⚠️ Community-contributed command — not part of the officially-maintained ArcKit baseline. Output should be reviewed by qualified DPO / RSSI / legal counsel before reliance. Citations to ANSSI / CNIL / EU regulations may lag the current text — verify against the source.
You are helping an enterprise architect generate an EU AI Act Compliance Assessment (Regulation EU 2024/1689) for an AI system deployed in the European Union. The AI Act is the world's first binding horizontal AI regulation, with phased application through 2027.
User Input
$ARGUMENTS
Instructions
Note: Before generating, scan projects/ for existing project directories. For each project, list all ARC-*.md artifacts, check external/ for reference documents, and check 000-global/ for cross-project policies. If no external docs exist but they would improve output, ask the user.
Step 0: Read existing artifacts from the project context
MANDATORY (warn if missing):
REQ (Requirements) — Extract: functional requirements describing what the AI system does, AI/ML features, automated decision-making requirements, data inputs and outputs, human oversight requirements
If missing: warn that AI Act classification requires a clear description of the AI system's purpose and mechanism
Exploitation of vulnerabilities (age, disability, socioeconomic)
Real-time remote biometric identification in public spaces (with narrow exceptions)
Emotion recognition in workplace or educational institutions
Biometric categorisation for sensitive characteristics
Predictive policing based solely on profiling
If ANY prohibited practice applies → STOP and flag: the AI system cannot be placed on the EU market.
HIGH RISK — Annex I (safety components of products covered by sector legislation): Machinery, toys, recreational craft, lifts, ATEX, medical devices, in vitro diagnostics, aviation, agricultural vehicles, railway
HIGH RISK — Annex III (standalone AI systems):
Biometric identification and categorisation (with exceptions)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
✅ EU AI Act Assessment Generated
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📄 Document: projects/{project_id}/ARC-{PROJECT_ID}-AIACT-v{VERSION}.md
📋 Document ID: {document_id}
📅 Assessment Date: {date}
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
🤖 AI System Classification
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Risk Class: {PROHIBITED ⛔ / HIGH RISK 🔴 / LIMITED RISK 🟡 / MINIMAL RISK 🟢}
GPAI Model: {Yes / No}
Role: {Provider / Deployer}
{If PROHIBITED: ⛔ SYSTEM CANNOT BE DEPLOYED ON EU MARKET — see Section 2}
{If HIGH RISK: Full conformity assessment required before market placement}
{If LIMITED RISK: Transparency obligations apply}
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📋 Conformity Requirements
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
{Summary of applicable requirements with status}
Total Gaps: {N} ({N} high, {N} medium)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
⏰ Critical Deadlines
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
{Application dates relevant to this classification}
Next steps:
1. {If personal data: Run $arckit-eu-rgpd for GDPR obligations}
2. {If high-risk: Initiate conformity assessment process}
3. Run $arckit-risk to register AI Act gaps
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Important Notes
Prohibited practices apply now: Article 5 prohibited practices have applied since February 2025. Any prohibited AI system deployed after that date is a violation.
Classification is consequential: High-risk classification triggers extensive conformity requirements (documentation, logging, human oversight, CE marking, database registration). If in doubt about classification, treat as high-risk.
Provider vs deployer obligations differ: Providers bear the main conformity obligations. Deployers have narrower obligations (human oversight, appropriate use) but are also responsible for compliance in their context of use.
GPAI models are a separate track: Even if the AI system using a GPAI model is not high-risk, the GPAI model provider has its own obligations under Articles 53–55.
Use Write Tool: AI Act assessments cover multiple risk levels and detailed technical requirements. Always use the Write tool.
Note for reviewers: The EU AI Act is the world's first comprehensive AI regulation, applying to providers and deployers of AI systems in the EU regardless of where the provider is based. It uses a risk-based approach: prohibited practices (e.g. social scoring, real-time biometric surveillance) are banned outright; high-risk systems (Annex III — employment, education, essential services, law enforcement, migration, justice) face strict conformity requirements before market placement; GPAI models (general-purpose AI, e.g. large language models) have separate transparency and safety obligations. Application dates are phased: prohibited practices from February 2025, high-risk from August 2026.
Success Criteria
✅ Assessment document created at projects/{project_id}/ARC-{PROJECT_ID}-AIACT-v{VERSION}.md
✅ In-scope determination made (AI system definition assessed)
✅ Prohibited practices (Article 5) assessed — system flagged and stopped if prohibited
✅ Risk classification determined (Default / Class I / Class II / GPAI)
✅ High-risk requirements (Articles 8–17) assessed if applicable
✅ Transparency obligations (Article 50) assessed if limited risk
✅ GPAI obligations (Articles 53–55) assessed if applicable
✅ Conformity route determined (self-assessment vs notified body)
✅ EU database registration requirement assessed
✅ French market authority context documented (ARCOM, CNIL, ANSSI)
✅ Application timeline with relevant deadlines provided
✅ Gap analysis with priority actions generated
Example Usage
$arckit-eu-ai-act Assess AI Act compliance for an automated CV screening tool used by a French public employment service (France Travail), processing personal data, making pre-selection recommendations to human recruiters
$arckit-eu-ai-act AI Act classification for 001 — chatbot for citizen service portal, built on GPT-4, providing information about public benefits eligibility
$arckit-eu-ai-act Assess a real-time emotion detection system to be deployed in a retail environment to monitor customer satisfaction
Suggested Next Steps
After completing this command, consider running:
$arckit-eu-rgpd -- Assess GDPR obligations for personal data used in AI training or inference (when AI system processes personal data)
$arckit-risk -- Integrate AI Act compliance gaps and prohibited practice findings into the risk register
$arckit-traceability -- Link AI Act conformity requirements back to functional requirements (when High-risk AI system classification confirmed)
