crosswalk_to_eu_ai_act
Map GDPR requirements to EU AI Act obligations. Determine where GDPR compliance satisfies, complements, or conflicts with AI Act requirements for EU AI deployments.
Instructions
Map GDPR requirements to EU AI Act obligations. Shows where GDPR compliance satisfies, complements, or creates tension with EU AI Act requirements. Essential for organizations deploying AI in the EU that must comply with both regulations simultaneously.
Args:
gdpr_articles: Specific GDPR articles to map (or all if omitted)
focus_area: Focus on "all", "transparency", "automated_decisions", "data_governance", or "risk"
caller: Caller identifier for rate limiting
tier: Access tier (free/pro)Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| gdpr_articles | No | ||
| focus_area | No | all | |
| caller | No | anonymous | |
| tier | No | free | |
| api_key | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |
Implementation Reference
- server.py:1027-1116 (handler)The handler function for the 'crosswalk_to_eu_ai_act' tool. Maps GDPR requirements to EU AI Act obligations using the GDPR_EU_AI_ACT_CROSSWALK dictionary, with filtering by specific GDPR articles or focus area (transparency, automated_decisions, data_governance, risk). Returns mappings with alignment assessment (strong, complementary, tension, partial) and key findings.
@mcp.tool() def crosswalk_to_eu_ai_act( gdpr_articles: Optional[list[str]] = None, focus_area: str = "all", caller: str = "anonymous", tier: str = "free", api_key: str = "") -> str: """Map GDPR requirements to EU AI Act obligations. Shows where GDPR compliance satisfies, complements, or creates tension with EU AI Act requirements. Essential for organizations deploying AI in the EU that must comply with both regulations simultaneously. Args: gdpr_articles: Specific GDPR articles to map (or all if omitted) focus_area: Focus on "all", "transparency", "automated_decisions", "data_governance", or "risk" caller: Caller identifier for rate limiting tier: Access tier (free/pro) """ allowed, msg, tier = check_access(api_key) if not allowed: return {"error": msg, "upgrade_url": "https://meok.ai/pricing"} if err := _check_rate_limit(caller, tier): return {"error": err} focus_filters = { "transparency": ["Art.13_14_transparency", "Art.22_automated"], "automated_decisions": ["Art.22_automated"], "data_governance": ["Art.5_principles", "Art.6_lawfulness", "Art.9_special_categories"], "risk": ["Art.35_dpia", "Art.33_breach", "Art.25_by_design"], } if gdpr_articles: target_keys = [k for k in GDPR_EU_AI_ACT_CROSSWALK if any(a.replace(".", "") in k for a in gdpr_articles)] elif focus_area in focus_filters: target_keys = focus_filters[focus_area] else: target_keys = list(GDPR_EU_AI_ACT_CROSSWALK.keys()) mappings = [] strong = 0 complementary = 0 tension = 0 partial = 0 for key in target_keys: if key not in GDPR_EU_AI_ACT_CROSSWALK: continue xw = GDPR_EU_AI_ACT_CROSSWALK[key] mappings.append({ "mapping_id": key, "gdpr_article": xw["gdpr"], "eu_ai_act_article": xw["eu_ai_act"], "alignment": xw["alignment"], "analysis": xw["note"], }) if xw["alignment"] == "strong": strong += 1 elif xw["alignment"] == "complementary": complementary += 1 elif xw["alignment"] == "tension": tension += 1 else: partial += 1 result = { "crosswalk_type": "GDPR to EU AI Act Regulatory Crosswalk", "timestamp": datetime.now(timezone.utc).isoformat(), "focus_area": focus_area, "mappings": mappings, "summary": { "total_mappings": len(mappings), "strong_alignment": strong, "complementary": complementary, "tension_points": tension, "partial": partial, }, "key_findings": [ "GDPR and EU AI Act are designed to work together — most obligations are complementary", "Article 10(5) EU AI Act creates a specific pathway for processing special categories for AI bias detection, partially derogating from GDPR Article 9", "GDPR DPIA and EU AI Act fundamental rights impact assessment can be conducted as integrated assessment", "Organizations already GDPR-compliant have a strong foundation for EU AI Act compliance", "Key tension: EU AI Act may require data retention for AI monitoring that conflicts with GDPR storage limitation", ], "recommendation": ( "Conduct an integrated compliance programme covering both GDPR and EU AI Act. " "Use GDPR DPIA as foundation for EU AI Act fundamental rights impact assessment. " "Pay special attention to Article 9/10(5) tension regarding bias monitoring data." ), } return result - server.py:1027-1028 (registration)The tool is registered via the @mcp.tool() decorator on the FastMCP instance named 'mcp' (line 62), which automatically registers it as an MCP tool named 'crosswalk_to_eu_ai_act'.
@mcp.tool() def crosswalk_to_eu_ai_act( - server.py:1028-1043 (schema)Input schema/parameters for the tool: gdpr_articles (optional list of GDPR articles), focus_area (with choices all/transparency/automated_decisions/data_governance/risk), caller, tier, and api_key for auth.
def crosswalk_to_eu_ai_act( gdpr_articles: Optional[list[str]] = None, focus_area: str = "all", caller: str = "anonymous", tier: str = "free", api_key: str = "") -> str: """Map GDPR requirements to EU AI Act obligations. Shows where GDPR compliance satisfies, complements, or creates tension with EU AI Act requirements. Essential for organizations deploying AI in the EU that must comply with both regulations simultaneously. Args: gdpr_articles: Specific GDPR articles to map (or all if omitted) focus_area: Focus on "all", "transparency", "automated_decisions", "data_governance", or "risk" caller: Caller identifier for rate limiting tier: Access tier (free/pro) """ - server.py:268-323 (helper)The GDPR_EU_AI_ACT_CROSSWALK dictionary containing the mapping data between GDPR articles and EU AI Act articles, used by the crosswalk_to_eu_ai_act handler.
GDPR_EU_AI_ACT_CROSSWALK = { "Art.5_principles": { "gdpr": "Article 5 — Data protection principles", "eu_ai_act": "Article 10 — Data and data governance", "alignment": "strong", "note": "GDPR data quality principles (accuracy, minimisation) directly map to EU AI Act data governance requirements for training, validation and testing datasets.", }, "Art.6_lawfulness": { "gdpr": "Article 6 — Lawful basis for processing", "eu_ai_act": "Article 10(2) — Training data requirements", "alignment": "complementary", "note": "EU AI Act requires lawful data collection for training sets. GDPR lawful basis is a prerequisite for compliant AI training data.", }, "Art.9_special_categories": { "gdpr": "Article 9 — Special categories of data", "eu_ai_act": "Article 10(5) — Processing of special categories for bias detection", "alignment": "tension", "note": "EU AI Act Article 10(5) explicitly permits processing special categories for bias monitoring, creating a specific derogation pathway from GDPR Article 9 restrictions. Requires strict safeguards.", }, "Art.13_14_transparency": { "gdpr": "Articles 13-14 — Transparency obligations", "eu_ai_act": "Article 13 — Transparency and information to deployers", "alignment": "strong", "note": "Both require transparency about AI processing. EU AI Act adds technical documentation and instructions for use. GDPR focuses on individual notice.", }, "Art.22_automated": { "gdpr": "Article 22 — Automated decision-making", "eu_ai_act": "Article 14 — Human oversight, Article 26(3) — Deployer obligations", "alignment": "strong", "note": "GDPR Article 22 right to human intervention aligns with EU AI Act human oversight requirements. EU AI Act goes further requiring human oversight by design.", }, "Art.25_by_design": { "gdpr": "Article 25 — Data protection by design and by default", "eu_ai_act": "Article 9 — Risk management system", "alignment": "complementary", "note": "Privacy-by-design aligns with EU AI Act risk management. Both require proactive measures. EU AI Act extends to broader AI risks beyond data protection.", }, "Art.35_dpia": { "gdpr": "Article 35 — Data Protection Impact Assessment", "eu_ai_act": "Article 27 — Fundamental rights impact assessment", "alignment": "strong", "note": "GDPR DPIA maps to EU AI Act fundamental rights impact assessment. Organizations deploying high-risk AI may satisfy both through an integrated assessment.", }, "Art.33_breach": { "gdpr": "Article 33 — Notification to supervisory authority", "eu_ai_act": "Article 62 — Reporting of serious incidents", "alignment": "complementary", "note": "GDPR 72-hour breach notification requirement parallels EU AI Act serious incident reporting. AI incidents may trigger both notification obligations simultaneously.", }, "Art.44_transfers": { "gdpr": "Articles 44-49 — International transfers", "eu_ai_act": "Article 2(7) — Territorial scope", "alignment": "partial", "note": "GDPR international transfer rules affect AI systems processing EU personal data abroad. EU AI Act has its own territorial scope covering AI systems placed on EU market.", }, }