eu-ai-act

What it does

You are an expert EU AI Act compliance advisor with deep knowledge of Regulation (EU) 2024/1689 and the Digital Omnibus. The skill instructs you to cite governing Article, Annex, or Recital in responses. It defines an 8-Step Workflow to determine if modeled AI systems are providers, deployers, importers, distributors, or authorised representatives; classify AI systems and GPAI models; screen for prohibited practices (Art. 5) including the 9th prohibition effective 2 December 2026; determine risk tier (Art. 6); walk through High-Risk Obligations (Arts. 8–17, 26, 27) with detailed pre-deployment and ongoing duties; address Conformity Assessment and CE Marking (Arts. 43–48) and EU AI database registration; outline GPAI obligations (Arts. 53–55) and the GPAI Code of Practice (July 2025); describe Post-Market Monitoring and Incident Reporting (Art. 72, 73); and explain the Fundamental Rights Impact Assessment (FRIA, Art. 27) including who must perform it and its content, with a pre-deployment notification requirement to market surveillance authorities.

It emphasizes the August 2, 2026 enforcement powers of the AI Office over GPAI providers, the phase-in timelines (Annex III standalone 2 December 2027; Annex I embedded 2 August 2028), and cross-framework mappings to ISO 42001, NIST AI RMF, and GDPR. Use for any EU regulation, AI system classification, or AI compliance question; current as of July 2026.

How it works

• Identify user role (provider, deployer, importer, distributor, authorised representative) and Member State(s).
• Confirm AI system definition and GDPAI status (Art. 3(63)) and assess systemic risk (Art. 51).
• Run Prohibited Practices Screen (Art. 5) against categories including the 9th prohibition effective Dec 2, 2026. If match, deployment is unlawful.
• Determine Risk Tier per Art. 6: High-risk Path A or B, Limited risk (Art. 50), or Minimal risk.
• If High-risk, walk through Obligations Arts. 9–17, 26, 27 with explicit items: risk management, data governance, technical docs, record-keeping, transparency, human oversight, accuracy/robustness/cybersecurity, provider checklist, QMS, deployer obligations (Art. 26), and FRIA (Art. 27).
• Apply Deployer Obligations (Art. 26 rows 1–10) in order and assess Met/Partial/Gap, noting pre-deployment gates vs ongoing duties.
• Cover Conformity Assessment and CE Marking (Arts. 43–48) and EU AI database registration (Arts. 49, 60).
• Address GPAI Obligations (Arts. 53–55) including Safety and Security Framework, red-teaming, risk assessment, incident reporting, and Code of Practice (July 2025).
• Outline Post-Market Monitoring requirements (Art. 72) and incident reporting (Art. 73).
• Explain FRIA scope (Art. 27) including who must perform it, its contents (a–f), and the pre-deployment notification requirement to market surveillance authorities, plus how FRIA interacts with GDPR DPIAs.

When to use it

Use when advising on EU AI Act compliance; specifically for determining provider/deployer roles, classifying AI systems (including GPAI), evaluating prohibited practices, applying risk tiers, planning obligations (risk management, data governance, documentation, transparency, human oversight, logging, notifications), and coordinating FRIA and DPIA processes before deployment. Also apply when preparing for GPAI enforcement timelines and post-market surveillance.

What it can touch

• Tools: "claude-code" (as declared in the skill).
• It references articles, annexes, and the GPAI Code of Practice, but does not perform any external actions by itself.

Caveats

• The 9th prohibited practice (CSAM) applies from 2 December 2026 with a safe harbour if safeguards exist.
• Enforcement powers for GPAI providers activate on August 2, 2026; compliance includes Safety and Security Framework submission for systemic risk models and documentation readiness for AI Office review.
• Timelines updated by Digital Omnibus: Annex III standalone 2 December 2027; Annex I embedded 2 August 2028; GPAI obligations earlier (2 August 2025).
• FRIA applicability is deployment-scoped (Art. 27) and depends on Annex III deployer categories (5(b)/(c)); if not applicable, FRIA is not required.