plugin.json

{
  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
  "name": "praxikon",
  "version": "1.0.2",
  "description": "EU AI Act and GDPR checks with sources, through the online Praxikon connector.",
  "author": {
    "name": "Zahed Ashkara",
    "url": "https://www.praxikon.com/en/ai-assistant"
  },
  "homepage": "https://www.praxikon.com/en/ai-assistant",
  "license": "MIT",
  "keywords": [
    "eu-ai-act",
    "ai-act",
    "gdpr",
    "privacy",
    "data-protection",
    "dpia",
    "fria",
    "ai-governance",
    "compliance",
    "avg"
  ],
  "extensions": {
    "com.openai": {
      "interface": {
        "displayName": "Praxikon",
        "shortDescription": "EU AI Act and GDPR checks",
        "longDescription": "Praxikon checks a concrete use of AI or personal data against the EU AI Act and the GDPR, and shows where every answer comes from.\n\nWhat you can ask:\n- How the EU AI Act classifies a specific AI system: prohibited practice screening, Annex III high risk, transparency under Article 50, the fundamental rights impact assessment (FRIA) and the general purpose model route.\n- Which obligations apply to your role, provider or deployer, and from when.\n- The legal path behind one obligation: the condition, the exception, the source and the exact locator.\n- Whether a data protection impact assessment (DPIA) is required under Article 35 GDPR and the list of the Dutch Data Protection Authority, and whether a FRIA comes into play.\n- The DPIA intake as a Word file to work on: the four parts of Article 35(7) GDPR with the seventeen points of the Dutch government model DPIA, and the FRIA draft where it applies.\n- A short general question about the EU AI Act or the GDPR, such as whether a customer service chatbot has to say that it is AI, answered from the published Praxikon answers with the articles and sources.\n- Who supervises the AI Act in a member state, how far the national implementing law has come, and dated enforcement signals.\n\nHow it works: the plugin calls a deterministic rules engine over the published Praxikon implementation graph of the EU AI Act and the published Praxikon answers. Nothing is generated by a language model on our side. The same answers always give the same outcome, every result carries the source and the locator it was read from, and a question it does not recognise gets no answer rather than a constructed one.\n\nWho it is for: data protection officers, privacy and AI governance professionals, lawyers and compliance teams, and anyone preparing an AI procurement, a DPIA or a FRIA in the European Union.\n\nPrivacy: no login and no account. Praxikon never sees the conversation. To improve its answers it keeps, for at most 12 months and without IP address, account, cookie or time of day, what a tool needs to work: the tool used and whether it worked, the kind of assistant and the language, the fixed-list choices (such as the case check answers), the outcome and, for the general question tool, the question itself when it passes a filter that drops anything that looks like a name, e-mail address, phone number or other number. Answers are not kept. Ask the assistant not to keep your question and nothing of that call is kept, apart from an anonymous daily count. The case check and the DPIA intake accept fixed answer codes only and refuse free text, so a case description, a name or an organisation name cannot reach them. The DPIA intake comes back as a link to the case check on the Praxikon site with the answers after the # sign, a part the browser does not send to the server, and the Word file is built in the user's own browser. The general question tool takes one question of at most 200 characters in general terms and refuses a question that looks like it contains personal data. Details: privacy statement, section 2.7.\n\nLimitations: Praxikon prepares, it does not advise. The output is not legal advice, and Praxikon is not a supervisory authority. The engine assesses what its questions cover; anything it did not assess is reported as not assessed, with the reason, and an unknown answer is never treated as no. The legal content covers the EU AI Act and the GDPR, with national supervision data per member state and the most detail for the Netherlands.",
        "developerName": "Praxikon",
        "category": "Business & Operations",
        "websiteURL": "https://www.praxikon.com/en/ai-assistant",
        "supportURL": "https://www.praxikon.com/en/contact",
        "privacyPolicyURL": "https://www.praxikon.com/en/legal/privacy",
        "termsOfServiceURL": "https://www.praxikon.com/en/legal/terms",
        "defaultPrompt": [
          "Is our AI hiring tool high risk under the EU AI Act?",
          "Do we need a DPIA for this AI use case?",
          "Who supervises the AI Act in the Netherlands?"
        ],
        "brandColor": "#1b3354",
        "brandColorDark": "#9db8dc",
        "logo": "./assets/logo.png",
        "composerIcon": "./assets/icon.png"
      },
      "review": {
        "test_cases": {
          "positive": [
            {
              "description": "Municipal welfare fraud score, DPIA and AI Act",
              "prompt": "Our municipality wants to use a model that gives every welfare application a fraud risk score; high scores get an extra investigation. It uses income and housing data for about 3,000 applications a year. Do we need a DPIA, and does the AI Act apply?",
              "tools_triggered": "check_case",
              "expected_behavior": "Calls check_case with coded answers only (public body, deployer, AI system, personal data, public benefits, profiling, significant effect, large scale, AP categories fraud prevention and profiling), never the case text. Reports that a DPIA is required under Article 35 GDPR, likely high risk under Annex III point 5(a) with a likely FRIA, the dates as returned by the tool, the open questions, the sources and the link to the full case check, and shows the notice that this is not legal advice. May first ask whether the system is already in use and whether a human assesses every case."
            },
            {
              "description": "DPIA intake as a Word file",
              "prompt": "Our municipality plans an AI model that gives every welfare application a fraud risk score, using income and housing data for about 3,000 applications a year. Please prepare the DPIA intake as a Word file our privacy officer can work on.",
              "tools_triggered": "export_dpia_intake",
              "expected_behavior": "Calls export_dpia_intake with coded answers only (public body, deployer, AI system, personal data, public benefits, profiling, significant effect, large scale, AP categories fraud prevention and profiling), never the case text, and may call check_case first. Gives the user the download_url, a link to the case check on the Praxikon site with the answers after the # sign, explains that the Word file is built in the user's browser and that Praxikon keeps no copy of it, summarises the DPIA outcome (required) and the seventeen points as filled, partly filled or open, mentions that the FRIA draft is included, and shows the notice."
            },
            {
              "description": "Short general question: must a chatbot disclose that it is AI",
              "prompt": "Does a customer service chatbot have to tell people that they are talking to an AI?",
              "tools_triggered": "answer_question",
              "expected_behavior": "Calls answer_question with the question in general terms (at most 200 characters, no names) and lang en. Reports the transparency obligation for direct interaction under Article 50 of Regulation (EU) 2024/1689, from the date returned by the tool, with the source and the link to the published answer, and states that this is not legal advice. Does not construct an answer of its own if the tool returns none."
            },
            {
              "description": "National supervisor in the Netherlands",
              "prompt": "Who supervises the EU AI Act in the Netherlands?",
              "tools_triggered": "get_national_enforcement",
              "expected_behavior": "Calls get_national_enforcement with country NL and reports the supervisory set-up as recorded, including that the Dutch designation is still a draft (the Dutch Data Protection Authority and the Netherlands Authority for Digital Infrastructure as intended coordinators), the status of the implementing law and the dated enforcement signals, each with a primary source."
            },
            {
              "description": "Source of a specific obligation",
              "prompt": "Where exactly does the Article 26 duty for deployers of high risk AI come from? Give me the source and the locator.",
              "tools_triggered": "explain_applicability, get_source_provenance",
              "expected_behavior": "Returns the legal path for the Article 26 deployer obligation (praxikon:eu:ai-act:obligation:article-26-deployer-obligations): the conditions, the exceptions, the primary source and the locator in Regulation (EU) 2024/1689, and cites the identifier and version rather than paraphrasing from memory."
            }
          ],
          "negative": [
            {
              "description": "Unrelated creative writing. The plugin should not be called; the assistant answers on its own.",
              "prompt": "Write a short LinkedIn post announcing our team summer party."
            },
            {
              "description": "Contract drafting is outside the scope of Praxikon, which only assesses AI Act and GDPR applicability. The plugin should not be called; the assistant may draft on its own or explain it cannot.",
              "prompt": "Draft a mutual non-disclosure agreement between two Dutch companies."
            },
            {
              "description": "AI law outside the European Union. Praxikon covers the EU AI Act and the GDPR only, so it should not be called; the assistant should say the question is outside what Praxikon covers.",
              "prompt": "What does the Colorado AI Act require from employers that use AI in hiring?"
            }
          ]
        },
        "demo_recording_url": "https://www.praxikon.com/media/praxikon-chatgpt-demo.mp4",
        "commerce": false,
        "commerce_description": "This plugin sells nothing and processes no payments. One tool, request_expert_review, returns a link to book an introductory call with a person, and only when the user asks in their own words to talk to a person. The call costs nothing, and the plugin shows no prices, plans or offers."
      },
      "publication": {
        "countries": [],
        "release_notes": "Praxikon now keeps, for at most 12 months and without IP address or account, the fixed-list choices, the outcome and short general questions that pass a filter for names and numbers, to improve its answers; the privacy text says exactly what is kept. New optional argument store_for_improvement on every tool: the assistant sets it to false when the user asks that the question is not kept. Keywords ai-act, privacy, data-protection and avg."
      },
      "apps": "./.app.json"
    }
  }
}