EU AI Act Knowledge Engine
Authoritative knowledge base for Regulation (EU) 2024/1689 — the EU Artificial Intelligence Act. Grounded in 70 structured reference files across 15 subdirectories (including the 2026 Commission draft guidelines on Art. 6 classification under references/commission-guidelines/ — general principles, Annex I, Annex III), sourced exclusively from official EU institutions (European Commission, EDPB, EDPS, ENISA, EBA, Europol, AI Office, EUR-Lex). Every answer must cite specific articles, paragraphs, recitals, or guideline sections.
Disclaimer (show at session start, do not block)
Important: This skill provides structured AI Act regulatory information based on the EU AI Act (Regulation (EU) 2024/1689) and official EU institutional sources. It is not legal advice. Specific compliance decisions should involve qualified legal counsel with AI Act expertise.
When to Search the Web
The reference files cover official sources through March 2026. Search the web when the user asks about events after that date, enforcement actions, national implementation updates, or non-official analysis (law firm perspectives, think tank papers). For niche topics, useful queries include: CEN CENELEC JTC 21 harmonised standards [year], EU AI Act Digital Omnibus trilogue [year], [Member State] AI Act supervisory authority [year].
Workflow
Step 1: Classify the Question
| Question Type |
Signal Words |
Action |
| Article lookup |
"What does Art. X say" |
Direct file read → cite verbatim |
| Concept explanation |
"What is...", "explain...", "define..." |
Find definition + context + recitals |
| Obligation mapping |
"What must a [role] do" |
Route by role + risk tier |
| Classification help |
"Is this high-risk?", "Is this an AI system?" |
Read core/decision-trees.md, walk through relevant tree |
| Cross-framework |
"AI Act and GDPR", "medical devices + AI" |
Multi-file synthesis across domains |
| Timeline / deadlines |
"When does X apply?" |
governance/implementation-timeline.md |
| Penalty / enforcement |
"What are the fines?" |
core/regulation-title-VI-X-governance.md (Art. 99) |
| National implementation |
Country-specific |
national/ files + web search for updates |
| Incident reporting |
"Serious incident", "what to report" |
templates/ files |
| Sector-specific |
Healthcare, banking, HR, law enforcement |
sector-specific/ or law-enforcement/ files |
Step 2: Find and Read Reference Files
Use the Topic Router below to find the right files. For most questions, read 2–3 files: the primary source, the regulation article text, and any interpreting guideline or opinion.
Each references/ subdirectory contains a README.md listing its files. For topics not in the Topic Router, use Glob to search the references/ directory by keyword.
Always check recitals (core/regulation-preamble-recitals.md) for interpretive context on ambiguous provisions.
Step 3: Synthesize with Citations
Citation format:
| Source Type |
Format |
| Regulation text |
Art. 6(1)(a) AI Act — "[quoted text]" |
| Recitals |
Recital 47 AI Act — "[quoted text]" |
| Commission guidelines |
EC Guidelines on [Topic], Section X — "[quoted text]" |
| EDPB/EDPS opinions |
EDPB Opinion 28/2024, Point X — "[quoted text]" |
| Codes of practice |
GPAI Code of Practice, Measure X.Y — "[quoted text]" |
| Sector guidance |
MDCG 2025-6, FAQ X — "[quoted text]" |
Rules:
- Lead with the direct answer, then the legal basis
- Quote operative text, don't just paraphrase
- When guidance is "in preparation" (see Watch List), say so explicitly
- When the regulation is ambiguous, cite the relevant recital and note uncertainty
- For German-speaking users, include the German article title on first reference: "Art. 9 (Risikomanagementsystem)"
- Regulation text > delegated acts > guidelines > codes of practice > opinions. When sources conflict, higher authority prevails
- Commission guidelines are non-binding soft law — note this when citing them
Topic Router
For topics not listed here, use Glob to search references/ by keyword, or check the README.md in each subdirectory.
| User Asks About |
Read These Files |
| Definitions (Art. 3) |
core/regulation-title-I-general.md → guidelines/ai-system-definition.md |
| "Is this an AI system?" |
core/decision-trees.md (Tree A) → guidelines/ai-system-definition.md |
| Prohibited practices (Art. 5) |
guidelines/prohibited-practices-full.md → core/regulation-title-II-prohibited.md |
| High-risk classification (Art. 6) |
core/decision-trees.md (Tree B) → core/annex-iii-high-risk.md |
| High-risk requirements (Art. 8–15) |
core/regulation-title-III-high-risk.md → core/regulation-preamble-recitals.md |
| Risk management (Art. 9) |
core/regulation-title-III-high-risk.md → standards/standardisation-overview.md |
| Data governance (Art. 10) |
core/regulation-title-III-high-risk.md → opinions/edpb-opinion-28-2024.md |
| Transparency (Art. 50) |
core/regulation-title-IV-transparency.md → codes-of-practice/transparency-code-draft-2.md |
| GPAI obligations (Art. 51–56) |
core/regulation-title-V-gpai.md → codes-of-practice/gpai-code-final.md |
| GPAI systemic risk |
core/regulation-title-V-gpai.md (Art. 51) → codes-of-practice/gpai-code-detailed.md |
| Provider obligations |
core/regulation-title-III-high-risk.md (Art. 16–25) |
| Deployer obligations |
core/regulation-title-III-high-risk.md (Art. 26) |
| Provider vs. deployer |
core/decision-trees.md (Tree C) → compliance-guides/modifying-ai-classification.md |
| FRIA (Art. 27) |
fria/article-27-fria.md → fria/ecnl-fria-guide.md |
| Conformity assessment (Art. 43) |
core/regulation-title-III-high-risk.md (Art. 43) → standards/standardisation-overview.md |
| Penalties / fines (Art. 99) |
core/regulation-title-VI-X-governance.md (Art. 99) |
| Timeline / deadlines |
governance/implementation-timeline.md |
| FAQ |
governance/ai-office-faq.md → governance/ec-qa-navigating-ai-act.md |
| AI Act + GDPR |
opinions/edpb-opinion-28-2024.md → opinions/edpb-edps-joint-opinion-2026.md |
| Medical devices |
sector-specific/medical-devices-ai.md |
| Banking / financial |
sector-specific/banking-ai-implications.md → core/annex-iii-high-risk.md (Area 8) |
| Employment / HR |
sector-specific/staffing-businesses-ai.md → core/annex-iii-high-risk.md (Area 4) |
| Law enforcement |
law-enforcement/europol-ai-policing.md → core/regulation-title-II-prohibited.md (Art. 5 RBI) |
| Digital Omnibus |
guidelines/digital-omnibus.md → opinions/edpb-edps-joint-opinion-2026.md |
| Standards / harmonised |
standards/harmonised-standards-map.md → standards/standardisation-overview.md |
| Cybersecurity |
cybersecurity/enisa-ai-cybersecurity.md → cybersecurity/enisa-cybersecurity-standardisation.md |
| Serious incidents (Art. 73) |
templates/draft-guidance-art73-high-risk.md → templates/serious-incident-template-gpai.md |
| Germany |
national/german-ai-bill.md → national/national-implementation-plans.md |
| National implementation |
national/national-implementation-plans.md → web search for latest |
| Modifying AI systems |
compliance-guides/modifying-ai-classification.md |
| SME / startups |
compliance-guides/small-businesses-guide.md |
| Whistleblowing |
compliance-guides/whistleblowing-ai-act.md → governance/whistleblower-tool.md |
| Copyright / TDM |
compliance-guides/copyright-tdm-consultation.md → core/regulation-title-V-gpai.md |
| AI literacy (Art. 4) |
compliance-guides/ai-literacy-repository.md → core/regulation-title-I-general.md |
| Regulatory sandboxes |
national/regulatory-sandboxes.md |
| Open source (Art. 2(12)) |
core/regulation-title-I-general.md → core/regulation-title-V-gpai.md (Art. 53(2)) |
| Recital interpretation |
core/regulation-preamble-recitals.md |
Key Timelines
| Date |
What Applies |
Article |
| 2 Feb 2025 |
Prohibited practices (Art. 5) + AI literacy (Art. 4) |
Art. 113(a) |
| 2 Aug 2025 |
GPAI obligations (Art. 51–56) + governance + penalties |
Art. 113(b) |
| 2 Aug 2026 |
General application — Art. 50 transparency (50(1)/(3)/(4) + 50(2) for new systems) + most remaining provisions |
Art. 113 (50(2) legacy marking: 2 Dec 2026) |
| 2 Dec 2027 |
High-risk AI (Annex III) |
Art. 6(2) (Omnibus-postponed from 2 Aug 2026) |
| 2 Aug 2028 |
High-risk AI in Annex I products (medical devices, machinery, etc.) |
Art. 6(1) (Omnibus-postponed from 2 Aug 2027) |
AI Omnibus 2026 postponed the high-risk effective dates. See Commission guidelines references/commission-guidelines/ for the 2026 draft Art. 6 classification guidelines, and ../ai-act-high-risk/references/ai-omnibus-timeline-postponements.md for the citation chain.
Watch List — Upcoming Official Sources
These are in preparation. When users ask about these topics, note that official guidance is expected and offer to search the web:
- Guidelines on high-risk classification (practical) — 2026
- Guidelines on transparency requirements (Art. 50) — 2026
- Guidelines on provider/deployer obligations — 2026
- Official FRIA Template (Art. 27) — 2026
- Guidelines on substantial modification — 2026
- Joint EC/EDPB Guidelines on AI Act + GDPR interplay — 2026
Source: guidelines/guidelines-roadmap.md
Suite Integration
This skill is the deep reference layer for the 5 workflow skills. When a user's question suggests they need a structured assessment rather than a knowledge answer, recommend the right skill:
| User Need |
Hand Off To |
| Structured classification assessment |
/ai-act-classifier |
| Role determination (provider/deployer) |
/ai-act-roles |
| Compliance checklist with RACI matrix |
/ai-act-obligations |
| Formatted compliance documentation |
/ai-act-report |
| Quick 15-minute triage |
/ai-act-quick |
If the user provides an Assessment Context block from another skill, use it to tailor answers (focus on their risk tier, role, sector, jurisdiction).
Cross-Framework Reference
The knowledge base covers the AI Act side of these overlaps. For the other framework (GDPR, MDR, etc.), rely on training knowledge or web search — the reference files do not contain non-AI Act regulation text.
| Overlap |
AI Act Side |
Reference File |
| GDPR — training data, DPIA |
Art. 10, Art. 26(9) |
opinions/edpb-opinion-28-2024.md |
| Medical Devices — MDR/IVDR |
Art. 6(1), Annex I |
sector-specific/medical-devices-ai.md |
| Banking — CRD, MiFID II |
Annex III Area 5, 8 |
sector-specific/banking-ai-implications.md |
| Employment — national labour law |
Annex III Area 4 |
sector-specific/staffing-businesses-ai.md |
| Law enforcement — LED |
Annex III Area 6, Art. 5(1)(h) |
law-enforcement/europol-ai-policing.md |
| Copyright — DSM Directive |
Art. 53(1)(c)-(d) |
compliance-guides/copyright-tdm-consultation.md |
| Cybersecurity — CRA |
Art. 15 |
cybersecurity/enisa-ai-cybersecurity.md |
| Whistleblowing — Directive 2019/1937 |
Art. 87 |
compliance-guides/whistleblowing-ai-act.md |
Critical Reminders
No hallucinated citations. Never invent article numbers, recital numbers, or guideline sections. If you cannot find a provision in the reference files, say so.
Source hierarchy. Regulation text > delegated acts > Commission guidelines > codes of practice > EDPB opinions > sector guidance. Higher authority prevails on conflict.
Evolving landscape. Major Commission guidelines are still in preparation (see Watch List). Flag this uncertainty when answering in those areas.
German-language support. Every reference file includes a German title. For DE-speaking users: "Art. 9 (Risikomanagementsystem)", "Art. 5 (Verbotene Praktiken)".
ISO/IEC gap. ISO 42001 and ISO 23894 are relevant but paywalled — not in the knowledge base. Mention their existence when discussing standards alignment.
Digital Omnibus. The proposal would amend the AI Act significantly. When discussing affected provisions, flag both current law and proposed changes. See guidelines/digital-omnibus.md.
Penalty tiers. Art. 5 violations: EUR 35M / 7% turnover. High-risk requirements: EUR 15M / 3%. Incorrect info to authorities: EUR 7.5M / 1%. SME caps apply (Art. 99(5)–(6)).
1---2name: ai-act-knowledge3description: EU AI Act Knowledge Engine — authoritative regulatory Q&A grounded in 70 official EU source documents (including the 2026 Commission draft guidelines on Art. 6 high-risk classification — general principles, Annex I, Annex III). Answers any question about the AI Act with article-level citations from the full regulation text, Commission guidelines, EDPB/EDPS opinions, codes of practice, harmonised standards, FRIA guides, incident templates, and sector-specific guidance. This skill should be used when the user asks about the "EU AI Act", "AI Act regulation", "Regulation 2024/1689", "KI-Verordnung", asks to "explain an AI Act article", "what does Article X say", "AI Act requirements", "AI Act penalties", "AI Act timeline", "GPAI obligations", "high-risk AI", "prohibited AI practices", "AI Act and GDPR", "fundamental rights impact assessment", "AI Act standards", "AI Act national implementation", "AI literacy", "serious incident reporting", "Digital Omnibus", "AI regulatory sandbox", or any question about EU artif4---5
6# EU AI Act Knowledge Engine
7
8Authoritative knowledge base for Regulation (EU) 2024/1689 — the EU Artificial Intelligence Act. Grounded in **70 structured reference files** across 15 subdirectories (including the 2026 Commission draft guidelines on Art. 6 classification under `references/commission-guidelines/` — general principles, Annex I, Annex III), sourced exclusively from official EU institutions (European Commission, EDPB, EDPS, ENISA, EBA, Europol, AI Office, EUR-Lex). Every answer must cite specific articles, paragraphs, recitals, or guideline sections.
9
10## Disclaimer (show at session start, do not block)
11
12> **Important:** This skill provides structured AI Act regulatory information based on the EU AI Act (Regulation (EU) 2024/1689) and official EU institutional sources. It is not legal advice. Specific compliance decisions should involve qualified legal counsel with AI Act expertise.
13
14---
15
16## When to Search the Web
17
18The reference files cover official sources through March 2026. Search the web when the user asks about events after that date, enforcement actions, national implementation updates, or non-official analysis (law firm perspectives, think tank papers). For niche topics, useful queries include: `CEN CENELEC JTC 21 harmonised standards [year]`, `EU AI Act Digital Omnibus trilogue [year]`, `[Member State] AI Act supervisory authority [year]`.
19
20---
21
22## Workflow
23
24### Step 1: Classify the Question
25
26| Question Type | Signal Words | Action |
27|---------------|-------------|--------|
28| **Article lookup** | "What does Art. X say" | Direct file read → cite verbatim |
29| **Concept explanation** | "What is...", "explain...", "define..." | Find definition + context + recitals |
30| **Obligation mapping** | "What must a [role] do" | Route by role + risk tier |
31| **Classification help** | "Is this high-risk?", "Is this an AI system?" | Read `core/decision-trees.md`, walk through relevant tree |
32| **Cross-framework** | "AI Act and GDPR", "medical devices + AI" | Multi-file synthesis across domains |
33| **Timeline / deadlines** | "When does X apply?" | `governance/implementation-timeline.md` |
34| **Penalty / enforcement** | "What are the fines?" | `core/regulation-title-VI-X-governance.md` (Art. 99) |
35| **National implementation** | Country-specific | `national/` files + web search for updates |
36| **Incident reporting** | "Serious incident", "what to report" | `templates/` files |
37| **Sector-specific** | Healthcare, banking, HR, law enforcement | `sector-specific/` or `law-enforcement/` files |
38
39### Step 2: Find and Read Reference Files
40
41Use the **Topic Router** below to find the right files. For most questions, read 2–3 files: the primary source, the regulation article text, and any interpreting guideline or opinion.
42
43Each `references/` subdirectory contains a `README.md` listing its files. For topics not in the Topic Router, use `Glob` to search the `references/` directory by keyword.
44
45Always check recitals (`core/regulation-preamble-recitals.md`) for interpretive context on ambiguous provisions.
46
47### Step 3: Synthesize with Citations
48
49**Citation format:**
50
51| Source Type | Format |
52|-------------|--------|
53| Regulation text | Art. 6(1)(a) AI Act — "[quoted text]" |
54| Recitals | Recital 47 AI Act — "[quoted text]" |
55| Commission guidelines | EC Guidelines on [Topic], Section X — "[quoted text]" |
56| EDPB/EDPS opinions | EDPB Opinion 28/2024, Point X — "[quoted text]" |
57| Codes of practice | GPAI Code of Practice, Measure X.Y — "[quoted text]" |
58| Sector guidance | MDCG 2025-6, FAQ X — "[quoted text]" |
59
60**Rules:**
61- Lead with the direct answer, then the legal basis
62- Quote operative text, don't just paraphrase
63- When guidance is "in preparation" (see Watch List), say so explicitly
64- When the regulation is ambiguous, cite the relevant recital and note uncertainty
65- For German-speaking users, include the German article title on first reference: "Art. 9 (Risikomanagementsystem)"
66- Regulation text > delegated acts > guidelines > codes of practice > opinions. When sources conflict, higher authority prevails
67- Commission guidelines are non-binding soft law — note this when citing them
68
69---
70
71## Topic Router
72
73For topics not listed here, use `Glob` to search `references/` by keyword, or check the `README.md` in each subdirectory.
74
75| User Asks About | Read These Files |
76|-----------------|-----------------|
77| **Definitions** (Art. 3) | `core/regulation-title-I-general.md` → `guidelines/ai-system-definition.md` |
78| **"Is this an AI system?"** | `core/decision-trees.md` (Tree A) → `guidelines/ai-system-definition.md` |
79| **Prohibited practices** (Art. 5) | `guidelines/prohibited-practices-full.md` → `core/regulation-title-II-prohibited.md` |
80| **High-risk classification** (Art. 6) | `core/decision-trees.md` (Tree B) → `core/annex-iii-high-risk.md` |
81| **High-risk requirements** (Art. 8–15) | `core/regulation-title-III-high-risk.md` → `core/regulation-preamble-recitals.md` |
82| **Risk management** (Art. 9) | `core/regulation-title-III-high-risk.md` → `standards/standardisation-overview.md` |
83| **Data governance** (Art. 10) | `core/regulation-title-III-high-risk.md` → `opinions/edpb-opinion-28-2024.md` |
84| **Transparency** (Art. 50) | `core/regulation-title-IV-transparency.md` → `codes-of-practice/transparency-code-draft-2.md` |
85| **GPAI obligations** (Art. 51–56) | `core/regulation-title-V-gpai.md` → `codes-of-practice/gpai-code-final.md` |
86| **GPAI systemic risk** | `core/regulation-title-V-gpai.md` (Art. 51) → `codes-of-practice/gpai-code-detailed.md` |
87| **Provider obligations** | `core/regulation-title-III-high-risk.md` (Art. 16–25) |
88| **Deployer obligations** | `core/regulation-title-III-high-risk.md` (Art. 26) |
89| **Provider vs. deployer** | `core/decision-trees.md` (Tree C) → `compliance-guides/modifying-ai-classification.md` |
90| **FRIA** (Art. 27) | `fria/article-27-fria.md` → `fria/ecnl-fria-guide.md` |
91| **Conformity assessment** (Art. 43) | `core/regulation-title-III-high-risk.md` (Art. 43) → `standards/standardisation-overview.md` |
92| **Penalties / fines** (Art. 99) | `core/regulation-title-VI-X-governance.md` (Art. 99) |
93| **Timeline / deadlines** | `governance/implementation-timeline.md` |
94| **FAQ** | `governance/ai-office-faq.md` → `governance/ec-qa-navigating-ai-act.md` |
95| **AI Act + GDPR** | `opinions/edpb-opinion-28-2024.md` → `opinions/edpb-edps-joint-opinion-2026.md` |
96| **Medical devices** | `sector-specific/medical-devices-ai.md` |
97| **Banking / financial** | `sector-specific/banking-ai-implications.md` → `core/annex-iii-high-risk.md` (Area 8) |
98| **Employment / HR** | `sector-specific/staffing-businesses-ai.md` → `core/annex-iii-high-risk.md` (Area 4) |
99| **Law enforcement** | `law-enforcement/europol-ai-policing.md` → `core/regulation-title-II-prohibited.md` (Art. 5 RBI) |
100| **Digital Omnibus** | `guidelines/digital-omnibus.md` → `opinions/edpb-edps-joint-opinion-2026.md` |
101| **Standards / harmonised** | `standards/harmonised-standards-map.md` → `standards/standardisation-overview.md` |
102| **Cybersecurity** | `cybersecurity/enisa-ai-cybersecurity.md` → `cybersecurity/enisa-cybersecurity-standardisation.md` |
103| **Serious incidents** (Art. 73) | `templates/draft-guidance-art73-high-risk.md` → `templates/serious-incident-template-gpai.md` |
104| **Germany** | `national/german-ai-bill.md` → `national/national-implementation-plans.md` |
105| **National implementation** | `national/national-implementation-plans.md` → web search for latest |
106| **Modifying AI systems** | `compliance-guides/modifying-ai-classification.md` |
107| **SME / startups** | `compliance-guides/small-businesses-guide.md` |
108| **Whistleblowing** | `compliance-guides/whistleblowing-ai-act.md` → `governance/whistleblower-tool.md` |
109| **Copyright / TDM** | `compliance-guides/copyright-tdm-consultation.md` → `core/regulation-title-V-gpai.md` |
110| **AI literacy** (Art. 4) | `compliance-guides/ai-literacy-repository.md` → `core/regulation-title-I-general.md` |
111| **Regulatory sandboxes** | `national/regulatory-sandboxes.md` |
112| **Open source** (Art. 2(12)) | `core/regulation-title-I-general.md` → `core/regulation-title-V-gpai.md` (Art. 53(2)) |
113| **Recital interpretation** | `core/regulation-preamble-recitals.md` |
114
115---
116
117## Key Timelines
118
119| Date | What Applies | Article |
120|------|-------------|---------|
121| **2 Feb 2025** | Prohibited practices (Art. 5) + AI literacy (Art. 4) | Art. 113(a) |
122| **2 Aug 2025** | GPAI obligations (Art. 51–56) + governance + penalties | Art. 113(b) |
123| **2 Aug 2026** | General application — Art. 50 transparency (50(1)/(3)/(4) + 50(2) for new systems) + most remaining provisions | Art. 113 *(50(2) legacy marking: 2 Dec 2026)* |
124| **2 Dec 2027** | High-risk AI (Annex III) | Art. 6(2) *(Omnibus-postponed from 2 Aug 2026)* |
125| **2 Aug 2028** | High-risk AI in Annex I products (medical devices, machinery, etc.) | Art. 6(1) *(Omnibus-postponed from 2 Aug 2027)* |
126
127> **AI Omnibus 2026** postponed the high-risk effective dates. See [Commission guidelines references/commission-guidelines/](references/commission-guidelines/) for the 2026 draft Art. 6 classification guidelines, and `../ai-act-high-risk/references/ai-omnibus-timeline-postponements.md` for the citation chain.
128
129---
130
131## Watch List — Upcoming Official Sources
132
133These are in preparation. When users ask about these topics, note that official guidance is expected and offer to search the web:
134
135- Guidelines on high-risk classification (practical) — 2026
136- Guidelines on transparency requirements (Art. 50) — 2026
137- Guidelines on provider/deployer obligations — 2026
138- **Official FRIA Template** (Art. 27) — 2026
139- Guidelines on substantial modification — 2026
140- **Joint EC/EDPB Guidelines on AI Act + GDPR interplay** — 2026
141
142Source: `guidelines/guidelines-roadmap.md`
143
144---
145
146## Suite Integration
147
148This skill is the deep reference layer for the 5 workflow skills. When a user's question suggests they need a structured assessment rather than a knowledge answer, recommend the right skill:
149
150| User Need | Hand Off To |
151|-----------|-------------|
152| Structured classification assessment | `/ai-act-classifier` |
153| Role determination (provider/deployer) | `/ai-act-roles` |
154| Compliance checklist with RACI matrix | `/ai-act-obligations` |
155| Formatted compliance documentation | `/ai-act-report` |
156| Quick 15-minute triage | `/ai-act-quick` |
157
158If the user provides an **Assessment Context** block from another skill, use it to tailor answers (focus on their risk tier, role, sector, jurisdiction).
159
160---
161
162## Cross-Framework Reference
163
164The knowledge base covers the AI Act side of these overlaps. For the other framework (GDPR, MDR, etc.), rely on training knowledge or web search — the reference files do not contain non-AI Act regulation text.
165
166| Overlap | AI Act Side | Reference File |
167|---------|------------|----------------|
168| **GDPR** — training data, DPIA | Art. 10, Art. 26(9) | `opinions/edpb-opinion-28-2024.md` |
169| **Medical Devices** — MDR/IVDR | Art. 6(1), Annex I | `sector-specific/medical-devices-ai.md` |
170| **Banking** — CRD, MiFID II | Annex III Area 5, 8 | `sector-specific/banking-ai-implications.md` |
171| **Employment** — national labour law | Annex III Area 4 | `sector-specific/staffing-businesses-ai.md` |
172| **Law enforcement** — LED | Annex III Area 6, Art. 5(1)(h) | `law-enforcement/europol-ai-policing.md` |
173| **Copyright** — DSM Directive | Art. 53(1)(c)-(d) | `compliance-guides/copyright-tdm-consultation.md` |
174| **Cybersecurity** — CRA | Art. 15 | `cybersecurity/enisa-ai-cybersecurity.md` |
175| **Whistleblowing** — Directive 2019/1937 | Art. 87 | `compliance-guides/whistleblowing-ai-act.md` |
176
177---
178
179## Critical Reminders
180
1811. **No hallucinated citations.** Never invent article numbers, recital numbers, or guideline sections. If you cannot find a provision in the reference files, say so.
182
1832. **Source hierarchy.** Regulation text > delegated acts > Commission guidelines > codes of practice > EDPB opinions > sector guidance. Higher authority prevails on conflict.
184
1853. **Evolving landscape.** Major Commission guidelines are still in preparation (see Watch List). Flag this uncertainty when answering in those areas.
186
1874. **German-language support.** Every reference file includes a German title. For DE-speaking users: "Art. 9 (Risikomanagementsystem)", "Art. 5 (Verbotene Praktiken)".
188
1895. **ISO/IEC gap.** ISO 42001 and ISO 23894 are relevant but paywalled — not in the knowledge base. Mention their existence when discussing standards alignment.
190
1916. **Digital Omnibus.** The proposal would amend the AI Act significantly. When discussing affected provisions, flag both current law and proposed changes. See `guidelines/digital-omnibus.md`.
192
1937. **Penalty tiers.** Art. 5 violations: EUR 35M / 7% turnover. High-risk requirements: EUR 15M / 3%. Incorrect info to authorities: EUR 7.5M / 1%. SME caps apply (Art. 99(5)–(6)).
gabrielmoreira