The intelligence behind the Priventia Workspace is available to your systems and your AI agents: the covered instrument set, obligations with their citations and controls, and deterministic applicability assessment from declared organisation context.
Determination happens once, in one deterministic engine over a governed regulatory ontology. The Workspace, the API and the MCP server are doors into that engine, never separate implementations of it, so an answer is the same answer whichever door asked.
The application: assessments, obligations, controls, evidence and roadmaps, managed over time by your compliance and legal teams.
Read and assess endpoints for the software your organisation builds and runs: GRC platforms, legal operations tooling and internal systems that need regulatory intelligence in place.
A governed tool surface for AI agents, so an assistant can ask Priventia for a determination instead of reconstructing regulation from its own memory.
Version 1 is read and assess only. Requests authenticate with an organisation API key in the Authorization header; keys are created and revoked by your organisation administrator in the Workspace under Settings.
GET/api/v1/frameworksThe covered instrument set: code, name, category, family and jurisdictions. Coverage is a disclosed subset; instruments outside it are not assessed.
GET/api/v1/obligations?instrument=CODEThe obligations of one covered instrument, each with its citation, label, text, penalty exposure, enforcement intensity and Observable Governance Controls.
POST/api/v1/applicability/evaluateDeclared organisation context in, deterministic positions out. Every covered instrument returns indicated, not indicated within the covered set, or undetermined, each with its basis. The assessment is persisted and its id returned.
GET/api/v1/assessments/{id}A previously issued assessment, exactly as stored, with the engine and API versions it was issued under. Assessments are immutable; a rerun is a new assessment.
POST https://priventia.com/api/v1/applicability/evaluate
Authorization: Bearer pv_...
{
"organisation_name": "Example B.V.",
"establishment_jurisdictions": ["NL"],
"markets_served": ["EU"],
"uses_ai_systems": true,
"processes_personal_data": true
}Every response carries its coverage: the instrument set it drew from, stated as a disclosed subset, and any notice that reduces it. Responses are stamped with the engine and API versions they were issued under, and assessments are stored immutably, so a rerun months later can be compared honestly with the original.
Declared facts are recorded and rendered as provided. Priventia does not independently verify them, and applicability that depends on an unestablished fact is reported as undetermined.
An applicability evaluation returns one of three positions for every instrument in the covered set. None of them is a grade, and none of them is softened or hidden.
A declared jurisdiction intersects the instrument, and a declared or observed fact engages its family. The basis is returned with the position, so the conclusion can be traced to the facts that produced it.
Evaluated within the covered set and not indicated by the declared facts. This is a statement about the evaluation, never a statement of compliance or safety.
The deciding fact was not declared and is not observable. The response names the fact that would resolve it. Undetermined is a legitimate terminal answer, not an error and not a gap.
The MCP server at /api/mcp exposes the same services as the API to AI agents, over the open Model Context Protocol with the same organisation keys. Four tools in version 1, read and assess only: an agent can retrieve and evaluate, and cannot change your organisation's records.
list_frameworksThe covered instrument set, as the API returns it.
get_obligationsObligations and controls for one instrument code.
assess_applicabilityDeterministic applicability positions from declared context, persisted with an assessment id.
get_assessmentRetrieves a stored assessment by id.
Tool results are determination-layer output: structured positions with their basis, produced by the deterministic engine. No generative step sits between an input and a determination, whichever door asked.
API access is provisioned per organisation. If your team or your agents need regulatory intelligence they can call, talk to us.
Talk to us