CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

eu-ai-act

EU AI Act (Regulation (EU) 2024/1689) compliance advisor — risk classification across all four tiers, all 9 prohibited practices (Art. 5, including the nudification/CSAM prohibition from Dec 2, 2026), all 8 Annex III high-risk use case areas, provider and deployer obligations (Arts. 9–17, 26), GPAI model obligations including the July 2025 Code of Practice (Arts. 51–55), conformity assessment and CE marking (Arts. 43–48), EU AI database registration, Art. 50 transparency (chatbots, synthetic media, AI-generated content), governance (AI Office, AI Board), penalties (Art. 99), confirmed phase-in timeline (Digital Omnibus, Reg. (EU) 2026/1744, in force July 27, 2026: Annex III deferred to Dec 2, 2027; Annex I to Aug 2, 2028), and cross-framework mapping to ISO 42001, NIST AI RMF, and GDPR. Use for any EU AI regulation, AI system classification, or AI compliance question. Current as of August 2026. GPAI enforcement powers active since August 2, 2026.

Quality

89%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Passed

No findings from the security scan

SKILL.md
Quality
Evals
Security

Quality

Content

81%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is a highly actionable, well-sequenced compliance workflow with concrete tables, worked examples, and per-question-type response guidance, backed by real one-level-deep reference files. Its weaknesses are token efficiency — repeated enforcement/timeline information across multiple sections and prose that could be condensed into references — and a factual inconsistency: the body names the amending regulation "Digital Omnibus, Reg. (EU) 2026/1744, in force July 27, 2026" while references/risk-classification.md calls it "AI Omnibus (May 2026)", which could mislead a compliance answer.

Suggestions

State each phase-in date exactly once by consolidating the repeated timeline/enforcement-date content (top blockquote, step 5 and step 7 warnings, Response Format) into the Compliance Timeline Summary table and referencing it from the workflow steps.

Trim or move the long FRIA-to-DPIA relationship walkthrough and timing-discipline prose into references/obligations-high-risk.md, keeping a condensed version inline, and remove the duplication between the inlined Art. 26/FRIA/Annex III material and the same content in the reference files.

Reconcile the naming inconsistency between the body's "Digital Omnibus (Reg. (EU) 2026/1744, July 2026)" and references/risk-classification.md's "AI Omnibus (May 2026)" so the skill gives one consistent account of the amending regulation and its dates.

DimensionReasoningScore

Conciseness

The body is dense and substantive, but the August 2, 2026 GPAI enforcement date is repeated in at least five places (top blockquote, step 5 blockquote, step 7 warning, Response Format, and the timeline table), the Annex III/Annex I deadlines appear in both step 5 and the timeline table, and long explanatory passages (the FRIA-to-DPIA relationship walkthrough, timing-discipline prose) could be condensed or moved to the reference files. This fits anchor 3 (mostly efficient but includes unnecessary explanation or could be tightened) rather than 4, since the duplication goes beyond minor instances that could be trimmed.

3 / 5

Actionability

For an instruction-only skill the guidance is fully actionable: an 8-step workflow, a 10-row Art. 26 deployer duty table with article citations and a Met/Partial/Gap scoring method, a 6-element FRIA content table with a 6-step workflow, an Annex III area table with concrete example systems and misclassification traps, a worked example applying the Art. 6(3) filter in order, and per-question-type Response Format instructions. This matches anchor 5 (specific guidance covering the common cases) and exceeds anchor 4, which allows minor gaps.

5 / 5

Workflow Clarity

The 8-step workflow is clearly sequenced (scope → classification → prohibited screen → tier → obligations → conformity → GPAI → post-market) with explicit checkpoints such as "Confirm the user's role is deployer (not provider) before answering", "confirm the deployer falls into one of the three WHO categories before advising a FRIA is mandatory", and the mandated four-step ordering for borderline Annex III calls. This matches anchor 5 (clear sequence, checkpoints, checklists for complex processes); the destructive/batch cap does not apply to an advisory skill.

5 / 5

Progressive Disclosure

The three reference files exist, are one level deep, and are clearly summarized in the Reference Files section, and the body is well organized with headers and tables. However, the Art. 26, FRIA, and Annex III material is inlined in the body "for immediate use" while the same material (per the reference descriptions) also lives in obligations-high-risk.md and risk-classification.md, producing a ~230-line body with duplicated content. This fits anchor 4 (good structure, most content appropriately placed, minor organization gaps) rather than 5, which requires content appropriately split without this duplication.

4 / 5

Total

17

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, comprehensive description that explicitly answers both what the skill does and when to use it, in third person, with concrete capability coverage and domain-specific trigger terms. Its only weakness is verbosity: heavy citation and date detail (regulation numbers, phase-in dates, enforcement dates) pad the description beyond what the anchors' exemplars show, and a few natural trigger phrases (e.g., "high-risk" classification) are not explicitly named in the when-clause.

DimensionReasoningScore

Specificity

The description lists multiple concrete capability areas — "risk classification across all four tiers", "all 9 prohibited practices (Art. 5...)", "all 8 Annex III high-risk use case areas", "conformity assessment and CE marking", "penalties (Art. 99)", "cross-framework mapping to ISO 42001, NIST AI RMF, and GDPR" — with comprehensive coverage of the skill's scope. This matches the anchor for multiple specific concrete actions and is above the anchor of 4, which expects minor gaps in coverage; no vague fluff or over-claims are present, and the voice is consistently third person.

5 / 5

Completeness

Both questions are answered explicitly: the "what" is the detailed capability enumeration (risk classification, prohibited practices, obligations, GPAI, conformity assessment, transparency, governance, penalties, timeline, cross-framework mapping) and the "when" is the explicit "Use for any EU AI regulation, AI system classification, or AI compliance question" clause. This matches the anchor of 5 and exceeds anchor 4, where the "when" is present but could be more specific.

5 / 5

Trigger Term Quality

The trigger clause "Use for any EU AI regulation, AI system classification, or AI compliance question" plus natural terms like "EU AI Act", "chatbots", "synthetic media", and "GDPR" gives good keyword coverage, matching the anchor of 4 rather than 5 because a few natural phrasings users would say (e.g., "high-risk" determination or penalty/fine questions) are not explicitly covered as triggers. It is clearly above anchor 3 since the main natural entry points for this domain are present.

4 / 5

Distinctiveness Conflict Risk

The description carves out a clear niche — EU AI Act (Regulation (EU) 2024/1689) compliance — with distinct triggers ("EU AI regulation", "AI system classification", "AI compliance"), so it is unlikely to fire for unrelated skills and would only minimally overlap with a general GDPR skill. This matches the anchor of 5 (clear niche with distinct triggers, minimal conflict risk) and is above anchor 4, which expects minor overlap risk with closely related skills.

5 / 5

Total

19

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

Sushegaad/Claude-Skills-Governance-Risk-and-Compliance

Path

plugins/eu-ai-act/skills/eu-ai-act/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.