Skip to content

EU AI Act: Compliance Baseline for SkillPilot

Generated artifact. Do not edit manually.

Generated by: scripts/build_compendia.py Regenerate with: python3 scripts/build_compendia.py --compendium security --web-and-tex Source of truth: docs/security/source/

Language / Sprache: English (EN) · Deutsch (DE) | PDF: English PDF · Deutsches PDF

Compendium: §1 Data Privacy & Storage · §2 OpenAI MCP Client Binding · §3 EU AI Act Compliance

3. EU AI Act: Compliance Baseline for SkillPilot

Documented compliance baseline and live inventory

Baseline date of this assessment: 29 July 2026 (documented repository compliance record; does not constitute legal advice). The machine-readable AI transparency inventory is deterministically maintained as assets evolve; for the subsequent September 2026 provider work order (active Claude learning beta ahead of focused ChatGPT acceptance), see the Claude-first release strategy and 1.

3.1. Regulatory Calendar

Track Effective date Relevance for SkillPilot
Article 50 AI Act 2 August 2026 Transparency duties for direct AI interaction and specific synthetic content. The transition period until 2 December 2026 applies strictly to Art. 50(2) for generative systems placed on the market before 2 August 2026.
Annex III / Art. 6(2) 2 December 2027 Chapter III Sections 1–3 apply from this date to Annex III high-risk systems. Legally separate from Article 50.
Annex I / Art. 6(1) 2 August 2028 Later product-safety regulation track, not primary for SkillPilot's current scope.

Legal foundations are the EU AI Act (EU) 2024/1689, Amending Regulation (EU) 2026/1744 (in force since 27 July 2026), and the European Commission's Guidelines on Article 50 transparency obligations adopted on 20 July 2026 (interpretive guidance rather than statutory text).

3.2. Verified Product Inventory

The continuously verified machine-readable transparency inventory serves as technical evidence; as of 29 July 2026, the repository audit established the following facts and evidentiary boundaries:

Asset class Repository fact on 29 July 2026 Evidentiary boundary
Goal visualizations app/public/assets/goal-visualizations/ holds 1,494 images (1,484 JPG, 10 PNG), matching the canonical source set. File counts and formats prove neither initial public availability prior to a statutory cutoff nor deepfake status.
Image provenance A byte scan detects a c2pa marker in 1,491 images and Created by Google Generative AI in 1,484 images; prompt sidecars frequently cite Gemini / Nano Banana Pro. No cryptographic validation of C2PA signatures, certificate chains, or manifest integrity — provenance indicators rather than validated Art. 50 proof.
Narrative illustrations & comics Five semantic collections comprising 24 runtime files (12 bilingual quickstart scene files plus 12 language/format variants across four comic sets including docs/comic4/). File count does not equal distinct creative works; generation provider and first publication dates are not exhaustively evidenced.
Whitepaper raster figures docs/whitepaper/ and app/public/whitepaper/ bind 24 PNG files (2 shared with docs/comic4/), yielding 46 unique runtime images outside goal visualizations. Mixed or partially evidenced provenance; inventorying explicitly does not imply all 24 whitepaper figures are AI-generated.
Learning coach (29 July 2026 baseline) Two ChatGPT connection paths at baseline; the external AI provider executes the dialogue model while SkillPilot supplies context and tools. The Claude OAuth/MCP lane paused on 29 July 2026 was subsequently promoted to the active learning beta by Product Owner decision in September 2026 (see 1).
Texts and flashcards Governed by domain and editorial QA lanes without uniform per-item provider generation logs. No blanket claim that every text is purely AI-generated; the public-interest text exception requires demonstrable human review and editorial responsibility per case.

3.2. Audio Inventory

  • app/public/audio/intro-de.m4a — Duration 1095.540680 s, encoder tag Google, SHA-256: 11af439ea19741567bd797d7b05314c2a1f5c416413beed5f781e2fd7d1cf196
  • app/public/audio/intro-en.m4a — Duration 892.482177 s, encoder tag Google, SHA-256: e4d53b9f15932b7b1ce863cf06a48b36323a8a1efa09f0238fe96407a471a923
  • docs/notebooklm/SkillPilot_macht_Bildung_zum_Navigationssystem.m4a — Duration 801.413515 s, encoder tag Google, SHA-256: 267aafede53d9849a980cccd0304abc47c7069edee5ecac5ab8263c06c594876
  • docs/notebooklm/Skill_Graphs_Tame_the_Smart_Liar.m4a — Duration 1134.410884 s, encoder tag Google, SHA-256: 1542430f14f1beee4738dfa5b655b7fc1d819503a95e31dc1f02dbd580da43f8

Published audio introductions are not byte-identical to the two archived NotebookLM recordings. An encoder tag or UI icon proves neither the specific synthesis service nor voice provenance; accordingly, the precautionary provider-neutral player notice ("This audio introduction contains AI-generated voices") does not substitute for full segment and voice provenance records.

3.3. Article 50: Classification and Implementation

  • Role boundaries: Art. 50(2) attaches to the provider of the generative AI system placed on the market (not determined by model hosting alone). SkillPilot treats itself precautionarily as a deployer for its integration and publication, re-evaluating potential provider obligations whenever placing a system on the market under its own name, substantially modifying it, or changing its intended purpose. Role assessments are documented per system and content class.
  • Direct interaction: Coach dialogues run inside the selected provider's chat interface; additionally, the SkillPilot launch surface explicitly names the AI assistant and warns of potential mistakes rather than relying solely on the "obvious to a reasonably well-informed person" exception (applying heightened clarity standards for minors).
  • Four-part cumulative deepfake test (Art. 3(60)): Content constitutes a deepfake only when cumulatively (1) AI-generated or AI-manipulated, (2) image, audio, or video, (3) appreciably resembling existing persons, objects, places, entities, or events (even without a named real-world individual), and (4) presented in a context appearing falsely authentic or truthful to a person (applying stricter intelligibility for minors). Schematic didactic illustrations regularly lack element (4) as a class assumption — without granting a blanket exemption or claiming a global image badge. Both audio introductions display an explicit AI-voice notice directly on the player, since a standalone legal subpage alone would not satisfy Art. 50(4) where applicable.
  • Legacy stock and five-step gate for post-cutoff assets: Lacking exhaustive pre-2 August 2026 first-publication records, SkillPilot does not claim legacy grandfathering, relying instead on substantive Art. 50 review and contextual player/coach notices. Any content AI-generated, AI-manipulated, or materially repurposed after 2 August 2026 must pass five pre-release steps: (1) determine actor and role, (2) evaluate content type and deepfake criteria, (3) for public-interest text, document human review and editorial responsibility or disclose at the content, (4) where required, label clearly and accessibly no later than first exposure, and (5) record decision, version, date, and reviewer role in the inventory. Existing C2PA structures are preserved on deployment without substituting for human-readable disclosure.

3.4. Annex III: Preliminary High-Risk Boundary

System boundaries and AI-system status under Art. 3(1) are assessed separately for the learning coach, deterministic state tools, and future grading modules based on intended purpose, documentation, marketing, and concrete deployment context (informed by non-binding examples from the official AI Act Service Desk on Education):

Deployment context Preliminary classification
Self-directed learning outside an educational or vocational institution without formal grading, admission, or certification effect Currently not treated as Annex III No. 3(b); AI feedback remains a soft study aid with formal decisions excluded.
Deployment by an educational or vocational institution where AI outputs evaluate learning outcomes or steer the learning process based on such evaluation Treated precautionarily as high-risk under Annex III No. 3(b) unless a documented counter-assessment establishes otherwise; requires a dedicated release gate prior to activation.

Six triggers activating the high-risk review lane: (1) contracts, pilots, or marketing targeting schools, universities, or vocational institutions, (2) using AI outputs or mastery values for grades, certificates, admission, promotion, or graduation, (3) institutionally mandated learning-path steering driven by AI evaluation, (4) new automated scoring, ranking, or prediction features, (5) profiling within the meaning of Art. 4(4) GDPR inside an Annex III system (personalization alone does not automatically constitute profiling), and (6) placing on the market under SkillPilot's name, substantial modification, or change of intended purpose.

An exemption under Art. 6(3) never applies where profiling occurs and requires cumulatively no significant risk to health, safety, or fundamental rights, no material influence on decision outcomes, plus at least one of four alternative conditions: (1) narrow procedural task, (2) improving the result of a previously completed human activity, (3) detecting patterns or deviations without replacing proper human assessment, or (4) preparatory task for an Annex III assessment — backed by pre-market documentation and Art. 49(2) EU database registration by the provider.

3.5. Evidence Status, Release Gates, and Ongoing Maintenance

Measure Documented status (29 July 2026 baseline)
Concise AI transparency section in /legal (DE/EN) Implemented in repository without adding a new consent or liability-waiver gate or forcing re-consent.
General liability-notice gate Kept technically and legally separate from Article 50 and unchanged (mandatory statutory rights remain unaffected).
Contextual AI notices on audio player & coach start (DE/EN) Implemented in repository with passing local render, copy, and accessibility smoke checks.
Machine-readable inventory & CI/deploy gates check:ai-transparency-inventory, check:ai-transparency-artifact, and deploy readiness checks verify UI, inventory, and built artifacts.
Legacy grandfathering & cryptographic C2PA validation Neither is claimed; C2PA markers are documented strictly as byte structures.
Institutional high-risk release gate Future trigger prior to any institutional pilot or release; not a deficit of the voluntary self-study product.

Maintenance triggers: Both this dossier and the JSON inventory are re-evaluated upon any provider or model change, new asset class, realistic voice or human likeness, change to coaching or evaluation mechanics, institutional distribution, or material change of intended purpose, alongside role-appropriate AI literacy support under Article 4 AI Act.