AI Compliance

AI compliance analysis for EU AI Act, ISO 42001, NIST AI RMF, GDPR, OECD, financial services regulations (SEC, FCA, FINRA, DORA, MiFID II), and other frameworks. Use when asked to generate a compliance checklist for an AI tool or use case, determine if a risk assessment is required, score an AI tool's risk level, identify where an AI tool or use case could run afoul of regulatory requirements, perform a gap analysis, recommend remediation steps, assess a vendor, draft an acceptable use policy, map training requirements, or review jurisdiction-specific AI rules. Triggers on phrases like "compliance checklist", "risk assessment", "risk score", "does this comply", "EU AI Act", "ISO 42001", "NIST AI RMF", "AI governance", "gap analysis", "vendor assessment", "acceptable use policy", "MNPI", "AI training requirements", or any request to evaluate an AI tool or use case for regulatory compliance or risk.

AI Compliance Skill

Reference Files

Load only what's needed based on the request type:

Frameworks

• EU AI Act → references/eu-ai-act.md — risk tiers, prohibited uses, obligations
• ISO 42001 → references/iso-42001.md — clauses, Annex A controls
• NIST AI RMF → references/nist-ai-rmf.md — GOVERN/MAP/MEASURE/MANAGE
• GDPR, OECD, IEEE, UK, Singapore → references/other-frameworks.md
• Financial services (SEC, FCA, FINRA, DORA, MiFID II, MNPI) → references/finserv-regulations.md
• Jurisdiction map (global regulatory landscape) → references/jurisdiction-map.md
• ISO 27001 alignment → references/iso27001-alignment.md

Output Templates & Tools

• Checklists, risk assessment, gap analysis templates → references/checklist-templates.md
• Vendor AI risk assessment questionnaire → references/vendor-assessment.md
• Acceptable use policy template → references/aup-template.md
• Data classification × AI tool matrix → references/data-classification.md
• AI system inventory template → references/ai-inventory.md
• AI risk scoring model (0–100) → references/risk-scoring.md
• Training requirements by role → references/training-requirements.md

Remediation

• Incident response playbooks → references/incident-response.md
• Remediation playbooks (common gaps) → references/remediation-playbooks.md

When in doubt about which files to load, load the framework files + the relevant output template.

Workflow

1. Understand the AI Tool/Use Case

Gather (or ask for):

• What does the AI system do? (intended purpose)
• Who uses it and how? (internal staff, customers, automated pipeline)
• What data does it process? (personal, financial, confidential, public)
• Where is it deployed? (EU context? affecting EU residents?)
• Consumer or enterprise tier? Third-party or internal?

2. Select Output Type

Request	Load	Output
Compliance checklist	Framework files + checklist-templates.md	Full checklist per Template 1
Risk assessment needed?	eu-ai-act.md + checklist-templates.md	Risk tier determination per Template 2
Gap analysis	All framework files + checklist-templates.md	Gap table per Template 3
Risk score	risk-scoring.md	Scored worksheet + risk level
Vendor assessment	vendor-assessment.md	Questionnaire + scoring
AUP draft	aup-template.md	Customized policy draft
Data classification guidance	data-classification.md	Matrix + decision tree
Incident response	incident-response.md	Relevant playbook
Remediation steps	remediation-playbooks.md	Relevant playbook(s)
Financial services overlay	finserv-regulations.md	Regulatory requirements
Training requirements	training-requirements.md	Role-based matrix
Jurisdiction guidance	jurisdiction-map.md	Applicable rules by region

3. Output Structure

Always structure output as:

## AI Compliance Assessment: [Tool/Use Case Name]
### Risk Classification
### Applicable Frameworks
### Compliance Checklist (or Gap Analysis or Risk Score)
### Issues Found
### Recommendations
### Priority Actions

Key Principles

• Reference exact articles, clauses, controls (e.g., "EU AI Act Art.14", "ISO 42001 A.6.1", "NIST GOVERN 1.2")
• Flag HIGH/CRITICAL severity issues prominently — these are blockers
• Always include remediation steps, not just gaps — link to remediation-playbooks.md when relevant
• Cross-reference frameworks where they overlap
• For financial services firms: always check finserv-regulations.md for MNPI and sector-specific rules
• When uncertain about risk tier, err toward higher risk classification