ai-act-skills

# ai-act-skills

> Multi-platform agent skill for EU AI Act (Regulation 2024/1689) compliance, anchored on ISO/IEC 42001:2023 (AIMS) and ISO/IEC 27090:2025 (AI cybersecurity). Runs natively on Claude Code, Gemini CLI, and OpenAI Codex. Citation-grade — every obligation cites article + clause + Annex A control.

This is decision-support, not legal advice. Final EU AI Act conformity assessment requires qualified counsel and, for most high-risk systems, a notified body.

## Quick facts

- **Repository**: https://github.com/abk1969/ai-act-skills
- **Latest release**: v2.0.0 (2026-07-14) — 2026 AI Omnibus amendment + GPAI Code of Practice status
- **License**: MIT
- **Skill name**: `ai-act-compliance`
- **Standards anchored**: Regulation (EU) 2024/1689; ISO/IEC 42001:2023; ISO/IEC 27090:2025; ISO/IEC 23894, 23053, 5338, 5259-*, 24029-1/2, 25059, 42005, 42006, TS 4213; CEN-CENELEC JTC 21 EN ISO standards (under standardization mandate M/593)
- **Runtimes**: Claude Code, Gemini CLI, OpenAI Codex (auditable: `tool_calls: false` in ssl.json)
- **Manifest**: SSL representation per [arXiv:2604.24026](https://arxiv.org/abs/2604.24026) — Liang, Wang, Liang & Liu, "From Skill Text to Skill Structure"
- **Install**: `npx skills add abk1969/ai-act-skills@ai-act-compliance`

## Why ISO 42001 + 27090, not ISO 27001

Most AI compliance work mistakenly anchors on ISO 27001 (the generic Information Security Management System). For EU AI Act conformity:

- **ISO/IEC 42001:2023** is the AI-specific Management System standard. It includes AI-specific clauses (cl. 6.1.4 AI system impact assessment) and Annex A controls (A.5 impact, A.6 lifecycle, A.7 data, A.8 information for parties, A.9 use, A.10 third parties) that ISO 27001 does not cover.
- **ISO/IEC 27090:2025** is the AI-specific cybersecurity depth standard. Its threat taxonomy directly maps to AI Act art. 15(5) Recital 76 named threats: data poisoning, model poisoning, model evasion, confidentiality attacks, model flaws.
- **ISO 27001** remains useful as the org-level ISMS baseline that 42001 + 27090 build upon — but it is NOT the AI-specific framework for AI Act conformity.

CEN-CENELEC JTC 21 (under standardization mandate M/593) is on a path to publish EN ISO/IEC 42001 / 23894 / 27090 as harmonised standards conferring AI Act art. 40 presumption of conformity. This skill anticipates that path.

## Skill content overview

The `ai-act-compliance` skill ships with 15 reference files that cover the full AI Act compliance lifecycle:

1. **Risk classification** (art. 5/6/50, Annex III) — [`references/01-risk-classification.md`](https://github.com/abk1969/ai-act-skills/blob/main/skills/ai-act-compliance/references/01-risk-classification.md)
2. **High-risk obligations** (art. 8-29, 40-49) — [`references/02-high-risk-obligations.md`](https://github.com/abk1969/ai-act-skills/blob/main/skills/ai-act-compliance/references/02-high-risk-obligations.md)
3. **ISO 42001 AIMS mapping** (clauses 4-10 + 38 Annex A controls) — [`references/03-iso-42001-aims.md`](https://github.com/abk1969/ai-act-skills/blob/main/skills/ai-act-compliance/references/03-iso-42001-aims.md)
4. **ISO 27090 AI cybersecurity** (threat taxonomy, GenAI annex) — [`references/04-iso-27090-ai-security.md`](https://github.com/abk1969/ai-act-skills/blob/main/skills/ai-act-compliance/references/04-iso-27090-ai-security.md)
5. **Master crosswalk** (every art. → 42001 + 27090 + companion standards) — [`references/05-crosswalk-aiact-iso.md`](https://github.com/abk1969/ai-act-skills/blob/main/skills/ai-act-compliance/references/05-crosswalk-aiact-iso.md)
6. **Annex IV technical documentation template** — [`references/06-techdoc-annex-iv.md`](https://github.com/abk1969/ai-act-skills/blob/main/skills/ai-act-compliance/references/06-techdoc-annex-iv.md)
7. **FRIA (art. 27)** — [`references/07-fria-art27.md`](https://github.com/abk1969/ai-act-skills/blob/main/skills/ai-act-compliance/references/07-fria-art27.md)
8. **Transparency (art. 50)** — disclosure UX, watermarking, C2PA — [`references/08-transparency-art50.md`](https://github.com/abk1969/ai-act-skills/blob/main/skills/ai-act-compliance/references/08-transparency-art50.md)
9. **Post-market monitoring + serious-incident reporting** (art. 72-73) — [`references/09-post-market-art72-73.md`](https://github.com/abk1969/ai-act-skills/blob/main/skills/ai-act-compliance/references/09-post-market-art72-73.md)
10. **GPAI obligations** (art. 51-55) + sanctions (art. 99) + timeline (art. 113) — [`references/10-gpai-and-timeline.md`](https://github.com/abk1969/ai-act-skills/blob/main/skills/ai-act-compliance/references/10-gpai-and-timeline.md)
11. **Art. 4 AI literacy** (in force since 2025-02-02) — [`references/11-art4-ai-literacy.md`](https://github.com/abk1969/ai-act-skills/blob/main/skills/ai-act-compliance/references/11-art4-ai-literacy.md)
12. **Substantial modification** (art. 25) — provider/deployer flip, foundation-model fine-tuning — [`references/12-art25-substantial-modification.md`](https://github.com/abk1969/ai-act-skills/blob/main/skills/ai-act-compliance/references/12-art25-substantial-modification.md)
13. **Regulatory sandboxes + real-world testing** (art. 57-63) — [`references/13-sandboxes-and-real-world-testing.md`](https://github.com/abk1969/ai-act-skills/blob/main/skills/ai-act-compliance/references/13-sandboxes-and-real-world-testing.md)
14. **GPAI Code of Practice (art. 56) + voluntary codes (art. 95) + right to explanation (art. 86)** — [`references/14-codes-and-right-to-explanation.md`](https://github.com/abk1969/ai-act-skills/blob/main/skills/ai-act-compliance/references/14-codes-and-right-to-explanation.md)
15. **Multi-platform compatibility** (Claude Code / Gemini CLI / OpenAI Codex install + activation) — [`references/15-platform-compatibility.md`](https://github.com/abk1969/ai-act-skills/blob/main/skills/ai-act-compliance/references/15-platform-compatibility.md)

## Compliance categories — when to use which tool

A serious EU AI Act compliance program likely uses three categories of tooling. They are complementary, not substitutes:

- **Skill** (this repo) — codifies the regulation. Use to structure a compliance dossier, identify obligations, map ISO controls, draft Annex IV files. Consultative; runtime-agnostic.
- **MCP server** — automates scans in CI/CD. Examples: [`ark-forge/mcp-eu-ai-act`](https://github.com/ark-forge/mcp-eu-ai-act), [`SonnyLabs/EU_AI_ACT_MCP`](https://github.com/SonnyLabs/EU_AI_ACT_MCP), [`desiorac/mcp-eu-ai-act`](https://github.com/desiorac/mcp-eu-ai-act). Detects AI framework usage, scores documents 0-100 against AI Act articles.
- **Benchmark framework** — evaluates foundation models against AI Act technical thresholds. Example: [`compl-ai`](https://github.com/compl-ai/compl-ai) (ETH Zurich + INSAIT + LatticeFlow AI), 27 benchmarks across 6 EU AI Act principles.

## Key facts about the EU AI Act

- **In force**: 2024-08-01
- **Art. 5 prohibitions effective**: 2025-02-02
- **Art. 4 AI literacy effective**: 2025-02-02
- **Art. 50 transparency + Commission GPAI enforcement**: 2026-08-02
- **New art. 5 NCII/CSAM prohibition (AI Omnibus)**: 2026-12-02
- **High-risk regime for Annex III systems**: 2027-12-02 (deferred by the 2026 AI Omnibus from 2026-08-02)
- **Annex I product-safety pathway**: 2028-08-02 (deferred by the 2026 AI Omnibus from 2027-08-02)
- **AI Omnibus status**: adopted (Parliament 2026-06-16, Council 2026-06-29); OJ publication pending as of 2026-07-14
- **Sanctions tier 1**: €35M or 7% global turnover (art. 5 violations)
- **Sanctions tier 2**: €15M or 3% global turnover (most other provisions)
- **Sanctions tier 3**: €7.5M or 1.5% global turnover (incorrect info to authorities)
- **GPAI systemic-risk threshold**: 10²⁵ cumulative training compute FLOPs (art. 51(2))

## Authoritative sources

- Regulation (EU) 2024/1689 (AI Act) on EUR-Lex: https://eur-lex.europa.eu/eli/reg/2024/1689/oj
- ISO/IEC 42001:2023: https://www.iso.org/standard/81230.html
- ISO/IEC 27090:2025: https://www.iso.org/standard/56581.html
- CEN-CENELEC JTC 21 work programme: https://www.cencenelec.eu/areas-of-work/cen-cenelec-topics/artificial-intelligence/

## Repository structure

- `README.md` — repo overview + install per platform + compatibility matrix
- `AGENTS.md` — Codex / OpenAI / AGENTS-aware discovery
- `GEMINI.md` — Gemini CLI session-start activation
- `CONTRIBUTING.md` — contribution conventions
- `ROADMAP.md` — public dated roadmap
- `SECURITY.md` — threat model, vulnerability reporting
- `NOTICE` — decision-support disclaimer + third-party attributions
- `LICENSE` — MIT
- `CHANGELOG.md` — release history
- `CITATION.cff` — academic citation
- `skills/ai-act-compliance/` — the skill itself
  - `SKILL.md` — entry point
  - `ssl.json` — machine-readable manifest (SSL-1.0)
  - `references/` — 15 reference files

## License

MIT — see [LICENSE](https://github.com/abk1969/ai-act-skills/blob/main/LICENSE). The decision-support disclaimer and third-party attributions live in [NOTICE](https://github.com/abk1969/ai-act-skills/blob/main/NOTICE).