EU AI Act Compliance Skill

Purpose

Classify AI systems used in HR and recruitment contexts according to EU AI Act risk categories and generate compliance gap reports with remediation recommendations.

When to Use

Use this skill when:

• A user asks about whether their AI system is "high-risk"
• They need to assess compliance with EU AI Act requirements
• They're implementing AI in recruitment, HR management, or workforce planning
• They need documentation for regulatory compliance

How It Works

Step 1: Gather Information

Ask the following clarifying questions to understand the AI system:

1. Use Case: What specific HR or recruitment function does the AI perform?

   • CV screening or parsing
   • Candidate ranking or shortlisting
   • Interview scheduling
   • Employee performance assessment
   • Workforce planning or forecasting
   • Other (specify)

2. Data Processed: What types of data does the AI process?

   • Personal data (name, contact details)
   • Professional qualifications
   • Employment history
   • Performance data
   • Biometric data
   • Inferences or predictions about individuals

3. Decision Impact: What decisions are influenced or made by the AI?

   • Automatic decisions (no human review)
   • Recommendations that inform human decisions
   • Filtering that affects candidate pools
   • Scoring or ranking of individuals
   • Other outcomes

4. Human Oversight: What human oversight mechanisms exist?

   • Human review before final decisions
   • Ability to override AI recommendations
   • Appeal or review process for affected individuals
   • Documentation of human involvement

5. Deployment Context: Where will the AI be deployed?

   • Public sector (subject to SI 284/2016 procurement rules)
   • Private sector
   • Cross-border processing
   • Irish-specific regulatory requirements

Step 2: Determine Risk Classification

Based on the information gathered, classify according to EU AI Act risk categories:

High-Risk Systems (Annex III, Article 6(2))

AI systems in HR are presumed high-risk if they:

1. Recruitment or selection systems (Annex III, 4.(a)):

   • CV screening and parsing
   • Candidate ranking or scoring
   • Interview scheduling that affects opportunities
   • Assessment tools for selection

2. Employment, worker management, access to self-employment (Annex III, 4.(b)):

   • Task allocation
   • Performance evaluation
   • Promotion or termination decisions
   • Access to employment opportunities

Medium-Risk Systems

Systems that:

• Assist human decisions but don't make autonomous decisions
• Process data without significantly affecting rights
• Have robust human oversight mechanisms

Minimal-Risk Systems

Systems that:

• Are purely informational
• Don't process personal data for decisions
• Don't affect individual rights or opportunities

Step 3: Generate Compliance Gap Report

For high-risk systems, assess against:

Step 4: Provide Remediation Steps

Recommend specific actions based on gaps identified:

1. Immediate actions (0-30 days): Critical compliance gaps
2. Short-term actions (30-90 days): Documentation and process gaps
3. Long-term actions (90+ days): System improvements and monitoring

Step 5: Reference Relevant Guidance

Always cite:

• EU AI Act articles (with specific sections)
• Annex III categorisation
• Irish DPC guidance where relevant
• GDPR Article 22 for automated decision-making
• SI 284/2016 for public sector procurement

Reference Files

This skill includes detailed references:

• references/article-14-checklist.md — Human oversight requirements
• references/gdpr-ai-intersection.md — GDPR and AI intersection
• references/recruitment-risk-assessment.md — Recruitment-specific risks
• references/irish-employment-context.md — Irish regulatory context

Output Format

Provide structured output:

## AI System Risk Classification

**System Name:** [Name]
**Classification:** [High-Risk / Medium-Risk / Minimal-Risk]
**Reasoning:** [Brief explanation with article references]

## Compliance Gap Report

[Gap analysis table]

## Recommended Actions

### Immediate (0-30 days)
- [Action 1]
- [Action 2]

### Short-term (30-90 days)
- [Action 1]
- [Action 2]

### Long-term (90+ days)
- [Action 1]
- [Action 2]

## Relevant References

- [EU AI Act Article X]
- [Irish DPC Guidance Y]
- [GDPR Article 22]

Important Notes

• Presumption of high-risk: HR AI systems listed in Annex III are presumed high-risk regardless of the specific risk they pose. This is a legal presumption, not a risk assessment.
• Prohibited practices: Some AI uses in employment are prohibited entirely (e.g., emotional recognition in workplace). Always check Article 5 prohibitions first.
• Irish context: For systems deployed in Ireland or processing data of EU data subjects, include Irish DPC guidance and SI 284/2016 requirements where relevant.

This skill is for informational purposes only. It does not constitute legal advice. Consult with a qualified legal professional for compliance decisions.