💡 EU AI Act Compliance Readiness Mapping for Sam

[github-actions[bot]]

Summary

Extend Sam's security plan workflow (CS) with an EU AI Act compliance readiness section that maps AI system components against risk classifications (unacceptable/high/limited/minimal risk), generates compliance documentation per Article 11/Annex IV requirements, and produces a gap analysis with specific remediation tasks. Covers risk assessment, transparency requirements, human oversight mandates, and data governance obligations.

Market Signal

The EU AI Act enforcement date is August 2, 2026 — less than two weeks away. CISA and G7 partners released joint SBOM-for-AI guidance. CycloneDX ML-BOM and SPDX 3.0 are the two competing specs for AI supply chain transparency. 97% of organizations that experienced AI breaches lacked basic AI access controls (IBM 2025 study). The regulatory environment strongly favors governance-first tools over retrofit compliance. Sources: EU AI Act text, CISA/G7 SBOM guidance (Industrial Cyber), Cloudsmith 2026 supply chain guide, Dark Reading SBOM analysis.

User Signal

Sam's existing security plan workflow covers traditional compliance mapping (SOC2, HIPAA, PCI-DSS, GDPR) but does not address AI-specific regulatory requirements. The EU AI Act introduces novel obligations — risk classification of AI systems, mandatory technical documentation (Article 11/Annex IV), transparency for users interacting with AI, human oversight requirements, and data governance for training data — that do not map cleanly to existing compliance frameworks. Teams deploying AI in EU markets need structured planning guidance.

Technical Opportunity

Sam's security plan workflow (bgr-3-create-security-plan) already has a step-04-compliance-mapping.md phase with a framework-mapping pattern. An EU AI Act section can follow the same pattern:

1. Risk Classification — Classify AI system risk level based on use case and sector (unacceptable/high/limited/minimal)
2. Obligation Mapping — Map applicable obligations from Articles 8-15 for high-risk systems
3. Documentation Requirements — Generate documentation checklist per Annex IV
4. Gap Analysis — Identify gaps between current controls and required controls
5. Remediation Roadmap — Produce prioritized remediation plan

Cross-workflow coherence validation in step-05 can check that AI-related controls are reflected in the observability plan (Article 12 monitoring), infrastructure plan (Article 15 robustness), and existing AIBOM/supply chain work (Discussion #386).

Assessment

Dimension	Score	Rationale
Feasibility	med	Requires careful mapping of regulatory requirements to template sections; regulatory landscape is complex but the framework-mapping pattern already exists in step-04
Impact	high	Regulatory compliance is mandatory for EU market access; non-compliance carries fines up to 7% of global turnover
Urgency	high	EU AI Act enforcement begins August 2, 2026 — imminent deadline

Adversarial Review

Strongest objection: Regulatory interpretations are still evolving and teams should consult legal counsel, not a planning tool. Including compliance mapping risks creating false confidence or incorrect guidance that could expose teams to liability.

Rebuttal: BGreat already includes compliance mapping for SOC2, HIPAA, PCI-DSS, and GDPR — this is the established pattern. The EU AI Act section would be explicitly scoped as a planning framework (not legal advice), helping teams inventory their obligations and organize their compliance program. The core EU AI Act text is stable; it is the implementing acts that evolve, and the workflow can be updated as guidance clarifies. Teams that plan with structure are far better positioned than those who discover requirements during enforcement.

Suggested Next Step

Add an "AI Regulatory Compliance" section to Sam's step-04-compliance-mapping.md that covers EU AI Act risk classification, Article 11 documentation requirements, Annex IV technical documentation checklist, and integration points with existing compliance frameworks already in the workflow.