API documentation

EU AI Act

Our position under Regulation (EU) 2024/1689, on one page. Provider self-assessment of 8 July 2026, restated for publication on 15 October 2026.

Roles

Stonewake is the provider of an AI system that is not high-risk. The system integrates general-purpose language models through their providers' interfaces, behind a provider-neutral seam; the model providers' own duties under the Regulation stay with them. The model endpoint is modular by design.
Your institution is the deployer. The intended purpose is research over public sources about organizations and countries, including recurring checks of those sources, for deal origination and for credit monitoring of organizations, plus adverse media screening of natural persons in their professional capacity, on the bank's instruction and as a customer due diligence measure, and a comparison by name of natural persons with the natural persons on the official sanctions lists, which yields review candidates only. On the same instruction, as a customer due diligence measure with the purpose your institution records for each person, the system also follows a natural person your institution watches in news and social media and alerts it to what is reported, lets a model check the news events about that person, and researches a named person on a schedule under the rules of person screening, conduct in a professional capacity only. In the workspaces where we switch person data on, the system also serves the natural persons that official registers and the official sanctions lists name, as those sources state them and with their citations, for know your customer, sanctions and credit due diligence on organizations and their people, in the dashboard, the API and MCP alike, and it never scores, rates or ranks a person's creditworthiness, reliability or risk. That comparison covers the natural persons that public registers link to the organizations in your book, in the workspaces where we switch it on, and the person your institution names for a screening, where the result of that screening carries a section on the official lists. Excluded uses are creditworthiness evaluation of natural persons, employment or tenant screening, PEP list screening, a sanctions list check of a natural person outside these two cases, and any decision without human review. Within credit monitoring an organization is checked against six official sanctions lists, the EU Financial Sanctions Files, the UK Sanctions List, the two OFAC lists (SDN and non SDN), the Swiss sanctions list of SECO and the UN Security Council Consolidated List, beside your own sanctions screening and never in place of it. The six lists are switched on, and our software is set to read each once a day. An organization is checked once your team adds the sanctions list check to its configuration, and that check is not on by default. A list that is switched off or was not checked within the last 48 hours reads Not checked and never clear, and a result that finds no entry names the lists it was compared with. We compare organizations and persons with no other sanctions list and hold no list of politically exposed persons. A designation binds through an identifier the list itself states, an LEI, the first eight characters of a BIC, a register number with its country or a Belgian, Czech, Latvian or Norwegian VAT number that is the register number, and through nothing else. A shared name alone never counts as a match. It is shown for review and leaves the row unscored, unless your team has set the check to score missing data as amber. On a match the row reads red and names the list, the designation reference, its date where the list states one and the identifier that matched, with a link to the official file. List memberships at country level feed the country score. A deployer that repurposes the system takes on the provider's obligations for that use (Art. 25).
The check of natural persons compares the names of the persons that public registers link to an organization in your book, such as an officer, a shareholder or a beneficial owner, with the name and the aliases a list gives each of its natural persons, except the aliases the list itself marks as weak. A date of birth or a nationality that both sides state and that contradicts removes the pair. What remains is a review candidate. It names the list, the designation reference, the listed names, what matched and what narrowed it, with a link to the official file. It sets no colour and no score and never counts as a match. Only an analyst's confirmation records a match, and that confirmation changes no score. A rejection is remembered until the list changes its entry. When a person leaves a list, the entry, its earlier versions, the name keys and every decision on it are deleted in the same update, and no candidate remains. The sandbox workspace of our public API and our public pages never run this check.

Why Annex III does not apply

Annex III 5(b) covers systems that evaluate the creditworthiness of natural persons or establish their credit score. Stonewake does neither. Scores apply to organizations and countries only, no score, rating or ranking of a person's creditworthiness, reliability or risk exists anywhere in the product, and the build fails if a person-typed surface acquires one. The tone of the news and posts about a person your institution watches is context shown to your institution, never a score of the person and never an input to one. A sole trader's business counts as a natural person, so credit monitoring never scores one and no tone is computed for one, and the build also fails if a sole trader's company carries a score, a status or a tone in a stored table or a served answer. Person screening returns cited findings and draft verdicts that an analyst must confirm or dismiss; the system takes no decision and executes no action. The API and the MCP server serve a person screening as the official lists comparison and its findings with their sources, without the draft verdicts. A sanctions list candidate for a natural person is a name comparison for review, not a score, and an analyst confirms or rejects it.

Transparency (Art. 50)

AI involvement is disclosed in the product. The dashboard states that research content is AI assisted, and the deal summary on every surface says that its three lines are generated from the cited findings by fixed rules, not by a model. A deal can also carry a short briefing, a machine drafted summary of what the deal's cited sources report, which an AI model writes from the text of those sources. It is not a statement of fact by Stonewake. The API names it as model drafted in the field drafted_by and lists the sources the model was given. Only its numbers written in digits are checked against the text of those sources, and a sentence with a number that does not stand there is dropped. Words are not checked, so a name or the way a sentence connects its facts can still be wrong.
In API responses a deal briefing names its drafter in the field drafted_by, and the OpenAPI document describes a screening's rationale as machine drafted. Elsewhere AI drafted content is identified by its visible label and by this documentation.
A news event alerts a desk only after a news check, in which an AI model reads the event's articles and answers yes, no or unsure with quotes. A deterministic gate keeps a yes only when the quotes stand word for word in the articles of at least two publishers and the type is one GDELT's theme mapping already found for the event, so the model can hold an alert back and never invent one. In API responses the event's check names the model and the prompt version.

AI literacy (Art. 4)

What the model does. It extracts, verifies and drafts text over fetched public sources. Its outputs are draft findings, draft verdicts and draft summaries, each tied to the sources it was given.
What the deterministic gates do. A claim that cannot be matched verbatim to its source text is escalated or suppressed; scores ship with their per-component breakdown, weights and citations, computed from rubrics that are inspectable data; no person-level score can be built; the review ledger is append-only. A reported figure is accepted only when its amount, scale and currency are stated in the quoted source text, and the model cannot overrule that check.
What the analyst must do. Read the cited source before relying on a finding, confirm or dismiss every draft verdict, and treat every output as research input to a human decision, never as the decision.