Use whenever code touches authentication, login, session management, audit logging, or application logging — even if the user's prompt doesn't mention DSGVO, GDPR, privacy, or "personal data". Triggers on bcrypt/argon2/scrypt, jsonwebtoken/jose, passport/next-auth/Auth.js/authjs/lucia, express-session/iron-session…
Use whenever code touches newsletter, marketing-email, drip-campaign, re-engagement, win-back, lead-magnet, or any outbound email with promotional content — even if the user's prompt doesn't mention DSGVO, GDPR, UWG, privacy, or "personal data". Triggers on Mailchimp / @mailchimp/mailchimpmarketing, Brevo /…
Use whenever code or infrastructure handles user data and touches a non-EU service or region — even if the user's prompt doesn't mention DSGVO, GDPR, privacy, or "personal data". Any user data (names, emails, IPs, user IDs, avatars, profile pictures, uploaded files, user-generated content…
Classify AI systems and GPAI models under the current EU AI Act. Use for Article 5 prohibited-practice screening, Article 6 and Annex I/III high-risk analysis, Article 6(3) exceptions, Article 50 transparency duties, GPAI duties, role allocation, deadlines, or an evidence-backed classification memo.
Assess and build an EU AI Act compliance programme. Use for inventories, role maps, deadline readiness, Article 4 AI literacy, high-risk provider or deployer controls, GPAI governance, policy roadmaps, remediation plans, or executive compliance status.
Assess an AI vendor, model provider, or supplier relationship. Use for EU AI Act role and evidence checks, GDPR processor terms, security and resilience review, model-change controls, incident routes, audit rights, contractual redlines, or a go/no-go procurement recommendation.