Skill: rochyroch/eu-ai-act-compliance (version 1.0.3)

# EU AI Act Compliance Skill ## Purpose Classify AI systems used in HR and recruitment contexts according to EU AI Act risk categories and generate compliance gap reports with remediation recommendations. ## When to Use Use this skill when: - A user asks about whether their AI system is "high-risk" - They need to assess compliance with EU AI Act requirements - They're implementing AI in recruitment, HR management, or workforce planning - They need documentation for regulatory compliance ## How It Works ### Step 1: Gather Information Ask the following clarifying questions to understand the AI system: 1. **Use Case**: What specific HR or recruitment function does the AI perform? - CV screening or parsing - Candidate ranking or shortlisting - Interview scheduling - Employee performance assessment - Workforce planning or forecasting - Other (specify) 2. **Data Processed**: What types of data does the AI process? - Personal data (name, contact details) - Professional qualifications - Employment history - Performance data - Biometric data - Inferences or predictions about individuals 3. **Decision Impact**: What decisions are influenced or made by the AI? - Automatic decisions (no human review) - Recommendations that inform human decisions - Filtering that affects candidate pools - Scoring or ranking of individuals - Other outcomes 4. **Human Oversight**: What human oversight mechanisms exist? - Human review before final decisions - Ability to override AI recommendations - Appeal or review process for affected individuals - Documentation of human involvement 5. **Deployment Context**: Where will the AI be deployed? - Public sector (subject to SI 284/2016 procurement rules) - Private sector - Cross-border processing - Irish-specific regulatory requirements ### Step 2: Determine Risk Classification Based on the information gathered, classify according to EU AI Act risk categories: #### High-Risk Systems (Annex III, Article 6(2)) AI systems in HR are **presumed high-risk** if they: 1. **Recruitment or selection systems** (Annex III, 4.(a)): - CV screening and parsing - Candidate ranking or scoring - Interview scheduling that affects opportunities - Assessment tools for selection 2. **Employment, worker management, access to self-employment** (Annex III, 4.(b)): - Task allocation - Performance evaluation - Promotion or termination decisions - Access to employment opportunities #### Medium-Risk Systems Systems that: - Assist human decisions but don't make autonomous decisions - Process data without significantly affecting rights - Have robust human oversight mechanisms #### Minimal-Risk Systems Systems that: - Are purely informational - Don't process personal data for decisions - Don't affect individual rights or opportunities ### Step 3: Generate Compliance Gap Report For high-risk systems, assess against: | Requirement | Article | Status | Gap | Priority | |-------------|---------|--------|-----|----------| | Risk management system | Art. 9 | | | | | Data governance | Art. 10 | | | | | Technical documentation | Art. 11 | | | | | Record-keeping | Art. 12 | | | | | Transparency | Art. 13 | | | | | Human oversight | Art. 14 | | | | | Accuracy & robustness | Art. 15 | | | | | Conformity assessment | Art. 43-48 | | | | ### Step 4: Provide Remediation Steps Recommend specific actions based on gaps identified: 1. **Immediate actions** (0-30 days): Critical compliance gaps 2. **Short-term actions** (30-90 days): Documentation and process gaps 3. **Long-term actions** (90+ days): System improvements and monitoring ### Step 5: Reference Relevant Guidance Always cite: - EU AI Act articles (with specific sections) - Annex III categorisation - Irish DPC guidance where relevant - GDPR Article 22 for automated decision-making - SI 284/2016 for public sector procurement ## Reference Files This skill includes detailed references: - `references/article-14-checklist.md` — Human oversight requirements - `references/gdpr-ai-intersection.md` — GDPR and AI intersection - `references/recruitment-risk-assessment.md` — Recruitment-specific risks - `references/irish-employment-context.md` — Irish regulatory context ## Output Format Provide structured output: ```markdown ## AI System Risk Classification **System Name:** [Name] **Classification:** [High-Risk / Medium-Risk / Minimal-Risk] **Reasoning:** [Brief explanation with article references] ## Compliance Gap Report [Gap analysis table] ## Recommended Actions ### Immediate (0-30 days) - [Action 1] - [Action 2] ### Short-term (30-90 days) - [Action 1] - [Action 2] ### Long-term (90+ days) - [Action 1] - [Action 2] ## Relevant References - [EU AI Act Article X] - [Irish DPC Guidance Y] - [GDPR Article 22] ``` ## Important Notes - **Presumption of high-risk**: HR AI systems listed in Annex III are presumed high-risk regardless of the specific risk they pose. This is a legal presumption, not a risk assessment. - **Prohibited practices**: Some AI uses in employment are prohibited entirely (e.g., emotional recognition in workplace). Always check Article 5 prohibitions first. - **Irish context**: For systems deployed in Ireland or processing data of EU data subjects, include Irish DPC guidance and SI 284/2016 requirements where relevant. --- *This skill is for informational purposes only. It does not constitute legal advice. Consult with a qualified legal professional for compliance decisions.*


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)