arize-compliance-audit

This skill audits an AI agent or LLM application for regulatory compliance across a broad set of frameworks: the EU AI Act, the GPAI Code of Practice, GDPR, NIST AI RMF, the Colorado AI Act, NYC Local Law 144, HIPAA, and ISO 42001. It solves the problem of teams not knowing where their AI system falls short of documentation, logging, transparency, and governance expectations, and it cross-references Arize instrumentation to check whether tracing captures the audit-trail evidence regulators expect.

The workflow opens with a mandatory legal disclaimer presented verbatim, then asks the user which framework families apply and what the use case category is, rather than auto-selecting. It favors inspection over mutation, scanning the codebase for compliance gaps and tailoring findings to the specific jurisdiction and use case instead of dumping the entire regulatory text. Detailed reference files translate the EU AI Act risk tiers, high-risk obligations (risk management, data governance, technical documentation, record-keeping, human oversight, accuracy and cybersecurity), GPAI commitments, GDPR intersections, US frameworks, and ISO 42001 controls into developer-actionable items. It produces a remediation checklist and offers to implement fixes only after explicit user confirmation, and it emphasizes never embedding literal credential values, always referencing environment variables instead.

Target users are AI engineers, compliance and risk teams, and product owners building LLM applications who need a technical, developer-focused first pass at regulatory readiness. It is explicitly guidance, not legal advice, and is best used before engaging qualified legal counsel.