Let your AI agent fill in the audit.
Keep the decision.
DILAIG exposes an MCP server and a REST API so that Claude Code, GPT or any agent can fill in the EU AI Act audit questionnaire on your behalf. The agent prepares, you review, DILAIG scores and drafts.
One-click OAuth login (Claude, Le Chat, ChatGPT) · MCP protocol 2025-06-18 · OpenAPI-documented REST API
An agent that prepares,
a human who decides.
Save the data-entry time
The agent reads your internal documents, asks your teams and pre-fills the 64 questions. You only step in at review time.
Every answer is justified
For each question the agent attaches a note and its source: interview, document, URL. You see where every answer comes from before submitting.
Guardrails by construction
The agent never sees the scoring engine, the score or the obligations. It cannot submit the audit, run the analysis or write a document.
What the agent can do,
and what it will never do.
These rules do not rely on the agent's goodwill: the API simply does not expose those operations, and an automated test forbids any link between the agent module and the scoring engine.
The agent can
- Read the questionnaire: questions, options, required fields
- Create an audit draft and save answers into it
- Attach a justification and a source to every answer
- Hand the draft over to the human once all required questions are answered
The agent cannot
- Submit the audit or trigger the analysis
- See or estimate the score, the risk level, the obligations
- Write a FRIA, a declaration of conformity or any other document
- Modify the draft once it has been handed over to the human
Four steps,
one hand on the decision.
You create a key
From Settings → AI agent access. The key is shown once, can be revoked at any time.
The agent fills in the draft
Via MCP or REST it reads the questionnaire, creates a draft and saves its answers section by section, with justifications. Meanwhile the draft is read-only for you.
The agent hands the draft over
When every required question is answered it calls “ready for review”. You receive an e-mail, the agent loses write access.
You review, submit, generate
Every answer is shown with its justification. You correct, submit, get the score and, depending on your plan, generate the documents in DILAIG.
Connect your agent
in ten minutes.
This tutorial covers Claude.ai, Claude Code, Le Chat (Mistral) and ChatGPT — all connect with a simple OAuth login, no key to copy. A REST API option is still available for scripts and clients that don't support OAuth discovery yet. All transports expose exactly the same operations and the same rules.
The two states of an agent draft
Agent in progress
The agent writes. You see the draft read-only, with a banner. Nothing is autosaved on your side.
Handed over
You write. The agent gets an explicit error if it tries to change anything. You submit when you are ready.
- 1
Prerequisites
A DILAIG account you own, and an agent able to call an MCP server over HTTP. The module works on every plan: the plan then determines what you can do at review time (detailed questions, AI-written analysis, documents).
- 2
The OAuth flow in one sentence
You give your agent the MCP server URL, it redirects you to a DILAIG login page in your browser, you pick (or create) the access key to authorize, and the agent receives a token — never seeing or handling the key itself. Revocable anytime from Settings → OAuth connections.
MCP server URL: https://www.dilaig.com/api/v1/agent/mcp
- 3
Option A — Claude Code
In a terminal, add the MCP server with no header: Claude Code automatically detects that the server requires OAuth, opens your browser on the DILAIG login page, and asks you to pick the key to authorize. Claude Code then discovers six tools prefixed dilaig_.
claude mcp add --transport http dilaig https://www.dilaig.com/api/v1/agent/mcp
- 4
Option B — Claude.ai (chat interface)
On an account with organisation management (Team or Enterprise), an admin opens Settings → Connectors → Add a custom connector, pastes the server URL below and confirms. Claude.ai starts the OAuth flow: you sign in to DILAIG and pick the key to authorize, in the browser, nothing to copy.
Server URL: https://www.dilaig.com/api/v1/agent/mcp
- 5
Option C — Le Chat (Mistral)
Open Le Chat, go to Settings → Connectors → Add a custom MCP connector, paste the server URL below. Le Chat detects OAuth support, redirects you to DILAIG login to pick the key to authorize, then discovers the six dilaig_ tools automatically.
Server URL: https://www.dilaig.com/api/v1/agent/mcp
- 6
Option D — ChatGPT
In ChatGPT (Team/Enterprise), open Settings → Connectors → Add a custom connector, enter the server URL below. ChatGPT registers itself with DILAIG (dynamic client registration) and asks you to sign in to choose which API key to use — no command to copy.
Server URL: https://www.dilaig.com/api/v1/agent/mcp
- 7
Option E — REST API (scripts, clients without OAuth)
For a script or a client that doesn't support OAuth discovery yet, use an agent key directly: create it in Settings → AI agent access, then send it in the Authorization header on every request.
curl https://www.dilaig.com/api/v1/agent/me \ -H "Authorization: Bearer dlg_live_YOUR_KEY"
- 8
Brief the agent
Hand the agent the useful documents (system description, data policy, meeting notes) and an explicit prompt. An example prompt that works well:
Read the DILAIG instructions (https://www.dilaig.com/agent/SKILL.md). Prepare the EU AI Act audit draft for our client Acme's “CRM Scoring” system from the attached documents. Answer section by section, justify every answer with its source, leave blank whatever you cannot establish and flag it to me. When all required questions are answered, hand the draft over for review and relay the next steps to me.
- 9
Review and submit
You receive an e-mail with the review link as soon as the agent hands the draft over; it also shows on your dashboard as "Ready for review (AI agent)". Every answer comes with the agent's justification. Correct what is needed, submit: DILAIG computes the score and classification, then offers the documents available in your plan. From then on the agent cannot change anything.
What people ask us
What if the key or the connection leaks?
+
Revoke it in one click in Settings (API key or OAuth connection): access is cut immediately. A key only reaches the drafts it created itself, until they are submitted, and never completed audits, documents or scores. Keys are stored hashed, like passwords.
Can the agent guess the score?
+
No. The questionnaire exposed to the agent carries no weights, the API never returns a score or an obligation, and the agent module has no code link to the scoring engine. The instructions explicitly forbid it from estimating a score or a risk level.
Do I need a paid plan?
+
Not to connect an agent. The plan matters at review time: on Free you get the score and the classification; with Pro the agent sees the detailed questions, and you get the AI-written analysis and the generation of the mandatory documents.
Are the agent's justifications kept?
+
They are shown during review, then purged on submission, when your answers are encrypted. They are never passed to the scoring engine nor to the AI that drafts the documents.
Can I connect an agent without using a terminal?
+
Yes, and it's the recommended path. Claude.ai, Mistral's Le Chat and ChatGPT (Team/Enterprise accounts) all connect through a simple custom connector: you paste the server URL, sign in to DILAIG in the browser and pick the key to authorize. Claude Code does the same from the terminal, with no key to copy.
Do I still need an API key if I connect via OAuth?
+
The key still exists behind the scenes — it's what bounds what the agent can do — but you never copy or paste it anywhere. During the OAuth login you pick, in your browser, which existing key to authorize, or create one on the spot. Copy-pasting a key directly remains available for scripts or clients that don't support OAuth discovery yet.
Can ChatGPT use the DILAIG Agent module?
+
Yes, via custom connectors (Team/Enterprise offers): DILAIG exposes OAuth authentication with dynamic client registration that ChatGPT discovers automatically. You choose which API key to authorize at first login, and can revoke access anytime from your settings.
Your agent is ready.
Create its key.
One key, one command, and your agent prepares the next audit while you keep your hand on the decision.
Revocable any time · Draft only · No access to the score