ai-act-readiness

Imported from borghei/claude-skills (ra-qm-team/audit-prep/ai-act-readiness/SKILL.md). Install upstream with npx skills add borghei/claude-skills --skill ai-act-readiness. Copyright stays with the author (MIT + Commons Clause).

EU AI Act Readiness

Operational playbook for EU AI Act compliance readiness — focused on the sprint to demonstrate readiness for the high-risk AI deadlines (2 Dec 2027 for Annex III systems, 2 Aug 2028 for Annex I products) and ongoing conformity assessments.

When to use this skill vs. eu-ai-act-specialist:

• This skill: assessment imminent; need readiness sprint
• eu-ai-act-specialist: building AI Act compliance program; classifying systems; designing conformity processes

When to use this skill

Key AI Act timelines

Dates as amended by the Digital Omnibus on AI (Regulation (EU) 2026/1744, in force 27 July 2026). Check the Official Journal text before relying on a date; secondary guidance written before July 2026 still shows the old ones.

The readiness sprint

8-week sprint (high-risk system, conformity assessment prep)

Week 1-2: System classification confirmation; gap analysis
Week 3-5: Documentation buildout (technical file, risk management, data governance)
Week 6-7: Conformity assessment internal dry-run
Week 8: External notified-body engagement / assessment

4-week sprint (GPAI obligations)

Week 1: System classification (provider/deployer/importer/etc.)
Week 2: Documentation prep (model card, training data summary, copyright compliance)
Week 3: Risk assessment + transparency obligations
Week 4: Submission / publication of required information

Critical AI Act areas

Risk classification

Per Article 6 / Annex III, AI systems classify into risk categories:

High-risk system requirements (Articles 9-15, plus 16-22)

GPAI provider obligations (Article 53+)

GPAI with systemic risk (Article 55, models > 10^25 FLOPs training compute)

Additional requirements:

• Model evaluations
• Adversarial testing
• Systemic risk assessment + mitigation
• Serious incident reporting
• Cybersecurity protection

Clarify First

Before running the readiness assessment, settle the inputs below. When one is missing or vague and would change the result, ask about it; when it wouldn't, use a sensible default and say which one you used.

• AI system risk class: high-risk (Annex III), GPAI, or limited-risk (determines whether to run the 8-week high-risk sprint or the 4-week GPAI sprint, and which checklist applies).
• Trigger event: a high-risk deadline (Dec 2027 Annex III, Aug 2028 Annex I), scheduled notified-body conformity assessment, GPAI obligations, or annual review (sets sprint length and scope).
• Your role: provider, deployer, or importer (determines which obligation set is assessed).

Ask about the two or three inputs that matter most for this request, not the whole list. If the user wants a result straight away, produce it and state your assumptions at the top.

Quick start

1. Run readiness score: python3 scripts/ai_act_readiness_score.py --config ai-system.yaml
2. Check GPAI obligations (if applicable): python3 scripts/gpai_obligation_checker.py --model model.yaml
3. Pick sprint length based on score + system risk class
4. Execute sprint per references/ai-act-readiness-checklist.md

Common AI Act readiness failures

• Misclassification: deploying system as "limited-risk" when it's actually "high-risk" (Annex III)
• Risk management as one-time: AI Act requires continuous risk management
• Data governance gaps: training data without representativeness analysis
• Logging missing: post-market monitoring requires logs you don't have
• Human oversight theater: oversight that can't actually intervene
• GPAI training data summary missing: required since Aug 2025
• No conformity assessment plan: assuming notified body assessment is automatic
• AI literacy training skipped: required for staff working with AI systems

Tooling

Scope & Limitations

In Scope:

• Short-runway EU AI Act readiness sprints: 8 weeks for a high-risk system before conformity assessment, 4 weeks for GPAI provider obligations
• Per-article readiness scoring for one AI system, with Annex III classification warnings and a sprint recommendation, from ai_act_readiness_score.py
• GPAI applicability, per-obligation completion (Article 53+) and the Article 55 systemic-risk check from gpai_obligation_checker.py
• Punch lists for high-risk requirements (Articles 9-15, 17, 43, 71-73) and common readiness failures

Out of Scope:

• Building an AI Act compliance program or classifying systems from scratch (see ra-qm-team/eu-ai-act-specialist/)
• ISO 42001 AIMS certification prep (see ra-qm-team/audit-prep/aims-audit/)
• GDPR obligations for AI that processes personal data (see ra-qm-team/audit-prep/gdpr-audit-prep/)
• Performing the conformity assessment, registering the system in the EU database or reporting incidents

Important Caveats:

• Both tools read a YAML file you fill in. They check declared answers; they do not inspect the system, its data or its documentation.
• The readiness score uses the risk class you declare and only warns when the Annex III areas you list conflict with it. The systemic-risk check uses the training compute figure you enter.
• A high score is not a conformity assessment, a notified body opinion or legal advice.
• The timeline table reflects dates set when the skill was written. Application dates can be amended, so check the current text before planning around a deadline.

References

• ai-act-readiness-checklist.md — full punch list per requirement
• high-risk-system-readiness-playbook.md — high-risk-specific deep prep

Related skills

• ra-qm-team/eu-ai-act-specialist — deep AI Act program management
• ra-qm-team/iso42001-ai-management — ISO 42001 AIMS (companion AI governance)
• ra-qm-team/audit-prep/aims-audit — AIMS audit-prep variant
• ra-qm-team/audit-prep/gdpr-audit-prep — GDPR overlay for AI processing personal data
• ra-qm-team/audit-prep/compliance-readiness — multi-framework readiness