{
  "mcpServers": {
    "gibs": {
      "url": "https://mcp.gibs.dev/sse"
    }
  }
}

export GIBS_API_KEY=your_api_key_here

You: Classify my facial recognition attendance system for schools

Gibs: This system is classified as HIGH-RISK under the EU AI Act.

- Article 6(2) read with Annex III, point 1(a): biometric identification
  and categorisation of natural persons
- As used in an educational context, also caught by Annex III, point 3(a):
  AI systems intended to be used to determine access to educational institutions

Obligations include:
- Risk management system (Article 9)
- Data governance (Article 10)
- Technical documentation (Article 11)
- Record-keeping (Article 12)
- Transparency to users (Article 13)
- Human oversight (Article 14)
- Accuracy, robustness, cybersecurity (Article 15)
- Conformity assessment before placing on market (Article 43)

You: What are the GDPR requirements for a data breach notification?

Gibs: GDPR imposes two notification obligations following a personal data breach:

1. Notification to supervisory authority — Article 33
   - Without undue delay and no later than 72 hours after becoming aware
   - Must include: nature of breach, categories and approximate number of
     data subjects, likely consequences, measures taken or proposed
   - Exception: unlikely to result in a risk to rights and freedoms

2. Communication to data subjects — Article 34
   - Required when breach is likely to result in a HIGH risk
   - Must describe in clear and plain language the nature of the breach
   - Not required if: appropriate technical safeguards applied (e.g.,
     encryption), subsequent measures taken that eliminate the high risk,
     or it would involve disproportionate effort (use public communication instead)

The controller must also document all breaches per Article 33(5), regardless
of whether they meet the notification threshold.

You: Does DORA apply to a fintech startup processing payments?

Gibs: Yes. Under Article 2(1), DORA applies to payment institutions as
defined in Directive 2015/2366 (PSD2), which includes entities authorized
to provide payment services.

As a financial entity under DORA, the startup must comply with:
- ICT risk management framework (Chapter II, Articles 5–16)
- ICT-related incident management and reporting (Chapter III, Articles 17–23)
- Digital operational resilience testing (Chapter IV, Articles 24–27)
- ICT third-party risk management (Chapter V, Articles 28–44)
- Information-sharing arrangements (Chapter VI, Article 45)

Note: Proportionality applies — Article 4 allows competent authorities to
consider the size, risk profile, and complexity of the financial entity when
assessing compliance.