See CASE_STUDY.md for the problem, controls, and limitations.
Launch readiness is tracked in docs/launch-readiness.md. Deployment notes for the optional cockpit are in DEPLOYMENT.md.
Deterministic EU AI Act first-pass classifier: cited risk tiers, obligations, timelines, review status, CLI and MCP-style tools. Not legal advice; data is synthetic.
If you don't code: scroll to What the demo produces. This repo ships a sample output you can read in the browser. The point isn't the code; it's whether the legal work is structured, cited, reviewable, and testable.
git clone https://github.com/sebastianfoerste/eu-ai-act-classifier
cd eu-ai-act-classifier
uv sync
uv run python -m src.eu_ai_act_classifier.cli examples/credit_scoring.jsonRuns end to end, offline and deterministically.
The classifier runs a gates-based review over a system profile and outputs a report detailing the risk tier, binding timeline, regulatory sources, applicable obligations and review status. You can read the committed sample output in examples/classification-packet.md and examples/classification-packet.json.
EU AI Act classification: CreditSightScore
Risk tier: HIGH-RISK (Art. 6 AIA)
Disposition: DETERMINED
Scope status: in_scope
Roles: provider
Obligations:
- Art. 9 AIA: Risk management system.
- Art. 10 AIA: Data and data governance.
- Art. 11 AIA: Technical documentation.In the sample run, every tier and obligation is cited to an Article and carries an explicit review status.
| Gates / Steps | Focus | Verification Method |
|---|---|---|
| Scope and Intake | Alignment | Checks AI-system status, EU nexus, and transitional dates |
| Prohibited Practices | Art. 5 verification | Flags prohibited use cases |
| High-Risk & GPAI | Art. 6 / Annex III / GPAI | Classifies obligations based on deployment areas and compute scale |
Use the CLI first. It is the authoritative product surface and does not require web dependencies:
uv run pytest
uv run eu-ai-act-classify examples/credit_scoring.json --strict
uv run eu-ai-act-classify examples/credit_scoring.json --sources
uv run eu-ai-act-classify examples/credit_scoring.json --artifact all --artifacts-dir /tmp/eu-ai-act-draft-packThen inspect /tmp/eu-ai-act-draft-pack. The generated files are draft review artifacts, not legal opinions, conformity assessments or filing documents.
Reports and draft artifacts use a versioned source manifest. Binding Level 1 text, provisional materials and nonbinding guidance are labelled separately. Guidance overlays are advisory notes and do not override the binding classification logic.
The MCP server remains available:
uv pip install -e ".[mcp]"
python -m eu_ai_act_classifier.mcp_serverThe local JSON bridge is used by the optional web cockpit:
eu-ai-act-local-api schema
eu-ai-act-local-api inventory
echo '{"profile":{"name":"x"}}' | eu-ai-act-local-api classify
echo '{"profile":{"name":"x"}}' | eu-ai-act-local-api dossierThe bridge exposes schema, inventory, classify, sources, workspace, artifacts and dossier commands. It keeps the Python classifier as the legal source of truth.
eu-ai-act-local-api workspace and /workspace expose the same deterministic portfolio workspace: an AI-system vault, guided assessment workflows and a fleet command center. All deployment and external-use decisions remain review-gated.
The inventory payload includes a system review table with classifier-backed rows, source status, open facts, obligations, draft artifacts and review state. External action is blocked and all deployment, regulator, customer and public-facing use remains review-gated.
The web/ folder contains a local Next.js App Router cockpit with system inventory, guided questionnaire, risk map, open legal questions, reviewer notes, source provenance, obligation tracker and export pack preview.
Confirmed public demo: web-opal-chi-38.vercel.app. The CLI remains the authoritative legal-rule surface; the hosted cockpit is a fixture demo.
Run it locally:
cd web
npm install
npm run devThe web app uses in-memory state for v1. It does not persist client, matter, candidate, account or privileged data.
examples/ holds synthetic systems spanning prohibited, high-risk, limited risk, minimal risk, GPAI and review-required cases. The expected results are asserted in tests/test_examples.py.
- Guidance changes.
- National implementation and supervisory practice may vary by Member State.
- The engine applies rules to characterised facts and does not decide disputed intended purpose, operator role or factual deployment scope.
requires_review, draft artifacts and advisory overlays must be reviewed before reliance.
Python 3.13+, Pydantic v2, pytest, ruff and uv for the classifier. Next.js App Router and React for the optional local cockpit.
The local collaboration bridge command and /self-assessment route add stable inventory review cells, optimistic locks, versioned classification and policy workflows, and a synthetic self-assessment portal. Mutable state exports as review.collaboration.v1; deterministic classifier results remain separate from reviewer overrides and blocked classifications remain deployment-blocking.
This is a screening tool for supervised legal review. It does not produce legal advice, a conformity assessment or a binding regulatory conclusion. Generated work products require human legal review before use.
AI tools assisted the implementation, but the parts that carry the value are human-authored: the Annex/Article mappings, the obligation set, and the prohibited-practice and review-status logic. The point of this repository is not code volume; it is showing how legal judgment can be made structured, testable, and reviewable.
Part of a portfolio of deterministic, review-gated EU-regulation tools:
- micar-whitepaper-linter — MiCAR whitepaper linter with pinpoint citations and a CI action.
- dora-third-party-register-and-resilience-workbench — DORA ICT third-party register and resilience workbench.
- eu-financial-reg-horizon-scanner — Review-gated EU financial-regulation horizon scanner.
Curated index of EU financial-regulation primary sources and tools: awesome-eu-fintech-regulation.