compliance

name	compliance
description	Master skill for regulatory compliance assessment of a product: routes to the matching leaf and covers both the AI-specific and the personal-data regulations. Leaf `eu-ai-act` handles EU AI Act risk-tier classification (prohibited / high-risk / limited-risk transparency / minimal), the Article 50 transparency-disclosure pattern for consent screens and Terms of Service, and stakeholder/owner checklists. Leaf `dsgvo` handles DSGVO / GDPR personal-data compliance: lawful basis, data-subject rights, privacy notice, processor (Art. 28) agreements, records of processing, DPIA, breach notification, third-country transfers, and the compliance-check checklist. Use when asked to "check compliance", "compliance checklist", "EU AI Act compliance", "is our AI high-risk", "Article 50 transparency", "DSGVO compliance", "GDPR compliance", "check for DSGVO", "are we GDPR compliant", "do we need a privacy notice / Datenschutzerklärung", "lawful basis", "data subject rights", "data processing agreement", "AVV", "DPIA", "data breach 72 hours", "third-country transfer", "is DeepInfra DSGVO/GDPR compliant", "DeepInfra data privacy", "can we use DeepInfra with personal data", or when adding a feature that collects personal data or uses AI that touches people. Leaf `accessibility-a11y` handles web accessibility compliance: the EU Accessibility Act / Web Accessibility Directive / Austrian Barrierefreiheitsgesetz frame, WCAG 2.1 AA as the conformance target, the best-practice checklist (semantic HTML, ARIA, contrast, focus, keyboard, images, responsive, testing), an audit workflow, and fix recipes for legacy and CMS-exported static sites. Use when asked to "check accessibility", "a11y audit", "WCAG compliance", "is this site accessible", "EAA / Barrierefreiheit", or "fix accessibility findings".
metadata	{"type":"reference"}

compliance — regulatory compliance assessment (router)

Master skill for assessing and documenting a product's regulatory compliance. It owns two leaves, one per regulation, and routes work to the one (or both) in scope. Route to the leaf rather than answering inline; when a feature both uses AI and touches personal data, run both.

Leaves

Leaf	File	Owns
EU AI Act	references/eu-ai-act.md	AI-specific regulation: risk-tier classification, the Article 50 transparency-disclosure pattern for consent/ToS, stakeholder and owner checklists, the phased compliance timeline.
DSGVO / GDPR	references/dsgvo.md	Personal-data regulation (EU 2016/679, Austrian DSG): lawful basis, the seven principles, data-subject rights, privacy notice, Art. 28 processor agreements, records of processing, DPIA, Art. 32 security/TOMs, 72-hour breach notification, third-country transfers, DPO, and the compliance-check checklist.
DeepInfra & DSGVO	references/deepinfra-dsgvo.md	Vendor-specific assessment: whether/how DeepInfra-hosted models can be used DSGVO-compliantly (US-only hosting = third-country transfer, AVV + SCC + TIA needed, the Google/Anthropic upstream sub-processor chain, PII-minimization at the source). Companion to the general dsgvo leaf when DeepInfra is the model host.
Accessibility (a11y)	references/accessibility-a11y.md	Web accessibility compliance: the EAA (Directive 2019/882) / Web Accessibility Directive / Austrian Barrierefreiheitsgesetz frame, WCAG 2.1 AA conformance target, the best-practice checklist (semantic HTML, ARIA, contrast, focus, keyboard, images, responsive, testing), an audit workflow, and field-tested fix recipes for legacy and CMS-exported static sites.

Routing

• AI feature, risk tier, "is our AI high-risk", Article 50 / AI disclosure in consent or ToS → read references/eu-ai-act.md.
• Personal data, privacy notice / Datenschutzerklärung, lawful basis, data-subject rights, processor / AVV, DPIA, breach, third-country transfer, "check for DSGVO / GDPR compliance" → read references/dsgvo.md.
• A feature that uses AI on personal data (LLM extraction, a chat assistant over user data, AI drafting about a person) → both leaves. Classify the AI use in the AI Act leaf, run the personal-data check in the DSGVO leaf, and keep the two disclosures consistent (Art. 50 AI notice and the DSGVO privacy notice must not contradict each other; name the human-review invariant once, it satisfies both the AI Act high-risk carve-out and DSGVO Art. 22).
• DeepInfra is the model host (DSGVO question about that specific vendor: US hosting, AVV, data-privacy-framework status, sub-processor chain) → read references/deepinfra-dsgvo.md alongside references/dsgvo.md.
• Accessibility / a11y / WCAG / EAA / Barrierefreiheit ("check accessibility", "a11y audit", "is this site accessible", "fix accessibility findings", shipping a customer-facing site) → read references/accessibility-a11y.md. This leaf is independent of the personal-data and AI leaves; run it on its own for an accessibility pass.

Shared conventions (apply to every leaf and every deliverable)

• Not legal advice. Everything this skill produces is engineering-team orientation, not a legal opinion. Every document it helps author must say so and must recommend counsel (or the DPO) sign-off before any external compliance claim.
• Two audiences, two checklists. Both leaves produce a plain-language stakeholder checklist and a shorter decision-framed owner / sign-off checklist; keep the owner version to roughly a third the length.
• These are live regulations. Re-fetch the source pages before relying on specific dates, thresholds, or article numbers; do not trust cached dates, including any in these files.
• Writing style: no em dashes. Use a colon before a list or elaboration, parentheses or commas for an aside, a semicolon or two sentences for related clauses, and a comma or its own sentence for a hard qualifier ("only", "unless", "not"). Applies to every deliverable and to these files themselves.

Sharing this skill with another project or machine

Zip the whole compliance folder (it carries both leaves):

• Windows (PowerShell): Compress-Archive -Path ".claude\skills\compliance\*" -DestinationPath "compliance-skill.zip"
• macOS/Linux: zip -r compliance-skill.zip .claude/skills/compliance

The recipient extracts to their repo's .claude/skills/compliance/ (team-shared, commit it) or their personal ~/.claude/skills/compliance/ (global). Keep the folder name compliance so it matches the name: in this frontmatter. If a same-named skill already exists, reconcile rather than blindly overwrite (read both, keep the better version of each file).