AI Act Check
An API AI agents pay 60 cents to check their code against the EU AI Act.
A case study. Built at the Stripe MPP Hackathon Dublin on 10 Nov 2026, in a 90-minute build slot, with four Devin sessions in parallel and Claude Code as reviewer. Ranked 1st on the leaderboard.
Open the live demo (a replay with sample data, nothing is paid) · Try the real API with your agent · Open the design system · Run it yourself
Contents: The problem · Research · What it does · Results · Preparation · The build · Design system · What went wrong · What I learned · Run it yourself
The problem
Every team shipping AI in the EU has the same question about each feature: is this banned, high-risk, a transparency case, or fine? The answer decides a lot:
- Banned practices (emotion recognition at work, social scoring) have applied since February 2025, with fines up to EUR 35M or 7% of turnover.
- High-risk systems (CV screening, credit scoring, grading students) carry duties for whoever deploys them: human oversight, logs, informing workers, impact assessments. The 2026 AI Omnibus moved those dates to 2 December 2027. Delayed, not cancelled.
- Transparency cases (chatbots, deepfakes) must tell people they're dealing with AI.
- GDPR comes along as soon as people's data is involved: lawful basis, impact assessment, the right not to be decided about by a machine alone.
Today the answer comes from a consultant, a week later, or from a 400-page regulation nobody reads. Meanwhile the code is being written by agents, at a speed no review process keeps up with.
The compliance check happens after the code ships, by a human. We moved it to the moment the agent writes the code, and let the agent pay for it.
Research
What already exists. Online AI Act compliance checkers (the best known is the Future of Life Institute's) and vendor questionnaires: web forms for humans, one session at a time, with a summary at the end. Law firms sell the same answer as advice. None of it can be called by an agent in the middle of a task, and none of it is priced per question.
Who it's for. The coding agent first, and through it the small business that has no compliance team. Every answer has to work for both: structured JSON with articles and dates for the agent, and a tier in plain words ("Allowed, with strict duties.") for the person reading over its shoulder.
The limits we chose. A rule engine, not a model. The verdict is only as good as the answers the agent gives, so the rules had to be deterministic and cited, so that a wrong verdict can be traced to a wrong answer, never to a model's mood:
- Rule-based, no LLM in the verdict. Same answers, same verdict, every time. Every matched rule and every duty cites its article.
- Free discovery, paid verdict. The questionnaire is free. Bad input is rejected before the 402, so an agent never pays for an answer it can't use.
- Nothing about the use case is stored. The receipts log holds time, tier, amount and receipt id.
- Not legal advice. The disclaimer ships in every verdict. Anything relying on the Art. 6(3) exception or police biometrics needs a lawyer.
What I didn't build. Free-text classification with a model (cheaper to build, impossible to audit), accounts and API keys (MPP makes them unnecessary), and other laws (Chile's Ley 21.719 is next). The hackathon brief was "build something agents pay for"; a compliance verdict is something an agent genuinely needs at a precise moment and can't produce itself without the risk of making it up.
What it does
An agent reads 33 free questions, maps the use case it's working on to answers, and calls POST /classify. The server answers HTTP 402 with a price. The agent pays over Stripe's Machine Payments Protocol (MPP) and retries with proof. The rules engine returns the verdict with a receipt, the verdict lands on a live screen, and the agent saves a compliance record in its project.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
