EU Compliance Questions in Your AI Assistant: Five Worked Examples With an MCP Server

How it works in one paragraph

The Model Context Protocol (MCP) is the standard way AI assistants call outside tools. When you ask a compliance question, the assistant picks a matching tool, fills in the facts from your question, and gets back a structured answer. The ClevSec tools are rules, not a language model: the same facts always give the same answer, from the same code as our website tools. Every answer carries its legal sources, the date we last checked them, a link to a guide and a disclaimer. Setup takes a minute: see Use ClevSec from your AI assistant.

The assistant still writes the final reply, so read the cited articles before you act on it. What the tool adds is a fixed rule under the reply and the references to check it against.

1. Does NIS2 apply to a 120-person transport company?

The assistant calls nis2_scope_check with the sector (Transport) and the headcount (120). The answer:

Field	Value
In scope	Yes
Category	Important
Size class	Medium
Reason	Medium-sized entity of an Annex I type: covered (Art. 2(1)) and important (Art. 3(2)), unless the member state designates it essential

It also returns three notes worth reading: size was judged on headcount only, and turnover and balance sheet figures can move the company up a class; partner and linked enterprises count towards size under Recommendation 2003/361/EC; and the activity must match one of the specific entity types listed for transport in Annex I, not just the sector name. A rail freight operator or a port operator matches; a company that only sells travel insurance does not.

More on the rules: Does NIS2 apply to my company?.

2. Is a 3-hour payment outage a major incident under DORA?

The question: our payment system, which supports a critical function, was down for 3 hours and 15% of clients were affected. The assistant calls dora_classify_incident. Under Commission Delegated Regulation (EU) 2024/1772, an incident is major when it affects critical services (Art. 6) and meets at least two materiality thresholds (Art. 8(1)(b)), or involves successful malicious unauthorised access that may cause data losses (Art. 8(1)(a)).

Test	Result	Reference
Critical services affected	Met: ICT services supporting critical or important functions	Art. 6(a)
Clients	Met: more than 10% of clients using the service	Art. 9(1)(a)
Duration and service downtime	Met: downtime longer than 2 hours for services supporting critical or important functions	Art. 9(3)
Reputational impact, geographical spread, data losses, economic impact	Not met, or not given	Art. 9(2), (4), (5)(a), (6)

Result: major, because critical services are affected and two thresholds are met. The tool then adds the reporting time limits from Delegated Regulation (EU) 2025/301, Art. 5:

initial notification within 4 hours of classifying the incident as major, and no later than 24 hours after becoming aware of it;
intermediate report within 72 hours of the initial notification;
final report within one month of the latest intermediate report.

It also lists the facts it did not get (number of clients, transactions, member states, costs). If a fact is missing, the tool treats that threshold as not met, so the result can only get more serious once you add the missing facts. Details: DORA major incident classification.

3. A laptop with unencrypted customer data was stolen

The assistant calls gdpr_breach_decision. The tool needs one judgement from you: how likely the breach is to result in a risk to people's rights and freedoms. EDPB Guidelines 9/2022 list what to weigh: the type of breach, how sensitive the data are and how many records are involved, how easily people can be identified, how severe the consequences could be, and whether vulnerable people are affected. With customer data unencrypted on a stolen device, a high risk is a common conclusion, but it depends on the data. With high risk and the theft discovered 2 hours ago, the answer was:

Duty	Answer	Reference
Notify the supervisory authority	Yes, without undue delay and where feasible within 72 hours of becoming aware; about 70 hours remain	Art. 33(1)
Tell the people affected	Yes, without undue delay, in clear and plain language	Art. 34(1)-(2)
Document the breach	Always	Art. 33(5)

Had the laptop been encrypted with state-of-the-art encryption and the key not compromised, the tool would drop the duty to tell individuals under the Art. 34(3)(a) exception. It also reminds you that NIS2, DORA or CRA reports may be due separately. Step by step: GDPR breach notification: the 72-hour rule.

4. What must a privacy notice contain if we buy contacts from a data broker?

Data not collected from the person falls under Article 14, not Article 13. The assistant calls privacy_notice_requirements with the source set to other_source and gets the full Art. 14 list, each item with its paragraph. Two items are easy to miss in this case:

The categories of personal data concerned (Art. 14(1)(d)), which Article 13 does not require.
The source of the data, and whether it came from publicly accessible sources (Art. 14(2)(f)).

And the timing is different: within a reasonable period and at the latest within one month of obtaining the data; at the latest at the first communication if you use the data to contact the person; at the latest when you first disclose the data to another recipient (Art. 14(3)). The tool also lists the Art. 14(5) exceptions, such as disproportionate effort, which then requires other measures to protect the person, including making the information public. Full list: GDPR privacy policy requirements.

5. We found an actively exploited vulnerability in our router firmware

The assistant calls cra_reporting_check for a manufacturer of a product with digital elements. Under the Cyber Resilience Act the reporting obligations of Article 14 apply from 11 September 2026, also to products placed on the market before 11 December 2027 (Arts. 69(3), 71(2)). The answer:

Report	Deadline	Reference
Early warning	Within 24 hours of becoming aware	CRA Art. 14(2)(a)
Vulnerability notification	Within 72 hours of becoming aware	CRA Art. 14(2)(b)
Final report	No later than 14 days after a corrective or mitigating measure is available	CRA Art. 14(2)(c)

All three go through the ENISA single reporting platform to the CSIRT designated as coordinator in the member state of your main EU establishment (Arts. 14(1), 14(7), 16). The tool adds that you must inform impacted users, and where appropriate all users, about the vulnerability and the mitigation measures (Art. 14(8)). More: CRA reporting obligations.

What the tools do not do

They do not decide whether you are compliant. They apply the rule to the facts you give and say which article it comes from.
They do not cover national law. NIS2 is a directive, so national transposition laws add details, and authorities differ in practice.
They ask for facts about an organisation or incident, not personal data, and we do not store the requests.
They do not replace your judgement where the law requires one, such as the risk level of a personal data breach.

Free and Pro: the 20 tools on the free server need no account or key. A ClevSec Pro subscription adds a second server address with ten full reports, such as a NIS2 or DORA remediation plan with priorities and a 30/60/90-day roadmap.

Try it

Add https://mcp.clevsec.one/mcp as a connector or MCP server in your assistant (instructions for Claude, ChatGPT, Cursor and VS Code on the setup page).
Ask one of the questions above. If the assistant searches the web instead, ask it to use the ClevSec tool.
Open the sources in the answer and check the articles it cites.

Have the forms ready before you need them. The GDPR Data Breach Response Toolkit includes a 72-hour notification checklist, a breach register and letter templates for the authority and for the people affected; the DORA Compliance Checklist pack an ICT incident classification matrix and notification timeline.

EU Compliance Questions in Your AI Assistant: Five Worked Examples With an MCP Server

How it works in one paragraph

1. Does NIS2 apply to a 120-person transport company?

2. Is a 3-hour payment outage a major incident under DORA?

3. A laptop with unencrypted customer data was stolen

4. What must a privacy notice contain if we buy contacts from a data broker?

5. We found an actively exploited vulnerability in our router firmware

What the tools do not do

Try it

Sources

Related tools

ClevSec MCP Server

NIS2 Readiness Check