Compliance Check

Concept: Compliance | Python: client.compliance_check() | See also: Compliance API overview

For India DPDP, dedicated endpoints are available that go beyond point-in-time checks to offer stateful sessions, event-driven evidence, and workflow guidance. See the India DPDP API.

Pass framework for a single-framework check, or frameworks (even a list of one) for a multi-framework check with a cross-framework summary — the two return differently-shaped responses, documented separately below.

Parameters

content

string

required

Text to evaluate. 1–50,000 characters.

framework

string

A single framework ID. Mutually exclusive with frameworks.

frameworks

string[]

Up to 5 framework IDs: gdpr, ccpa, hipaa, eu_ai_act, india_dpdp, india_ai_gov. Mutually exclusive with framework. Always returns the multi-framework shape, even for a single-item list.

context

string or object

Either a free-form description string, or a structured object (domain, system_type, jurisdiction, data_subjects, decision_type, processes_personal_data, high_risk_indicators). A bare string is wrapped into {"description": ...} internally — both forms reach the same evaluation.

strict_mode

boolean

default:"false"

Use a stricter per-requirement pass/fail threshold.

include_explanations

boolean

default:"true"

Include per-dimension explanations and issue lists.

Request

curl -X POST https://api.responsibleailabs.ai/railscore/v1/compliance/check \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_RAIL_API_KEY" \
  -d '{
    "content": "We collect user interaction data to improve personalization.",
    "framework": "gdpr",
    "context": {"domain": "saas", "jurisdiction": "EU"}
  }'

Single-framework response

{
  "result": {
    "framework": "gdpr",
    "framework_version": "2016/679",
    "framework_url": "https://gdpr-info.eu",
    "evaluated_at": "2026-07-12T10:00:00Z",
    "compliance_score": { "score": 4.2, "confidence": 0.85, "label": "Fair", "summary": "..." },
    "dimension_scores": {},
    "requirements_checked": 12,
    "requirements_passed": 7,
    "requirements_failed": 4,
    "requirements_warned": 1,
    "requirements": [
      { "requirement_id": "gdpr-art5", "requirement": "...", "article": "Art. 5", "status": "pass", "score": 8.5 }
    ],
    "issues": [
      { "id": "...", "severity": "high", "description": "No mention of legal basis for processing or data retention period.", "article": "Art. 13", "remediation_effort": "medium" }
    ],
    "improvement_suggestions": ["..."],
    "risk_classification_detail": null,
    "partial_result": false,
    "from_cache": false
  },
  "credits_consumed": 5.0
}

result.compliance_score

object

score (0–10), confidence (0–1), label ("Critical"–"Excellent"), summary.

result.requirements

array

One entry per checked requirement: requirement_id, requirement, article, reference_url, status, score, threshold, ai_specific, and — when applicable — regulatory_deadline, penalty_exposure.

result.issues

array

id, description, dimension, severity, requirement, article, reference_url, remediation_effort, and — when applicable — remediation_deadline_days, remediation_deadline_date.

result.risk_classification_detail

object

EU AI Act only: tier, basis, obligations. null for other frameworks.

Multi-framework response

Requesting frameworks (plural) returns a different top-level shape — no result wrapper; instead results keyed by framework ID plus a cross_framework_summary:

{
  "results": {
    "gdpr": { "framework": "gdpr", "compliance_score": { "score": 4.2, "label": "Fair" }, "...": "..." },
    "eu_ai_act": { "framework": "eu_ai_act", "compliance_score": { "score": 6.1, "label": "Good" }, "...": "..." }
  },
  "cross_framework_summary": {
    "frameworks_evaluated": 2,
    "average_score": 5.15,
    "weakest_framework": "gdpr",
    "weakest_score": 4.2
  },
  "credits_consumed": 8.0
}

Each entry under results has the same shape as the single-framework result object above.

Credits

Frameworks requested	Cost
1 (`framework`)	5.0
2–3 (`frameworks`)	8.0
4–5 (`frameworks`)	10.0

A cached result (from_cache: true, or every framework cached in a multi-framework request) costs 0.

Errors

Code	Status	When
`INVALID_FRAMEWORK`	400	Unknown framework ID, or malformed request.
`INVALID_CONTEXT`	422	`context` is neither a string nor an object.
`TIER_INSUFFICIENT`	403	The framework isn’t included in the account’s plan tier.
`RATE_LIMIT`	429	Daily compliance-check limit reached.
`EVALUATION_FAILED`	500	Internal error; logged server-side.

Reference

Scoring

Compliance

Agent

Introspection & status

Parameters

Request

Single-framework response

Multi-framework response

Credits

Errors

​Parameters

​Request

​Single-framework response

​Multi-framework response

​Credits

​Errors

Parameters

Request

Single-framework response

Multi-framework response

Credits

Errors