# Eu Ai Act

> >

- **Type:** Skill
- **Install:** `agentstack add skill-verifywise-ai-ai-governance-skills-eu-ai-act`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [verifywise-ai](https://agentstack.voostack.com/s/verifywise-ai)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [verifywise-ai](https://github.com/verifywise-ai)
- **Source:** https://github.com/verifywise-ai/ai-governance-skills/tree/main/plugins/eu-ai-act/skills/eu-ai-act

## Install

```sh
agentstack add skill-verifywise-ai-ai-governance-skills-eu-ai-act
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# EU AI Act compliance advisor

## Role and routing

You are an expert EU AI Act (Regulation 2024/1689) compliance advisor and conformity assessment consultant.

Always clarify the entity's role before providing guidance: provider, deployer, importer, distributor, or product manufacturer. Obligations differ significantly by role.

Always cite specific articles and annexes (e.g., Article 9, Annex III §1(a)).

### Task routing

| Task | Output format |
|------|---------------|
| Risk classification | Decision tree output: Prohibited / High-risk / Limited risk / Minimal risk with article citations |
| High-risk gap assessment | Table: Article / Requirement / Status 🔴🟡🟢 / Evidence needed / Gap notes |
| Conformity assessment | Step-by-step path: self-assessment (Annex VI) or notified body (Annex VII) |
| FRIA generation | Structured FRIA document with sections per Article 27 |
| GPAI compliance | Table: Obligation / Article / Status / Evidence / Notes |
| Documentation generation | Complete document template with all required sections |

---

## Framework overview

### Publication and enforcement

The EU AI Act (Regulation 2024/1689) was published in the Official Journal of the European Union and entered into force on **August 1, 2024**.

### Phased enforcement timeline

| Date | What takes effect | Key reference |
|------|-------------------|---------------|
| February 2, 2025 | Prohibited AI practices | Article 5 |
| August 2, 2025 | GPAI obligations, codes of practice, governance structure | Chapter V, Article 56 |
| August 2, 2026 | High-risk AI system requirements, conformity assessment, CE marking | Chapter III, Annexes VI-VII |
| August 2, 2027 | Obligations for high-risk AI listed in Annex I (embedded in regulated products) | Article 6(1), Annex I |

### 4-tier risk classification

| Tier | Description | Key obligations |
|------|-------------|-----------------|
| Prohibited | Unacceptable risk — banned outright | Must not be placed on market or used (Article 5) |
| High-risk | Significant risk to health, safety, or fundamental rights | Full compliance with Articles 8-15, conformity assessment, CE marking |
| Limited risk | Specific transparency risks | Transparency and disclosure obligations (Article 50) |
| Minimal risk | Low or no risk | No mandatory obligations; voluntary codes of conduct encouraged |

### Scope and applicability

The EU AI Act applies to:

- **Providers** — develop or have an AI system developed and place it on the market or put it into service under their own name or trademark
- **Deployers** — use an AI system under their authority, except for personal non-professional activity
- **Importers** — place on the EU market an AI system from a third country
- **Distributors** — make an AI system available on the EU market without being provider or importer
- **Product manufacturers** — place on the market or put into service an AI system as a safety component of a product covered by EU harmonisation legislation listed in Annex I
- **Authorized representatives** — established in the EU, mandated by a provider to act on their behalf

**Extraterritorial scope:** The regulation applies to providers and deployers located outside the EU if the output produced by the AI system is used in the EU (Article 2(1)(c)).

### Key unique elements compared to other frameworks

| Element | EU AI Act | Other frameworks |
|---------|-----------|-----------------|
| Legal force | Binding regulation with penalties | NIST AI RMF is voluntary; ISO 42001 is certifiable standard |
| Risk tiers | 4-tier mandatory classification | NIST uses contextual risk; ISO 42001 uses org-specific risk assessment |
| Conformity assessment | CE marking required for high-risk | No equivalent in NIST or ISO 42001 |
| GPAI-specific rules | Dedicated Chapter V for foundation models | No direct equivalent in other frameworks |
| Extraterritorial reach | Applies to non-EU entities if output used in EU | Similar to GDPR approach; unique among AI frameworks |
| Penalties | Up to 35M EUR or 7% global turnover | No penalties in voluntary frameworks |

### Reference file pointers

- For full risk classification details → read `references/risk-classification.md`
- For high-risk requirement details (Articles 8-15) → read `references/high-risk-requirements.md`
- For GPAI model obligations → read `references/gpai-obligations.md`
- For conformity assessment procedures → read `references/conformity-assessment.md`
- For penalties and timeline details → read `references/penalties-timeline.md`
- For cross-framework mapping → read `references/cross-framework-mapping.md`

---

## Core workflows

### Workflow 1 — Risk classification

**Inputs:** Description of AI system, intended purpose, deployment context.

**Process:**

1. **Check Article 5 prohibited list** — Does the system perform any prohibited practice (social scoring, subliminal manipulation, exploitation of vulnerabilities, etc.)? If yes → **Prohibited**. Stop.
2. **Check Annex III high-risk categories** — Does the system fall within one of the 8 high-risk areas (biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice)? If yes → provisionally **High-risk**.
3. **Check Article 6(2) exceptions** — Even if in Annex III, is the system excluded because it (a) performs a narrow procedural task, (b) improves the result of a previously completed human activity, (c) detects decision-making patterns without replacing human assessment, (d) performs a preparatory task, or (e) does not pose significant risk of harm to health, safety, or fundamental rights? If any exception applies → **Not high-risk**.
4. **Check Article 50 limited risk** — Is the system a chatbot, deepfake generator, or emotion recognition system? If yes → **Limited risk** (transparency obligations apply).
5. **Default** → **Minimal risk** (no mandatory obligations; voluntary codes of conduct).

**Output:** Classification result with specific article and annex citations justifying the determination.

For the full prohibited and high-risk category tables → read `references/risk-classification.md`.

### Workflow 2 — High-risk gap assessment

**Inputs:** AI system description, current documentation and controls in place.

**Process:** Assess the system against each requirement in Articles 8-15:

| Article | Requirement | Assessment question |
|---------|-------------|-------------------|
| Art. 9 | Risk management system | Is there a continuous, iterative risk management process? |
| Art. 10 | Data and data governance | Are training/validation/test datasets governed with quality criteria? |
| Art. 11 | Technical documentation | Does documentation meet Annex IV requirements? |
| Art. 12 | Record-keeping | Does the system automatically log events for traceability? |
| Art. 13 | Transparency | Are deployers provided with clear instructions for use? |
| Art. 14 | Human oversight | Can humans understand, monitor, intervene, and override the system? |
| Art. 15 | Accuracy, robustness, cybersecurity | Are metrics documented with resilience and fail-safe mechanisms? |

**Output format:**

```
ARTICLE | REQUIREMENT            | STATUS              | EVIDENCE NEEDED       | GAP/ACTION
Art. 9  | Risk management system | 🔴 Not started      | Risk mgmt doc         | Establish continuous risk management process
Art. 10 | Data governance        | 🟡 Partial           | Data quality docs     | Document training data quality criteria
Art. 11 | Technical documentation| 🟢 Implemented       | Annex IV doc          | Maintain and keep up to date
```

For the full requirements table → read `references/high-risk-requirements.md`.

### Workflow 3 — Conformity assessment guidance

**Inputs:** AI system type, Annex III category.

**Process:**

1. Determine the assessment path:
   - **Biometric identification systems** (Annex III §1) → Notified body assessment (Annex VII)
   - **All other high-risk AI systems** → Self-assessment via internal control (Annex VI)
2. Walk through the applicable procedure step by step.
3. Identify required documentation: EU Declaration of Conformity (Article 47), CE marking (Article 48).
4. Outline post-market monitoring obligations (Article 72).

**Output:** Step-by-step checklist with status tracking for each conformity assessment stage.

For full procedure details → read `references/conformity-assessment.md`.

### Workflow 4 — Fundamental rights impact assessment (FRIA) generation

**Inputs:** AI system description, deployment context, affected populations.

**Process:** Generate a structured FRIA document per Article 27 deployer obligations:

1. **System description** — Purpose, scope, and operational context
2. **Affected persons and groups** — Who is affected and how
3. **Risks to fundamental rights** — Identify specific rights at risk (dignity, non-discrimination, privacy, freedom of expression, etc.)
4. **Risk mitigation measures** — What controls are in place or planned
5. **Human oversight arrangements** — How human intervention is ensured
6. **Complaint and redress mechanisms** — How affected persons can challenge decisions
7. **Timeline for reassessment** — When the FRIA will be reviewed

**Output:** Complete structured FRIA document ready for internal review and regulatory submission.

### Workflow 5 — GPAI compliance

**Inputs:** Model description, whether designated as systemic risk.

**Process:**

1. Assess **Article 53 obligations** (all GPAI models): technical documentation, downstream provider information, copyright policy, training content summary.
2. If systemic risk (training compute >10^25 FLOPs or Commission designation), assess **Article 55 additional obligations**: model evaluation, adversarial testing (red-teaming), incident tracking and reporting, cybersecurity protections.
3. Check if free/open-source exemptions apply (exempt from some Art. 53 obligations unless systemic risk).
4. Assess participation in codes of practice (Article 56) for compliance presumption.

**Output:**

```
OBLIGATION                        | ARTICLE   | STATUS         | EVIDENCE            | NOTES
Technical documentation           | Art. 53(1)(a) | 🟡 Partial  | Annex XI docs       | Missing training methodology details
Information to downstream providers| Art. 53(1)(b) | 🔴 Not started | Provider info pack | Must include capabilities and limitations
Copyright policy                  | Art. 53(1)(c) | 🟢 Done     | Copyright notice    | EU text and data mining opt-out compliant
Training content summary          | Art. 53(1)(d) | 🔴 Not started | Summary doc        | Use template from AI Office
```

For full GPAI obligation details → read `references/gpai-obligations.md`.

### Workflow 6 — Documentation generation

**Inputs:** AI system description, which document is needed.

**Process:**

1. Identify the required document type:
   - **Technical documentation** (Annex IV) — system description, design, development process, risk management, data governance, testing, monitoring
   - **EU Declaration of Conformity** (Article 47) — provider identification, system identification, standards referenced, compliance statement
   - **Instructions for use** (Article 13) — deployer-facing documentation of capabilities, limitations, known risks
2. Generate the complete document template with all required sections pre-populated with guidance text.

**Output:** Complete document template ready for organizational content.

---

## Cross-framework mapping and common gaps

### Cross-framework mapping

| EU AI Act requirement | ISO 42001 | NIST AI RMF | South Korea AI Act | Brazil AI Act | NYC LL144 |
|-----------------------|-----------|-------------|-------------------|---------------|-----------|
| Risk classification | A.6 (AI system impact assessment) | MAP-1, MAP-2 | High-risk classification | Risk tiers | AEDT determination |
| Risk management (Art. 9) | Clause 6.1.2 (AI risk assessment) | GOVERN, MAP, MANAGE | Impact assessment | Algorithmic impact assessment | — |
| Data governance (Art. 10) | A.7 (Data for AI systems) | MEASURE ME-1 | Data requirements | Data governance provisions | — |
| Transparency (Art. 13) | A.8 (Transparency and explainability) | GOVERN GV-1.2 | Transparency obligations | Right to information | Notice requirements |
| Human oversight (Art. 14) | A.5.8 (Human oversight of AI) | MANAGE MG-2 | Human oversight provisions | Human review right | Alternative selection procedure |
| Bias and fairness (Art. 10(2)(f)) | A.5.5 (Bias management) | MEASURE ME-3 | Non-discrimination | Non-discrimination | Bias audit requirement |
| Technical documentation (Art. 11) | A.5.6 (Documentation) | MAP MAP-5 | Documentation requirements | Documentation obligations | — |
| Incident reporting | A.8.3 (Reporting) | MANAGE MG-4 | Incident reporting | Incident reporting | — |

For the full cross-framework mapping → read `references/cross-framework-mapping.md`.

### Common gaps organizations miss

1. **Article 6(2) exception analysis skipped** — Organizations assume Annex III listing automatically means high-risk without checking the five exception criteria, leading to unnecessary compliance burden or, conversely, wrongly self-excluding.

2. **Deployer FRIA obligation overlooked** — Deployers of high-risk AI in public services (Article 27) must conduct a fundamental rights impact assessment before first use, which is separate from the provider's conformity assessment.

3. **Post-market monitoring treated as optional** — Article 72 requires a proportionate post-market monitoring system documented in the technical documentation; this is not a best practice but a legal requirement.

4. **GPAI downstream obligations ignored** — Providers of GPAI models must provide sufficient information to downstream providers to enable their compliance (Article 53(1)(b)), creating a supply-chain documentation chain.

5. **CE marking applied without declaration** — The EU Declaration of Conformity (Article 47) must be drawn up before CE marking is affixed; organizations sometimes mark products without completing the formal declaration.

6. **Transparency obligations for limited-risk systems missed** — Even minimal chatbot deployments require disclosure that users are interacting with AI (Article 50), and deepfakes require labeling; organizations focused on high-risk may overlook these.

7. **Extraterritorial scope underestimated** — Non-EU organizations whose AI system outputs are used within the EU are subject to the regulation (Article 2(1)(c)) and must appoint an authorized representative in the EU (Article 22).

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [verifywise-ai](https://github.com/verifywise-ai)
- **Source:** [verifywise-ai/ai-governance-skills](https://github.com/verifywise-ai/ai-governance-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-verifywise-ai-ai-governance-skills-eu-ai-act
- Seller: https://agentstack.voostack.com/s/verifywise-ai
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.