eu-ai-act-mcp

EU AI Act MCP Server

Connect to Claude (Anthropic's connectors directory)

An open-source Model Context Protocol (MCP) server that gives LLMs structured intelligence about the EU AI Act (Regulation (EU) 2024/1689, as amended by the Digital Omnibus, Regulation (EU) 2026/1744).

Built by Lexbeam Software - an agentic AI implementation boutique for regulated workflows.

Listed use, not sector

Annex III regulates uses, not sectors. Set signals.domain to an Annex III area only when the system itself performs a use listed there; a system that merely operates in that sector gets "other". Two calls to euaiact_classify_system, both for systems in the employment sector:

In the sector, not a listed use. Returns limited (Art. 50(1) transparency).

{
  "description": "An HR chatbot answers employees' questions about the holiday policy and where to find the travel expense form.",
  "signals": { "domain": "other", "interacts_with_natural_persons": true }
}

A listed use. Returns high-risk (Annex III(4)).

{
  "description": "Our ATS screens incoming CVs against the job spec and auto-rejects anyone missing the right keywords before a recruiter looks.",
  "signals": { "domain": "employment" }
}

The classifier trusts the signal: the same chatbot sent with "domain": "employment" comes back high-risk. Leave domain out when the description does not tell you which it is.

What's new in 1.7.3

The first harmonised standard under the AI Act is in the server. On 14 October 2026 the Official Journal published the reference of EN 18286:2026, Artificial intelligence - Quality management system for EU AI Act regulatory purposes (Commission Implementing Decision (EU) 2026/2274, in force that day).

• euaiact://standards: the harmonised standards with an Official Journal reference, what each covers and does not cover, the standardisation areas still without one, and the status of the Commission's high-risk classification guidelines (draft), Art. 50 guidelines (final) and transparency code of practice (found adequate).
• Art. 40 in euaiact_get_article, and Art. 6, 17, 43 and 50 summaries that state the new status.
• A corrected Art. 43 route: biometric systems under Annex III point 1 may use internal control (Annex VI) only where harmonised standards or common specifications were applied for the Chapter III, Section 2 requirements. EN 18286 covers Art. 17, not Section 2, so as of 20 October 2026 a notified body (Annex VII) remains their route.
• Two FAQ answers: which harmonised standards exist (and why ISO/IEC 42001 gives no presumption of conformity under the AI Act), and what the Art. 17 quality management system requires.

Full release history: CHANGELOG.md.

Quick Start

Claude, one click

The hosted server is listed in Anthropic's connectors directory as a community connector: claude.ai/directory/lexbeam-eu-ai-act. Open the listing and connect; it works in claude.ai, the Claude apps and Cowork. No account with Lexbeam and no API key are needed. The same server answers at https://mcp.lexbeam.com/mcp for any other MCP client (below).

npx (no install)

npx -y @lexbeam-software/eu-ai-act-mcp

Claude Desktop

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "eu-ai-act": {
      "command": "npx",
      "args": ["-y", "@lexbeam-software/eu-ai-act-mcp"]
    }
  }
}

Any other MCP client

Direct MCP endpoint: https://mcp.lexbeam.com/mcp (health check at /health). Open, no auth required. The front page at mcp.lexbeam.com has the tools and how to connect, and /llms.txt the same facts as plain text.

From source

git clone https://github.com/lexbeam-software/eu-ai-act-mcp.git
cd eu-ai-act-mcp
npm install
npm run build
npm start        # stdio transport
npm run start:http  # streamable HTTP (as hosted on Railway)

First successful calls

For the hosted server, add https://mcp.lexbeam.com/mcp as a remote Streamable HTTP MCP server in your client. It requires no API key. The package also supports the local stdio command above. Send the negotiated MCP-Protocol-Version header on subsequent HTTP requests; browser clients can preflight that header.

Start with euaiact_get_article and {"article":"Artikel 4"} to retrieve the existing Article 4 summary and its official source link. 4, Art. 4, and Article 4 are equivalent whole-article lookups. Summaries are not statutory text.

euaiact_answer_question searches curated FAQs. For example, {"question":"Welche Pflichten zur KI-Kompetenz gelten nach Artikel 4?"} routes to the literacy FAQ. Answers remain in English. Check match_status: matched identifies the accepted matched_question; no_match contains guidance instead of a FAQ answer and may identify a rejected candidate_question. Confidence is match confidence, not a probability that a legal conclusion is correct.

For the structured assessment, use the complete, syntactically valid minimum profile as the arguments to euaiact_assess_system. It is synthetic and intentionally leaves unconfirmed facts out. Replace its assertions only with facts the user supplied; do not copy the example's answers into a real assessment. Read missing_facts, legal_classification.limitations, and recommended_next_calls, even when the status is determined. Ask the relevant questions, add fact objects with unique IDs, and call euaiact_assess_system again to update all three result blocks. A minimal profile is not a complete assessment.

For the simpler classifier, missing_signals includes unprovided optional context. It does not mean all listed fields must be collected before reporting a matched route. Use next_questions for follow-up guidance. A matched high-risk route does not establish that every prohibited-practice or other route was ruled out.

All tools reject unknown argument names, including nested objects, consistently with their advertised closed input schemas. Correct a misspelled field rather than retrying it silently. Omitted optional fields and documented defaults work as before.

Tools

Tool	Description
euaiact_classify_system	Classify an AI system's risk level (prohibited / high-risk / limited / minimal) from structured signals that the calling agent derives from the user's description; free text alone is a keyword fallback. Returns matched signals, missing signals, and follow-up questions.
euaiact_check_deadlines	Implementation milestones with days remaining, next_milestone shortcut, only_upcoming filter, and the enacted Digital Omnibus (Regulation (EU) 2026/1744) status.
euaiact_get_obligations	Specific compliance obligations by role (provider/deployer) and risk level, including GPAI (Art. 51-56) and universal AI literacy (Art. 4).
euaiact_answer_question	Keyword FAQ search (lexical matching with stopword filtering, tie handling and abstention) across 27 curated EU AI Act questions; echoes your question and names the matched entry.
euaiact_calculate_penalty	Calculate maximum fines by violation type, turnover, SME status (Art. 99(6)) and SMC status (Art. 99(6a), tiers 99(4)-(5) only), with a comparative non-SME vs SME block.
euaiact_get_article	Retrieve an operational summary and EUR-Lex URL for a specific article. Covers 29 curated articles between Art. 3 and Art. 113 (including the new Art. 4a and Art. 40 on harmonised standards), not the full act.
euaiact_check_gpai_systemic_risk	Check whether a GPAI model crosses the 10²⁵ FLOPs threshold and return Art. 53 + Art. 55 obligations plus the Art. 52 notification duty.
euaiact_assess_art6_3_exception	Walk through the Art. 6(3) "no significant risk" exception with explicit profiling block and Art. 6(4) / Art. 49(2) reminders.
euaiact_annex_iv_checklist	Return all nine Annex IV technical-documentation items, optionally as a markdown checklist.
euaiact_assess_system	Assess a normalized system profile with separate legal-classification, qualitative-impact, and evidence-readiness blocks. Sparse decisive facts fail closed; every finding carries fact IDs and official provenance.

Resources

URI	Description
euaiact://timeline	Key implementation milestones of the EU AI Act.
euaiact://risk-levels	Overview of the four risk categories.
euaiact://annex/iii	Full Annex III high-risk AI categories (1-8) with descriptions, examples, and article references.
euaiact://annex/iv	Full Annex IV technical-documentation items (1-9).
euaiact://omnibus	The Digital Omnibus on AI (Regulation (EU) 2026/1744) as enacted: amended dates, deltas, and source status per item.
euaiact://standards	Harmonised standards with an Official Journal reference (so far EN 18286:2026 for the Art. 17 quality management system, published 14 October 2026), the standardisation areas still without one, and the status of Commission guidelines and codes of practice.

Prompts

• classify-my-system - guided classification using euaiact_classify_system with signal inference
• compliance-checklist - risk-level + role obligations checklist, including Annex IV for high-risk
• penalty-risk-assessment - penalty calculation with SME comparative
• ground-citation - retrieve an operational summary + EUR-Lex URL, then verify definitive wording in the official source before quoting

Knowledge Base

Curated, structured data covering:

• 8 Annex III high-risk categories with keyword matching and examples
• 10 prohibited AI practices: Art. 5(1)(a)-(h), plus (ba) and (bb) applying from 2 December 2026
• Art. 6(3) exception conditions with the profiling block rule
• Art. 50 transparency triggers (chatbots, deepfakes, emotion recognition, machine-readable marking)
• 8 implementation milestones with dynamic days-remaining calculation
• Digital Omnibus (enacted) status and impact assessment
• Provider obligations (13 for high-risk, 8 for GPAI including Art. 53 + Art. 55)
• Deployer obligations (9 for high-risk)
• Limited-risk transparency obligations (4 under Art. 50)
• Universal AI literacy (Art. 4)
• Penalty framework with SME protection logic (Art. 99)
• 27 FAQ entries with article references
• 29 article summaries with EUR-Lex URLs to the consolidated text
• Harmonised standards and guidance status: EN 18286:2026 (Art. 17) with its OJ reference, the open standardisation areas, and the status of the draft high-risk classification guidelines, the Art. 50 guidelines and the transparency code of practice
• Annex IV (9 documentation items) (new in 1.1.0)

Load-bearing dates, thresholds, amounts and exceptions are checked on every build by a claim matrix (test-claims.mjs) against a pinned, hash-verified copy of the consolidated act (law/), which since 1.7.3 also holds Commission Implementing Decision (EU) 2026/2274, the act that published the first harmonised standard reference. Coverage is the matrix, not a blanket claim.

Regulatory Accuracy

This server tracks the current state of the EU AI Act (Regulation 2024/1689) as amended by the Digital Omnibus on AI, Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026 and in force from 27 July 2026. The amended application dates are served as operative law. Article-level wording was verified against the enacted OJ text on 26 and 27 July 2026, delta by delta against the 43 numbered amendments in Article 1 of the amending act. No Omnibus delta was left unresolved in that reconciliation. The Art. 49 registration duty for self-assessed not-high-risk systems, previously carried as unresolved, SURVIVES: the enacted act does not amend Art. 49 and deletes only Annex VIII Section B points 7 and 9.

Operative dates as amended:

• 2 Feb 2025 - Prohibited practices (Art. 5) + AI literacy (Art. 4), in effect
• 2 Aug 2025 - GPAI model obligations, in effect
• 2 Aug 2026 - Art. 50 transparency, and Commission GPAI enforcement powers and fines. Not deferred
• 2 Dec 2026 - The two new Art. 5 prohibitions (non-consensual intimate material, CSAM), and the Art. 111(4) deadline for synthetic-content systems already on the market to meet Art. 50(2)
• 2 Aug 2027 - Legacy GPAI models (Art. 111(3)), unchanged
• 2 Dec 2027 - High-risk Annex III obligations. Deferred from 2 Aug 2026
• 2 Aug 2028 - High-risk Annex I regulated products. Deferred from 2 Aug 2027

Harmonised standards: on 14 Oct 2026 Commission Implementing Decision (EU) 2026/2274 published the reference of EN 18286:2026, the quality management system standard for Art. 17; per the Commission it gives a presumption of conformity with the Art. 17 requirements it covers from that day. Applying it is voluntary, and no harmonised standard covers the Chapter III, Section 2 requirements yet. Reviewed on 20 October 2026 against the decision (pinned in law/) and the Commission's AI Act pages of 19 October 2026; euaiact://standards carries the details and the review date.

Development

npm install
npm run build        # typescript -> dist/
node test.mjs         # full suite incl. ten agent journeys
node test-claims.mjs  # 154-check matrix: pinned law corpus vs served facts
node test-schemas.mjs # post-serialization output-schema gate
node law/fetch.mjs verify # verify all 5 pinned legal documents
npm --prefix compiler test # deterministic compiler: 6 tests
node evals/front-door/score.mjs evals/front-door/agent-args-1.6.0.json # the front door, measured
npm run dev          # stdio dev server
npm run dev:http     # HTTP dev server

Privacy

The hosted endpoint https://mcp.lexbeam.com/mcp runs statelessly: it receives the tool arguments your assistant sends and the request data (IP address, time, URL, user agent), stores no tool arguments or results, sets no cookies and runs no analytics. It is hosted by Railway. Run the server locally from npm and nothing reaches Lexbeam. Full policy: PRIVACY.md.

Disclaimer

This MCP server is a structured information tool that returns references to and summaries of Regulation (EU) 2024/1689. It provides general information only and does not constitute legal advice. Whether a service falls within a national regulated legal-services regime must be verified against current official sources and, where necessary, with qualified local counsel. This tool cannot replace that review, and its use does not establish a lawyer-client relationship. For implementation support, visit lexbeam.com/kontakt.

License

MIT. See LICENSE. Regulation text summarised in src/knowledge/articles.ts and src/knowledge/annex-iv.ts is derived from Regulation (EU) 2024/1689 as amended; src/knowledge/standards.ts summarises Commission Implementing Decision (EU) 2026/2274 and the Commission's AI Act pages. EUR-Lex, Official Journal and Commission content is reused under the conditions of Commission Decision 2011/833/EU (preserve attribution, do not distort the meaning of the source). The text of EN 18286 is not reproduced; CEN and CENELEC distribute it through the national standardisation bodies.

About Lexbeam

Lexbeam Software builds agentic AI for compliance, legal operations, internal audit, and risk workflows.

Give us one ugly, regulation-heavy workflow. We'll turn it into a working AI system fast.