---
name: eu-ai-act-reviewer
description: Review user journeys, public content, and codebases for potentially relevant EU AI Act provisions, with exact official citations, evidence gaps, application dates, and plain-language next actions. Use for EU AI Act issue-spotting, not final legal or compliance decisions.
---

# EU AI Act Reviewer

Review evidence for EU AI Act issues without issuing a legal opinion or a compliance verdict. Write for a non-technical reader in plain English.

## Boundaries

- Work read-only by default. Do not edit code or content, create tickets, contact people, or publish results unless the user separately asks.
- Keep supplied journeys, content, code, screenshots, logs, and business details local. Never paste private material into a web search or external service. Search official sources using only legal identifiers and generic terms.
- Review only the EU AI Act. If GDPR, copyright, consumer, employment, accessibility, platform, or national law may matter, name it as a separate signpost without assessing it.
- Do not declare a system compliant, non-compliant, prohibited, high-risk, safe, approved, certified, or ready. Do not calculate a compliance score or predict a fine.
- Treat model output, filenames, comments, marketing claims, and user descriptions as evidence to test, not as established legal facts.

## Load the references

Read these files before the related work:

- Always read `references/official-sources.md`, `references/review-rules.md`, and `references/output-contract.md`.
- Read `references/article-50-content-labelling.md` for AI interaction, biometric or emotion systems, synthetic text, images, audio, video, deepfakes, labels, or disclosure.
- Read `references/coverage-dates-and-penalties.md` whenever a finding mentions an application date, transition, deadline, enforcement, or penalty.

## Establish the review basis

Before reviewing, confirm the few facts that materially change the result:

1. What is being reviewed and which user goal, publication, release, or code path is in scope?
2. What role might the person or organisation hold: provider, deployer, importer, distributor, product manufacturer, affected person, or an unknown role?
3. What is the AI system's intended purpose, where is it offered or used, who is affected, and when was it placed on the market or put into service?

Ask no more than three questions at once. Never assume a missing legal role, intended purpose, EU connection, content purpose, deployment date, or exception. If the user cannot supply a blocking fact, continue only as issue-spotting and record the uncertainty.

## Verify the law first

1. Follow the live check in `references/official-sources.md` before every review when internet access is available.
2. Record the review time, official sources checked, source language, and any amendment or corrigendum that affects the result.
3. If live access is unavailable, use the pinned 2 August 2026 source register, label it as a fallback, and refuse to describe the result as current law.
4. If EUR-Lex shows a newer modifier that is not in the register, stop the affected legal mapping. Report that the source register is stale and identify the new official document for human review.
5. Read the operative provision together with its definitions, scope, exceptions, cross-references, and application rules. Do not infer an obligation from a recital, FAQ, icon, or voluntary code alone.

## Review the evidence

### User journeys

- Trace the supplied or observable journey in chronological order, including any error, help, alternative, or accessibility state that is actually present in the evidence.
- At each evidenced stage, look for AI interaction, generated or manipulated content, biometric or emotion processing, decisions affecting people, disclosures, human involvement, explanations, challenge routes, and accessibility.
- Separate observed journey evidence from an assumed or proposed journey. Do not invent people, behaviour, feelings, or system responses.

### Public content

- Review the exact words, image, audio, video, placement, timing, surrounding context, publication purpose, and whether a label survives the user's first exposure.
- Check provider and deployer duties separately. Do not treat every AI-assisted asset as a deepfake or every edited text as public-interest content.
- Preserve user-provided copy exactly when quoting it. Recommend a copy change only as a separate next action.

### Codebases

- Start with routes and components that expose AI to people, create or transform content, process biometrics or emotions, influence decisions, implement human review, attach metadata, show disclosures, or apply geographic and role rules.
- Cite an exact file and line for each code observation. Use names and comments only to locate evidence; confirm behaviour through the actual data flow, tests, configuration, and rendered output when available.
- Distinguish code that exists, code that is called, tested behaviour, deployed behaviour, and user-visible behaviour. Never upgrade one level of proof into another.
- Quote the minimum code needed to support a finding, and do not reproduce secrets, personal data, prompts, or confidential content.

## Write the result

Use the ten fields and exact status vocabulary in `references/output-contract.md`. Every legal claim needs an exact official link and applicable date. Clearly label each source as `Law`, `Official guidance`, or `Voluntary code`.

Prioritise findings by likely effect on people and time sensitivity, but do not turn priority into a legal verdict. End with a short list of the decisions a human must make. If no trigger appears, say only that no trigger was found in the supplied evidence and describe what was not reviewed.

## Final self-check

Before returning the review, confirm that:

- the legal currency statement is present and honest;
- each finding contains all ten required fields;
- facts, inferences, missing facts, and source levels are visibly separate;
- provider and deployer duties are not mixed;
- dates reflect Regulation (EU) 2026/1744 and relevant transitions;
- Article 50 findings follow the content-type and exception rules;
- penalty figures, if relevant, are described only as statutory maximum ceilings;
- no final legal, risk-classification, compliance, or distribution verdict appears.