cannot identify a provision number, use search_text, then read the returned provision in full.
Call tools/call with the tool name and an arguments object. Parameter names, types and allowed IDs are case-sensitive.
Check JSON-RPC errors and result.isError before using content. Preserve the source, date, context and limitations when reporting an answer.
Tools (9: eight read-only lookups, plus send_feedback)
“Required” is a schema requirement, not proof the supplied facts are sufficient for a sound assessment. Example arguments below fit the contract; they are not legal advice or automatic submissions.
get_article: Read a known article. If its number is unknown, search first.
Schema roles also include notified_body and authority; enum acceptance does not establish comprehensive obligation coverage for every role. This is a role-based inventory, not a classification of a particular system. Risk-tier aliases are accepted as listed; all means no filter. Provider results include GPAI entries.
Show which EU AI Act obligations and phases are in force or pending as of a given date.
date · string · optional
ISO date, e.g. "2027-06-01". Defaults to today.
Returns: As-of date and phases with date, description and in-force status.
Example arguments:
{
"date": "2027-06-01"
}
send_feedback
Tell the maintainer what is wrong, what is missing, or what worked well (a wrong text, a missing amendment, a broken answer, or that this server helped you). One-way: no reply is sent.
category · string · required
error = something factually wrong; content_gap = correct request for missing material; useful = this server helped - say what worked; other = anything else
What is wrong, missing, or helpful. Max 1,000 characters.
Maximum 1,000 characters. Do not send secrets or private client facts.
tool · string · optional
Optional: which tool the feedback is about
client · string · optional
Optional: self-declared client name
Returns: Acknowledgement (ok/message); one-way, no reply.
Only writing tool. Categories: error = factually wrong; content_gap = missing material; useful = what helped; other = anything else. Use only for an intended feedback submission. The example below has not been submitted.
Example arguments:
{
"category": "content_gap",
"message": "Describe the missing material and the source that supports it.",
"tool": "get_article",
"client": "your-client-name"
}
assess_compliance
Run the EU AI Act compliance assessment: given the entity's answers (same decision tree as the interactive checker on euaiactlaw.com), returns the applicable roles, risk classification, full obligation list with legal basis and deadlines, and notes (e.g. Annex I Section B reduced regime, open-source GPAI exception, Art 27(3) NCA notification, distributor obligations under Art 24). Pass answers keyed by step id (E1, E2, S1, R1-R5, HR1-HR6, ...); E1 (roles) is required. Multi-select steps take arrays of option ids; single-choice steps take one option id.
Returns: Text summary plus structuredContent: terminal, route, statuses, roles, classification, obligation_count, groups, obligations, checker_link, source; also a resource_link to the checker.
The IDs below come directly from the tool schema, not from page headings or guessed numbers. There are 15 steps: E1-E3, S1, R1-R5 and HR1-HR6. Only E1 is technically required. All other keys are optional in the schema, but the route may need their facts. Omission is not an “unknown” answer: missing arrays can act like no selection. In particular, missing S1 produces out-of-scope even when other supplied facts generate a high-risk classification and obligations.
Before calling: collect the relevant facts. Multi-select steps take arrays of exact option IDs; HR3, HR5 and R5 take one string. Do not combine none with positive options. Do not invent a negative answer when facts are unknown; ask for the facts or report that assessment is incomplete. The server does not validate that every question on the route was answered.
The route descriptions below document the current checker implementation, not an independent legal conclusion. Use route, terminal and statuses to audit what happened. Human questionnaire: interactive compliance checker.
E1 · multi-select array · required
What is your role in relation to the AI system?
Start here. Required. Authorised-representative-only route ends early. Product-manufacturer-only goes to E3; provider/deployer/distributor/importer routes go through E2. Mixed roles may take a different route.
provider
Provider Develops an AI system or GPAI model and places it on the market or puts it into service under own name or trademark. Art 3(3)
deployer
Deployer Uses an AI system under its authority, except for purely personal non-professional use. Art 3(4)
distributor
Distributor Makes an AI system available on the EU market (other than provider or importer). Art 3(7)
importer
Importer Located in EU, places on market an AI system bearing the name of a non-EU entity. Art 3(6)
product_manufacturer
Product Manufacturer Places on market or puts into service an AI system together with a product under own name/trademark. Art 25(3)
auth_rep
Authorised Representative Appointed by written mandate from a provider established outside the EU. Art 3(5)
E2 · multi-select array · conditional
Do you or any downstream entity make any of these modifications?
After E1 for ordinary operator roles; then HR1.
rename
Putting a different name or trademark on the system Affixing your own name/trademark to an AI system developed by another. Art 25(1)(a)
repurpose
Modifying the intended purpose of a system already in operation Changing the purpose for which a system was placed on the market or put into service. Art 25(1)(c)
substantial_mod
Performing a substantial modification (Article 3(23)) to the system A change that affects compliance with requirements or alters the intended purpose. Art 3(23) · Art 25(1)(b)
none
None of the above No modifications are made.
E3 · multi-select array · conditional
Does your product integrate an AI system and meet either criterion?
Product-manufacturer route. “none” or missing/empty answer ends out of scope; otherwise HR6.
ai_with_product
AI system placed on the market together with the product under manufacturer name/trademark The AI system ships as part of the product.
ai_after_product
AI system put into service under manufacturer name/trademark after product placed on market AI functionality added after initial product release, still under your name.
none
None of the above The AI system is not integrated with a product under your name.
HR1 · multi-select array · conditional
Does your AI system fall within any Annex I, Section B categories?
After E2. Any non-none Section B category goes to S1; otherwise HR2.
aviation_security
Civil aviation security Regulation (EC) No 300/2008
motor_type_approval
Motor vehicles type approval Regulation (EU) 2018/858
machinery
Machinery Regulation (EU) 2023/1230
vehicles_two_three
Two/three-wheel vehicles and quadricycles Regulation (EU) No 168/2013
agri_vehicles
Agricultural and forestry vehicles Regulation (EU) No 167/2013
marine
Marine equipment Council Directive 2014/90/EU
rail
Interoperability of rail systems Directives 2016/797/EU
motor_vehicles
Motor vehicles and their trailers Regulation (EU) 2019/2144
In vitro diagnostic medical devices Regulation (EU) 2017/746
none
None of the above System does not fall under Section A product safety laws.
HR3 · single string · conditional
Is your product required to undergo third-party conformity assessment under the applicable EU laws?
When HR2 matches. “yes” goes to S1; “no” goes to HR4.
yes
Yes — third-party conformity assessment is required A notified body must assess compliance under the applicable harmonisation legislation.
no
No — manufacturer self-declaration or no third-party assessment required Under Art 43(3), where the AI system is a safety component of an Annex I Section A product (or is itself such a product), the conformity assessment follows the applicable product legislation; adding an AI safety component does not by itself force third-party assessment. Where Annex VII is used, the required elements are points 3, 4.3–4.5, the fifth paragraph of 4.6 and point 5.
HR4 · multi-select array · conditional
Does your AI system fall within any Annex III high-risk categories?
When preceding product rules did not establish the branch. Any non-none category goes to HR5; otherwise S1.
biometrics
Biometrics Remote biometric identification, biometric categorisation of natural persons, or emotion recognition systems.
critical_infra
Critical infrastructure Management and operation of critical digital infrastructure, road traffic, or supply of water, gas, heating, or electricity.
education
Educational and vocational training Determining access/admission, assessing students, monitoring prohibited behaviour in exams.
employment
Employment, workers management, self-employment access Recruitment, promotion decisions, task allocation, monitoring and evaluation of performance.
essential_services
Access to essential private/public services and benefits Creditworthiness assessment, insurance pricing, emergency dispatch, social benefits assessment.
law_enforcement
Law enforcement Risk assessment of victims, polygraphs, evaluation of evidence reliability, individual risk assessment, profiling in criminal offence detection.
migration
Migration, asylum, border control Polygraphs, risk assessment of persons, document authenticity, examination of applications.
justice
Administration of justice and democratic processes Researching and interpreting facts and law, influencing election outcomes.
none
None of the above System does not fall within Annex III categories.
HR5 · single string · conditional
Does your AI system pose a significant risk of harm to health, safety, or fundamental rights?
When HR4 matches; then S1.
yes
Yes — poses significant risk (or system performs profiling of natural persons) The system poses a significant risk to health, safety or fundamental rights, OR it performs GDPR profiling.
no
No — meets one of the Art 6(3) derogation conditions A derogation condition applies and the system does not perform GDPR profiling.
HR6 · multi-select array · conditional
Does your product include an AI system as a "safety component" AND fall within Annex I, Section A categories?
Product-manufacturer path after E3; then S1.
toys
Toys Directive 2009/48/EC
recreational
Recreational craft & personal watercraft Directive 2013/53/EU
lifts
Lifts and safety components of lifts Directive 2014/33/EU
atex
Equipment for potentially explosive atmospheres Directive 2014/34/EU
radio
Radio equipment Directive 2014/53/EU
pressure
Pressure equipment Directive 2014/68/EU
cableway
Cableway installations Regulation (EU) 2016/424
ppe
Personal protective equipment Regulation (EU) 2016/425
In vitro diagnostic medical devices Regulation (EU) 2017/746
none
None of the above AI system is not a safety component in a Section A product.
S1 · multi-select array · conditional
Do you meet any of the following criteria for EU AI Act applicability?
EU territorial/material applicability. Missing, empty or “none” ends out of scope. Include established facts here; do not omit it just because schema requires only E1. gpai_eu goes through R1, other positive criteria to R2.
placing_eu
I am placing on the market or putting into service AI systems in the EU Your system is deployed to EU users or offered on the EU market.
gpai_eu
I am placing on the market General Purpose AI (GPAI) models in the EU You develop and distribute a GPAI model (e.g., foundation model, large language model) to EU downstream providers.
established_eu
I am established or located within the EU Your organisation is legally incorporated or has a registered office in an EU Member State.
importer_eu
I am an importer placing on the EU market a system bearing a non-EU entity name You import AI systems from outside the EU and place them on the EU market.
distributor_eu
I am a distributor making an AI system available on the EU market You make systems available without importing them. Art 2(1)(d)
output_eu
My AI system's output is used in the EU Even if the system operates outside the EU, its outputs affect persons or decisions within the EU.
none
None of the above The EU AI Act does not apply to your situation.
R1 · multi-select array · conditional
Does your AI model meet any systemic risk criteria? (GPAI only)
Only when S1 includes gpai_eu; then R2.
high_flops
High impact capabilities (trained with cumulative compute >10²⁵ FLOPs) Models with very large training compute are presumed to have systemic risk. Art 51(2)
commission_decision
Commission has decided the model has high capabilities or impact (Annex XIII criteria) The European Commission can designate models as having systemic risk based on Annex XIII criteria.
none
None of the above (or this is not a GPAI model) The model does not meet systemic risk thresholds, or this question is not applicable.
R2 · multi-select array · conditional
Does your system or use-case fall within any exclusion category?
After positive scope route; then R3. Selection describes checker inputs, not blanket legal exemption advice.
military
AI systems developed and used exclusively for military purposes Fully excluded from scope. Art 2(3)
third_country_law
Public authorities / international organisations in third countries using AI for law enforcement or judicial cooperation Excluded under international cooperation agreements. Art 2(4)
research
AI research and development activity (not yet placed on market) R&D excluded until system is placed on market or put into service. Art 2(6)
open_source
AI components provided under free and open-source licences Open-source exclusion does NOT apply if system is high-risk, an Art 5 practice, or has Art 50 transparency obligations. Art 2(12)
personal_use
Purely personal, non-professional activity by a natural person Deployer obligations do not apply for personal non-professional use. Art 2(10)
none
None of the above No exclusions apply to your situation.
R3 · multi-select array · conditional
Does your system perform any prohibited AI practices?
After R2. A prohibited practice for provider/deployer proceeds to R4; other roles may terminate. Otherwise R4.
subliminal
Subliminal techniques, manipulation, or deception Systems that deploy subliminal techniques beyond a person's consciousness or exploit vulnerabilities to materially distort behaviour causing significant harm.
vulnerable_exploit
Exploiting vulnerabilities of specific groups Exploiting vulnerabilities due to age, disability, or social/economic situation to materially distort behaviour causing harm.
biometric_categorisation_prohibited
Biometric categorisation to infer sensitive attributes Inferring race, political opinions, trade union membership, religious beliefs, sex life or sexual orientation. (Exception: lawful labelling/filtering of biometric datasets, law enforcement categorisation.)
social_scoring
Social scoring — evaluating or classifying persons based on social behaviour Evaluating trustworthiness of persons based on social behaviour or personal characteristics leading to detrimental treatment.
predictive_policing
Predictive policing based solely on profiling or personality traits Exception: systems augmenting human assessments based on objective, verifiable facts directly linked to criminal activity.
facial_scraping
Untargeted scraping of facial images from internet/CCTV to expand databases Creating or expanding facial recognition databases through untargeted scraping.
emotion_recognition_prohibited
Emotion recognition in workplace or educational institutions Exception: systems used for medical or safety reasons.
realtime_rbi
Real-time remote biometric identification in publicly accessible spaces for law enforcement Limited exceptions exist under Art 5(2)–(3) for targeted searches for crime victims, specific threats, and serious crimes.
nonconsensual_intimate
Generating or manipulating non-consensual intimate material or child sexual abuse material Art 5(1)(ba)/(bb), with the Art 5(1a)–(1b) qualifiers: AI systems generating or manipulating realistic intimate imagery of an identifiable person without their explicit consent, or material within Art 2(c)/(e) of Directive 2011/93/EU. Prohibition applies from 2 December 2026.
none
None of the above System does not perform any prohibited AI practice.
R4 · multi-select array · conditional
Does your system perform any transparency-triggering functions?
Then R5 if the checker detects high risk from HR answers; otherwise result.
deepfake
Generating or manipulating image/audio/video constituting a deep fake Content that resembles existing persons, objects, places or events and would falsely appear authentic. Deployer obligation: Art 50(4). Provider obligation: Art 50(2).
public_interest_text
Generating or manipulating text published for matters of public interest (e.g., news) AI-generated text published to inform the public on matters of public interest. Deployer obligation: Art 50(4). Provider obligation: Art 50(2).
emotion_biometric
Emotion recognition or biometric categorisation (non-prohibited) The system performs emotion recognition or biometric categorisation of natural persons. Deployer obligation: Art 50(3).
natural_persons
Interacting directly with natural persons (e.g., chatbot) The system is designed to interact directly with natural persons. Provider obligation: Art 50(1).
synthetic_content
Generating synthetic audio, image, video, or text content The system generates synthetic content. Provider obligation: mark outputs in machine-readable format (Art 50(2)). Deployer obligation: disclose AI-generated content where applicable (Art 50(4)).
none
None of the above No transparency triggers apply.
R5 · single string · conditional
Are you a body governed by public law, or a private entity providing public services, or operating in insurance/banking?
Conditional high-risk branch; then result.
yes
Yes — public law body, public service provider, or insurance/banking entity Must conduct FRIA before deploying Annex III high-risk systems (except critical infrastructure). Art 27(1)
no
No — private entity not providing public services and not in insurance/banking FRIA obligation does not apply.
Responses, errors and coverage limits
Read human-readable blocks in result.content. The assessment also has result.structuredContent and a checker resource link. Every tool declares an outputSchema in tools/list; responses also carry human-readable text blocks, and assess_compliance returns a structuredContent object matching its outputSchema. The presence of an output schema alone is not proof that every runtime response uses one uniform structured envelope.
Check result.isError. A missing provision can return HTTP200 with a tool error instead of transport failure. Observed: get_article({"number":"999"}) returned isError:true and “No article numbered "999" found. Use search_text to find the right provision.” Search by topic and use returned references; never fabricate a number.
Handle top-level JSON-RPC errors separately from tool errors. A successful HTTP response alone is not successful retrieval. Exact malformed-request and rate-limit envelopes are not specified here; do not retry indefinitely or guess thresholds.
The assessment may return an out-of-scope terminal alongside classification and obligation data derived from raw answers. This is especially possible with omitted S1. Do not present such an internally mixed result as a final conclusion. Resolve missing facts and inspect the route, or state the limitation.
Coverage is the site's English AI Act dataset and its amendment/version labels, not all EU/national law, case law or exhaustive legal advice. A matching passage or obligation list does not prove applicability, completeness or a correct legal conclusion. Verify the cited official text and dates.
Respect modest automated request rates. Do not use send_feedback as a query channel, status poll or support conversation; it records a one-way message.
Worked agent workflow: recruitment tool
Fictional facts, real bounded read-only call checked 26 October 2026: an EU-established deployer uses an employment system, answers the significant-risk question yes, and has confirmed the listed negative answers. Those facts are assumptions for the example, never defaults to infer for a real user.
Find candidate provisions with search_text({"query":"recruitment","scope":"all","limit":5}). Follow returned labels and permalinks using get_article/get_annex; snippets are discovery, not full evidence.
Collect all relevant questionnaire facts. Call assess_compliance with the complete example arguments shown above.
Inspect the terminal and route. The observed structured summary was:
This is the checker's result, not independent legal verification. Review the returned obligations, their legal bases and dates against the full source. Compare role obligations separately with get_obligations if useful; do not treat its unfiltered inventory as automatically applicable.
For an exact quotation rather than assessment, call get_article directly. For a date-specific timeline, call get_deadlines with an explicit ISO date. Submit feedback only when intended; it is not needed for any lookup.
Fair use: free tier; automated clients should keep request rates modest (a zone rate limit applies). The server stores no queries and answers only from the official texts.
Privacy: We record aggregate MCP usage statistics through Cloudflare. Feedback submitted through the MCP service is retained for 90 days. Cloudflare processes connection data to deliver and protect the service, and network data for its own security purposes. See Cloudflare Privacy Policy. Questions: yiango@proton.me
Protocol notes
The server is dual-era: it speaks the current MCP revision (2026-07-28, per-request _meta protocol fields, MCP-Protocol-Version / Mcp-Method / Mcp-Name headers, server/discover) and the legacy initialize-handshake revisions (2025-03-26 through 2025-11-25), selected per request. server/discover lists the supported versions.
Two deliberate deviations from a strict reading of the 2026-07-28 spec:
Origin header: the spec's Origin validation exists to stop DNS-rebinding attacks on localhost servers. This is a public read-only remote server, so that attack does not apply; any https Origin is accepted and non-https Origins are rejected.
GET on the endpoint: a browser GET to the MCP endpoint redirects (302) to this documentation page instead of returning 405, so humans who paste the URL land somewhere useful. API clients only ever POST.