Quick tips

A 3-minute read for new subscribers. Once your agent is connected through Setup, the snippet below tells it to query the Ansvar gateway instead of answering from training data — and the rest of the page covers what to ask, how to verify the agent is grounded, and where to send feedback when a source is missing.

1. Paste this into your agent's system prompt

Drop the block below into your system prompt, custom instructions, or agent-instructions field. One snippet works across Claude (web + Desktop), Claude Code, VS Code Copilot, and Cursor — no per-agent variant is needed. When you're ready for the full version — query craft, retries, and output discipline — Instruct your agent carries it.

For any question about EU/EEA law, regulatory compliance, or
cybersecurity controls (GDPR, NIS2, AI Act, DORA, ISO 27001,
sector-specific regulation, national implementations), call the
Ansvar Gateway tools before answering — never from memory.

Always scope search: jurisdictions=["SE"] (your market; add "EU"
for EU regulation) or frameworks=["GDPR"]. Never pass the whole
question as the query — reduce it to 1-3 legal key terms in the
language of the law you are searching (Swedish terms for Swedish
law); try alternative terms as separate searches.

Quote article numbers, paragraph numbers, and authority names
verbatim from the tool output. For questions that touch both an
EU framework and a Member State (e.g. "Swedish law on…", "how
does Germany implement…"), issue at least one Gateway call per
regime — one for the EU instrument, one for each national
jurisdiction — before composing the answer.

If a search returns nothing, retry before concluding there is
nothing: a synonym or broader key term first, still in the
law's language, then one search per concept. As a last resort
allow_broadening=true returns the relaxed matches we hold back
by default — these are frequently off-topic, so present them
as unverified leads for a human to check, never as the answer.

If those retries also return no result:
state which queries you ran, that they returned zero results,
and that you will not substitute training-data recall. Do not
name supervisory authorities, statute numbers, or timelines
unless they appear in a tool result.

2. Which question goes to which tool

Tier links go to pricing.

Question	Tool	Tier
Using Ansvar: what does Art. 32 GDPR require? (and any other lookup across 49 audited jurisdictions)	`search` / `get_provision`	Free +
Using Ansvar: how do courts and regulators apply this rule? (case law and preparatory works arrive automatically inside `search` on Premium and above — there is no separate tool to call)	`search` / `search_guidance`	Premium +
Using Ansvar: where am I non-compliant with X regulation? (on a system you describe — the Free and Solo monthly run covers NIS2, DORA, CRA and the EU AI Act; Premium drops the framework fence; document-grounded runs at Team)	`start_workflow(workflow_type="gap_analysis")`	Free +
Using Ansvar: what can go wrong with this system? (on a system you describe — 1 run a month on Free, 2 on Solo, both STRIDE with a watermarked render or JSON report; 5 at Premium (JSON report), which adds LINDDUN and TARA; document-grounded runs and unwatermarked renders at Team)	`start_workflow(workflow_type="threat_model")`	Free +
Using Ansvar: what privacy risk does this processing carry? (on a system you describe, inside the same monthly run allowance; document-grounded runs at Team)	`start_workflow(workflow_type="dpia")`	Free +
Using Ansvar: does this tender let us bid?	`start_workflow(workflow_type="tender_review")`	Team +
Using Ansvar: prove to an auditor what was asked and answered	tamper-evident audit ledger	Company

The tier ladder behind the table:

Free — €0, sign in with Microsoft, Google or email. Search scoped to one jurisdiction or one framework per question, 100 search calls / day, three concurrent requests. No fan-out. One workflow run a month on a system you describe — threat model, gap analysis (incl. NIS2, DORA, CRA, EU AI Act) or DPIA — reported as a watermarked render or JSON.
Solo — 750 search calls / day, 4 concurrent requests. Multi-source fan-out across the full fleet — every jurisdiction in one question. Shows when case law exists; reading it is Premium. Two workflow runs a month from the same seven types as Free, watermarked render or JSON.
Premium — 5,000 search calls / day / seat, 5 concurrent requests. The legal evidence layer: case law, preparatory works, and agency guidance inside search — plus 5 workflow runs a month on a system you describe (STRIDE, LINDDUN, TARA), reported as structured JSON; rendered exports start at Team.
Team — adds workflows on your own documents (gap analysis, DPIA, tender review, and more — run list_workflow_types for the live list), 16 concurrent requests. Self-serve at €490/seat/month — see pricing.
Company — adds the tamper-evident audit ledger (the ledger is Company-only), 64 concurrent requests. Not self-serve.

Tools above your tier are absent from tools/list and return JSON-RPC -32601 if called anyway; quota and cap overruns return JSON-RPC -32000 with data.cause = "cap_exceeded". start_workflow itself is visible on every tier — a refusal there names the reason (a workflow type outside your plan, or the monthly allowance spent); it is a tier fence on types and runs, not an outage.

3. How to tell the agent did (or didn't) ground its answer

Grounded looks like: article numbers (GDPR Art. 32(1)(b)), authority names (Datatilsynet, EDPB), a source_url to a .gov, .europa.eu, or recognised publisher domain, and a named MCP in the response (via danish-law).

Not grounded looks like: hedge words (generally, typically, in most cases), no article numbers, no source URLs, no MCP name.

One-line check. Paste this if you're unsure:

Which Ansvar MCP did you query, and which article number is this from? If you didn't query the Gateway, say so explicitly.

4. Report a missing source

Spot a law, regulator, or dataset Ansvar should cover and doesn't? Tell us — we triage source requests weekly.

Email: team@ansvar.eu (suggested subject: Missing source)
See what's already covered: /coverage — the "In active development" stripe lists what's being built next, and "Suggest a source" takes requests for anything missing.