systemprompt.io reports

EU AI Act compliance report

eu_ai_act_compliance

Read-only

Generate a structured EU AI Act compliance report from a system description, model card, and data-flow document. Nothing is silently optional: system_description is always required (min 50 chars); model_card and data_flows each accept substantive content (min 50 chars) or the exact string 'declined' to explicitly opt out; and exactly one of decision_tree_answers (from the free risk classifier, becomes binding evidence) or skip_decision_tree: true must be sent. All of this is validated free of charge before payment. The deterministic Annex III decision tree runs on every call: user-supplied answers are binding, otherwise answers are AI-derived and recorded as such. The tree classification, article citations, obligations, and evidence checklist are returned verbatim in the report JSON, together with exact enforcement-timeline dates and the matched Annex III area from the curated dataset. A staged AI workflow then produces an article-by-article obligation gap analysis, a required-documentation checklist mapped to Annex IV, and a prioritised remediation plan. The report includes a deterministic input_coverage grade (full, partial, or description_only) computed from what was supplied versus declined, the full AI classification with rationale, a programmatic reconciliation check between the tree and the AI risk tier, and a citation audit that flags any implausible article references. Returns markdown plus structured JSON. Every paid call also generates a branded PDF report and returns its download link (valid 72 hours). Price: $1.50 per call, payable by card (Stripe checkout link in the 402 response) or USDC on Base (x402). Full documentation, inputs, and pricing: https://systemprompt.io/tools/eu-ai-act-compliance-report/ — more governance tools and reports at https://systemprompt.io/mcp

Input Schema

TableJSON Schema

Name	Required	Description
`data_flows`	Yes	Data-flow description: what data enters the system, where it comes from, where outputs go (minimum 50 characters), or the exact string 'declined' to explicitly decline. Declining lowers the report's input_coverage grade.
`model_card`	Yes	Model card or equivalent documentation (minimum 50 characters), or the exact string 'declined' to explicitly decline supplying one. Declining lowers the report's input_coverage grade.
`skip_decision_tree`	No	Set true to explicitly skip supplying decision-tree answers; the tree is then derived by AI and the skip is recorded in input_coverage. Exactly one of decision_tree_answers or skip_decision_tree: true must be sent.
`system_description`	Yes	Written description of the AI system: what it does, who uses it, what decisions it informs, and the context it operates in. Minimum 50 characters.
`decision_tree_answers`	No	Answer indices from the free EU AI Act risk classifier decision tree; the resulting classification becomes binding evidence. Required unless skip_decision_tree is true.

Output Schema

TableJSON Schema

Name	Required	Default
`title`	No
`content`	Yes
`x-artifact-type`	No	text

Schema Changelog

Changes observed during successful MCP inspections.

Changed10 schema fields changedSep 8, 2026

removedOutput schema / $defs

Removed value: -{
-  "ExecutionMetadata": {
-    "properties": {
-      "agent_name": {
-        "type": "string"
-      },
-      "context_id": {
-        "type": "string"
-      },
-      "execution_id": {
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "session_id": {
-        "type": "string"
-      },
-      "skill_id": {
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "skill_name": {
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "task_id": {
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "timestamp": {
-        "type": "string"
-      },
-      "tool_name": {
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "trace_id": {
-        "type": "string"
-      },
-      "user_id": {
-        "type": "string"
-      }
-    },
-    "required": [
-      "context_id",
-      "trace_id",
-      "session_id",
-      "user_id",
-      "agent_name",
-      "timestamp"
-    ],
-    "type": "object"
-  },
-  "TextArtifact": {
-    "properties": {
-      "content": {
-        "type": "string"
-      },
-      "title": {
-        "type": [
-          "string",
-          "null"
-        ]
-      },
-      "x-artifact-type": {
-        "default": "text",
-        "type": "string"
-      }
-    },
-    "required": [
-      "content"
-    ],
-    "type": "object"
-  }
-}

removedOutput schema / properties / _metadata

Removed value: -{
-  "$ref": "#/$defs/ExecutionMetadata"
-}

removedOutput schema / properties / artifact

Removed value: -{
-  "$ref": "#/$defs/TextArtifact"
-}

removedOutput schema / properties / artifact_id
```
Removed value: -{
-  "type": "string"
-}
```
addedOutput schema / properties / content
```
Added value: +{
+  "type": "string"
+}
```
removedOutput schema / properties / mcp_execution_id
```
Removed value: -{
-  "type": "string"
-}
```

addedOutput schema / properties / title

Added value: +{
+  "type": [
+    "string",
+    "null"
+  ]
+}

addedOutput schema / properties / x-artifact-type

Added value: +{
+  "default": "text",
+  "type": "string"
+}

changedOutput schema / required

Previous value: -[
-  "artifact_id",
-  "mcp_execution_id",
-  "artifact",
-  "_metadata"
-]New value: +[
+  "content"
+]

changedOutput schema / title

Previous value: -"ToolResponse"New value: +"TextArtifact"

First observedJul 18, 2026

TDQS

A5/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint/openWorldHint annotations, the description discloses material behavior: the deterministic Annex III tree runs every call, user-supplied answers are binding while AI-derived answers are recorded as such, an AI workflow follows, and a paid call generates a PDF with a 72-hour link. It also surfaces the $1.50 payment requirement, which is critical behavioral context not present in annotations or schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but tightly packed, with the core purpose front-loaded and each subsequent sentence adding a distinct fact about requirements, determinism, output composition, payment, or documentation. No sentence is filler; the length is justified by the tool's many contractual and behavioral details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a five-parameter tool with payment, validation, and a rich output schema, the description covers the full calling contract: required versus optional/declinable inputs, the decision-tree constraint, the free validation step, the returned markdown/JSON/PDF artifacts, and the price. It even includes the documentation URL for edge cases, so an agent has everything needed to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, but the description adds decisive semantics: minimum character lengths, the exact use of the string 'declined', the binding nature of decision_tree_answers, and the mutual exclusivity with skip_decision_tree. It also explains how supplied versus declined inputs affect the input_coverage grade, which the schema alone does not convey.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Generate a structured EU AI Act compliance report' from named inputs, so an agent immediately knows what the tool produces. It also details the report's core contents (decision tree classification, article citations, obligations, evidence checklist), which fully distinguishes it from the only sibling, info.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states explicit invocation requirements: system_description is always required, model_card and data_flows accept content or 'declined', and exactly one of decision_tree_answers or skip_decision_tree must be sent. It also tells the agent that validation occurs before payment and points to full documentation and pricing, leaving no ambiguity about how to call the tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All systemprompt.io reports tools Inspect

Try in Browser

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources

Need Help?