欧盟人工智能法案（EU AI Act）

Regulation (EU) 2024/1689 — the EU AI Act — sets obligations for those who provide or deploy AI systems, and for providers of general-purpose AI models. This page explains where AnythingMCP sits in that picture, and what it gives you for your own obligations.

What AnythingMCP is, in the terms of the Act

The gateway itself

AnythingMCP is a connector gateway: it turns APIs, databases and existing MCP servers into tools that an AI client can call. That routing layer contains no AI — it forwards calls and returns results.

Where we do use AI

Two optional features use a large language model: Knowledge Graph enrichment, which proposes relationships between the entities your connectors expose, and AI Skills, which turns recurring tool usage into reusable rules. For those features we are a deployer of an AI system, and — because we ship them as part of our product — also their provider towards you. We are not a provider of a general-purpose AI model: we do not train one, we call a third party's.

How those features behave

Off by default. They require an instance-wide setting and, on top of that, an explicit opt-in per workspace. With them off, no data leaves for an AI model at all.
The model is only ever asked about metadata — connector and tool names, parameters, and captured request patterns. Your customers' business records are not sent to it.
Captured request texts are scrubbed of e-mails, phone numbers, IBANs, card-like numbers and long digit sequences before they leave, and that scrubbing is on by default.
Output is a suggestion, never an action. Graph edges and skills arrive flagged as suggested and take effect only once a person approves them; auto-apply is a separate, off-by-default choice.
On AnythingMCP Cloud the model is Anthropic Claude Haiku. If you self-host, you supply your own provider and key — OpenAI, Anthropic or OpenRouter — and nothing is sent anywhere until you do.

Where your responsibility sits

The moment you connect an AI client to your systems through AnythingMCP, the resulting assistant or agent is an AI system in the sense of the Act — and you are normally its deployer, and possibly its provider. How it is classified depends on what you build it for: an internal assistant that looks up orders is assessed very differently from something used in recruitment, creditworthiness, or critical infrastructure. That assessment is yours to make, because only you know the purpose and the context.

What the product gives you

None of this makes you compliant by itself. It is the material you need when you have to show how your system behaves:

An audit log of every tool call — who called it, when, with which arguments, what came back, how long it took. That is the traceability and record-keeping evidence you would otherwise have to build yourself.
Role-based access and per-tool permissions, so an agent can only reach what you deliberately exposed to it.
Tool annotations, which tell the calling agent whether a tool only reads or can change something — the basis for treating writes more carefully than reads.
Human oversight by construction: nothing is exposed automatically. Every connector and every tool is enabled by a person.
Self-hosting, or EU-hosted cloud. Your credentials and your data stay where you put them.
Caller-context variables, which let the system behind the connector record which human was behind a request, rather than only seeing a service account.

When it applies

The Act entered into force on 1 August 2024 and applies in stages:

2 February 2025 — prohibited practices, and AI literacy duties for staff.
2 August 2025 — obligations for general-purpose AI models, governance and penalties.
2 August 2026 — general application, including most high-risk system obligations.
2 August 2027 — high-risk systems that are safety components of regulated products.

This is information, not legal advice

This page describes our own role and our product. It is not a compliance certification, and it does not classify your system for you — that depends on your use case and should be confirmed with your own legal counsel. If something here is unclear or you need documentation for an assessment, write to us and we will help.