[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M718AHDDC0H5SPFS5PX90JDK":3,"skill-same:01M718AHDDC0H5SPFS5PX90JDK":73},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":51,"commitSha":52,"skillDirectory":53,"forksCount":54,"repositoryHtmlUrl":55,"repositoryHomepageUrl":6,"ownerHtmlUrl":56,"ownerBlogUrl":57,"ownerDescription":6,"updatedAt":58,"install":59,"resources":72},"01M718AHDDC0H5SPFS5PX90JDK","reg-gap-analysis",null,"Diff a new AI regulation or guidance against your current governance posture — surfaces gaps, priorities, and a remediation plan with owners and deadlines. Use when an AI regulation moves (or you learn about one you missed), or when user says \"new reg just dropped\", \"does [regulation] affect us\", \"gap analysis for EU AI Act\", \"compliance check against [AI law or guidance]\", or pastes regulatory text.","anthropics\u002Fclaude-for-legal","anthropics","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F76263028?v=4","01M697XGDPXJAVQ8391V2BCYTE","Anthropic","01M7189QY7HXHMC9BW4MFHPZ6H",9970,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fanthropics\u002Fclaude-for-legal\u002Fblob\u002Fmain\u002Fai-governance-legal\u002Fskills\u002Freg-gap-analysis\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"reg","reg gap analysis","gap analysis","gap","analysis","for","diff","act","priorities","surfaces","paste","remediation","missed","attach","plan","text","you","learn","when","new","2026-11-10 10:12:30",false,"---\nname: reg-gap-analysis\ndescription: >\n  Diff a new AI regulation or guidance against your current governance posture —\n  surfaces gaps, priorities, and a remediation plan with owners and deadlines.\n  Use when an AI regulation moves (or you learn about one you missed), or when\n  user says \"new reg just dropped\", \"does [regulation] affect us\", \"gap analysis\n  for EU AI Act\", \"compliance check against [AI law or guidance]\", or pastes\n  regulatory text.\nargument-hint: \"[regulation name, or paste regulatory text, or attach a document]\"\n---\n\n# \u002Freg-gap-analysis\n\n1. Read `~\u002F.claude\u002Fplugins\u002Fconfig\u002Fclaude-for-legal\u002Fai-governance-legal\u002FCLAUDE.md`. Confirm regulatory footprint and use case registry are populated.\n2. Use the framework below.\n3. Scope: does this regulation apply? (Jurisdiction, threshold, builder\u002Fdeployer, sector.) If not, one line and done.\n4. Extract requirements. Diff against current state in `~\u002F.claude\u002Fplugins\u002Fconfig\u002Fclaude-for-legal\u002Fai-governance-legal\u002FCLAUDE.md`.\n5. Prioritize gaps. Output: remediation plan with must-do \u002F should-do \u002F already compliant \u002F accepted gaps.\n6. Save as dated markdown doc for the file.\n\n```\n\u002Fai-governance-legal:reg-gap-analysis \"EU AI Act high-risk provisions\"\n```\n\n---\n\n## Purpose\n\nThe EU AI Act goes live. Colorado passes an AI law. The CFPB issues model risk\nguidance. The FTC publishes an AI enforcement policy. Something moves — and now\nyou need to know what, if anything, you have to change.\n\nThis skill diffs the new requirement against your current AI governance posture\n(per `~\u002F.claude\u002Fplugins\u002Fconfig\u002Fclaude-for-legal\u002Fai-governance-legal\u002FCLAUDE.md` — use case registry, vendor positions, impact assessment practices,\nand AI policy commitments) and produces a gap list with a remediation plan.\n\nThe AI regulatory landscape is moving faster than any other area of law right now.\nWhen a regulation is genuinely ambiguous, say so. Don't paper over uncertainty —\nlegal teams need to know when they're on solid ground versus when they're making a\njudgment call.\n\n## Load current state\n\nRead `~\u002F.claude\u002Fplugins\u002Fconfig\u002Fclaude-for-legal\u002Fai-governance-legal\u002FCLAUDE.md`:\n- `## Regulatory footprint` — what already applies\n- `## Use case registry` — what AI you're actually running, and under what conditions\n- `## AI policy commitments` — what you've publicly or contractually committed to\n- `## Vendor AI governance` — what vendor positions are in place\n- `## Impact assessment house style` — what assessment practices exist\n\nIf the regulation clearly doesn't apply (wrong jurisdiction, below threshold,\nwrong sector, builder\u002Fdeployer distinction eliminates you from scope), say so\ndirectly: \"Doesn't apply. Here's why: [reason]. No action needed.\"\n\n---\n\n## Research first, then workflow\n\nBefore running the gap analysis, research the currently operative AI regulatory regimes for the jurisdictions in the user's footprint. For each regime identify:\n\n- **Scope** — who's covered (provider\u002Fbuilder vs. deployer vs. distributor vs. user; sectoral carve-outs).\n- **Applicability thresholds** — revenue, user count, headcount, compute, model category, affected-population size.\n- **Risk-tier definitions** — how the regime distinguishes tiers (prohibited \u002F high-risk \u002F limited-risk \u002F minimal), what's in each.\n- **Substantive obligations** — transparency, documentation, human oversight, bias testing, registration, incident reporting, vendor flow-down.\n- **Enforcement mechanism** — which regulator, what penalties, any private right of action.\n- **Effective dates** — many AI laws phase in obligations over 2-4 years; note which obligations are live vs. upcoming.\n\nCite the regulatory text with pinpoint references. Flag provisions subject to ongoing interpretation, delegated acts, or pending rulemaking. The AI regulatory landscape changes quickly — verify currency before advising.\n\nBuild the gap analysis from the researched requirements, not from hardcoded reference tables.\n\n## Workflow\n\n### Step 1: Scope the regulation\n\nBefore diffing, answer:\n\n- **Does it apply?** Jurisdiction, threshold, sector carve-outs, builder vs. deployer distinction. Research the specific scoping rules in the regulation — don't assume.\n\n  *Builder\u002Fdeployer matters a lot here.* Many AI regimes impose different obligations on the entity that develops\u002Fprovides the AI system versus the entity that deploys\u002Fuses it. Research which role the company occupies under each regime's definitions. Scope first; don't gap-analyze a law that doesn't apply.\n\n- **When?** Effective date. Enforcement date (often different). Phase-in periods for specific provisions. Verify currency.\n\n- **What's actually new?** Some \"new\" AI laws largely restate existing legal principles (consumer protection, anti-discrimination, sectoral risk management) applied to AI. Others are genuinely new obligations. Identify the delta from what you already do, not the full text of the law.\n\n### Step 2: Extract requirements\n\nRead the regulation, guidance, or summary. List every substantive requirement:\n\n| # | Requirement | Citation | Category |\n|---|---|---|---|\n| 1 | [requirement] | [section] | [see categories below] |\n\n**Categories:**\n- **Transparency** — disclosures to users, employees, or affected parties about AI use\n- **Impact assessment** — required documentation before deployment\n- **Human oversight** — mandatory human review, override, or appeals mechanisms\n- **Accuracy \u002F testing** — bias testing, accuracy documentation, validation\n- **Governance** — registration, record-keeping, designated responsible persons\n- **Vendor flow-down** — obligations to pass down to AI vendors or pass up from AI vendors\n- **Prohibited practices** — outright bans on specific AI capabilities or uses\n- **Rights** — what affected parties can request or invoke\n\n### Step 3: Diff against current state\n\nFor each requirement:\n\n```markdown\n### [Requirement #N]: [short name]\n\n**Regulation says:** [requirement, quoted or paraphrased]\n\n**We currently:** [what `~\u002F.claude\u002Fplugins\u002Fconfig\u002Fclaude-for-legal\u002Fai-governance-legal\u002FCLAUDE.md` \u002F AI policy \u002F use case registry \u002F assessment\npractice shows]\n\n**Gap:** [None | Partial | Full]\n\n**If partial\u002Ffull — what's missing:** [specific — not \"more documentation\" but\n\"no human review step is documented for [use case category]\"]\n\n**Effort to close:** [Policy update only | Process change | Product\u002Fsystem change |\nNew assessment required | Vendor renegotiation | Registration \u002F filing]\n\n**Risk of non-compliance:** [penalty range, enforcement likelihood, reputational]\n```\n\n### Step 4: Prioritize\n\nNot every gap is equal. Sort by:\n\n1. **Hard deadline with teeth** — effective date + active enforcement + real penalties\n2. **Prohibited practice** — if the gap is a prohibition, not a process requirement,\n   that's the first priority regardless of enforcement date\n3. **Effort-to-impact ratio** — updating policy language is cheap; adding human\n   oversight to a deployed system is not\n4. **Use case overlap** — gaps that affect multiple use cases in the registry are\n   higher priority than single-use-case gaps\n\n### Step 5: Remediation plan\n\n```markdown\n[WORK-PRODUCT HEADER — per plugin config ## Outputs — differs by role; see `## Who's using this`]\n\n## Remediation Plan: [Regulation name]\n\n**Effective date:** [date]\n**Enforcement begins:** [date if different]\n**Applies to us as:** [Builder \u002F Deployer \u002F Both]\n\n### Must-do before enforcement\n\n| Gap | Fix | Owner | Due | Status |\n|---|---|---|---|---|\n| [gap] | [specific fix] | [name] | [date] | [ ] |\n\n### Should-do (important but not blocking enforcement)\n\n[same table]\n\n### Already compliant\n\n[list of requirements where gap = None — useful context for the legal\u002Fexecutive\nsummary of where you actually stand]\n\n### Accepted gaps (risk accepted, not fixing)\n\n[if any — with documented rationale and who accepted the risk. Documenting accepted\nrisk is better governance than leaving it unaddressed silently.]\n```\n\n---\n\n## Research the regulation before building the gap analysis\n\nDo not rely on hardcoded reference tables for specific regimes. For each regulation in scope, research the currently operative text:\n\n- Which obligations apply to the company's role (provider\u002Fbuilder, deployer, importer, distributor)?\n- Which tier does the system fall into under the regime's own classification (prohibited \u002F high-risk \u002F limited-risk \u002F minimal, or the regime's equivalent)?\n- What are the live vs. phase-in dates for each obligation?\n- Are there delegated acts, implementing acts, or regulator guidance that affect interpretation?\n- For builder contexts: are there model-level obligations (technical documentation, training data transparency, copyright compliance, systemic-risk testing)?\n- For prohibited-practice categories: check any use case in the registry that might touch them and flag as critical regardless of enforcement date.\n\nCite primary sources with pinpoint references. Flag ambiguity for attorney judgment.\n\n> **No silent supplement.** If a research query to the configured legal research tool (Westlaw, EUR-Lex, regulator sites, or firm platform) returns few or no results for a regime's text, delegated act, or guidance, report what was found and stop. Do NOT fill the gap from web search or model knowledge without asking. Say: \"The search returned [N] results from [tool]. Coverage appears thin for [regime \u002F topic]. Options: (1) broaden the search query, (2) try a different research tool, (3) search the web — results will be tagged `[web search — verify]` and should be checked against the issuing authority before relying, or (4) flag as unverified and stop. Which would you like?\" A lawyer decides whether to accept lower-confidence sources.\n>\n> **Source attribution tiering.** Tag every citation in the gap analysis with its source. For model-knowledge citations, use one of three tiers rather than a single blanket \"verify\" tag:\n>\n> - `[settled]` — stable, well-known statutory and regulatory references unlikely to have changed (e.g., GDPR Art. 22, the existence of Regulation (EU) 2024\u002F1689 as the EU AI Act, Colorado AI Act as C.R.S. § 6-1-1701 et seq.). Still verify before filing, but lower priority.\n> - `[verify]` — model-knowledge citations that are real but should be verified: specific delegated \u002F implementing acts, regulator guidance, standards, enforcement actions, case holdings, thresholds, effective dates, phase-in provisions, harmonized-standards references.\n> - `[verify-pinpoint]` — pinpoint citations (specific article numbers, annex references, subsection letters, paragraph numbers, standard-clause references) carry the highest fabrication risk and should ALWAYS be verified against a primary source. EU AI Act article numbers in particular shifted during consolidation; every pinpoint cite to the Act should be verified against the Official Journal text.\n>\n> Tool-retrieved citations keep their source tag (`[Westlaw]`, `[EUR-Lex]`, `[regulator site]`, or the MCP tool name); web-search citations remain `[web search — verify]`; user-supplied citations remain `[user provided]`. The tiering surfaces the real verification work — a reader who verifies everything verifies nothing. Never strip or collapse the tags.\n>\n> **For non-lawyer users, uncertain dates, thresholds, and phase-in provisions go in a confirm-list, not inline.** A `[verify]` tag on \"effective February 1, 2026\" reads as \"effective February 1, 2026\" to a non-lawyer who doesn't know what the tag means. Read `## Who's using this` in `~\u002F.claude\u002Fplugins\u002Fconfig\u002Fclaude-for-legal\u002Fai-governance-legal\u002FCLAUDE.md`. If Role is **Non-lawyer** and a date, deadline, phase-in, threshold, or effective-date assertion is uncertain (would carry `[verify]` or `[verify-pinpoint]` if inline), replace the inline assertion with \"effective date: confirm with counsel\" (or \"threshold: confirm with counsel\") and collect all uncertain items in a final gap-analysis section titled: \"**Things I'm not certain about — ask your attorney to confirm before relying on this:**\" with each item listed (what I said, what's uncertain, why it matters to the gap). Lawyer-role users keep the inline `[verify]` treatment.\n\n---\n\n## Integration with other skills\n\n**From aia-generation:** AIAs flag regulatory obligations for specific\nsystems → those feed here when a regulation is new or coverage is uncertain.\n\n**From use case triage:** Newly triaged use cases that hit regulatory triggers →\ngap analysis runs on the specific requirement for that use case type.\n\n**To regulatory-legal plugin, if the plugin is installed:** This skill is the manual\nversion. The monitor plugin watches feeds and triggers this analysis automatically\nwhen something relevant changes.\n\n---\n\n## Output\n\nSave as a dated markdown doc. The remediation plan table becomes a tracker — update\nstatus as items close.\n\nIf the gap analysis concludes \"no gaps, we're compliant,\" still write the doc. It's\nuseful evidence that you looked, and useful baseline when the regulation is amended.\n\n**Cite check before relying on this.** Citations here were generated by an AI model and have not been verified against primary sources. Before relying on any citation — statute, regulation, delegated act, guidance, or case — run a verification pass against a legal research tool (Westlaw, CourtListener, or your firm's platform) for accuracy, currency, and subsequent history. Fabricated or misquoted citations in filed materials have resulted in sanctions. Source tags on each citation (e.g., `[EUR-Lex]`, `[web search — verify]`) show where it came from; `verify` tags carry higher fabrication risk and should be checked first.\n\n---\n\n## Close with the next-steps decision tree\n\nEnd with the next-steps decision tree per CLAUDE.md `## Outputs`. Customize the options to what this skill just produced — the five default branches (draft the X, escalate, get more facts, watch and wait, something else) are a starting point, not a lock-in. The tree is the output; the lawyer picks.\n\n## What this skill does not do\n\n- It doesn't interpret ambiguous regulatory language authoritatively. The EU AI Act\n  in particular has significant interpretive questions that aren't resolved yet.\n  When the reg is genuinely ambiguous: say so, state the conservative read, and\n  flag for outside counsel if the issue is material.\n- It doesn't track regulatory changes proactively. It runs when you point it at a\n  change. For proactive monitoring, see the `regulatory-legal` plugin, if the plugin is installed.\n- It doesn't implement fixes. It plans them.\n- It doesn't substitute for sector-specific legal counsel where specialized knowledge\n  is required (healthcare AI, financial services model risk management, etc.).\n","# \u002Freg-gap-analysis\n\n1. Read `~\u002F.claude\u002Fplugins\u002Fconfig\u002Fclaude-for-legal\u002Fai-governance-legal\u002FCLAUDE.md`. Confirm regulatory footprint and use case registry are populated.\n2. Use the framework below.\n3. Scope: does this regulation apply? (Jurisdiction, threshold, builder\u002Fdeployer, sector.) If not, one line and done.\n4. Extract requirements. Diff against current state in `~\u002F.claude\u002Fplugins\u002Fconfig\u002Fclaude-for-legal\u002Fai-governance-legal\u002FCLAUDE.md`.\n5. Prioritize gaps. Output: remediation plan with must-do \u002F should-do \u002F already compliant \u002F accepted gaps.\n6. Save as dated markdown doc for the file.\n\n```\n\u002Fai-governance-legal:reg-gap-analysis \"EU AI Act high-risk provisions\"\n```\n\n---\n\n## Purpose\n\nThe EU AI Act goes live. Colorado passes an AI law. The CFPB issues model risk\nguidance. The FTC publishes an AI enforcement policy. Something moves — and now\nyou need to know what, if anything, you have to change.\n\nThis skill diffs the new requirement against your current AI governance posture\n(per `~\u002F.claude\u002Fplugins\u002Fconfig\u002Fclaude-for-legal\u002Fai-governance-legal\u002FCLAUDE.md` — use case registry, vendor positions, impact assessment practices,\nand AI policy commitments) and produces a gap list with a remediation plan.\n\nThe AI regulatory landscape is moving faster than any other area of law right now.\nWhen a regulation is genuinely ambiguous, say so. Don't paper over uncertainty —\nlegal teams need to know when they're on solid ground versus when they're making a\njudgment call.\n\n## Load current state\n\nRead `~\u002F.claude\u002Fplugins\u002Fconfig\u002Fclaude-for-legal\u002Fai-governance-legal\u002FCLAUDE.md`:\n- `## Regulatory footprint` — what already applies\n- `## Use case registry` — what AI you're actually running, and under what conditions\n- `## AI policy commitments` — what you've publicly or contractually committed to\n- `## Vendor AI governance` — what vendor positions are in place\n- `## Impact assessment house style` — what assessment practices exist\n\nIf the regulation clearly doesn't apply (wrong jurisdiction, below threshold,\nwrong sector, builder\u002Fdeployer distinction eliminates you from scope), say so\ndirectly: \"Doesn't apply. Here's why: [reason]. No action needed.\"\n\n---\n\n## Research first, then workflow\n\nBefore running the gap analysis, research the currently operative AI regulatory regimes for the jurisdictions in the user's footprint. For each regime identify:\n\n- **Scope** — who's covered (provider\u002Fbuilder vs. deployer vs. distributor vs. user; sectoral carve-outs).\n- **Applicability thresholds** — revenue, user count, headcount, compute, model category, affected-population size.\n- **Risk-tier definitions** — how the regime distinguishes tiers (prohibited \u002F high-risk \u002F limited-risk \u002F minimal), what's in each.\n- **Substantive obligations** — transparency, documentation, human oversight, bias testing, registration, incident reporting, vendor flow-down.\n- **Enforcement mechanism** — which regulator, what penalties, any private right of action.\n- **Effective dates** — many AI laws phase in obligations over 2-4 years; note which obligations are live vs. upcoming.\n\nCite the regulatory text with pinpoint references. Flag provisions subject to ongoing interpretation, delegated acts, or pending rulemaking. The AI regulatory landscape changes quickly — verify currency before advising.\n\nBuild the gap analysis from the researched requirements, not from hardcoded reference tables.\n\n## Workflow\n\n### Step 1: Scope the regulation\n\nBefore diffing, answer:\n\n- **Does it apply?** Jurisdiction, threshold, sector carve-outs, builder vs. deployer distinction. Research the specific scoping rules in the regulation — don't assume.\n\n  *Builder\u002Fdeployer matters a lot here.* Many AI regimes impose different obligations on the entity that develops\u002Fprovides the AI system versus the entity that deploys\u002Fuses it. Research which role the company occupies under each regime's definitions. Scope first; don't gap-analyze a law that doesn't apply.\n\n- **When?** Effective date. Enforcement date (often different). Phase-in periods for specific provisions. Verify currency.\n\n- **What's actually new?** Some \"new\" AI laws largely restate existing legal principles (consumer protection, anti-discrimination, sectoral risk management) applied to AI. Others are genuinely new obligations. Identify the delta from what you already do, not the full text of the law.\n\n### Step 2: Extract requirements\n\nRead the regulation, guidance, or summary. List every substantive requirement:\n\n| # | Requirement | Citation | Category |\n|---|---|---|---|\n| 1 | [requirement] | [section] | [see categories below] |\n\n**Categories:**\n- **Transparency** — disclosures to users, employees, or affected parties about AI use\n- **Impact assessment** — required documentation before deployment\n- **Human oversight** — mandatory human review, override, or appeals mechanisms\n- **Accuracy \u002F testing** — bias testing, accuracy documentation, validation\n- **Governance** — registration, record-keeping, designated responsible persons\n- **Vendor flow-down** — obligations to pass down to AI vendors or pass up from AI vendors\n- **Prohibited practices** — outright bans on specific AI capabilities or uses\n- **Rights** — what affected parties can request or invoke\n\n### Step 3: Diff against current state\n\nFor each requirement:\n\n```markdown\n### [Requirement #N]: [short name]\n\n**Regulation says:** [requirement, quoted or paraphrased]\n\n**We currently:** [what `~\u002F.claude\u002Fplugins\u002Fconfig\u002Fclaude-for-legal\u002Fai-governance-legal\u002FCLAUDE.md` \u002F AI policy \u002F use case registry \u002F assessment\npractice shows]\n\n**Gap:** [None | Partial | Full]\n\n**If partial\u002Ffull — what's missing:** [specific — not \"more documentation\" but\n\"no human review step is documented for [use case category]\"]\n\n**Effort to close:** [Policy update only | Process change | Product\u002Fsystem change |\nNew assessment required | Vendor renegotiation | Registration \u002F filing]\n\n**Risk of non-compliance:** [penalty range, enforcement likelihood, reputational]\n```\n\n### Step 4: Prioritize\n\nNot every gap is equal. Sort by:\n\n1. **Hard deadline with teeth** — effective date + active enforcement + real penalties\n2. **Prohibited practice** — if the gap is a prohibition, not a process requirement,\n   that's the first priority regardless of enforcement date\n3. **Effort-to-impact ratio** — updating policy language is cheap; adding human\n   oversight to a deployed system is not\n4. **Use case overlap** — gaps that affect multiple use cases in the registry are\n   higher priority than single-use-case gaps\n\n### Step 5: Remediation plan\n\n```markdown\n[WORK-PRODUCT HEADER — per plugin config ## Outputs — differs by role; see `## Who's using this`]\n\n## Remediation Plan: [Regulation name]\n\n**Effective date:** [date]\n**Enforcement begins:** [date if different]\n**Applies to us as:** [Builder \u002F Deployer \u002F Both]\n\n### Must-do before enforcement\n\n| Gap | Fix | Owner | Due | Status |\n|---|---|---|---|---|\n| [gap] | [specific fix] | [name] | [date] | [ ] |\n\n### Should-do (important but not blocking enforcement)\n\n[same table]\n\n### Already compliant\n\n[list of requirements where gap = None — useful context for the legal\u002Fexecutive\nsummary of where you actually stand]\n\n### Accepted gaps (risk accepted, not fixing)\n\n[if any — with documented rationale and who accepted the risk. Documenting accepted\nrisk is better governance than leaving it unaddressed silently.]\n```\n\n---\n\n## Research the regulation before building the gap analysis\n\nDo not rely on hardcoded reference tables for specific regimes. For each regulation in scope, research the currently operative text:\n\n- Which obligations apply to the company's role (provider\u002Fbuilder, deployer, importer, distributor)?\n- Which tier does the system fall into under the regime's own classification (prohibited \u002F high-risk \u002F limited-risk \u002F minimal, or the regime's equivalent)?\n- What are the live vs. phase-in dates for each obligation?\n- Are there delegated acts, implementing acts, or regulator guidance that affect interpretation?\n- For builder contexts: are there model-level obligations (technical documentation, training data transparency, copyright compliance, systemic-risk testing)?\n- For prohibited-practice categories: check any use case in the registry that might touch them and flag as critical regardless of enforcement date.\n\nCite primary sources with pinpoint references. Flag ambiguity for attorney judgment.\n\n> **No silent supplement.** If a research query to the configured legal research tool (Westlaw, EUR-Lex, regulator sites, or firm platform) returns few or no results for a regime's text, delegated act, or guidance, report what was found and stop. Do NOT fill the gap from web search or model knowledge without asking. Say: \"The search returned [N] results from [tool]. Coverage appears thin for [regime \u002F topic]. Options: (1) broaden the search query, (2) try a different research tool, (3) search the web — results will be tagged `[web search — verify]` and should be checked against the issuing authority before relying, or (4) flag as unverified and stop. Which would you like?\" A lawyer decides whether to accept lower-confidence sources.\n>\n> **Source attribution tiering.** Tag every citation in the gap analysis with its source. For model-knowledge citations, use one of three tiers rather than a single blanket \"verify\" tag:\n>\n> - `[settled]` — stable, well-known statutory and regulatory references unlikely to have changed (e.g., GDPR Art. 22, the existence of Regulation (EU) 2024\u002F1689 as the EU AI Act, Colorado AI Act as C.R.S. § 6-1-1701 et seq.). Still verify before filing, but lower priority.\n> - `[verify]` — model-knowledge citations that are real but should be verified: specific delegated \u002F implementing acts, regulator guidance, standards, enforcement actions, case holdings, thresholds, effective dates, phase-in provisions, harmonized-standards references.\n> - `[verify-pinpoint]` — pinpoint citations (specific article numbers, annex references, subsection letters, paragraph numbers, standard-clause references) carry the highest fabrication risk and should ALWAYS be verified against a primary source. EU AI Act article numbers in particular shifted during consolidation; every pinpoint cite to the Act should be verified against the Official Journal text.\n>\n> Tool-retrieved citations keep their source tag (`[Westlaw]`, `[EUR-Lex]`, `[regulator site]`, or the MCP tool name); web-search citations remain `[web search — verify]`; user-supplied citations remain `[user provided]`. The tiering surfaces the real verification work — a reader who verifies everything verifies nothing. Never strip or collapse the tags.\n>\n> **For non-lawyer users, uncertain dates, thresholds, and phase-in provisions go in a confirm-list, not inline.** A `[verify]` tag on \"effective February 1, 2026\" reads as \"effective February 1, 2026\" to a non-lawyer who doesn't know what the tag means. Read `## Who's using this` in `~\u002F.claude\u002Fplugins\u002Fconfig\u002Fclaude-for-legal\u002Fai-governance-legal\u002FCLAUDE.md`. If Role is **Non-lawyer** and a date, deadline, phase-in, threshold, or effective-date assertion is uncertain (would carry `[verify]` or `[verify-pinpoint]` if inline), replace the inline assertion with \"effective date: confirm with counsel\" (or \"threshold: confirm with counsel\") and collect all uncertain items in a final gap-analysis section titled: \"**Things I'm not certain about — ask your attorney to confirm before relying on this:**\" with each item listed (what I said, what's uncertain, why it matters to the gap). Lawyer-role users keep the inline `[verify]` treatment.\n\n---\n\n## Integration with other skills\n\n**From aia-generation:** AIAs flag regulatory obligations for specific\nsystems → those feed here when a regulation is new or coverage is uncertain.\n\n**From use case triage:** Newly triaged use cases that hit regulatory triggers →\ngap analysis runs on the specific requirement for that use case type.\n\n**To regulatory-legal plugin, if the plugin is installed:** This skill is the manual\nversion. The monitor plugin watches feeds and triggers this analysis automatically\nwhen something relevant changes.\n\n---\n\n## Output\n\nSave as a dated markdown doc. The remediation plan table becomes a tracker — update\nstatus as items close.\n\nIf the gap analysis concludes \"no gaps, we're compliant,\" still write the doc. It's\nuseful evidence that you looked, and useful baseline when the regulation is amended.\n\n**Cite check before relying on this.** Citations here were generated by an AI model and have not been verified against primary sources. Before relying on any citation — statute, regulation, delegated act, guidance, or case — run a verification pass against a legal research tool (Westlaw, CourtListener, or your firm's platform) for accuracy, currency, and subsequent history. Fabricated or misquoted citations in filed materials have resulted in sanctions. Source tags on each citation (e.g., `[EUR-Lex]`, `[web search — verify]`) show where it came from; `verify` tags carry higher fabrication risk and should be checked first.\n\n---\n\n## Close with the next-steps decision tree\n\nEnd with the next-steps decision tree per CLAUDE.md `## Outputs`. Customize the options to what this skill just produced — the five default branches (draft the X, escalate, get more facts, watch and wait, something else) are a starting point, not a lock-in. The tree is the output; the lawyer picks.\n\n## What this skill does not do\n\n- It doesn't interpret ambiguous regulatory language authoritatively. The EU AI Act\n  in particular has significant interpretive questions that aren't resolved yet.\n  When the reg is genuinely ambiguous: say so, state the conservative read, and\n  flag for outside counsel if the issue is material.\n- It doesn't track regulatory changes proactively. It runs when you point it at a\n  change. For proactive monitoring, see the `regulatory-legal` plugin, if the plugin is installed.\n- It doesn't implement fixes. It plans them.\n- It doesn't substitute for sector-specific legal counsel where specialized knowledge\n  is required (healthcare AI, financial services model risk management, etc.).\n",{"name":5,"description":49,"argument-hint":50},"Diff a new AI regulation or guidance against your current governance posture — surfaces gaps, priorities, and a remediation plan with owners and deadlines. Use when an AI regulation moves (or you learn about one you missed), or when user says \"new reg just dropped\", \"does [regulation] affect us\", \"gap analysis for EU AI Act\", \"compliance check against [AI law or guidance]\", or pastes regulatory text.\n","[regulation name, or paste regulatory text, or attach a document]","main","4a6c651889c97cc9140580363c73e0eb17379c2b","ai-governance-legal\u002Fskills\u002Freg-gap-analysis",1958,"https:\u002F\u002Fgithub.com\u002Fanthropics\u002Fclaude-for-legal","https:\u002F\u002Fgithub.com\u002Fanthropics","https:\u002F\u002Fanthropic.com","2026-11-08 22:42:37",{"source":8,"skillName":5,"commands":60,"prompt":70,"zipAvailable":71},[61,64,67],{"tool":62,"command":63},"npx","npx skills add anthropics\u002Fclaude-for-legal --skill reg-gap-analysis",{"tool":65,"command":66},"bunx","bunx skills add anthropics\u002Fclaude-for-legal --skill reg-gap-analysis",{"tool":68,"command":69},"pnpm","pnpm dlx skills add anthropics\u002Fclaude-for-legal --skill reg-gap-analysis","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fanthropics\u002Fclaude-for-legal\u002Fblob\u002Fmain\u002Fai-governance-legal\u002Fskills\u002Freg-gap-analysis\u002FSKILL.md",true,[],[74,101,122,136,158,170],{"skillNo":75,"name":76,"nameZh":6,"description":77,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":78,"categories":79,"keywords":85,"publishedAt":44},"01M718SG9G2R92ECCD0HYK2R5E","reg-feed-watcher","Check regulatory feeds now and report what's new since the last check, filtered by your materiality threshold. Use when the user says \"check the feeds\", \"what's new\", \"regulatory update\", when running from the scheduled agent, or when manually pasting a regulatory development for classification and diff.","https:\u002F\u002Fgithub.com\u002Fanthropics\u002Fclaude-for-legal\u002Fblob\u002Fmain\u002Fregulatory-legal\u002Fskills\u002Freg-feed-watcher\u002FSKILL.md",[80],{"categoryNo":81,"categoryName":82,"taxonomyType":83,"taxonomyTypeDesc":84},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,86,87,88,89,90,30,91,29,92,43,93,94,95,42,96,97,98,99,100],"watcher","reg feed watcher","running","feeds","filtered","development","classification","now","use","scheduled","check","last","update","report","regulatory",{"skillNo":102,"name":103,"nameZh":6,"description":104,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":105,"categories":106,"keywords":107,"publishedAt":44},"01M718SCRTBN55DMTVSPG67A7N","policy-redraft","Produce a proposed marked-up policy redraft that closes a gap found by \u002Fregulatory-legal:gaps or \u002Fregulatory-legal:policy-diff. A first draft for internal review — not for direct application to approved policy documents. Use when the user says \"redraft the policy\", \"draft the policy fix\", \"mark up the policy\", or when gap-surfacer hands off a gap for drafting.","https:\u002F\u002Fgithub.com\u002Fanthropics\u002Fclaude-for-legal\u002Fblob\u002Fmain\u002Fregulatory-legal\u002Fskills\u002Fpolicy-redraft\u002FSKILL.md",[],[108,109,30,29,110,111,112,94,113,42,114,115,116,117,118,27,119,120,100,121],"policy","policy redraft","up","fix","produce","documents","drafting","gaps","review","draft","id","mark","first","direct",{"skillNo":123,"name":124,"nameZh":6,"description":125,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":126,"categories":127,"keywords":128,"publishedAt":44},"01M718S8RV0C4NMVKG078CBFXP","policy-diff","Diff a specific regulatory change against the indexed policy library. Use when a reg has changed and you need to know which policies it touches and what the gap is, when the user says \"diff this reg against our policies\", \"which policy does this affect\", or \"gap analysis\", or when reg-feed-watcher hands off a material item.","https:\u002F\u002Fgithub.com\u002Fanthropics\u002Fclaude-for-legal\u002Fblob\u002Fmain\u002Fregulatory-legal\u002Fskills\u002Fpolicy-diff\u002FSKILL.md",[],[30,108,129,130,42,40,28,24,39,86,131,34,132,133,94,26,27,134,135,100],"policy diff","which","change","library","material","what the","name",{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":140,"categories":141,"keywords":142,"publishedAt":44},"01M718S6521Y0FT4T24VCFKVG5","matter-workspace","Manage matter workspaces — create, list, switch, close, or detach the active matter (practice-level). Use when working across multiple clients or matters and you need to keep one engagement's context separate from another, or when a substantive skill needs to know which matter it's working in.","https:\u002F\u002Fgithub.com\u002Fanthropics\u002Fclaude-for-legal\u002Fblob\u002Fmain\u002Fregulatory-legal\u002Fskills\u002Fmatter-workspace\u002FSKILL.md",[],[143,144,130,145,146,147,43,94,42,40,148,149,150,151,152,153,154,155,156,157],"workspace","matter workspace","switch","manage","workspaces","keep","across","create","engagement","close","active","clients","list","it","context",{"skillNo":159,"name":115,"nameZh":6,"description":160,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":161,"categories":162,"keywords":163,"publishedAt":44},"01M718S3FPEJNQGCMQ1AR8M4HE","Open gaps tracker — what's flagged and not yet closed. Use when the user asks \"what gaps are open\", \"gap tracker\", \"remediation status\", or wants to close (--close GAP-ID) or risk-accept (--accept GAP-ID) a tracked gap.","https:\u002F\u002Fgithub.com\u002Fanthropics\u002Fclaude-for-legal\u002Fblob\u002Fmain\u002Fregulatory-legal\u002Fskills\u002Fgaps\u002FSKILL.md",[],[115,118,27,164,152,165,35,166,167,94,168,42,169],"risk","tracker","status","open","accept","user",{"skillNo":171,"name":172,"nameZh":6,"description":173,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":174,"categories":175,"keywords":177,"publishedAt":44},"01M718S06WSZ9Y24JKYM0VVPPE","gap-surfacer","Reference: shared gap- and comment-tracker framework backing \u002Fregulatory-legal:gaps and \u002Fregulatory-legal:comments. Tracks open policy gaps with remediation status, ingests gaps from policy-diff, surfaces what's open and aging, routes to owners, and notifies gap owners via Slack with per-send confirmation. Loaded by the gaps and comments skills before doing substantive work.","https:\u002F\u002Fgithub.com\u002Fanthropics\u002Fclaude-for-legal\u002Fblob\u002Fmain\u002Fregulatory-legal\u002Fskills\u002Fgap-surfacer\u002FSKILL.md",[176],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[27,178,179,180,30,108,181,167,182,183,184,185,115,186,187,188,189,165,35,33],"gap surfacer","shared","tracks","send","confirmation","aging","false","comments","with","work","slack","via"]