Add EU AI Governance Pack (3 assistant workflows)

[mazurwieslaw2022-cmd]

Add EU AI Governance Pack (3 assistant workflows)

What

A new assistant workflow pack, eu-ai-governance-pack, with three English-language workflows for organisations deploying or building AI under EU rules:

• eu-ai-act-triage - fast classification under Regulation (EU) 2024/1689 through eight ordered determinations: AI-system definition (Article 3(1)), prohibited practices (Article 5), high-risk (Article 6 plus Annexes I and III, including the Article 6(3) filter and its profiling exception), GPAI (Chapter V, the 10^25 FLOP systemic-risk threshold), transparency (Article 50), operator role with the Article 25 requalification trap, and an obligation map against the Article 113 timeline. Ends in a triage card with a confidence tag on every cited provision; high-risk, GPAI, or suspected-prohibited results escalate mandatorily to a human.
• nis2-compliance-triage - a scope-and-obligations navigator for Directive (EU) 2022/2555 that puts the national-transposition question first, because a directive binds through national law and transpositions still diverge. Then: Annex I/II sectors, the size-cap rule and its size-independent exceptions, essential versus important, the ten Article 21(2) measures, the Article 23 reporting clock (24h / 72h / one month), Article 20 management-body duties, Article 34 penalty ceilings.
• privilege-preflight - a check on a single piece of legal content before it is pasted into an external AI tool. Five factors (client identifiability with a mosaic test, professional secrecy, work-product, third-party personal data, provider terms), a mechanical aggregation rule, and a banded SAFE / CAUTION / STOP verdict - with a redacted draft on CAUTION and alternatives instead of a bare prohibition on STOP. Framed on CJEU case law (AM&S 155/79, Akzo C-550/07 P), national secrecy regimes, GDPR, and the Trade Secrets Directive.

Every workflow ends in a draft for decision. Registering a system, notifying a CSIRT, filing a FRIA, sending a prompt - the outward acts stay with a human. All three carry an explicit source-verification discipline: an article number that cannot be confirmed in-session keeps a [TO VERIFY] tag and can never support a "does not apply" determination.

Where it comes from

The workflows are adapted from the open-source collection at awesome-matematic-skills-en and rewritten for this repository: harness-neutral wording, no CLI commands, no connector names, Mike frontmatter, add-on availability. All text is original work by Wieslaw Mazur / MateMatic Solutions, written against the texts of Regulation (EU) 2024/1689 and Directive (EU) 2022/2555, contributed under MIT.

One content note: the AI Act timeline in the triage reflects the state of the law as of August 2026 - the prohibitions and AI-literacy duties (since 2 February 2025), the GPAI and penalties layer (since 2 August 2025), and the main body including Annex III high-risk and Article 50 (since 2 August 2026) are all marked APPLYING, with only the Annex I product path still running to 2 August 2027.

Overlap with existing workflows

The eu-gdpr-pack (PR #16) covers data protection operations; this pack covers the two neighbouring regimes (AI Act, NIS2) plus prompt-level privilege hygiene. The regime boundaries are stated inside the workflows: the AI Act triage flags the DPIA overlap rather than assessing GDPR, and the NIS2 triage runs its incident clock alongside - never instead of - the GDPR breach clock.

How it was validated

workflow-schema/validate-workflows.py passes with the pack in place: 137 workflows, 16 column files, 5 packs. Checked by hand for what the validator does not cover: no CLI blocks, no harness-specific tool names, no em dashes. Statutory references were checked against the source texts during preparation; the [TO VERIFY] tags inside the workflows mark exactly the spots where a number or a document status must be confirmed at time of use rather than trusted.

🤖 Generated with Claude Code