Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add legalithm-org/legalithm --skill eu-ai-act-compliancegit clone --depth 1 https://github.com/legalithm-org/legalithmWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/legalithm-org/legalithm/eu-ai-act-compliance)<a href="https://agentmods.dev/skills/legalithm-org/legalithm/eu-ai-act-compliance"><img src="https://agentmods.dev/badge/skills/legalithm-org/legalithm/eu-ai-act-compliance/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/legalithm-org/legalithm/eu-ai-act-compliance"><img src="https://agentmods.dev/badge/skills/legalithm-org/legalithm/eu-ai-act-compliance.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00060 | $0.00860 |
| Opus 5.5 | $0.00024 | $0.00344 |
| Sonnet 5.5 | $0.00012 | $0.00172 |
| Haiku 4.5 | $0.00006 | $0.00086 |
Grade A, and why
eu-ai-act-compliance scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
100% identical to eu-ai-act-compliance — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 67 lines — stays where its author put it; the contents beside it link to each section on GitHub.
EU AI Act compliance
The EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744)
applies to AI systems placed on the EU market. This skill routes the work to the
legalithm MCP tools, which answer from a versioned rule corpus and cite an
Article for every claim.
When to reach for this
- A new AI feature is being added, or an existing one materially changes
- Someone asks "does the AI Act apply to us?" or "what do we have to do?"
- A customer questionnaire, tender, or investor asks about AI compliance
- A chatbot, generated content, deepfake, or emotion-recognition feature ships
How to work
Rule, before anything else: classify runs first. Every risk argument you
pass to another tool must come from a classify result in this conversation,
never from your own reading of the case. If you have not called classify yet,
you do not know the tier, and calling explain_obligation with a guessed tier
returns a confident list of the wrong duties. Guessing "high" and being right is
not the same as knowing.
1. Classify. Call classify with the role (provider or deployer), the
domain, a plain-sentence description of the use case, and the audience. It
returns a risk tier — unacceptable, high, limited, or minimal — with a cited
rationale and a confidence. The tier determines everything downstream.
2. Get the actual duties. Call explain_obligation with the role and the
tier as returned by classify. Each obligation comes back with its Article
citation, for example Article 9 risk management or Article 10 data governance.
Use those named duties. Do not paraphrase the Act from memory and do not write
fear copy.
3. Article 50 transparency. If the feature is user-facing AI, generate the
disclosure with generate_disclosure rather than hand-writing legal text.
Scenarios are chatbot (Art 50(1)), genai-content (Art 50(2)), deepfake
(Art 50(4)) and emotion (Art 50(3)); English and German are supported. Article
50 has applied since 2 August 2026, so this is a live obligation, not a
future one.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 67 lines · 60 tokens per session scan A 00b4b9234dd9
eu-ai-act-compliance is a skill published in the GitHub repository legalithm-org/legalithm (1 stars, last pushed 14d ago), licensed MIT. It adds 60 tokens to every session and 860 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 100% identical to eu-ai-act-compliance, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
ai-act-compliance
Use when the user asks about EU AI Act (Regulation 2024/1689) compliance — classifying an AI system's risk tier (art. 5 prohibited / art. 6 + Annex III high-risk / art. 50 limited / minimal), evaluating conformity for high-risk AI (art. 8–17, 26–27), drafting Annex IV technical documentation, conducting a Fundamental…
compliance
Use when scoping which regulatory frameworks bind a business — SOC 2, ISO 27001, HIPAA, PCI DSS, EU AI Act, DORA, NIS2 — building a control register with owners and evidence, or standing up the cadence that keeps it audit-ready. NOT drafting privacy-policy/ROPA/DPA or ToS text (that is gdpr-privacy, terms-conditions)…
app-store-preflight-compliance
Pre-submission compliance scanner workflow for Apple App Store apps. Use when reviewing iOS, macOS, tvOS, watchOS, or visionOS projects (Swift, Objective-C, React Native, Expo) for App Store rejection risks, submission readiness, privacy compliance, or guideline violations.
receipt-query
Retrieve bounded receipt evidence by exact ids or explicit filters, returning native verification results for downstream review.
policy-draft
Draft or tighten a Runx operational policy from a governance brief, then validate the exact runx.operationalpolicy.v1 contract with the native policy engine. Use for repository/source/runner/owner policy design, fail-closed policy linting, or authority attenuation; never use this lane to widen an existing policy.
receipt-audit
Audit a sealed runx receipt for governance, comparing exercised authority and any declared approval requirement with signed evidence, and flag over-reach, approval inconsistency, unrecorded refusals, or exposed secret material.