How our EU AI Act classification works

Classifications are produced by a rules engine that maps a system onto a structured reading of the EU AI Act, not by a language model. The same inputs always produce the same output, so a verdict never changes phrasing or conclusion between runs.

There is no LLM, no network call and no randomness in the classification path, and this is enforced by an automated test, not just a policy. The web app, the API, the CLI and the developer tooling all call the same engine, so results never diverge across surfaces.

Every output links to its exact article. Each obligation and each risk tier deep-links into Regulation (EU) 2024/1689 on EUR-Lex, so a compliance officer or their counsel can verify a verdict against the law itself.

The rules corpus is versioned. Every change is dated and published to a public changelog, and each classification is stamped with the engine version that produced it.

When the rules change, existing systems are re-classified automatically. A change that raises a risk tier is held for human review before it goes live, and every published change generates a dated, plain-language notice of what changed and why.

Because classification is deterministic code and not a language model, your system inventory, its purpose and its data categories are never sent to OpenAI, Anthropic or any third-party AI service, for training or for inference. No model ever sees your compliance data.

The classification path makes no external call at all, so you do not have to take our word for it. The same engine ships in our command-line tool and MCP server (published on npm) and produces byte-identical results offline, on your own machine, air-gapped if you want. You can reproduce any verdict yourself.

Your compliance records are stored in the EU (Frankfurt). Nothing in the classification path hands them to a third-party AI service, so the sensitive question — who else sees your compliance posture — has a simple answer: no model, and no one outside the engine that classifies it.