AI Compliance

---

name: ai-compliance description: > AI compliance analysis for EU AI Act, ISO 42001, NIST AI RMF, GDPR, OECD, financial services regulations (SEC, FCA, FINRA, DORA, MiFID II), and other frameworks. Use when asked to generate a compliance checklist for an AI tool or use case, determine if a risk assessment is required, score an AI tool's risk level, identify where an AI tool or use case could run afoul of regulatory requirements, perform a gap analysis, recommend remediation steps, assess a vendor, draft an acceptable use policy, map training requirements, or review jurisdiction-specific AI rules. Triggers on phrases like "compliance checklist", "risk assessment", "risk score", "does this comply", "EU AI Act", "ISO 42001", "NIST AI RMF", "AI governance", "gap analysis", "vendor assessment", "acceptable use policy", "MNPI", "AI training requirements", or any request to evaluate an AI tool or use case for regulatory compliance or risk.

---

AI Compliance Skill

Reference Files

Load only what's needed based on the request type:

Frameworks

EU AI Act → references/eu-ai-act.md — risk tiers, prohibited uses, obligations

ISO 42001 → references/iso-42001.md — clauses, Annex A controls

NIST AI RMF → references/nist-ai-rmf.md — GOVERN/MAP/MEASURE/MANAGE

GDPR, OECD, IEEE, UK, Singapore → references/other-frameworks.md

Financial services (SEC, FCA, FINRA, DORA, MiFID II, MNPI) → references/finserv-regulations.md

Jurisdiction map (global regulatory landscape) → references/jurisdiction-map.md

ISO 27001 alignment → references/iso27001-alignment.md

Output Templates & Tools

Checklists, risk assessment, gap analysis templates → references/checklist-templates.md

Vendor AI risk assessment questionnaire → references/vendor-assessment.md

Acceptable use policy template → references/aup-template.md

Data classification × AI tool matrix → references/data-classification.md

AI system inventory template → references/ai-inventory.md

AI risk scoring model (0–100) → references/risk-scoring.md

Training requirements by role → references/training-requirements.md

Remediation

Incident response playbooks → references/incident-response.md

Remediation playbooks (common gaps) → references/remediation-playbooks.md

When in doubt about which files to load, load the framework files + the relevant output template.

Workflow

1. Understand the AI Tool/Use Case

Gather (or ask for):

What does the AI system do? (intended purpose)

Who uses it and how? (internal staff, customers, automated pipeline)

What data does it process? (personal, financial, confidential, public)

Where is it deployed? (EU context? affecting EU residents?)

Consumer or enterprise tier? Third-party or internal?

2. Select Output Type

| Request | Load | Output | |---|---|---| | Compliance checklist | Framework files + checklist-templates.md | Full checklist per Template 1 | | Risk assessment needed? | eu-ai-act.md + checklist-templates.md | Risk tier determination per Template 2 | | Gap analysis | All framework files + checklist-templates.md | Gap table per Template 3 | | Risk score | risk-scoring.md | Scored worksheet + risk level | | Vendor assessment | vendor-assessment.md | Questionnaire + scoring | | AUP draft | aup-template.md | Customized policy draft | | Data classification guidance | data-classification.md | Matrix + decision tree | | Incident response | incident-response.md | Relevant playbook | | Remediation steps | remediation-playbooks.md | Relevant playbook(s) | | Financial services overlay | finserv-regulations.md | Regulatory requirements | | Training requirements | training-requirements.md | Role-based matrix | | Jurisdiction guidance | jurisdiction-map.md | Applicable rules by region |

3. Output Structure

Always structure output as:

## AI Compliance Assessment: [Tool/Use Case Name]
Risk Classification
Applicable Frameworks
Compliance Checklist (or Gap Analysis or Risk Score)
Issues Found
Recommendations
Priority Actions

Key Principles

Reference exact articles, clauses, controls (e.g., "EU AI Act Art.14", "ISO 42001 A.6.1", "NIST GOVERN 1.2")

Flag HIGH/CRITICAL severity issues prominently — these are blockers

Always include remediation steps, not just gaps — link to remediation-playbooks.md when relevant

Cross-reference frameworks where they overlap

For financial services firms: always check finserv-regulations.md for MNPI and sector-specific rules

When uncertain about risk tier, err toward higher risk classification