EU AI Act Risk Assessment

Classify your AI system's risk level under the EU AI Act. Risk classification, obligations, and supervisory authority.

3 steps x402 eligible ai-act-assess

What it runs

EU AI Act Classification
Source: Algorithmic (rule-based classification against EU AI Act Annex III, Articles 5/6/50)
Data Protection Authority Lookup
Source: Static database (EU/EEA Data Protection Authority registry)
GDPR Fine Lookup
Source: GDPR Enforcement Tracker (public enforcement database)

The answer returns every step’s result, so your agent can show or check each one.

Inputs

Field	Type	Required	What it is
`company`	string	No	—
`description`	string	Yes	Describe what your AI system does
`deployment_country`	string	Yes	ISO 3166-1 alpha-2 country code

How to call it

# Needs an API key. The whole check is charged once, at the listed price.
curl -X POST https://api.strale.io/v1/solutions/ai-act-assess/execute \
  -H "Authorization: Bearer $STRALE_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{
    "inputs": {
      "company": "Kry",
      "description": "AI system that triages patient symptoms and recommends urgency level for GP appointments",
      "deployment_country": "SE"
    },
    "max_price_cents": 80
  }'

# No account. The first request answers 402 with the price in USDC;
# an x402 client pays it from your wallet and repeats the request.
curl -i -X POST https://api.strale.io/x402/v2/solutions/ai-act-assess \
  -H 'Content-Type: application/json' \
  -d '{
    "company": "Kry",
    "description": "AI system that triages patient symptoms and recommends urgency level for GP appointments",
    "deployment_country": "SE"
  }'

The bundle’s published example input.

Limitations

Classification is guidance only — official EU AI Act risk categorisation requires legal analysis
From step: EU AI Act Classification
What to do instead: Use the classification output as a starting point for legal review — include the returned risk factors in your compliance documentation
Based on AI Act text as of latest published version — implementing regulations may change interpretation
From step: EU AI Act Classification
What to do instead: Monitor the EU AI Office website for delegated acts and compare against the version_date field in the response
Covers all EU/EEA member state DPAs — does not include sub-national authorities (e.g., German Länder DPAs)
From step: Data Protection Authority Lookup
What to do instead: For German entities, map the company's registered state to the corresponding Landesdatenschutzbeauftragter via datenschutz.de
Fine database updated weekly — recently announced fines may take up to 7 days to appear
From step: GDPR Fine Lookup
What to do instead: Check the relevant data protection authority’s press releases for recently announced fines.
Covers publicly reported fines only — some national DPAs delay publication
From step: GDPR Fine Lookup
What to do instead: Supplement with the target company's own regulatory disclosure filings, which may reference unpublished penalties
Structured output is limited to about 2000 output tokens per call; requests exceeding this limit are refused rather than returned truncated. Requests with large results can exceed this limit, and repeating the same request does not help.
From step: GDPR Fine Lookup
What to do instead: Narrow the search (specific company or country) so fewer fines are returned per call