01
Describe the system
Purpose, data types, deployment context, autonomy level, and who it affects — YAML or JSON.
Open source · Apache 2.0
Offline EU AI Act risk classification
Describe an AI system. Get a risk tier with article references, rationale, and recommended controls — from a versioned ruleset, not an LLM.
How it works
02
Get a tier + clause refs
Prohibited, high-risk, limited-risk, or minimal-risk — with matched rules, rationale, and controls.
03
Run in CI
Single Go binary. Offline by default. Same contract via CLI or HTTP API. Diff the ruleset like code.
Why RiskLine
Offline-first
No data leaves your machine by default. A compliance tool that phones home is a trust problem.
Deterministic
Same input, same output. Versioned JSON ruleset you can audit, diff, and challenge.
CI-native
Distribution model borrowed from OPA and Trivy — one binary, no runtime, pipeline-friendly.
Explainable
Every result cites which article or annex fired, plus judgment-call notes where the ruleset hedges.
Honest limits
- Pre-1.0. APIs and the ruleset may change. Misclassification reports are how we validate.
- EU AI Act only. No NIST, ISO, or multi-jurisdiction packs in v1.
- Partial Annex III. Recruitment, employment, credit, biometrics, and adjacent cases — not full coverage yet.
- Advisory, not legal advice. Every response includes a disclaimer. Not a substitute for counsel or formal conformity assessment.