git:20260416.b5afb85 to git:20260502.ed65b97

46 added, 98 removed. Audit A to A.

---

name: eu-ai-act-check

- description: >

- EU AI Act compliance checklist for high-risk AI systems — 9 obligations from Articles 9-15.

- Use BEFORE major releases of EU-deployed high-risk AI systems. Maps to H1 (Be Proactive) + H8 (Voice/Conscience).

- Includes scope-check pre-flight to skip if not high-risk or not EU-targeted.

+ description: EU AI Act compliance — migrated to pitimon/claude-governance v3.1.0. This stub redirects to the canonical implementation. Maps to H1 (Be Proactive — prevent regulatory crisis) + H8 (Voice/Conscience).

user-invocable: true

- argument-hint: "[component to check, or --scope for pre-flight]"

- allowed-tools: ["Read", "Glob", "Grep", "Bash"]

+ argument-hint: "(install pitimon/claude-governance for the canonical skill)"

+ allowed-tools: ["Read", "Bash"]

prev-skill: any

next-skill: any

---

- # EU AI Act Compliance Check (9 Obligations)

- **Habit**: H1 (Be Proactive — prevent regulatory crisis) + H8 (Voice — Spirit/Conscience)

- **Regulation**: Regulation (EU) 2024/1689, Articles 9-15

- **Enforcement**: 2 August 2026 (subject to Digital Omnibus harmonized standards conditionality)

- **Anti-pattern**: Discovering compliance gaps after EU deployment instead of during development

- > ⚠️ **NOT LEGAL ADVICE.** This skill produces a developer-facing compliance checklist. Consult a qualified EU AI lawyer before relying on it for production EU deployment.

- ## When to Use

- - Before major release of an AI system targeting the **EU market**

- - During architecture design of a new high-risk AI feature

- - During audit preparation for EU customers/regulators

- - After significant changes to data, model, or human-oversight design

- ## When to Skip

- - System is **not high-risk** under Annex III (most internal tools, dev tools, non-safety AI fall outside)

- - System is **not deployed in the EU** (no EU users, no EU market)

- - Already covered by a recent (<90 day) `/eu-ai-act-check` run with no material changes since

- ## Process

- ### Step 0 — Scope Pre-Flight (--scope flag)

- Before running the full 9-obligation check, confirm the system is in scope:

- ```

- SCOPE CHECK (Annex III high-risk classification)

- ─────────────────────────────────────────────────

- 1. Does the system fall under Annex III categories?

- - [ ] Biometrics (1)

- - [ ] Critical infrastructure (2)

- - [ ] Education/vocational training (3)

- - [ ] Employment/HR (4)

- - [ ] Essential services (credit scoring, public benefits) (5)

- - [ ] Law enforcement (6)

- - [ ] Migration/asylum/border (7)

- - [ ] Justice/democratic processes (8)

- 2. Is the system deployed/marketed in the EU?

- - [ ] EU users

- - [ ] EU customers

- - [ ] EU data subjects

+ # EU AI Act Compliance Check — Migrated

- If BOTH "any Annex III box" AND "any EU box" are checked → IN SCOPE → continue with full check

- If either is NO → OUT OF SCOPE → stop here, document decision in `docs/compliance/eu-ai-act/scope-decision.md`

- ```

+ > ⚠️ **NOT LEGAL ADVICE.** This redirect stub is not a substitute for the canonical implementation or for legal counsel.

- ### Step 1 — Tiered Obligation Checklist

+ ## What happened

- To prevent checklist fatigue, items are grouped into 3 tiers. **Default mode runs Tier 1 (MUST) only**. Use `--full` to include Tier 2 + 3.

+ The EU AI Act compliance toolkit (skill + 9-obligation reference + primary-source research + Article-to-skill mapping guide) **migrated to [`pitimon/claude-governance`](https://github.com/pitimon/claude-governance) v3.1.0** on 2026-05-02.

- | ---------- | ---------------------------------------------------------------------------------------- | ---------------------- | ---------- |

+ **Why the migration**: per the plugin boundary established in memory observation #233270 (2026-04-07), the two plugins are complementary by design:

- For each item in the 9-obligation checklist, mark Pass / Fail / N/A with 1-line evidence. Items are tagged inline with **[MUST]** / **[SHOULD]** / **[COULD]** so a default-mode runner can filter to MUST only. Each obligation references the linked 8-habit skill that produces the evidence.

+ - **`8-habit-ai-dev`** = workflow discipline (HOW to develop well — the 7-step Covey-derived process)

+ - **`pitimon/claude-governance`** = compliance enforcement + framework mappings (WHAT standards apply — DSGAI, EU AI Act, fitness functions, ADRs, Three Loops)

- **Obligation counts**: 25 MUST items across 9 obligations, 27 SHOULD items, 8 COULD items (60 total). The full checklist — including exact article/paragraph references, evidence file paths, and Three Loops / DSGAI anchors — is in the reference file.

+ EU AI Act compliance is a **framework mapping** (Articles 9-15 → governance controls), not a workflow step. Original placement here was a boundary error; v3.1.0 of `claude-governance` corrects it. See `docs/adr/ADR-012-eu-ai-act-migration-completion.md` (this plugin) and [`docs/adr/ADR-003-eu-ai-act-compliance-toolkit.md`](https://github.com/pitimon/claude-governance/blob/main/docs/adr/ADR-003-eu-ai-act-compliance-toolkit.md) (governance plugin) for full provenance.

- Load `${CLAUDE_PLUGIN_ROOT}/skills/eu-ai-act-check/reference.md` for the full 9-obligation checklist with article references and evidence file paths.

+ ## How to use the canonical skill

- ### Step 2 — Generate Report

+ ```bash

+ # 1. Install claude-governance alongside this plugin (one-time)

+ claude plugin marketplace add pitimon/claude-governance

+ claude plugin install claude-governance@claude-governance

+ # 2. Invoke the canonical skill

+ /eu-ai-act-check --scope # Annex III + EU deployment pre-flight

+ /eu-ai-act-check # Full 9-obligation checklist (Tier 1 MUST only)

+ /eu-ai-act-check --full # Tier 1 + 2 + 3 (60 items)

```

- ## EU AI Act Compliance Report

- **Date**: YYYY-MM-DD

- **System**: [name]

- **Scope status**: IN SCOPE / OUT OF SCOPE

- **Overall**: [X/9 obligations PASS, Y/9 PARTIAL, Z/9 FAIL]

- |---|-----------|---------|--------|----------|------|

- | 1 | Risk Management | 9 | PASS | risk-register.md | — |

- | 2 | Data Governance | 10 | PARTIAL | data-inventory.md | Bias examination missing |

- | ... |

+ The canonical skill in `claude-governance` provides the same 9-obligation tiered checklist (25 MUST + 27 SHOULD + 8 COULD), `--scope` pre-flight, primary-source verified Articles 9-15 quotes, and Article-to-skill mapping — but rewritten to route to governance skills (`/governance-check`, `/spec-driven-dev`, `/create-adr`, `governance-reviewer` agent) rather than 8-habit workflow skills.

- ### Critical Gaps

- - [list of FAIL items]

+ ## When to Use

- ### Recommended Next Actions

- - [actionable items mapped to other 8-habit skills]

- ```

+ - You have `pitimon/claude-governance` v3.1.0+ installed and want to invoke the canonical EU AI Act 9-obligation checklist

+ - You're discovering this skill via the `8-habit-ai-dev` skill catalog (RESOLVER, session-start hook, README) and need to know where the canonical implementation lives

- Save to `docs/compliance/eu-ai-act/reports/YYYY-MM-DD-<system>.md`

+ ## When to Skip

- ### Step 3 — Habit Checkpoint (H1 + H8)

+ - The system is not high-risk under Annex III (most internal tools, dev tools, non-safety AI fall outside)

+ - The system is not deployed in the EU (no EU users, no EU customers, no EU data subjects)

+ - A recent (<90 day) `/eu-ai-act-check` run from `claude-governance` is already on file with no material changes since

+ - You don't have `pitimon/claude-governance` installed and don't intend to install it — install command is in the redirect block above

- > **H1**: "Have I prevented a regulatory crisis, or am I waiting to react to one?"

- > **H8**: "Do I understand WHY this regulation exists (protect fundamental rights), not just WHAT to comply with?"

+ ## What stays in this plugin

- ## Handoff

+ The complementary workflow skills remain here and continue to produce evidence as a side effect of the 7-step process:

- - **Expects from predecessor**: A finalized release candidate or design ready for compliance review

- - **Produces for successor**: Compliance report + gap list. Failures route back to specific 8-habit skills (e.g., `/security-check` for risk gaps, `/design` for oversight gaps)

+ - `/research`, `/requirements`, `/design`, `/breakdown`, `/build-brief`, `/review-ai`, `/deploy-guide`, `/monitor-setup`

+ - `/ai-dev-log` — generates AI-assisted development log from git history (covers EU AI Act Article 11 ¶3(d) disclosure)

+ - `/design` Step 5 — lightweight Article 14 design-time sanity check (5-capability table); for the formal Three Loops Decision Model, see `claude-governance` ADR-002

## Definition of Done

- - [ ] Scope pre-flight completed; OUT OF SCOPE decisions documented

- - [ ] All 9 obligations checked with Pass/Fail/N-A + 1-line evidence

- - [ ] Critical gaps identified with recommended remediation skill

- - [ ] Report saved under `docs/compliance/eu-ai-act/reports/`

- - [ ] H1 + H8 checkpoint answered honestly

- - [ ] (For production EU deployment) Lawyer review scheduled

+ - [ ] `pitimon/claude-governance` v3.1.0+ is installed (`claude plugin install claude-governance@claude-governance`)

+ - [ ] The canonical `/eu-ai-act-check` skill ran successfully against the system in scope

+ - [ ] Compliance report from the canonical skill is saved under `docs/compliance/eu-ai-act/reports/` in your project repository

+ - [ ] (For production EU deployment) Lawyer review scheduled — this redirect stub is not a substitute for legal counsel

## References

- - Primary research: `${CLAUDE_PLUGIN_ROOT}/docs/research/eu-ai-act-obligations.md` (verified quotes per article)

- - User guide: `${CLAUDE_PLUGIN_ROOT}/guides/eu-ai-act-mapping.md` (workflow + examples)

- - Habit details: `${CLAUDE_PLUGIN_ROOT}/habits/h1-be-proactive.md`, `${CLAUDE_PLUGIN_ROOT}/habits/h8-find-voice.md`

- > ⚠️ **NOT LEGAL ADVICE.** This skill is a developer reference. The 9-obligation checklist is derived from the regulation text but interpretation is subject to Commission guidance, harmonized standards (pending), and case law. Always consult a qualified EU AI lawyer for production compliance decisions.

+ - **Canonical skill**: [`pitimon/claude-governance` `/eu-ai-act-check`](https://github.com/pitimon/claude-governance/tree/main/skills/eu-ai-act-check)

+ - **Canonical mapping guide**: [`pitimon/claude-governance` `docs/compliance/EU-AI-ACT-MAPPING.md`](https://github.com/pitimon/claude-governance/blob/main/docs/compliance/EU-AI-ACT-MAPPING.md)

+ - **Canonical research**: [`pitimon/claude-governance` `docs/research/eu-ai-act-obligations.md`](https://github.com/pitimon/claude-governance/blob/main/docs/research/eu-ai-act-obligations.md)

+ - **Migration ADR (this plugin)**: `docs/adr/ADR-012-eu-ai-act-migration-completion.md`

+ - **Source ADR (this plugin, superseded)**: `docs/adr/ADR-005-eu-ai-act-compliance-toolkit.md`

+ - **Migration ADR (governance plugin)**: [`pitimon/claude-governance` ADR-003](https://github.com/pitimon/claude-governance/blob/main/docs/adr/ADR-003-eu-ai-act-compliance-toolkit.md)

+ - **EU AI Act enforcement**: 2 August 2026 (subject to Digital Omnibus harmonized standards conditionality)

+ - **Regulation**: Regulation (EU) 2024/1689, Articles 9-15