Compliance Checks

Conduct EU regulatory assessments and receive structured first-pass compliance checks.

EU regulatory compliance checks covering NIS-2 applicability, EU AI Act risk classification, GDPR risk assessment for applications, DPA (Data Processing Agreement) review, TOM (Technical and Organizational Measures) review, and AI system security assessment against ISO 27001 and ISO 42001 — all producing structured RED/YELLOW/GREEN reports against legal requirements.

Use /nis2-check to determine whether an entity falls within NIS-2 scope as essential or important entity. Use /aiact-risk-check to classify an AI system's risk category and map applicable EU AI Act obligations.

Assess GDPR compliance for new applications with /gdpr-risk-check, review Data Processing Agreements clause-by-clause with /dpa-check, and evaluate Technical and Organizational Measures against Art. 32 GDPR with /tom-check.

Check AI system security documentation against ISO 27001 and ISO 42001 controls with /ai-security-check.

Disclaimer: This plugin assists with compliance workflows but does not provide legal advice. All assessments should be reviewed by qualified professionals. Regulatory requirements change frequently; always verify current requirements with authoritative sources.

Installation

claude plugins add github:cyberagentic/compliance-checks

Skills

Skill	Description
nis2-check	NIS-2 Directive applicability assessment. Determines whether an entity falls within NIS-2 scope and classifies it as essential or important.
aiact-risk-check	EU AI Act risk classification with simplified decision tree. Determines risk category and maps applicable obligations.
gdpr-risk-check	GDPR risk check for new applications and systems. Assesses 8 compliance dimensions and determines risk category.
tom-check	Assesses Technical and Organizational Measures against 12 check points aligned to Art. 32 GDPR and ISO 27001. Accepts PDF, Word, or pasted text.
dpa-check	Reviews a Data Processing Agreement against 9 mandatory check points from Art. 28 GDPR. Accepts PDF, Word, or pasted text.
ai-security-check	Assesses AI system security documentation against 11 check points derived from ISO 27001 and ISO 42001 controls. Accepts PDF, Word, or pasted text.

NIS-2 Check

Assess whether an entity falls within the scope of the NIS-2 Directive (EU 2022/2555).

/nis2-check

What it does:

Gathers entity information: website URL or company name + country, optionally sector, employee count, turnover, balance sheet total
Cross-references against NIS-2 scope rules, sector lists (Annex I + II), and size thresholds
Produces a classification report: 🔴 essential entity, 🟡 important entity, 🟢 not in scope, or ⚠️ conditional

Criteria assessed:

Sector and sub-sector matching (Annex I high-criticality / Annex II other critical sectors)
Size thresholds (employees, turnover, balance sheet total)
Special-rule entities (regardless of size)
Essential vs. important entity classification

EU AI Act Check

Classify an AI system under the EU AI Act and map applicable obligations.

/aiact-risk-check

What it does:

Asks 6 intake questions (+ conditional follow-ups): system description, role in AI value chain, application area, significant risk, transparency functions, exclusions
Processes a simplified classification decision tree internally (Steps C1–C8)
Produces a report with risk category and applicable obligations

Risk categories:

🔴 Prohibited — Art. 5 EU AI Act
🟠 High Risk — Art. 6 EU AI Act
🟡 Limited Risk — Art. 50 transparency obligations
🟢 Minimal Risk — Art. 4 AI literacy only
⚪ Excluded / Not in Scope
⚠️ Ambiguous — insufficient information

GDPR Check

GDPR risk check for introducing a new application or system.

/gdpr-risk-check

What it does:

Asks 5 intake questions: service description, data types, third-country transfer, DPA status, legal basis
Assesses 8 compliance dimensions (🟢/🟡/🔴 per dimension)
Produces a risk category (🔴 High / 🟡 Limited / 🟢 Minimal) with an obligations table

Dimensions assessed:

Personal data classification
Legal basis
DPIA requirement
Data protection principles
Data subject rights
Third country transfer
Data processing agreement
Accountability

TOM Check

Assess a Technical and Organizational Measures document against Art. 32 GDPR.

/tom-check

Accepts: PDF upload, Word/DOCX upload, or pasted text (TOM annex, security concept, or standalone TOM description).

What it does:

Accepts the TOM documentation
Evaluates 12 check points ordered by ISO 27001:2022 Annex A domains with GDPR article references
Produces a traffic-light report: 🔴 Critical → 🟡 Action Needed → 🟢 Requirement Met

Check points covered:

Data protection organization, training & certification
Supplier & processor control
Incident management & reporting
Review & continuous improvement
Physical security
Access control & authentication
Access rights management
Separation control
Encryption & pseudonymization
Integrity & transfer security
Availability & recovery
Deletion & storage limitation

AI Security Check

Assess an AI system's security documentation against ISO 27001 and ISO 42001 controls.

/ai-security-check

Accepts: PDF upload, Word/DOCX upload, or pasted text (security concept, ISMS documentation, AI system security documentation, or similar).

What it does:

Accepts the security documentation
Evaluates 11 check points covering ISO 27001 information security controls and ISO 42001 AI-specific controls
Produces a traffic-light report: 🔴 Critical → 🟡 Action Needed → 🟢 Requirement Met

Check points covered:

Asset management
Access control
Cryptography
Operations security (incl. AI system monitoring and event logging)
Communications security
System acquisition, development & maintenance (incl. responsible AI design and AI verification)
Supplier relationships (incl. AI system deployment)
Business continuity
Resources for AI systems
Assessing impacts of AI systems
Data for AI systems

DPA Check

Review a Data Processing Agreement for Art. 28 GDPR compliance.

/dpa-check

Accepts: PDF upload, Word/DOCX upload, or pasted contract text.

What it does:

Asks 3 intake questions: contract input, your role (controller/processor), third-country nexus
Evaluates 9 check points strictly aligned to Art. 28 GDPR (Para. 3 lit. a–h + Para. 9)
Produces a traffic-light report: 🔴 Critical → 🟡 Action Needed → 🟢 Requirement Met

Check points covered:

Written form and mandatory contract contents
Documented instructions
Confidentiality
Technical and organizational measures
Sub-processors (authorization, flow-down, liability)
Data subject rights assistance
Security and notification obligations
Deletion and return
Accountability and audit

Example Workflows

NIS-2 Applicability

Run /nis2-check and provide your company website or name + country
Answer questions about sector, employee count, and turnover
Receive a scope assessment with essential/important classification

AI Act Risk Classification

Run /aiact-risk-check and describe your AI system and its use case
Answer intake questions about role, application area, and system functions
Receive a risk classification with applicable obligations

GDPR Risk Check

Run /gdpr-risk-check and describe the application or system you want to introduce
Answer questions on data types, transfers, legal basis, and DPA status
Receive a risk category with an obligations table per compliance dimension

TOM Assessment

Run /tom-check and upload the TOM annex (PDF, Word) or paste the text
Receive a report covering 12 check points from physical security to deletion concepts
Address flagged gaps before signing or renewing the processor contract

AI Security Assessment

Run /ai-security-check and upload the security documentation (PDF, Word) or paste the text
Receive a report covering 11 check points from asset management to AI data governance
Address flagged gaps to strengthen your AI system's security posture

DPA Review

Run /dpa-check and upload the Data Processing Agreement (PDF, Word) or paste the text
Provide context: your role (controller/processor) and third-country nexus
Receive an Art. 28 GDPR compliance check with flagged clauses and gaps

File Structure

compliance-checks/
├── .claude-plugin/
│   └── plugin.json
├── README.md
└── skills/
    ├── nis2-check/
    │   ├── SKILL.md
    │   └── references/
    │       ├── nis2-criteria.md
    │       └── nis2-nace-rev2.md
    ├── aiact-risk-check/
    │   ├── SKILL.md
    │   └── references/
    │       └── decision-tree.md
    ├── gdpr-risk-check/
    │   ├── SKILL.md
    │   └── references/
    │       └── gdpr-dimensions.md
    ├── tom-check/
    │   ├── SKILL.md
    │   └── references/
    │       └── check-requirements.md
    ├── dpa-check/
    │   ├── SKILL.md
    │   └── references/
    │       └── check-requirements.md
    └── ai-security-check/
        ├── SKILL.md
        └── references/
            └── check-requirements.md

Setup

No external services or environment variables required. The plugin works entirely through Claude's built-in capabilities — upload or paste your documents and get structured compliance reports.