For product teams
Ask before building
A product manager describes the planned feature in plain language and gets the verdict, what blocks the build, what is required before the build and what is already covered, with next steps.
GDPR · EU AI Act
Know whether a product feature meets the GDPR and the EU AI Act before building it.
An AI agent for a first compliance assessment. Describe a product feature and it drafts an assessment against the GDPR and the EU AI Act.
A demonstration, not legal advice. The hosted demo runs on free tiers and may take a minute to wake up. Please enter no real personal data; see the privacy notice.
For the Data Protection Officer
Decide and keep the record
The DPO reviews each draft in a queue: amend, approve, request changes to the feature, or reject.
What it does
Full assessment
Describe a feature; get a structured draft.
VerdictProceed · with conditions · Do not build
Findings with severityBlocker · Required · Covered
Flagshigh-risk AI · DPIA required
Citationseach one checked against the law's text
Highlights
Two agents
Worker
searches the law in a grade-and-retry loop (agentic RAG), calls tools through a role gate, drafts the assessment
Reviser
takes over after the DPO requests changes: reads the product manager's revised feature and drafts version 2
Human in the loop
The agent pauses; the DPO has the last word.
Pause
every full assessment stops at a checkpoint and waits for review
Decision
approve · request changes · reject, after editing severities and wording; the DPO's decision resumes the run
Memory
Organisation
facts and lessons from the DPO's rulings, read by the agent at the start of every run; what is remembered is chosen by the DPO, never taken from the feature text
Person
each user's own preferences for future assessments, saved by the user
Processing register
Written on approval only
the DPO's approval is the one action that creates a record
What it holds
title, verdict, risk level, DPIA, AI Act class, who requested and who approved
How well does it work?
Seven evaluation sets with 100 synthetic inputs, run against the deployed configuration on 27 October 2026 (retrieval re-run on 3 November). Scored three ways: exact rules against the test data; an AI judge with a rubric, from a model family the app never uses; and a blind human check of five cases.
High-risk AI flag right
20 of 20
full assessments over eight legal areas
Dangerous misses
0
no case that expected Do not build got Proceed
What agentic RAG buys over plain RAG
+19 % recall
higher retrieval recall with agentic RAG than with a single retrieval pass
Faithfulness of the full assessment
0.85
how far the findings rest on the retrieved law
Where it falls short: the right finding sometimes sits one severity step too high or too low, and the verdict field is stricter than the findings beneath it. Read the full report.
Compliant and secure
A compliance tool has to practise what it checks. Every statement below can be verified in the public repository: the code, the model configuration and the gateway's documents and settings saved as evidence.
01
Personal data never reaches a model
The input screen redacts e-mail addresses, phone numbers, bank account and card numbers before any model call.
02
Zero data retention at the model providers
The gateway account allows only zero-retention endpoints and no training on requests, and every request carries that policy itself; a reranker that could not meet it was replaced.
03
Data stays in the EU, and not for long
The database is hosted in Frankfurt. Conversations and their saved state are deleted after 30 days by a scheduled job, and a person can have their data deleted on request.
04
Roles and a tool gate
Product manager and DPO see different screens and the agent may call only the tools the signed-in role allows.
05
Guardrails on the way in and out
Prompt injections and off-topic text are refused at the door; every citation in a draft is checked against the law's text, the output gets a disclaimer, and the evaluation caught 14 of 14 planted inputs.
06
Secure sign-in and a public privacy notice
Sign-in through Google with PKCE and a signed eight-hour session. The privacy notice, public in the app, says what is collected, where it goes and how to ask for deletion.
Under the hood
Python 3.12
LangGraph
LangChain
FastAPI
PostgreSQL + pgvector
Next.js + React + TypeScript
OpenRouter
Google sign-in (OIDC)
Docker
Render + Neon
GitHub Actions
78 automated tests
Models
LLMsGPT-6 Luna (OpenAI) for assessments, quick answers and the retrieval grader; Gemini 3.1 Flash Lite (Google) for input screening, query rewrites, summaries and re-ranking
Embedding modeltext-embedding-3-small (OpenAI), 1,536 dimensions, stored in pgvector
Classification modelTypeSafe Jev Router routes each request: quick answer, full assessment or reject
Hybrid retrieval over the two regulations (vector and keyword search, fused, then re-ranked), a tool gate that limits what each role may call, a checkpointer that makes the human pause durable, and long-term memory in the same database. The repository has the technical design, the UI notes, the evaluation method and the compliance evidence.