EU AI Act Compliance Specialist

EU AI Act Compliance Specialist

Production-ready compliance patterns for Regulation (EU) 2024/1689 -- the EU Artificial Intelligence Act. Covers risk classification, provider/deployer obligations, GPAI model requirements, conformity assessment, and AI governance.

Clarify First

Before classifying or mapping obligations, confirm these inputs. If any is unknown or vague, ASK — do not assume:

• Intended purpose and domain — what the system does and its Annex III area (drives the risk classification and which obligations apply)
• Role — provider, deployer, GPAI provider, or importer (determines the obligation set)
• Biometric / GPAI characteristics — uses biometrics, is a GPAI model, or trained with >10^25 FLOPs (drives the prohibited / high-risk / systemic-risk path and the conformity-assessment route)

Stop rule: ask only the 2-3 that most change the output. If the user says "just draft it," proceed and list your assumptions at the top of the classification.

AI System Inventory and Classification Workflow

The agent classifies AI systems under the EU AI Act's risk-based framework and maps applicable obligations.

Workflow: Classify and Map Obligations

1. Inventory all AI systems -- for each system, document: name, provider/developer, description, intended purpose, deployment status, affected persons, geographic scope, data processed, and decision impact level.
2. Apply classification decision tree to each system:
   • Does it meet the Art. 3(1) definition of an AI system? If no, document exclusion.
   • Does it fall under a prohibited practice (Art. 5)? If yes, flag as UNACCEPTABLE RISK -- must be discontinued.
   • Is it a safety component of an Annex I product? If yes, HIGH-RISK (product legislation path).
   • Does it fall under an Annex III category? If yes, apply Art. 6(3) exception analysis. If exception does not apply, HIGH-RISK.
   • Does Art. 50 transparency obligation apply? If yes, LIMITED RISK. Otherwise, MINIMAL RISK.
3. Map obligations based on classification -- assign compliance owners for each obligation.
4. Run gap analysis using scripts/ai_compliance_checker.py to identify compliance gaps.
5. Prioritize remediation by deadline urgency, penalty severity, and number of affected persons.
6. Validation checkpoint: Every AI system classified; prohibited practices flagged for immediate action; high-risk systems have assigned compliance owners and remediation timelines.

Example: AI System Classification Output

{
  "system_name": "Resume Screener v2.1",
  "provider": "Internal ML Team",