compliance-review

A Claude Agent Skill that helps code meet the EU AI Act, the GDPR, the NIS2 Directive (EU 2022/2555), and secure-development (SSDLC) best practice — in three modes:

• Review — audit an existing repo and get a structured, evidence-based gap analysis: one table per area with, for each requirement, a status (Compliant / Gap / Partial / N/A / Out-of-scope), the evidence in the code (file and line), a severity, and a remediation, plus a prioritised fix list.
• Design / build — when you start or write a new app or feature, it applies the same requirements as compliance-by-design guardrails while coding (secure coding, secrets handling, access control, encryption, logging, data minimisation, AI transparency…), then self-checks and summarises what was built in.
• Data masking — hand it a CSV/JSON dataset and it infers the schema and detects PII without ever reading raw values into the conversation. It first asks what you want: pseudonymise (deterministic tokens — joins and dedup still work, still personal data under GDPR) or anonymise (drop identifiers, generalise dates/numbers, enforce k-anonymity — aims at leaving GDPR scope, at a cost in detail). Either way it can write a protected copy for safe analysis.

Just ask in plain language — "do a compliance review of this repo against NIS2 and GDPR" or "build this service GDPR-compliant and secure by design".

[!warning] This is an advisory aid, not a certification or legal opinion, and not legal advice. It never reads, prints, or hardcodes secret values — it only checks how secrets are handled. Not affiliated with or endorsed by the EU or any regulatory authority.

What it covers

• EU AI Act — risk classification, then (for higher-risk systems) data governance, technical documentation, logging, human oversight, and the transparency duties for chatbots and generative AI.
• GDPR — personal-data inventory, minimisation, retention/erasure, encryption (Art. 32), records of processing, international transfers, access logging.
• NIS2 — the code-visible technical measures of Art. 21 (cryptography, access control & MFA, secure development & vulnerability handling, supply-chain security, backup/continuity) and incident-handling/logging (Art. 23).
• Secure development (SSDLC) — environment separation, secure coding, SAST/dependency scanning, dependency & license inventory, security testing and code review before release. Aligned with OWASP SAMM / ASVS and NIST SSDF.
• Data masking — schema inference, PII detection (emails, phones, national IDs, IBANs, health terms…) and two strategies: deterministic pseudonymisation or k-anonymity-based anonymisation. Honest about limits: hashing is pseudonymisation under GDPR Art. 4(5); anonymisation is strong risk reduction, not a legal guarantee.

The EU frameworks are public legal texts, so the skill cites articles directly.

Install it on Claude

The skill can run a small scanner script in review mode, so enable Code execution in Settings -> Capabilities (review still works without it — the script is optional).

Claude apps (web & desktop)

1. Download compliance-review.skill (or install via the marketplace below).
2. In Claude, click Customize (bottom-left) -> Skills.
3. Click + -> Upload a skill -> choose the compliance-review.skill file. A .skill file is just a ZIP; if the uploader insists on .zip, rename it.
4. It appears in your skills list, enabled.

Cowork (desktop automation)

Use the same Settings -> Capabilities -> Skills -> Upload a skill flow, or copy the compliance-review skill folder into your Cowork skills folder (each skill in its own subdirectory). Cowork picks it up on the next start.

Claude Code (via this marketplace)

/plugin marketplace add leodisa/compliance-review-skill
/plugin install compliance-review@compliance-review-skill

/plugin marketplace add also accepts a full Git URL.

Use it

Review an existing repo:

Do a compliance review of ./my-service against NIS2 and GDPR.

Is this codebase AI Act compliant? Save the report to a compliance/ folder.

Mask a dataset before analysing it:

Here's customers.csv — infer the structure and anonymise it before we work on it.

Build something new, compliant and secure by design:

Build a FastAPI service to store customer contacts, GDPR-compliant by design.

Add a login feature to this app with NIS2 and secure-coding measures baked in.

You can name one area or all four; if you name none, it uses all four (AI Act, GDPR, NIS2, secure development). Review mode saves the report where you ask; design mode delivers the code plus a short "what was built in" summary.

Good to know (scope)

NIS2 and GDPR are mostly organisational regimes — policies, training, and reporting to authorities live outside any codebase, and the skill honestly marks those Out-of-scope (org). Whether NIS2 applies to your organisation is a legal question (sector/size), stated as a premise rather than judged from code. AI Act risk classification is ultimately the provider's responsibility — the skill reasons and flags, it does not rule. Treat the output as a prioritised worklist for a human reviewer, not a verdict.

License

MIT — see LICENSE.