How do I install the AI Compliance skill?

Run npx skillmds@latest add cslawyer1985/ai-compliance in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is AI Compliance safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with AI Compliance?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is AI Compliance free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published AI Compliance?

cslawyer1985 (@cslawyer1985) published this skill. Their other Agent Skills are listed on their SkillMD profile.

AI Compliance by cslawyer1985 — Agent Skill

Name: AI Compliance
Author: cslawyer1985

AI Compliance

AI compliance analysis for EU AI Act, ISO 42001, NIST AI RMF, GDPR, OECD, financial services regulations (SEC, FCA, FINRA, DORA, MiFID II), and other frameworks. Use when asked to generate a compliance checklist for an AI tool or use case, determine if a risk assessment is required, score an AI tool's risk level, identify where an AI tool or use case could run afoul of regulatory requirements, perform a gap analysis, recommend remediation steps, assess a vendor, draft an acceptable use policy, map training requirements, or review jurisdiction-specific AI rules. Triggers on phrases like "compliance checklist", "risk assessment", "risk score", "does this comply", "EU AI Act", "ISO 42001", "NIST AI RMF", "AI governance", "gap analysis", "vendor assessment", "acceptable use policy", "MNPI", "AI training requirements", or any request to evaluate an AI tool or use case for regulatory compliance or risk.

cslawyer1985 Updated Sep 17, 2026

File contents

AI Compliance Skill

Reference Files

Load only what's needed based on the request type:

Frameworks

EU AI Act → references/eu-ai-act.md — risk tiers, prohibited uses, obligations
ISO 42001 → references/iso-42001.md — clauses, Annex A controls
NIST AI RMF → references/nist-ai-rmf.md — GOVERN/MAP/MEASURE/MANAGE
GDPR, OECD, IEEE, UK, Singapore → references/other-frameworks.md
Financial services (SEC, FCA, FINRA, DORA, MiFID II, MNPI) → references/finserv-regulations.md
Jurisdiction map (global regulatory landscape) → references/jurisdiction-map.md
ISO 27001 alignment → references/iso27001-alignment.md

Output Templates & Tools

Checklists, risk assessment, gap analysis templates → references/checklist-templates.md
Vendor AI risk assessment questionnaire → references/vendor-assessment.md
Acceptable use policy template → references/aup-template.md
Data classification × AI tool matrix → references/data-classification.md
AI system inventory template → references/ai-inventory.md
AI risk scoring model (0–100) → references/risk-scoring.md
Training requirements by role → references/training-requirements.md

Remediation

Incident response playbooks → references/incident-response.md
Remediation playbooks (common gaps) → references/remediation-playbooks.md

When in doubt about which files to load, load the framework files + the relevant output template.

Workflow

1. Understand the AI Tool/Use Case

Gather (or ask for):

What does the AI system do? (intended purpose)
Who uses it and how? (internal staff, customers, automated pipeline)
What data does it process? (personal, financial, confidential, public)
Where is it deployed? (EU context? affecting EU residents?)
Consumer or enterprise tier? Third-party or internal?

2. Select Output Type

Request	Load	Output
Compliance checklist	Framework files + checklist-templates.md	Full checklist per Template 1
Risk assessment needed?	eu-ai-act.md + checklist-templates.md	Risk tier determination per Template 2
Gap analysis	All framework files + checklist-templates.md	Gap table per Template 3
Risk score	risk-scoring.md	Scored worksheet + risk level
Vendor assessment	vendor-assessment.md	Questionnaire + scoring
AUP draft	aup-template.md	Customized policy draft
Data classification guidance	data-classification.md	Matrix + decision tree
Incident response	incident-response.md	Relevant playbook
Remediation steps	remediation-playbooks.md	Relevant playbook(s)
Financial services overlay	finserv-regulations.md	Regulatory requirements
Training requirements	training-requirements.md	Role-based matrix
Jurisdiction guidance	jurisdiction-map.md	Applicable rules by region

3. Output Structure

Always structure output as:

## AI Compliance Assessment: [Tool/Use Case Name]
### Risk Classification
### Applicable Frameworks
### Compliance Checklist (or Gap Analysis or Risk Score)
### Issues Found
### Recommendations
### Priority Actions

Key Principles

Reference exact articles, clauses, controls (e.g., "EU AI Act Art.14", "ISO 42001 A.6.1", "NIST GOVERN 1.2")
Flag HIGH/CRITICAL severity issues prominently — these are blockers
Always include remediation steps, not just gaps — link to remediation-playbooks.md when relevant
Cross-reference frameworks where they overlap
For financial services firms: always check finserv-regulations.md for MNPI and sector-specific rules
When uncertain about risk tier, err toward higher risk classification

---name: ai-compliancedescription: AI compliance analysis for EU AI Act, ISO 42001, NIST AI RMF, GDPR, OECD, financial services regulations (SEC, FCA, FINRA, DORA, MiFID II), and other frameworks. Use when asked to generate a compliance checklist for an AI tool or use case, determine if a risk assessment is required, score an AI tool's risk level, identify where an AI tool or use case could run afoul of regulatory requirements, perform a gap analysis, recommend remediation steps, assess a vendor, draft an acceptable use policy, map training requirements, or review jurisdiction-specific AI rules. Triggers on phrases like "compliance checklist", "risk assessment", "risk score", "does this comply", "EU AI Act", "ISO 42001", "NIST AI RMF", "AI governance", "gap analysis", "vendor assessment", "acceptable use policy", "MNPI", "AI training requirements", or any request to evaluate an AI tool or use case for regulatory compliance or risk.---# AI Compliance Skill## Reference FilesLoad only what's needed based on the request type:### Frameworks- **EU AI Act** → `references/eu-ai-act.md` — risk tiers, prohibited uses, obligations- **ISO 42001** → `references/iso-42001.md` — clauses, Annex A controls- **NIST AI RMF** → `references/nist-ai-rmf.md` — GOVERN/MAP/MEASURE/MANAGE- **GDPR, OECD, IEEE, UK, Singapore** → `references/other-frameworks.md`- **Financial services (SEC, FCA, FINRA, DORA, MiFID II, MNPI)** → `references/finserv-regulations.md`- **Jurisdiction map (global regulatory landscape)** → `references/jurisdiction-map.md`- **ISO 27001 alignment** → `references/iso27001-alignment.md`### Output Templates & Tools- **Checklists, risk assessment, gap analysis templates** → `references/checklist-templates.md`- **Vendor AI risk assessment questionnaire** → `references/vendor-assessment.md`- **Acceptable use policy template** → `references/aup-template.md`- **Data classification × AI tool matrix** → `references/data-classification.md`- **AI system inventory template** → `references/ai-inventory.md`- **AI risk scoring model (0–100)** → `references/risk-scoring.md`- **Training requirements by role** → `references/training-requirements.md`### Remediation- **Incident response playbooks** → `references/incident-response.md`- **Remediation playbooks (common gaps)** → `references/remediation-playbooks.md`When in doubt about which files to load, load the framework files + the relevant output template.## Workflow### 1. Understand the AI Tool/Use CaseGather (or ask for):- What does the AI system do? (intended purpose)- Who uses it and how? (internal staff, customers, automated pipeline)- What data does it process? (personal, financial, confidential, public)- Where is it deployed? (EU context? affecting EU residents?)- Consumer or enterprise tier? Third-party or internal?### 2. Select Output Type| Request | Load | Output ||---|---|---|| Compliance checklist | Framework files + checklist-templates.md | Full checklist per Template 1 || Risk assessment needed? | eu-ai-act.md + checklist-templates.md | Risk tier determination per Template 2 || Gap analysis | All framework files + checklist-templates.md | Gap table per Template 3 || Risk score | risk-scoring.md | Scored worksheet + risk level || Vendor assessment | vendor-assessment.md | Questionnaire + scoring || AUP draft | aup-template.md | Customized policy draft || Data classification guidance | data-classification.md | Matrix + decision tree || Incident response | incident-response.md | Relevant playbook || Remediation steps | remediation-playbooks.md | Relevant playbook(s) || Financial services overlay | finserv-regulations.md | Regulatory requirements || Training requirements | training-requirements.md | Role-based matrix || Jurisdiction guidance | jurisdiction-map.md | Applicable rules by region |### 3. Output StructureAlways structure output as:```## AI Compliance Assessment: [Tool/Use Case Name]### Risk Classification### Applicable Frameworks### Compliance Checklist (or Gap Analysis or Risk Score)### Issues Found### Recommendations### Priority Actions```## Key Principles- Reference exact articles, clauses, controls (e.g., "EU AI Act Art.14", "ISO 42001 A.6.1", "NIST GOVERN 1.2")- Flag HIGH/CRITICAL severity issues prominently — these are blockers- Always include remediation steps, not just gaps — link to remediation-playbooks.md when relevant- Cross-reference frameworks where they overlap- For financial services firms: always check finserv-regulations.md for MNPI and sector-specific rules- When uncertain about risk tier, err toward higher risk classification

Frequently asked questions