Praxikon

Case check: GDPR and EU AI Act

check_case

Read-only

Use this when the user describes a concrete, intended use of AI or of personal data (a system, a project, a supplier) and wants to know whether a DPIA, a FRIA or duties under the GDPR (AVG) and the EU AI Act come into play. It runs the Praxikon case check: fixed rules over fixed answers, the same rules as the case check on the site. It returns per law (GDPR, AI Act, and where the two meet) each test with its outcome, the article and a source link, the DPIA and FRIA signal, the next steps and the facts that are still open. Fill in the answers yourself from what the user said, and ask the user for a fact that decides a test rather than guessing it. Leave out what is not known: it counts as unknown, never as no. Send only these coded answers and never the case text, names or other personal data; there is no field for them. Show the notice with the result. It does not build the implementation graph or the obligation list of one AI system.

Input Schema

Name	Required	Description	Default
`org`	No	What kind of organisation uses the system? Values: public = Government or public-law legal person (municipality, implementing agency, GGD, public university, public-authority school); public_service = Private organisation providing a public service (e.g. privately run school or college, care foundation, housing association); company = Company or other private organisation.	unknown
`lang`	No	Language of the result. Dutch is the default.	nl
`role`	No	What is the role of that organisation with regard to the AI system? Values: deployer = Uses a system from a supplier (deployer); provider = Develops it itself and places it on the market under its own name (provider); both = Develops it itself and also uses it itself (provider and deployer); gpai = Makes a general-purpose AI model, such as a language model, for others.	unknown
`scale`	No	Does it involve many people, or are people systematically monitored or observed? For example thousands of data subjects, all residents or customers, or continuous monitoring with cameras, location or software.	unknown
`domain`	No	What is the system used for? Areas of Annex III or Annex I of the AI Act. For other insurance than life or health, or for fraud detection, choose none. Values: public_benefits = Granting, reducing or recovering benefits, allowances or other public services; credit = Creditworthiness or credit score of natural persons; life_health_insurance = Risk assessment and pricing in life or health insurance only; emergency = Classifying emergency calls or emergency healthcare; employment = Recruitment, selection, evaluation or task allocation of staff; education = Admission, evaluation or monitoring of tests in education; biometrics = Biometric identification or categorisation of people; law_enforcement = Police and criminal investigation; migration = Migration, asylum or border control; justice = Administration of justice or elections; critical_infra = Safety component of critical infrastructure (energy, water, traffic); product = Part of a product with CE marking, such as a medical device; none = None of these.	unknown
`effect`	No	Does the outcome have legal effects or affect people significantly (benefit, job, loan, investigation, exam)?	unknown
`special`	No	Does it involve special categories of personal data (health, genetic, biometric, racial or ethnic origin, religion or belief, political opinion, trade union membership, sex life or sexual orientation)?	unknown
`aiSystem`	No	Is it an AI system: does it infer the outcome from data itself (machine learning, language model), rather than only applying fixed rules written by a human? Fixed rules drawn up by people, such as a calculation rule or a written-out decision tree, are not. A model trained on examples is, even if it stops learning once in use. An expert system that draws its own conclusions from encoded knowledge can be too.	unknown
`criminal`	No	Does it involve personal data relating to criminal convictions or offences, including a suspicion? Art. 10 GDPR: for example a criminal record, a criminal case, or a suspicion or report of an offence.	unknown
`transfer`	No	Do the data go to a country outside the European Economic Area, including via the supplier or a cloud?	unknown
`automated`	No	Is the decision about a person taken without a human assessing the case on its merits? Also yes if a human only sees part of it, such as the top ten, and the rest get a decision, such as a rejection, without human review. Merely not being selected for closer checks is no decision.	unknown
`frequency`	No	For how long and how often is the system used? Values: continuous = Continuously, with no end date: for every application or case, or every day; periodic = Periodically, with no end date: in fixed rounds, for example monthly or yearly; limited = For a limited period, such as a pilot or a one-off project.	unknown
`inService`	No	Was the system put into service or placed on the market before 2 December 2027? Also yes if it is in use now or goes into use before that date, or if the same type and model was on the EU market or in use before then (Recital 39 of Regulation (EU) 2026/1744). A significant change in its design or intended purpose afterwards makes it count as new.	unknown
`profiling`	No	Does the system produce a score, ranking or prediction about persons (profiling)? Scoring businesses (establishments, declarants, licence holders): yes only if sole traders or other natural persons are among them; only legal persons: no.	unknown
`interaction`	No	Does the system do one or more of these things? Values: chatbot = People talk or chat with it directly; generated = It creates text, images, audio or video; deepfake = It creates images, audio or video that look real (deepfake); emotion = It recognises the emotions or mood of people.
`apCategories`	No	Categories of the Dutch Data Protection Authority list of processing that requires a DPIA (Stcrt. 2019, 64418) that the facts confirm; leave out any the facts do not show.
`personalData`	No	Are personal data processed (data about identifiable people)?	unknown
`interactionKnown`	No	Whether interaction is settled, so that an empty list means none of these. Defaults to true when interaction is sent, false when left out; never false when interaction lists items.
`store_for_improvement`	No	Optional. Set to false when the user asks that Praxikon does not keep this request to improve its answers; nothing of this call is then kept beyond the anonymous daily count. See https://www.praxikon.com/nl/legal/privacy, section 2.7.

Output Schema

Name	Required	Description	Default
`dpia`	Yes
`fria`	Yes
`lang`	No
`laws`	Yes
`view`	Yes
`notice`	Yes
`sources`	No
`headline`	Yes
`law_date`	No
`left_out`	No
`provenance`	Yes
`answers_used`	No
`outcome_note`	No
`full_check_url`	Yes
`open_questions`	Yes
`outcome_labels`	No
`recommendations`	No
`transition_note`	No

Schema Changelog

Changes observed during successful MCP inspections.

Changed5 schema fields changedOct 27, 2026

changedInput schema / properties / aiSystem / description

Previous value: -"Is it an AI system: does it infer the outcome from data itself (machine learning, language model), rather than only applying fixed rules written by a human? A system that only applies fixed rules drawn up by people, such as a calculation rule or a written-out decision tree, is not an AI system. A model trained on examples is, even if it does not keep learning after it is put into use. An expert system that draws conclusions by itself from encoded knowledge can be an AI system too."New value: +"Is it an AI system: does it infer the outcome from data itself (machine learning, language model), rather than only applying fixed rules written by a human? Fixed rules drawn up by people, such as a calculation rule or a written-out decision tree, are not. A model trained on examples is, even if it stops learning once in use. An expert system that draws its own conclusions from encoded knowledge can be too."

changedInput schema / properties / apCategories / description

Previous value: -"Categories of the Dutch Data Protection Authority list of processing that requires a DPIA (Stcrt. 2019, 64418) that the facts of the case confirm. Leave out any category the facts do not show."New value: +"Categories of the Dutch Data Protection Authority list of processing that requires a DPIA (Stcrt. 2019, 64418) that the facts confirm; leave out any the facts do not show."

changedInput schema / properties / domain / description

Previous value: -"What is the system used for? These areas are listed in Annex III or Annex I of the AI Act. For other insurance than life or health, or for fraud detection, choose none. Values: public_benefits = Granting, reducing or recovering benefits, allowances or other public services; credit = Creditworthiness or credit score of natural persons; life_health_insurance = Risk assessment and pricing in life or health insurance only; emergency = Classifying emergency calls or emergency healthcare; employment = Recruitment, selection, evaluation or task allocation of staff; education = Admission, evaluation or monitoring of tests in education; biometrics = Biometric identification or categorisation of people; law_enforcement = Police and criminal investigation; migration = Migration, asylum or border control; justice = Administration of justice or elections; critical_infra = Safety component of critical infrastructure (energy, water, traffic); product = Part of a product with CE marking, such as a medical device; none = None of these."New value: +"What is the system used for? Areas of Annex III or Annex I of the AI Act. For other insurance than life or health, or for fraud detection, choose none. Values: public_benefits = Granting, reducing or recovering benefits, allowances or other public services; credit = Creditworthiness or credit score of natural persons; life_health_insurance = Risk assessment and pricing in life or health insurance only; emergency = Classifying emergency calls or emergency healthcare; employment = Recruitment, selection, evaluation or task allocation of staff; education = Admission, evaluation or monitoring of tests in education; biometrics = Biometric identification or categorisation of people; law_enforcement = Police and criminal investigation; migration = Migration, asylum or border control; justice = Administration of justice or elections; critical_infra = Safety component of critical infrastructure (energy, water, traffic); product = Part of a product with CE marking, such as a medical device; none = None of these."

changedInput schema / properties / interactionKnown / description

Previous value: -"Whether the answer to interaction is settled, so that an empty list means none of these. Defaults to true when interaction is sent and to false when it is left out; never false when interaction lists items."New value: +"Whether interaction is settled, so that an empty list means none of these. Defaults to true when interaction is sent, false when left out; never false when interaction lists items."

changedInput schema / properties / profiling / description

Previous value: -"Does the system produce a score, ranking or prediction about persons (profiling)?"New value: +"Does the system produce a score, ranking or prediction about persons (profiling)? Scoring businesses (establishments, declarants, licence holders): yes only if sole traders or other natural persons are among them; only legal persons: no."

Changed2 schema fields changedOct 27, 2026

changedInput schema / properties / inService / description

Previous value: -"Was the system put into service or placed on the market before 2 December 2027? Also yes if it is in use now, or goes into use before that date. This concerns this system in its current form: if its design changes significantly afterwards, it counts as new."New value: +"Was the system put into service or placed on the market before 2 December 2027? Also yes if it is in use now or goes into use before that date, or if the same type and model was on the EU market or in use before then (Recital 39 of Regulation (EU) 2026/1744). A significant change in its design or intended purpose afterwards makes it count as new."

changedInput schema / properties / org / description

Previous value: -"What kind of organisation uses the system? Values: public = Government or public body (municipality, implementing agency); public_service = Private organisation providing a public service (e.g. education, healthcare, housing association); company = Company or other private organisation."New value: +"What kind of organisation uses the system? Values: public = Government or public-law legal person (municipality, implementing agency, GGD, public university, public-authority school); public_service = Private organisation providing a public service (e.g. privately run school or college, care foundation, housing association); company = Company or other private organisation."

Changed1 schema field changedOct 23, 2026

addedInput schema / properties / store_for_improvement

Added value: +{
+  "default": true,
+  "description": "Optional. Set to false when the user asks that Praxikon does not keep this request to improve its answers; nothing of this call is then kept beyond the anonymous daily count. See https://www.praxikon.com/nl/legal/privacy, section 2.7.",
+  "type": "boolean"
+}

Changed4 schema fields changedOct 12, 2026

removedOutput schema / properties / expert_review

Removed value: -{
-  "required": [
-    "tool",
-    "text"
-  ],
-  "type": "object"
-}

addedOutput schema / properties / outcome_labels
```
Added value: +{
+  "type": "object"
+}
```
addedOutput schema / properties / outcome_note
```
Added value: +{
+  "type": "string"
+}
```

changedOutput schema / required

Previous value: -[
-  "view",
-  "headline",
-  "dpia",
-  "fria",
-  "laws",
-  "open_questions",
-  "notice",
-  "full_check_url",
-  "expert_review",
-  "provenance"
-]New value: +[
+  "view",
+  "headline",
+  "dpia",
+  "fria",
+  "laws",
+  "open_questions",
+  "notice",
+  "full_check_url",
+  "provenance"
+]

First observedOct 11, 2026

TDQS

A4.8/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare it is a safe read, but the description adds that results come from fixed rules over fixed answers, matching the website's check. It discloses the return contents (per-law tests with outcomes, article, source link, DPIA/FRIA signal, next steps, open facts) and an important privacy constraint: send only coded answers, never case text or personal data, and show the notice.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The trigger and purpose come first, then behavior, then the data-handling rule and the exclusion. It is dense and a couple of sentences are long, but nearly every sentence carries information an agent needs to call it correctly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 19 parameters, an output schema and rich annotations, the description covers trigger, exclusions, how to derive answers, unknown-handling, data minimization and the notice requirement. An agent has everything needed to call it without opening the schema, and return values are covered by the output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the enum definitions are already detailed, so the schema does most of the work. The description still adds real meaning by saying the agent must fill answers itself, must ask rather than guess when a fact decides a test, and must treat omitted facts as unknown rather than no.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: it runs the Praxikon case check over GDPR, AVG and the EU AI Act for a described intended use. It also names what it is not — it does not build the implementation graph or the obligation list of one AI system — which separates it from get_applicable_obligations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The opening clause gives the exact trigger (user describes a concrete intended use and wants to know whether DPIA, FRIA or GDPR/AI Act duties apply), and the closing sentence excludes the obligation-list use case. It also gives operational guidance to ask the user for a deciding fact rather than guess.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Praxikon tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?