EU AI Act Compliance

Classify HR AI systems by EU AI Act risk level, provide compliance gap analysis, and recommend remediation steps for recruitment and workforce planning tools.

Enda @ Randtrad@rochyroch

Install

openclaw skills install @rochyroch/eu-ai-act-compliance

EU AI Act Compliance Skill

Purpose

Classify AI systems used in HR and recruitment contexts according to EU AI Act risk categories and generate compliance gap reports with remediation recommendations.

When to Use

Use this skill when:

A user asks about whether their AI system is "high-risk"
They need to assess compliance with EU AI Act requirements
They're implementing AI in recruitment, HR management, or workforce planning
They need documentation for regulatory compliance

⚠️ Legislative Updates (July 2026)

The EU AI Act timeline has changed significantly since the original publication. Key updates:

Digital Omnibus Package (2026): Annex III high-risk compliance deadline pushed from 2 August 2026 → 2 December 2027. Also simplified technical documentation requirements and scoped down fundamental rights impact assessments.
Article 4 AI Literacy: Still applies from August 2026 — this deadline was NOT moved. Providers and deployers must ensure staff have sufficient AI literacy.
Annex I Products: AI systems that are safety components of products (machinery, medical devices, toys) have until August 2028.
UK DUAA 2025: UK GDPR Article 22 replaced by Articles 22A–22D (Data (Use and Access) Act 2025, effective 5 February 2026). UK now has a permissive + safeguards model, not a prohibition. Relevant for UK/Ireland cross-border work.
Northern Ireland: EU proposed extending AI Act to NI under Windsor Framework (not yet agreed).

How It Works

Step 1: Gather Information

Ask the following clarifying questions to understand the AI system:

Use Case: What specific HR or recruitment function does the AI perform?
- CV screening or parsing
- Candidate ranking or shortlisting
- Interview scheduling
- Employee performance assessment
- Workforce planning or forecasting
- Other (specify)
Data Processed: What types of data does the AI process?
- Personal data (name, contact details)
- Professional qualifications
- Employment history
- Performance data
- Biometric data
- Inferences or predictions about individuals
Decision Impact: What decisions are influenced or made by the AI?
- Automatic decisions (no human review)
- Recommendations that inform human decisions
- Filtering that affects candidate pools
- Scoring or ranking of individuals
- Other outcomes
Human Oversight: What human oversight mechanisms exist?
- Human review before final decisions
- Ability to override AI recommendations
- Appeal or review process for affected individuals
- Documentation of human involvement
Deployment Context: Where will the AI be deployed?
- Public sector (subject to SI 284/2016 procurement rules)
- Private sector
- Cross-border processing (UK/EU — check DUAA vs AI Act applicability)
- Irish-specific regulatory requirements

Step 2: Determine Risk Classification

Based on the information gathered, classify according to EU AI Act risk categories:

High-Risk Systems (Annex III, Article 6(2))

AI systems in HR are presumed high-risk if they:

Recruitment or selection systems (Annex III, 4.(a)):
- CV screening and parsing
- Candidate ranking or scoring
- Interview scheduling that affects opportunities
- Assessment tools for selection
Employment, worker management, access to self-employment (Annex III, 4.(b)):
- Task allocation
- Performance evaluation
- Promotion or termination decisions
- Access to employment opportunities

Note: Under the Digital Omnibus, the high-risk compliance deadline is now 2 December 2027 (was 2 August 2026). However, the Article 4 AI literacy obligation still applies from August 2026 — do not delay staff training.

Medium-Risk Systems

Systems that:

Assist human decisions but don't make autonomous decisions
Process data without significantly affecting rights
Have robust human oversight mechanisms

Minimal-Risk Systems

Systems that:

Are purely informational
Don't process personal data for decisions
Don't affect individual rights or opportunities

Step 3: Generate Compliance Gap Report

For high-risk systems, assess against:

Requirement	Article	Status	Gap	Priority
Risk management system	Art. 9
Data governance	Art. 10
Technical documentation	Art. 11
Record-keeping	Art. 12
Transparency	Art. 13
Human oversight	Art. 14
Accuracy & robustness	Art. 15
Conformity assessment	Art. 43-48
AI literacy (staff training)	Art. 4

Note: Digital Omnibus simplified some technical documentation requirements (Art. 11) and scoped down fundamental rights impact assessments. Check current scope before assessing.

Step 4: Provide Remediation Steps

Recommend specific actions based on gaps identified:

Immediate actions (0-30 days): Critical compliance gaps, Article 4 literacy training
Short-term actions (30-90 days): Documentation and process gaps
Long-term actions (90+ days): System improvements and monitoring (note: full high-risk compliance not due until December 2027)

Step 5: Reference Relevant Guidance

Always cite:

EU AI Act articles (with specific sections)
Annex III categorisation
Irish DPC guidance where relevant
GDPR Article 22 for automated decision-making (EU)
UK Articles 22A–22D for UK automated decision-making (DUAA 2025, effective 5 Feb 2026)
SI 284/2016 for public sector procurement

Reference Files

This skill includes detailed references:

references/article-14-checklist.md — Human oversight requirements
references/gdpr-ai-intersection.md — GDPR and AI intersection (updated with UK DUAA 2025)
references/recruitment-risk-assessment.md — Recruitment-specific risks
references/irish-employment-context.md — Irish regulatory context (updated timeline)
references/legislative-timeline.md — Current EU AI Act timeline (NEW)

Output Format

Provide structured output:

markdown

## AI System Risk Classification

**System Name:** [Name]
**Classification:** [High-Risk / Medium-Risk / Minimal-Risk]
**Reasoning:** [Brief explanation with article references]
**Compliance Deadline:** [Relevant date based on current timeline]

## Compliance Gap Report

[Gap analysis table]

## Recommended Actions

### Immediate (0-30 days)
- [Action 1]
- [Action 2]

### Short-term (30-90 days)
- [Action 1]
- [Action 2]

### Long-term (90+ days)
- [Action 1]
- [Action 2]

## Relevant References

- [EU AI Act Article X]
- [Irish DPC Guidance Y]
- [GDPR Article 22 / UK Articles 22A-22D]

Important Notes

Presumption of high-risk: HR AI systems listed in Annex III are presumed high-risk regardless of the specific risk they pose. This is a legal presumption, not a risk assessment.
Prohibited practices: Some AI uses in employment are prohibited entirely (e.g., emotional recognition in workplace). Always check Article 5 prohibitions first. Prohibited practices enforcement has applied since 2 February 2025.
Article 4 AI literacy: Applies from August 2026. This deadline was NOT extended by the Digital Omnibus. Providers and deployers must ensure staff have sufficient AI literacy.
Digital Omnibus changes: High-risk deadline extended to 2 December 2027. Technical documentation requirements simplified. Fundamental rights impact assessments scoped down. Use the extra time wisely — don't delay preparation.
UK divergence: UK GDPR Article 22 replaced by Articles 22A–22D (DUAA 2025, effective 5 February 2026). UK now has permissive + safeguards model for automated decision-making. For UK/Ireland cross-border work, assess under both frameworks.
Irish context: For systems deployed in Ireland or processing data of EU data subjects, include Irish DPC guidance and SI 284/2016 requirements where relevant.
Northern Ireland: EU proposed extending AI Act to NI under Windsor Framework — not yet agreed. Monitor for updates.

This skill is for informational purposes only. It does not constitute legal advice. Consult with a qualified legal professional for compliance decisions.

Last updated: July 2026 | Version 1.1.0 | Author: Enda Rochford, RandTrad Consulting