GPAI Code of Practice Compliance

What this skill does

Assess compliance with the EU General-Purpose AI (GPAI) Code of Practice under the AI Act (Regulation (EU) 2024/1689), Articles 51-56. Covers GPAI model identification (Art. 3(63)), systemic risk model designation (Art. 3(65), Art. 51, 10^25 FLOP training compute threshold), upstream provider obligations under Art. 53 (transparency, technical documentation, copyright policy, training data summary), additional systemic risk obligations under Art. 55 (model evaluation, adversarial testing, AI Office incident notification, cybersecurity), systemic-risk notification and Commission designation under Art. 52, downstream Art. 25 quasi-provider duties, and Art. 53(2) open-source exemption. Built for in-house counsel and AI governance teams reviewing LLM or foundation model deployments, drafting GPAI compliance plans, or assessing systemic risk thresholds. DACH: BaFin, BSI, BNetzA. Pairs with the EU AI Act System Classifier, High-Risk Readiness, FRIA, and Serious Incident Reporting skills.

• Gpai
• Code
• Practice

Where it runs, and how to install it

Agent Skills are a format, not a product feature: a folder with a SKILL.md and whatever files it needs. Nothing inside one is model-specific.

Claude

Drop the skill folder into ~/.claude/skills/, or upload it in Settings → Capabilities. Claude loads it when the description matches what you asked for.

Claude Code

Same folder, per-project instead: .claude/skills/ inside the repository, so the skill travels with the work rather than with the machine.

Any agent that reads SKILL.md

A skill is a folder with a SKILL.md and whatever files it needs. Nothing in the format is model-specific, so a runtime that reads the file reads the skill.

More from Werner Plutat

• EU AI Act System ClassifierClassify an AI system under the EU AI Act (Regulation (EU) 2024/1689) and map the compliance obligations that follow. Walks Art. 2 scope exclusions, Art. 3(1) AI system definition (7-criteria test), Art. 5 prohibited practice screening, Annex I and Annex III high-risk assessment with the Art. 6(3) narrow procedural exception, Art. 51-56 GPAI with the 10^25 FLOP systemic risk threshold, and Art. 50
• EU AI Act High-Risk Implementation ReadinessAssess and operationalize implementation readiness for high-risk AI systems under the EU AI Act Annex III, including provider and deployer obligations, conformity assessment, post-market monitoring, and EU database registration. Use when users say things like “we classified this as high-risk, what now?”, “build an EU AI Act readiness plan”, “assess our Annex III compliance gaps”, “what do providers/deployers of high-risk AI need to implement?”, “prepare for conformity assessment”, or “create a high-risk AI implementation roadmap.”
• EU Data Act Compliance AssessmentAssess compliance obligations under the EU Data Act (Regulation (EU) 2023/2854) for connected products, IoT devices, data sharing, cloud switching, B2B fairness, B2G data access, dispute resolution, and international data transfers. Covers scope assessment (manufacturer, data holder, data recipient roles), user data access rights, pre-sale transparency, unfair contract terms, public authority data requests, cloud portability, dispute settlement mechanisms, international transfer restrictions, access-by-design obligations, trade secret protection, and cross-regulation mapping with GDPR, AI Act, and CRA. Use when assessing Data Act obligations, designing connected products, drafting data sharing contracts, responding to B2G requests, planning cloud switching capabilities, or evaluating dispute resolution options.
• Fundamental Rights Impact Assessment - EU AI Act Art. 27Assess whether a Fundamental Rights Impact Assessment (FRIA) is required under Article 27 EU AI Act, and structure or draft that assessment for a specific high-risk AI deployment. Covers deployer scope gating (public bodies and private entities providing public services), affected group mapping, Charter rights analysis, proportionality, safeguards evaluation, residual risk, DPIA/FRIA interaction, notification under Article 27(3), and DACH-specific considerations. Use when asked about FRIA obligations, Article 27 scope, fundamental rights and AI, or deployer assessment duties.
• Serious Incident Reporting - EU AI Act Article 73Serious Incident Reporting (SIR) for high-risk AI systems under Article 73 EU AI Act (Regulation (EU) 2024/1689). Assess, qualify, draft, and submit Art. 73 SIR notifications across the four Art. 3(49) harm categories (death or serious health damage, critical infrastructure disruption, breach of fundamental rights, property or environmental damage). Covers Art. 73 immediate, 2/10/15-day reporting windows, market surveillance authority notification, deployer duties under Art. 26(5), and cross-regulation mapping with GDPR Art. 33/34 breach notification, NIS2 Art. 23 incident reporting, DORA Art. 19 ICT incident, and MDR vigilance. Built for in-house counsel and AI risk teams handling AI incidents, building AI incident response playbooks, or managing AI failure, AI bias, or automated decision incidents. DACH routing through German market surveillance (BNetzA, BaFin, BSI, BfArM, KBA). Pairs with the EU AI Act System Classifier, High-Risk Readiness, FRIA, and GPAI Code of Practice skills.

Skills that do related work

• Agent Authority Charter BuilderCreates an Agent Authority Charter for enterprise or regulated AI agents before deployment. Use this Skill when a user needs to define what an AI agent is allow
• Agentic Delegation AuditUse when a lawyer, legal team, or client needs to assess AI agents that can act on someone's behalf: send messages, search, draft, file, pay, delete, connect to
• AI Audit TrailThis skill builds a structured audit trail of an AI-assisted task: what the tool was asked to do, what materials it was given, what it produced, how the output
• AI Governance ReviewerConduct AI governance, legal-risk, privacy, compliance, procurement, or vendor-risk reviews of internal AI use cases, AI product features, LLM workflows, or thi
• Ai InventoryEU AI Act per-system inventory — track each AI system's role (provider, deployer, importer, distributor, authorized representative, product manufacturer) and ri
• Aia GenerationRun an AI impact assessment — structured intake, risk analysis, regulatory classification per regime in scope, policy consistency diff, and recommendation with