Detailed Analysis
A developer working with German website compliance requirements has released a Claude Code skill suite that takes a structurally distinct approach to AI-assisted legal auditing: rather than reasoning from a curated, periodically updated knowledge base, every statutory citation in the suite is drawn live from rechtsinformationen.bund.de, Germany's official federal law portal, via a Model Context Protocol (MCP) integration. This architecture means that the verbatim text of any provision cited in an audit finding reflects the law as it currently exists in the authoritative government database, not as it was summarized when the tool was last maintained. The distinction matters because German data protection and accessibility law has been in active flux, and stale legal knowledge bases represent a systemic liability in compliance tooling.
The suite is organized around three discrete skills targeting distinct compliance domains. The `/legal-audit` skill addresses DSGVO obligations — data processors, the Datenschutzerklärung, lawful bases for processing, data processing agreements (AVVs), and US-based services operating without Standard Contractual Clauses — and generates draft remediation documents alongside its findings. The `/bfsg-check` skill addresses the Barrierefreiheitsstärkungsgesetz, the German accessibility law that became mandatory for B2C digital services as of June 28, 2025, a deadline the author notes most site operators have not acted on. The `/widerruf-check` skill operationalizes Art. 7(3) DSGVO's consent withdrawal requirement by measuring the UX asymmetry between opt-in and opt-out flows, a specific enforcement focus area where regulators have been active: requiring fewer clicks to consent than to withdraw it constitutes a violation.
The tool's origin story is illustrative of a broader pattern in developer-built compliance tooling. The author built it after running a self-audit and surfacing three actual violations on their own sites — a third-party email service (Resend) absent from the Datenschutzerklärung, analytics firing before consent was obtained, and a US service with no SCCs in place. The violations were not exotic edge cases but routine oversights typical of product-focused builders who lack dedicated legal resources. This positions the suite not as a replacement for legal counsel but as a practical first-pass instrument for operators who have never formally checked their compliance posture.
The acknowledged gap in the tool is technically significant: the DSK Orientierungshilfen — guidance documents issued by the Datenschutzkonferenz, the body coordinating Germany's state and federal data protection authorities — are not available through any structured API. The skill explicitly surfaces this limitation when a finding depends on DSK guidance, pointing users to datenschutzkonferenz-online.de for manual review. This is an honest architectural disclosure that distinguishes the tool from legal products that elide the boundaries of their own knowledge. It also points to a meaningful gap in the German legal data infrastructure: while statutory law is accessible programmatically through the federal portal, supervisory authority guidance — which carries substantial practical weight in DSGVO enforcement — remains unstructured and portal-only.
The project sits at a growing intersection of MCP-enabled tooling, legal engineering, and the increasing use of Claude Code as a platform for domain-specific skill development. The choice to anchor legal citations in live government data rather than distilled summaries reflects an emerging architectural philosophy in AI legal tools: that the risk of hallucinated or outdated citations is severe enough to warrant real-time retrieval even at the cost of latency or complexity. As regulatory environments grow more dynamic — particularly in EU data protection, AI Act compliance, and digital accessibility — tools built on live authoritative sources rather than static knowledge bases may represent a meaningful design standard for the category.
Read original article →