Rekvira
EN
Try it freeConnect
Menu

¶ 1Founding Beta · free account, one email

EU compliance answers that quote the source.

Ask your AI assistant a compliance question. Rekvira gives it the official EUR-Lex text. The answer comes back with the article, paragraph and recital it rests on, and a link you can put in the file.

For compliance officers, DPOs and in-house counsel.

Add Rekvira to Claude (opens in a new window) Read a recorded answer

€0 during the beta · Sign in with your email, no API key · Search queries are never stored

  • 5EU acts
  • 3,667citable passages
  • 8playbooks
  • 4recorded jobs
  • €0free account, no API key

¶ 2A specimen answer

The answer, with its footnotes.

Recorded on the live service on 23 September 2026, without an account. Every passage and check is what Rekvira returned; the assistant’s wording is ours, written from those results.

Data protection officer

“We are about to deploy a high-risk AI system. Does the AI Act also send us to a GDPR data protection impact assessment?”

Yes, where one applies.

The AI Act tells deployers of high-risk AI systems to use the information the provider gives them under Article 13. They use it to carry out their data protection impact assessment under Article 35 GDPR 1.

The GDPR side sets the test. When processing is likely to result in a high risk to the rights and freedoms of natural persons, the controller must carry out the assessment first 2.

I checked the quoted words against the official AI Act text and they match. The text tells you what applies; whether your processing meets the high-risk test is a call for your team.

4 calls: one search across the acts, two passage reads, one citation check · 542 ms

Marginal notes

Note 1: EU AI Act, Article 26(9)

Where applicable, deployers of high-risk AI systems shall use the information provided under Article 13 of …

Checked: quoted words found

Official text from EUR-Lex, CELEX 32024R1689, as held on 2 Sep 2026. Open on EUR-Lex

Note 2: GDPR, Article 35(1)

Where a type of processing in particular using new technologies, and taking into account the nature, scope …

Official text from EUR-Lex, CELEX 32016R0679, as held on 2 Sep 2026. Open on EUR-Lex

Ask it yourself

We are about to deploy a high-risk AI system. Does the AI Act also send us to a GDPR data protection impact assessment?

Product security lead

“A vulnerability in our connected product is being actively exploited. What do we have to report, and by when?”

Three reports: 24 hours, 72 hours, 14 days.

As the manufacturer, the Cyber Resilience Act gives you three reports 1:

  • An early warning within 24 hours of becoming aware of it.
  • A vulnerability notification within 72 hours.
  • A final report no later than 14 days after a corrective or mitigating measure is available.

These reporting duties apply from 11 September 2026, before the rest of the regulation 2. You file once through the single reporting platform, which reaches the coordinating CSIRT and ENISA 3.

If your company is also an essential or important entity under NIS2 and the exploit becomes a significant incident, NIS2 runs its own clock: early warning within 24 hours, incident notification within 72 hours, final report within one month 4.

7 calls: one look at what is loaded, two searches in one act, four passage reads · 547 ms

Marginal notes

Note 1: Cyber Resilience Act, Article 14(2)

For the purposes of the notification referred to in paragraph 1, the manufacturer shall submit …

Official text from EUR-Lex, CELEX 32024R2847, as held on 2 Sep 2026. Open on EUR-Lex

Note 2: Cyber Resilience Act, Recital (126)

Economic operators should be provided with sufficient time to adapt to the requirements set out in this …

Official text from EUR-Lex, CELEX 32024R2847, as held on 2 Sep 2026. Open on EUR-Lex

Note 3: Cyber Resilience Act, Recital (65)

Manufacturers should notify simultaneously via the single reporting platform both the computer security …

Official text from EUR-Lex, CELEX 32024R2847, as held on 2 Sep 2026. Open on EUR-Lex

Note 4: NIS2 Directive, Article 23(4)

Member States shall ensure that, for the purpose of notification under paragraph 1, the entities concerned …

Official text from EUR-Lex, CELEX 32022L2555, as held on 2 Sep 2026. Open on EUR-Lex

Ask it yourself

A vulnerability in our connected product is being actively exploited. What do we have to report, and by when?

ICT risk manager at a bank

“Under DORA, do we have to keep a register of our ICT vendor contracts? What goes in it?”

Yes. Every ICT contract, at every level.

Yes. You must keep and update a register of information on all contractual arrangements for ICT services from ICT third-party service providers, at entity level and at sub-consolidated and consolidated levels 1. The same paragraph says:

  • Mark which arrangements cover ICT services supporting critical or important functions 1.
  • Report at least yearly to your competent authority on new arrangements, provider categories and the services provided 1.
  • Hand over the full register, or the sections asked for, when the authority requests it 1.

The layout is not left to you: the recitals say the ESAs draft standardised templates for the register of information 2. Want me to read the rest of Article 28 next?

4 calls: two searches in one act, two passage reads · 320 ms

Marginal notes

Note 1: DORA, Article 28(3)

As part of their ICT risk management framework, financial entities shall maintain and update at entity level …

Official text from EUR-Lex, CELEX 32022R2554, as held on 2 Sep 2026. Open on EUR-Lex

Note 2: DORA, Recital (100)

To facilitate the comparability of reports on major ICT-related incidents and major operational or security …

Official text from EUR-Lex, CELEX 32022R2554, as held on 2 Sep 2026. Open on EUR-Lex

Ask it yourself

Under DORA, do we have to keep a register of our ICT vendor contracts? What goes in it?

¶ 3Give it the job

Four jobs, run end to end.

Each is one real run on the live service, for an invented company. It follows the playbooks, reads the official text, checks every citation, and stops where you have to decide.

  1. No. 1 · AI-governance or compliance lead

    AI system classification memo

    “We are about to put an AI system into service and have to say where it sits under the AI Act.”

    2.6 min57 tool calls33 citations verified

  2. No. 2 · ICT risk or security lead

    DORA third-party contract review

    “A new or renewing ICT contract has landed and it has to meet DORA before anyone signs.”

    2.1 min55 tool calls32 citations verified

  3. No. 3 · AI-governance or compliance lead

    Customer AI questionnaire answered

    “A customer has sent its AI due-diligence questionnaire and wants it back this week.”

    1.8 min66 tool calls35 citations verified

  4. No. 4 · ICT risk or security lead

    NIS2 scoping memo

    “The board asks whether NIS2 applies to us, and if so, as what.”

    1.7 min60 tool calls33 citations verified

In addition to the high-risk AI systems referred to in paragraph 1, AI systems referred to in Annex III shall be considered to be high-risk.

From the classification memo, section 3.3 · EU AI Act, Article 6(2) · citation check: held, quoted words found · Read the memo

¶ 4The corpus

Five EU acts, read from the official text.

Every act comes from EUR-Lex by its CELEX number, split into articles, paragraphs, annexes and recitals, so an answer can point at the exact passage.

  • Artificial intelligence

    Status: Loaded

    EU AI Act

    For providers and deployers of AI systems: risk classes, high-risk duties, transparency.

    Ask it “Is our CV screening tool high-risk?”

    Regulation (EU) 2024/1689 · EUR-Lex

  • Financial services

    Status: Loaded

    DORA

    For banks, insurers and other financial entities: ICT risk, incidents, third-party providers.

    Ask it “What goes in our ICT vendor register?”

    Regulation (EU) 2022/2554 · EUR-Lex

  • Personal data

    Status: Loaded

    GDPR

    For anyone processing personal data: lawful bases, rights, impact assessments.

    Ask it “When do we need a DPIA?”

    Regulation (EU) 2016/679 · EUR-Lex

  • Cybersecurity

    Status: Loaded

    NIS2 Directive

    For essential and important entities: risk measures, incident reporting, supervision.

    Ask it “When is the early warning due?”

    Directive (EU) 2022/2555 · EUR-Lex

  • Connected products

    Status: Loaded

    Cyber Resilience Act

    For makers of products with digital elements: security requirements, vulnerability reporting.

    Ask it “What do we report on an exploited flaw?”

    Regulation (EU) 2024/2847 · EUR-Lex

  • What is not held

    Every other act

    A cross-regulation cite can still name an act outside the registry. A citation to an act that is not loaded resolves to nothing, and says so.

    What is held, and when it was checked

¶ 5How it works

From connect to a citable pinpoint.

Nothing to install on your side and nothing new to learn.

  1. Connect once

    Paste the start line into your assistant, or add the address in its settings. Then it signs you in with your email: a free account.

  2. Ask in plain words

    Ask the question you already have. The assistant searches the official text and reads the passages it needs.

  3. Check before you cite

    Every passage carries its pinpoint and the date it was fetched. A citation check tests each quote against the held text before it reaches a memo.

For developers: the tools your client sees
  • Findlist_regulations · search_regulation · search_regulations: one act, or every loaded act at once
  • Readread_unit · lookup_obligations: an article, paragraph, annex or recital; the articles addressed to a role
  • Checkverify_citation: does the pinpoint exist, and are the quoted words in it
  • Playbookslist_workflows · get_workflow: 8 ready research paths
  • Keeprecord_assessment · save_workflow: your own verdicts and drafts, in your free account

Each response carries the date its text was fetched and the CELEX number of its source.

¶ 6Connect

Start with a free account.

One email to sign in, no API key, and free during the beta.

€0free account, free during the beta.

Claude on the web, desktop or phone

Add Rekvira to Claude

  1. Press the button. Claude opens its add-connector window with Rekvira’s address filled in.
  2. Confirm Add, then sign in once with your email: free, no key or card.
  3. Ask in your own words, for example: is our CV screening tool high-risk under the AI Act?
Add Rekvira to Claude(opens in a new window)

Claude Code, Cursor and assistants that set themselves up: paste this

Read https://rekvira.com/start.md and follow the onboarding instructions.

or for another assistant

https://mcp.rekvira.com/mcp

Set up by hand, app by app

¶ 7Stated plainly

What Rekvira does not do.

Sources, not advice. The boundary is deliberate.

  • It does not tell you what compliance requires

    It returns official text with pinpoints; the conclusion belongs to your professional.

  • It does not hold every act a cite can name

    All five registered regulations are loaded; a cross-regulation cite can still name an act outside the registry.

  • It does not profile your searches

    Search queries are not stored. Only the verdicts and drafts you deliberately ask it to keep are retained, under a private trial code or your free account.

¶ 8Questions

Questions buyers ask first.

Short answers for procurement, counsel and the DPO. The pricing page and the privacy notice have the detail.

Does it replace counsel?

No. Rekvira returns official EUR-Lex text with pinpoints and the date each text was fetched. Your counsel draws the compliance conclusion.

Can we try it before procurement signs?

Yes. A free account takes one email and no API key. Connect or paste the start.md line into your assistant.

What if a citation is wrong?

The citation check tests the pinpoint and the quoted words against the loaded text and reports held, found or not found, as in the DPIA example above.

Does it replace our GRC system?

No. Rekvira puts the official EUR-Lex text inside the AI you already use, so a memo can be checked against the source before your GRC record or your counsel relies on it.

What changes when the trial changes?

Rekvira is free during the beta and nothing is charged. Any change is announced on the pricing page in advance.

Is it in German too?

Yes. The site has a German edition at rekvira.com/de, and the sign-in email arrives in your language.