eu-ai-act-specialist

What this skill does

# EU AI Act Compliance Specialist

Production-ready compliance patterns for Regulation (EU) 2024/1689 -- the EU Artificial Intelligence Act. Covers risk classification, provider/deployer obligations, GPAI model requirements, conformity assessment, and AI governance.

---

## AI System Inventory and Classification Workflow

The agent classifies AI systems under the EU AI Act's risk-based framework and maps applicable obligations.

### Workflow: Classify and Map Obligations

1. **Inventory all AI systems** -- for each system, document: name, provider/developer, description, intended purpose, deployment status, affected persons, geographic scope, data processed, and decision impact level.
2. **Apply classification decision tree** to each system:
   - Does it meet the Art. 3(1) definition of an AI system? If no, document exclusion.
   - Does it fall under a prohibited practice (Art. 5)? If yes, flag as UNACCEPTABLE RISK -- must be discontinued.
   - Is it a safety component of an Annex I product? If yes, HIGH-RISK (product legislation path).
   - Does it fall under an Annex III category? If yes, apply Art. 6(3) exception analysis. If exception does not apply, HIGH-RISK.
   - Does Art. 50 transparency obligation apply? If yes, LIMITED RISK. Otherwise, MINIMAL RISK.
3. **Map obligations** based on classification -- assign compliance owners for each obligation.
4. **Run gap analysis** using `scripts/ai_compliance_checker.py` to identify compliance gaps.
5. **Prioritize remediation** by deadline urgency, penalty severity, and number of affected persons.
6. **Validation checkpoint:** Every AI system classified; prohibited practices flagged for immediate action; high-risk systems have assigned compliance owners and remediation timelines.

### Example: AI System Classification Output

```json
{
  "system_name": "Resume Screener v2.1",
  "provider": "Internal ML Team",
  "intended_purpose": "Screen job applications and rank candidates for recruiter review",
  "ai_act_classification": "HIGH-RISK",
  "classification_rationale": "Annex III Category 4 - Employment: AI for recruitment and screening of job applicants",
  "art_6_3_exception": false,
  "exception_rationale": "System directly influences which candidates proceed to interview stage - not a narrow procedural task",
  "applicable_obligations": [
    "Risk management system (Art. 9)",
    "Data governance (Art. 10)",
    "Technical documentation (Art. 11)",
    "Record-keeping / automatic logging (Art. 12)",
    "Transparency and information to deployers (Art. 13)",
    "Human oversight (Art. 14)",
    "Accuracy, robustness, cybersecurity (Art. 15)",
    "Quality management system (Art. 17)",
    "Conformity assessment (Art. 43)",
    "CE marking (Art. 48)",
    "EU database registration (Art. 49)",
    "Post-market monitoring (Art. 72)"
  ],
  "compliance_deadline": "2026-08-02",
  "assigned_owner": "Head of AI Governance"
}
```

---

## Risk Classification System

The AI Act uses a risk-based approach with four tiers.

### Tier 1: Prohibited Practices (Art. 5) -- Banned from 2 February 2025

| Prohibited Practice | Article |
|---------------------|---------|
| Social scoring by public authorities | Art. 5(1)(c) |
| Real-time remote biometric identification in public spaces (with narrow exceptions) | Art. 5(1)(h) |
| Emotion recognition in workplace and education (except medical/safety) | Art. 5(1)(f) |
| Individual predictive policing based solely on profiling | Art. 5(1)(d) |
| Exploitation of vulnerabilities (age, disability, social/economic situation) | Art. 5(1)(b) |
| Subliminal manipulation causing significant harm | Art. 5(1)(a) |
| Untargeted facial image scraping for recognition databases | Art. 5(1)(e) |
| Biometric categorization by sensitive attributes (race, religion, etc.) | Art. 5(1)(g) |

### Tier 2: High-Risk AI Systems (Art. 6, Annex III)

An AI system is high-risk if it falls under Annex III categories OR is a safety component of a product covered by Annex I harmonization legislation.

**Annex III Categories:**

| # | Category | Examples |
|---|----------|----------|
| 1 | Biometric identification and categorization | Remote biometric ID, emotion recognition |
| 2 | Critical infrastructure management | Road traffic, water/gas/electricity supply, digital infrastructure |
| 3 | Education and vocational training | Admissions, learning outcome evaluation, test monitoring |
| 4 | Employment and workers management | Recruitment/screening, promotion/termination, performance monitoring |
| 5 | Essential private and public services | Creditworthiness, insurance risk, public assistance eligibility |
| 6 | Law enforcement | Polygraph, deepfake detection, crime analytics |
| 7 | Migration, asylum, border control | Asylum risk assessment, visa/permit examination |
| 8 | Administration of justice | Judicial fact-finding, election influence |

### Tier 3: Limited Risk -- Transparency Obligations (Art. 50)

| System Type | Transparency Requirement |
|-------------|------------------------|
| Chatbots / AI interacting with persons | Inform person they are interacting with AI |
| Emotion recognition / biometric categorization | Inform exposed persons of system operation |
| Deepfakes / AI-generated content | Disclose AI generation; machine-readable labelling |
| AI-generated text on public interest matters | Disclose AI generation unless editorially reviewed |

### Tier 4: Minimal Risk

No mandatory requirements. Voluntary codes of conduct encouraged (Art. 95).

---

## Provider Obligations for High-Risk AI

Providers of high-risk AI systems must comply with all of the following:

| # | Obligation | Article | Key Requirement |
|---|-----------|---------|-----------------|
| 1 | Risk Management System | Art. 9 | Continuous iterative process throughout lifecycle; test against defined metrics |
| 2 | Data Governance | Art. 10 | Training/validation/testing datasets meet quality, representativeness, and bias criteria |
| 3 | Technical Documentation | Art. 11 | Drawn up before market placement; kept up to date throughout lifecycle |
| 4 | Record-Keeping / Logging | Art. 12 | Automatic recording of events enabling traceability |
| 5 | Transparency | Art. 13 | Instructions for use with capabilities, limitations, and oversight measures |
| 6 | Human Oversight | Art. 14 | Human-in-the-loop, on-the-loop, or in-command depending on risk |
| 7 | Accuracy, Robustness, Cybersecurity | Art. 15 | Appropriate levels declared and maintained; adversarial resilience |
| 8 | Quality Management System | Art. 17 | Documented QMS covering design, development, testing, data management, post-market |
| 9 | Conformity Assessment | Art. 43 | Internal control (Annex VI) or third-party assessment (Annex VII) |
| 10 | CE Marking | Art. 48 | Affix CE marking before market placement |
| 11 | EU Database Registration | Art. 49 | Register in EU database before market placement |
| 12 | Post-Market Monitoring | Art. 72 | Active systematic data collection; serious incident reporting within 15 days |

---

## Deployer Obligations (Art. 26)

| Obligation | Detail |
|-----------|--------|
| Use per instructions | Operate per provider's instructions for use |
| Human oversight | Assign competent, trained, authorized oversight personnel |
| Input data relevance | Ensure input data is relevant and representative |
| Monitoring | Monitor operation; inform provider of risks/incidents |
| Record-keeping | Keep auto-generated logs (minimum 6 months) |
| Inform workers | Notify workers/representatives before deployment of high-risk AI |
| DPIA | Carry out GDPR Art. 35 data protection impact assessment when required |
| Fundamental Rights Impact Assessment | Required for public bodies / private entities providing public services (Art. 27) |

---

## General-Purpose AI Models (GPAI)

### GPAI Provider Obligations (Art. 53) -- Effective 2 August 2025

| Obligation | Detail |
|-----------|--------|
| Technical documentation | Maintain documentation of mode