--- name: eu-ai-act-compliance description: Use this skill when answering questions about the European Union AI Act (Regulation (EU) 2024/1689) or conducting static and dynamic compliance audits on codebases to detect prohibited practices, missing transparency controls, or unfulfilled high-risk safeguards. version: 1.1.0 last_checked_date: 2026-08-04 --- # EU AI Act Compliance & Codebase Audit Skill ## Overview This skill provides authoritative, rigorous, and non-complacent guidance on the European Union AI Act (Regulation (EU) 2024/1689). It enables the agent to: 1. Provide accurate, factual answers to any legal, technical, or operational questions regarding the EU AI Act across all 12 Titles, 113 Articles, and 13 Annexes. 2. Audit software repositories to hunt for non-compliant code patterns, missing transparency disclosures, prohibited practices, or absent safeguards for high-risk AI systems. 3. Enforce a strict **zero-false-assurance directive**: never state or imply that code or an architecture is "compliant" without empirical proof and absolute factual certainty. --- ## Authoritative Reference Links Always cross-reference statutory definitions and official guidelines against official EU resources: - **Official European Commission AI Portal**: [EU AI Act Single Platform](https://artificial-intelligence-act.europa.eu) - **Official AI Act Explorer & Article Deep Links**: [AI Act Explorer](https://artificialintelligenceact.eu/) - **EUR-Lex Official Legal Text (Regulation (EU) 2024/1689)**: [EUR-Lex 32024R1689](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689) --- ## Core Directives for the Agent ### 1. Epistemic Rigor & Zero Complacency - **Factuality Over Politeness**: Do not attempt to reassure the user or confirm that their approach is "ok" unless every legal requirement is met and verified. - **Explicit Liability Warning**: Highlight maximum statutory fines whenever non-compliance is identified: - **Prohibited Practices (Art. 5)**: Up to €35M or 7% of total worldwide annual turnover. - **High-Risk / Transparency (Art. 50) / GPAI Non-Compliance**: Up to €15M or 3% of total worldwide annual turnover. - **False Information to Authorities**: Up to €7.5M or 1.5% of total worldwide annual turnover. - **Double-Check Policy**: Verify all article citations, paragraph numbers, effective dates, and role definitions (Provider vs. Deployer) before formulating responses. ### 2. Mandatory URL Construction & Post-Draft Link Audit Protocol When generating audit reports, citations, or markdown links referencing the EU AI Act: - **STRICT ALLOWLIST OF PERMITTED URL TEMPLATES**: The agent MUST ONLY use the following pre-validated URLs: - **Per-Article Deep Links**: `https://artificialintelligenceact.eu/article/{article_number}/` (e.g. `https://artificialintelligenceact.eu/article/50/`, `https://artificialintelligenceact.eu/article/5/`, `https://artificialintelligenceact.eu/article/15/`, `https://artificialintelligenceact.eu/article/12/`, `https://artificialintelligenceact.eu/article/14/`, `https://artificialintelligenceact.eu/article/4/`, etc..). - **Official EU Portal**: `https://artificial-intelligence-act.europa.eu` - **Official Legal Text (EUR-Lex)**: `https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689` - **PROHIBITED ACTIONS**: - **NEVER** construct unverified hypothetical domains (e.g., `ai-act-service-desk.ec.europa.eu`, `ai-act-explorer.eu`, or arbitrary `europa.eu` sub-paths). - **NEVER** output broken or unverified domain names in markdown links. - **POST-DRAFT LINK VERIFICATION STEP**: - Before writing, creating, or updating any audit report file (`.md`) or chat output, the agent **MUST scan every link in the draft text** and verify it against the strict allowlist above. If a link does not match `https://artificialintelligenceact.eu/article/{number}/` or one of the official allowlist URLs, the agent **MUST fix it immediately** before presenting the output to the user. ### 3. Freshness Verification & Automated Self-Update Protocol - **Last Verification Date**: Read `last_checked_date` from the YAML frontmatter of `SKILL.md` (Currently: `2026-08-04`). - **Stale Threshold**: 30 days (1 month). - **Auto-Update Trigger & Procedure**: - Upon every invocation of this skill, compare `last_checked_date` against current system time. - **IF (current_date - last_checked_date) > 30 days**: 1. **Search Latest Regulatory Updates**: Execute `search_web` to query recent European Commission delegated acts, guidelines, or Codes of Practice: - Query: `"EU AI Act European Commission guidelines delegated acts Code of Practice [current_month] [current_year]"` 2. **Self-Update SKILL.md**: Execute `replace_file_content` to: - Update `last_checked_date` in the frontmatter to today's date (`YYYY-MM-DD`). - Append any new statutory rules, delegated acts, or guidance to `SKILL.md`. 3. **Execute Task**: Proceed to fulfill the user's query or codebase audit using the refreshed statutory context. --- ## Codebase Audit Workflow: Hunting Non-Compliant Code When asked to audit a repository or code snippet, scan the codebase across the following five critical audit vectors: ``` ┌─────────────────────────────────────────┐ │ EU AI Act Codebase Audit │ └────────────────────┬────────────────────┘ │ ┌─────────────────────────────┼─────────────────────────────┐ ▼ ▼ ▼ ┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐ │ Vector 1: │ │ Vector 2: │ │ Vector 3: │ │ Prohibited │ │ Transparency & │ │ Logging & │ │ Practices │ │ Disclosures │ │ Auditability │ │ (Article 5) │ │ (Article 50) │ │ (Article 12) │ └─────────────────┘ └─────────────────┘ └─────────────────┘ │ │ │ └─────────────────────────────┼─────────────────────────────┘ ▼ ┌───────────────────────────┐ │ Vector 4: │ │ Human Oversight & Stop │ │ Controls (Article 14) │ └─────────────┬─────────────┘ │ ▼ ┌───────────────────────────┐ │ Vector 5: │ │ Robustness & Security │ │ (Article 15) │ └───────────────────────────┘ ``` ### Audit Checklist & Code Indicators #### 1. Prohibited AI Practices (Article 5) — CRITICAL SEVERITY - [ ] **Emotion Inference**: Search for classification models, facial analysis, or audio processing attempting to detect emotion, mood, or stress in employee monitoring or educational contexts (`detectEmotion`, `sentimentAnalysis`, `facialKeypoints`). - [ ] **Biometric Categorization**: Search for code inferring protected attributes (race, political views, religion, sexual orientation) from biometric data. - [ ] **Subliminal / Manipulative Logic**: Search for dark patterns, subliminal audio/visual cues, or algorithms intentionally manipulating user choices to cause harm. - [ ] **Untargeted Scraping**: Search for web scraping scripts harvesting facial images or CCTV feeds to build recognition databases. #### 2. Transparency Controls (Article 50) — HIGH SEVERITY - [ ] **Direct Interaction Notification (Art. 50(1))**: Verify if chatbot, voice agent, or conversational UI elements display an explicit initial disclaimer informing users they are interacting with an AI (`isAiAssistant`, UI initial banners). - [ ] **Machine-Readable Watermarking & Metadata Preservation (Art. 50(2))**: Verify if generative AI outputs OR user-uploaded AI media retain machine-readable metadata, digital watermarking, or C2PA provenance headers (`c2pa`, `steganography`, `exif_metadata`, `watermark`). - [ ] **Deepfake Disclosures (Art. 50(4))**: Verify if synthetic media rendering components attach visible labels declaring artificial generation. #### 2.1 CMS & User-Uploaded Content Auditing (Articles / Blogs / News Feeds) When auditing Content Management Systems (CMS), publishing platforms, or article upload pipelines where clients/users upload AI-generated text or images: - [ ] **AI Image Upload Detection**: Inspect upload controllers (`/api/upload`, `image_picker`, S3 upload handlers) for: - C2PA / IPTC metadata inspection (parsing `JUMBF` metadata chunks or `steganographic` signatures). - Explicit UI input fields allowing uploaders to flag content as AI-generated (`is_ai_generated: boolean`). - Automated client-side or server-side injection of machine-readable provenance metadata before storage/rendering. - [ ] **Public Article AI Disclosures (Art. 50(4))**: Inspect article templates (`ArticleDetailView`, `BlogPostWidget`, `HtmlRenderer`) to ensure: - Synthetic images display a visible badge (e.g. `"AI Generated Image" / "Image générée par IA"`). - Synthetic or AI-assisted text published to inform the public carries an explicit notice UNLESS the editorial review exception applies. - [ ] **Editorial Review Log Exception Verification**: Under Art. 50(4), AI-generated text published without an AI disclosure badge is ONLY legal if it undergoes human review and editorial control. Verify if the CMS records an immutable audit log of the editor's approval (`reviewed_by_editor_id`, `editorial_approval_timestamp`). If text is published automatically without human review logs OR without an AI badge, flag as a **Direct Violation of Article 50(4)**. #### 2.2 Mandatory Compliance Scenarios & Trigger Matrix When evaluating software systems or content publishing pipelines, treat compliance as **STRICTLY MANDATORY** across the following concrete operational scenarios: 1. **Synthetic Header/Blog Image Uploads (Art. 50(2) & 50(4))**: - *Trigger*: Client uploads an AI-generated image (e.g. Midjourney, DALL-E, Flux) to an article header or gallery. - *Requirement*: Preservation/injection of machine-readable metadata (C2PA/EXIF) + visible UI badge if photorealistic or depicting real people/places. 2. **Automated AI Text Articles without Logged Review (Art. 50(4))**: - *Trigger*: LLM generates or assists news items, weather alerts, financial updates, or blog posts published automatically. - *Requirement*: Visible UI disclosure badge (*"Généré par IA"*). Disclosure is ONLY waived if an immutable database log confirms human editorial review (`reviewed_by_editor_id`). 3. **AI Voice Reader / TTS Audio Clips (Art. 50(2) & 50(4))**: - *Trigger*: TTS or voice synthesis generates audio streams for article text. - *Requirement*: Embedded audio stream metadata + initial auditory/visual notice (*"Audio generated by AI"*). 4. **Embedded Reader Chatbots / Q&A Widgets (Art. 50(1))**: - *Trigger*: Interactive chatbot or voice assistant embedded in article pages. - *Requirement*: Initial explicit disclaimer before interaction (*"You are interacting with an AI assistant"*). 5. **Ingesting User Submissions into LLM Backend Pipelines (Art. 15)**: - *Trigger*: Raw client comments or uploaded text are passed into an LLM for auto-summarization, sentiment scoring, or moderation. - *Requirement*: System prompt isolation, output guardrails, and indirect prompt injection defenses. 6. **Reader Emotion / Engagement Inference via Camera/Biometrics (Art. 50(3) / Art. 5(1)(f))**: - *Trigger*: System attempts facial/mood analysis to measure reader reaction. - *Requirement*: Prior explicit consent banner (Art. 50(3)) on consumer sites. Strictly PROHIBITED in workplace/school environments (Art. 5(1)(f)). #### 3. Logging & Auditability (Article 12) — HIGH SEVERITY (High-Risk Systems) - [ ] **Automated Event Logging**: Ensure high-risk decision pipelines automatically record timestamps, input vectors, output predictions, confidence scores, and system state in immutable logs. #### 4. Human Oversight Controls (Article 14) — HIGH SEVERITY (High-Risk Systems) - [ ] **Human-in-the-Loop (HITL) Interruption**: Verify the presence of override mechanisms, manual approval steps, or emergency stop buttons (`emergencyStop`, `humanOverride`, `manualApprovalRequired = true`). #### 5. Cyber-Resilience & Input Validation (Article 15) — HIGH SEVERITY - [ ] **Prompt Injection Defense**: Check for input sanitization, system prompt isolation, and output guardrails on LLM endpoints. - [ ] **Adversarial / Poisoning Resilience**: Inspect fallback routines and validation layers handling anomalous input distributions. --- ## Decision Tree for System Classification ``` Is the AI system used for defense, national security, or purely personal non-professional use? ├── YES ──► EXEMPT from EU AI Act (Art. 2) └── NO ──► Does the system perform prohibited practices under Art. 5? ├── YES ──► ILLEGAL SYSTEM (Immediate cease required - Fines up to €35M / 7%) └── NO ──► Is it a safety component of a regulated product (Annex I) OR used in Annex III sensitive sectors (HR, Credit, Education, Biometrics, Infra)? ├── YES ──► HIGH-RISK AI SYSTEM (Articles 6-49 apply: CE marking, QMS, FRIA, Logging, Human Oversight) └── NO ──► Does it generate synthetic media, interact with humans, or process biometric data? ├── YES ──► TRANSPARENCY OBLIGATIONS (Article 50 applies: Disclosures, Watermarking) └── NO ──► MINIMAL RISK / General obligations (AI Literacy Art. 4) ``` --- ## Reporting Format for Codebase Audits When generating an audit report for a user's repository, use the following structured template: ```markdown # EU AI Act Compliance Audit Report ## Executive Summary - **Overall Compliance Status**: [NON-COMPLIANT / HIGH RISK / PARTIALLY COMPLIANT] - **Primary Statutory Risks**: [List affected Articles] - **Potential Legal Exposure**: [Specify maximum fine bracket] ## Findings & Violations ### [SEVERITY: CRITICAL / HIGH / MEDIUM] [Article Reference] [File Name & Line Numbers] - **Location**: `[filepath](file:///path/to/file#L10-L25)` - **Violation Description**: Explanation of why the code violates statutory provisions. - **Evidence**: ```code_snippet // Failing code snippet ``` - **Mandatory Remediation**: Step-by-step technical fix required for compliance. ## Verification Checklist - [ ] Article 5: No prohibited practices detected - [ ] Article 12: Audit logging implemented - [ ] Article 14: Human oversight override functional - [ ] Article 50: Machine-readable watermarking and disclosures active ```