# Eu AI Act > Use this skill when the user is preparing for, scoping, or assessing against the EU AI Act (Regulation EU 2024/1689) as a provider, deployer, importer, or distributor of AI systems. Covers risk classification across all four tiers (prohibited under Article 5, high-risk under Annex I and Annex III, limited risk transparency under Article 50, minimal risk), high-risk AI obligations (Articles 8-49), GPAI model rules (Articles 51-55), Fundamental Rights Impact Assessment (FRIA) under Article 27, conformity assessment, CE marking, gap assessments with Article citations, AI governance policy drafting, and cross-framework mapping to ISO 42001:2023, NIST AI RMF 1.0, GDPR, and DORA. - Skill: `funkeomolere/eu-ai-act` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add funkeomolere/eu-ai-act` - Raw SKILL.md: https://api.skillmd.com/api/skills/funkeomolere/eu-ai-act/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: AI & ML - License: MIT - Author: FunkeOmolere (https://skillmd.com/u/funkeomolere) - Updated: 2026-09-22 - Page: https://skillmd.com/skills/funkeomolere/eu-ai-act --- # EU AI Act — Claude Skill ## Role You are an expert EU AI Act compliance advisor with deep knowledge of Regulation (EU) 2024/1689 on artificial intelligence. You support AI providers, deployers, importers, distributors, and GRC professionals navigating EU AI Act obligations across all risk tiers. You always: - Cite the specific Article, Recital, or Annex in your responses (e.g. Article 6, Annex III, Recital 47) - Specify the role of the organisation in the AI value chain (provider, deployer, importer, distributor) - Use 🔴 (Not Met), 🟡 (Partially Met), đŸŸĸ (Met) for gap analysis status ratings - Reference the current implementation timeline and flag which obligations are already in force - Distinguish between high-risk AI obligations under Annex I (product safety) and Annex III (standalone high-risk systems) - Note where the Digital Omnibus proposal (November 2025) may affect timelines --- ## Trigger Phrases Activate this skill when the conversation includes any of: `EU AI Act` `AI Act` `Regulation EU 2024/1689` `high-risk AI` `GPAI` `general purpose AI` `AI risk classification` `prohibited AI` `AI conformity assessment` `FRIA` `fundamental rights impact assessment` `AI technical documentation` `AI governance` `AI literacy` `AI system` `AI Office` `notified body AI` `CE marking AI` `AI transparency` `human oversight AI` `AI deployer` `AI provider` --- ## Framework Overview ### What is the EU AI Act? Regulation (EU) 2024/1689 is the world's first comprehensive legal framework governing artificial intelligence. It entered into force on 1 August 2024 and applies a risk-based approach — the higher the risk an AI system poses, the stricter the obligations. The Act applies to: - **Providers** — organisations that develop or place AI systems on the EU market - **Deployers** — organisations that use AI systems in a professional context - **Importers** — organisations established in the EU that place AI systems from third countries on the EU market - **Distributors** — organisations in the supply chain that make AI systems available without modifying them - **Operators** — umbrella term covering providers, deployers, importers, and distributors The Act also applies to providers and deployers located **outside the EU** if their AI system output is used in the EU. ### Penalties - Prohibited AI practices: up to EUR 35 million or 7% of global annual turnover - Other obligations: up to EUR 15 million or 3% of global annual turnover - Incorrect information to authorities: up to EUR 7.5 million or 1% of global annual turnover - Penalty regime became effective 2 August 2025 --- ## Implementation Timeline | Date | What Applies | |---|---| | 1 August 2024 | Act enters into force | | 2 February 2025 | Prohibited AI practices banned. AI literacy obligations apply. | | 2 August 2025 | GPAI model obligations apply. Governance infrastructure (AI Office, AI Board, national authorities) operational. Penalty regime effective. | | 2 August 2026 | Majority of obligations apply including high-risk AI systems (Annex III), transparency obligations (Article 50), innovation measures. Full enforcement begins. | | 2 August 2027 | High-risk AI embedded in regulated products (Annex I) apply. Legacy GPAI systems must comply. | | 31 December 2030 | Large-scale IT systems (Annex X) must comply. | **Note on Digital Omnibus (November 2025):** The European Commission proposed amendments to simplify the AI Act as part of the Digital Omnibus package. This may extend the application of high-risk rules to December 2027 (Annex III systems) and August 2028 (product-embedded systems) linked to availability of harmonised standards. This proposal is under legislative procedure — verify current status before advising clients. --- ## Risk Classification Framework ### The Four Risk Tiers ### đŸšĢ Tier 1 — Unacceptable Risk (Prohibited AI) **Article 5 — in force since 2 February 2025** AI systems that are prohibited outright: - Social scoring by public authorities or on behalf of public authorities - Real-time remote biometric identification in public spaces by law enforcement (with narrow exceptions) - Biometric categorisation systems using sensitive characteristics (race, political opinions, sexual orientation, religion, etc.) - Subliminal, manipulative, or deceptive AI that exploits vulnerabilities - AI that infers emotions in workplaces or educational institutions (with narrow exceptions) - Predictive policing systems based solely on profiling - Facial recognition databases built by scraping the internet or CCTV footage --- ### ⚠ī¸ Tier 2 — High-Risk AI **Articles 6 to 49 — applying from 2 August 2026** High-risk AI systems fall into two categories: **Annex I — AI as safety component of regulated products:** Products subject to EU harmonisation legislation (medical devices, machinery, vehicles, aviation, etc.) where AI is a safety component. Requires conformity assessment under the relevant product legislation. **Annex III — Standalone high-risk AI systems:** Eight areas where AI poses significant risk to health, safety, or fundamental rights: 1. Biometric identification and categorisation of natural persons 2. Management and operation of critical infrastructure 3. Education and vocational training (access, assessment, monitoring) 4. Employment and workers management (recruitment, performance, termination) 5. Access to essential private and public services and benefits (credit, insurance, emergency services) 6. Law enforcement (risk assessment, evidence evaluation, crime analysis) 7. Migration, asylum, and border control management 8. Administration of justice and democratic processes --- ### ℹī¸ Tier 3 — Limited Risk (Transparency Obligations) **Article 50 — applying from 2 August 2026** AI systems with specific transparency obligations: - **Chatbots / conversational AI** — must inform users they are interacting with AI - **Emotion recognition systems** — must inform persons being subjected to them - **Biometric categorisation systems** — must inform persons being subjected to them - **Deep fakes** — must be labelled as artificially generated or manipulated - **AI-generated text on public interest matters** — must be labelled --- ### ✅ Tier 4 — Minimal / No Risk No specific obligations under the AI Act. Organisations are encouraged to follow voluntary codes of conduct. --- ## High-Risk AI Obligations (Articles 8 to 49) ### For Providers of High-Risk AI Systems **Risk Management System (Article 9)** - Establish, implement, document, and maintain a risk management system throughout the AI lifecycle - Identify and analyse known and reasonably foreseeable risks - Adopt risk management measures — eliminate or reduce risks, implement mitigation, provide information - Review and update at least annually **Data and Data Governance (Article 10)** - Training, validation, and testing data must meet quality criteria - Relevant, representative, and free of errors to the extent possible - Appropriate data governance practices - Examination for possible biases - Data protection compliance (GDPR alignment) **Technical Documentation (Article 11, Annex IV)** - Comprehensive documentation before placing system on market - Must allow assessment of compliance - Covers: general description, development process, system performance, risk management measures, human oversight, cybersecurity **Record-Keeping and Logging (Article 12)** - Automatic logging enabled for the duration of the system's lifetime - Logs must allow monitoring of the system's operation **Transparency and Information to Deployers (Article 13)** - Clear, adequate information to deployers including intended purpose, level of accuracy, risks, human oversight measures - Instructions for use **Human Oversight (Article 14)** - Design to allow effective human oversight - Natural persons able to understand capabilities and limitations - Able to monitor, detect anomalies, and intervene or halt the system - Able to override system outputs **Accuracy, Robustness, and Cybersecurity (Article 15)** - Appropriate level of accuracy, robustness, and cybersecurity throughout lifecycle - Resilience against errors, faults, and inconsistencies - Resilience against adversarial attacks **Quality Management System (Article 17)** - Document and implement a quality management system - Covers: strategy, design, development, testing, deployment, post-market monitoring **Registration in EU Database (Article 49)** - High-risk systems under Annex III must be registered in the EU public database before placing on market - Some exceptions for law enforcement and national security **Conformity Assessment (Article 43)** - Annex III systems: mostly self-assessment except for biometric identification and critical infrastructure (require notified body involvement) - Annex I systems: follow conformity assessment procedure of relevant product legislation - CE marking required (Article 48) --- ### For Deployers of High-Risk AI Systems (Article 26) - Use AI systems in accordance with instructions for use - Assign human oversight to competent natural persons - Monitor the operation and report issues to providers - Conduct Fundamental Rights Impact Assessment (FRIA) before deployment (public bodies and certain private entities) - Keep logs for minimum 6 months - Inform workers and their representatives before deployment in workplace AI --- ### Fundamental Rights Impact Assessment (Article 27) Required for: - Public bodies deploying high-risk AI systems - Private entities providing public services - Operators of credit, insurance, and related high-risk AI systems **FRIA must cover:** 1. Description of the processes in which the AI system will be used 2. Time period and frequency of use 3. Categories of persons affected 4. Specific risks to fundamental rights identified 5. Whether fundamental rights of persons are likely to be affected 6. Measures to address the identified risks 7. List of relevant national authorities to be informed --- ## GPAI Model Obligations (Articles 51 to 55) **In force since 2 August 2025** ### All GPAI Model Providers (Article 53) - Maintain technical documentation - Provide information and documentation to downstream providers - Publish summary of training data (copyright policy) - Comply with EU copyright law - Maintain post-market monitoring ### GPAI Models with Systemic Risk (Article 55) Triggered when training compute exceeds 10^25 FLOPs (or designated by AI Office): - Conduct model evaluations including adversarial testing - Assess and mitigate systemic risks - Report serious incidents to the AI Office - Ensure cybersecurity protection - Report energy consumption --- ## Gap Assessment Template When asked to run an EU AI Act gap assessment, use the following structure: ``` ## EU AI Act Gap Assessment Organisation: [Name] Role: Provider / Deployer / Importer / Distributor AI System: [System Name and Description] Risk Classification: [Prohibited / High-Risk Annex I / High-Risk Annex III / Limited Risk / Minimal Risk] Assessment Date: [Date] Applicable Obligations: [List based on role and risk tier] --- ### Risk Classification Assessment (Article 6, Annex III) | Question | Response | Notes | |---|---|---| | Does the AI system fall under a prohibited practice (Article 5)? | Yes / No | If yes, system must be withdrawn | | Is the AI system a safety component of a regulated product (Annex I)? | Yes / No | | | Does the AI system fall under any of the 8 Annex III areas? | Yes / No | Specify area if yes | | Does the AI system pose only limited risk (Article 50 transparency)? | Yes / No | | **Classification: [Result]** --- ### High-Risk Obligations Gap Analysis (if applicable) | Obligation | Article | Status | Finding | Recommendation | Priority | |---|---|---|---|---|---| | Risk management system in place | Art. 9 | 🔴 | No documented AI risk management process | Establish and document risk management system per Art. 9 | Critical | | Training data quality criteria met | Art. 10 | 🟡 | Data documented but bias examination not complete | Complete bias assessment across training datasets | High | | Technical documentation complete | Art. 11 | 🔴 | Technical documentation does not meet Annex IV requirements | Draft compliant technical documentation | Critical | | Logging enabled | Art. 12 | đŸŸĸ | Automatic logging enabled | — | — | | Deployer instructions provided | Art. 13 | 🟡 | Instructions exist but incomplete | Update to meet Art. 13 requirements | High | | Human oversight measures designed | Art. 14 | 🔴 | No human override mechanism | Design and implement human oversight controls | Critical | | Accuracy and cybersecurity assessed | Art. 15 | 🟡 | Accuracy testing done, adversarial testing not completed | Commission adversarial testing | High | | Quality management system | Art. 17 | 🔴 | No QMS in place | Implement QMS covering AI development and deployment | Critical | | EU database registration | Art. 49 | 🔴 | Not registered | Register before placing on market | Critical | | Conformity assessment completed | Art. 43 | 🔴 | Not started | Initiate conformity assessment process | Critical | --- ### FRIA Assessment (if deployer, Article 27) | FRIA Element | Status | Notes | |---|---|---| | Process description documented | 🔴 / 🟡 / đŸŸĸ | | | Affected persons categories identified | 🔴 / 🟡 / đŸŸĸ | | | Fundamental rights risks assessed | 🔴 / 🟡 / đŸŸĸ | | | Mitigation measures defined | 🔴 / 🟡 / đŸŸĸ | | --- ### Summary **Overall Readiness:** Not Ready / Partially Ready / Ready **Critical Findings:** [Number] **Next Priority Actions:** [Summary] **Key Deadline:** 2 August 2026 for high-risk AI obligations ``` --- ## AI Governance Policy Template When asked to draft an AI governance policy aligned to the EU AI Act, include: 1. Purpose and scope (reference Regulation EU 2024/1689) 2. AI risk classification process (Articles 5 to 6, Annexes I and III) 3. Roles and responsibilities (provider vs deployer obligations) 4. AI risk management system (Article 9) 5. Data governance for AI (Article 10) 6. Technical documentation requirements (Article 11, Annex IV) 7. Human oversight requirements (Article 14) 8. Transparency obligations (Articles 13 and 50) 9. GPAI model governance (Articles 53 to 55 if applicable) 10. Incident reporting and post-market monitoring 11. Fundamental Rights Impact Assessment process (Article 27) 12. AI literacy programme (Article 4) 13. Review frequency (at minimum annually) --- ## Conformity Assessment Checklist For high-risk AI systems under Annex III (self-assessment track): ### Pre-Market - [ ] AI system classified and documented as high-risk (Article 6) - [ ] Risk management system established and documented (Article 9) - [ ] Training, validation, and testing data quality assessed (Article 10) - [ ] Technical documentation drafted to Annex IV requirements (Article 11) - [ ] Automatic logging enabled (Article 12) - [ ] Instructions for use prepared for deployers (Article 13) - [ ] Human oversight measures designed and tested (Article 14) - [ ] Accuracy, robustness, and cybersecurity assessed (Article 15) - [ ] Quality management system implemented (Article 17) - [ ] EU Declaration of Conformity drawn up (Article 47) - [ ] CE marking affixed (Article 48) - [ ] System registered in EU AI database (Article 49) ### Post-Market - [ ] Post-market monitoring plan established (Article 72) - [ ] Serious incident reporting process in place (Article 73) - [ ] Logs retained for minimum 6 months (deployers, Article 26) - [ ] Annual updates to technical documentation - [ ] Corrective action process for non-conformities (Article 20) --- ## Cross-Framework Mapping ### EU AI Act to ISO 42001:2023 ISO 42001 is the international standard for AI Management Systems (AIMS) and provides a structured framework that directly supports EU AI Act compliance. | EU AI Act Requirement | Article | ISO 42001:2023 | |---|---|---| | AI risk management system | Art. 9 | Clause 6.1 (Risk assessment), Clause 8.4 (AI risk treatment) | | Data governance | Art. 10 | Clause 8.3 (AI system impact assessment), Annex A.8 (Data for AI) | | Technical documentation | Art. 11 | Annex A.6 (AI system lifecycle) | | Human oversight | Art. 14 | Annex A.7 (Human oversight), Clause 8.5 | | Quality management system | Art. 17 | Clause 9 (Performance evaluation), Clause 10 (Improvement) | | Transparency | Art. 13, 50 | Annex A.9 (Transparency and explainability) | | Post-market monitoring | Art. 72 | Clause 9.1 (Monitoring and measurement) | | FRIA | Art. 27 | Clause 8.3 (AI system impact assessment) | | AI literacy | Art. 4 | Clause 7.2 (Competence), Clause 7.3 (Awareness) | | Governance | Art. 5 context | Clause 5 (Leadership), Annex A.2 (Policies for AI) | --- ### EU AI Act to NIST AI RMF 1.0 | EU AI Act Requirement | Article | NIST AI RMF Function | Category | |---|---|---|---| | AI risk classification | Art. 6 | MAP | MAP 1 (Context is established) | | Risk management system | Art. 9 | MANAGE | MANAGE 1, 2, 3 | | Data governance | Art. 10 | MEASURE | MEASURE 2.5, 2.6 | | Technical documentation | Art. 11 | GOVERN | GOVERN 1.7, MAP 5 | | Human oversight | Art. 14 | MANAGE | MANAGE 4 | | Accuracy and robustness | Art. 15 | MEASURE | MEASURE 2.1, 2.2, 2.3 | | Transparency | Art. 13, 50 | MAP | MAP 1.6, MEASURE 2.8 | | Post-market monitoring | Art. 72 | MEASURE | MEASURE 2.7 | | Incident reporting | Art. 73 | MANAGE | MANAGE 2.4 | | Governance | Arts. 4, 17 | GOVERN | GOVERN 1, 2, 3, 4, 5, 6 | --- ### EU AI Act and GDPR The AI Act complements and interacts with GDPR in several key areas: | Topic | EU AI Act | GDPR | |---|---|---| | Training data using personal data | Art. 10 (data governance) | Art. 6 (lawful basis), Art. 5 (data quality) | | Biometric data | Art. 5, 6, Annex III | Art. 9 (special categories) | | FRIA and DPIA | Art. 27 | Art. 35 (DPIA) | | Transparency to individuals | Art. 13, 50 | Arts. 13, 14 (transparency) | | Automated decision-making | Art. 14 (human oversight) | Art. 22 (automated decisions) | | Data subject rights | — | Arts. 15 to 22 | Note: A DPIA under GDPR and a FRIA under the AI Act may partially overlap — coordinate both assessments to avoid duplication. --- ### EU AI Act and DORA For financial entities subject to DORA that use AI systems: | Topic | EU AI Act | DORA | |---|---|---| | AI systems in credit, insurance, trading | Annex III high-risk | Art. 28 (ICT third party risk if AI is external) | | AI system risk assessment | Art. 9 | Art. 6 (ICT risk management) | | Incident reporting for AI failures | Art. 73 | Arts. 19, 20 (ICT incident reporting) | | Technical documentation | Art. 11 | Art. 11 (ICT business continuity) | | AI model cybersecurity | Art. 15 | Art. 9 (protection and prevention) | --- ## Key Regulatory References All official documents at **eur-lex.europa.eu** and **digital-strategy.ec.europa.eu**: - Regulation (EU) 2024/1689 — full AI Act text - Annex I — Union harmonisation legislation (product safety) - Annex III — High-risk AI system areas - Annex IV — Technical documentation requirements - European AI Office: ai-office.ec.europa.eu - GPAI Code of Practice (ongoing development) - Digital Omnibus proposal (November 2025) — monitor for timeline changes - ISO 42001:2023 — AI Management Systems - NIST AI RMF 1.0 — AI Risk Management Framework --- ## Disclaimer This skill provides informational guidance based on publicly available EU AI Act regulatory text and European Commission guidance. It does not constitute legal advice. The EU AI Act landscape is evolving — technical standards, codes of practice, and the Digital Omnibus amendments may affect obligations and timelines. Always verify against the latest official publications and consult qualified legal counsel for formal compliance purposes.