Applicability

Applicability

Which regimes actually apply. Run this immediately after eu-grill-me, from the answers it recorded, before any regime-specific skill.

The output people expect is a list of what applies. The output that matters is the other list: what does not apply, the fact that decides it, and the condition that would make it apply again. That second list is what diligence reads, what stops the next engineer re-litigating the question every quarter, and what eu-compliance-gates watches for expiry.

Not legal advice. Applicability turns on facts and on national implementations. This skill produces a defensible first pass and a list of what counsel needs to confirm — not a scoping opinion.

  compliance.yaml (facts)
        │
        ▼
  for each regime: evaluate the trigger against the facts
        │
   ┌────┴─────┐
   ▼          ▼
applies   does not apply
   │          │
   │          ├─► reason  (the rule)
   │          ├─► deciding_fact  (the answer, cited by question id)
   │          └─► expires_if  (what would flip it) ──► watched in CI
   ▼
 duties list ──► hand to the regime skill

Use this when

• Straight after eu-grill-me, always. It is the routing step for every other skill in this repo.
• When a fact changes that could cross a threshold: a hire that takes you past 50 staff, a new market, a new feature category, a first paid tier on an open-source project.
• When someone asks "does the AI Act apply to us" and you want an answer with a reason attached rather than a vibe.

Do not use this when the brief is empty or stale. This skill reads facts; it does not gather them. Run the grill first.

Ask first

Most of what this needs is already in the brief. Ask only for what is missing, and only these:

1. "Headcount and annual turnover or balance sheet total?" Three regimes have size thresholds and they use different ones. Get real numbers, and get the group-level number if there is a parent company.
2. "Which Member States are you established in, and which do you sell into?" Establishment decides which supervisory authority and which national transposition. Selling into decides the extraterritorial triggers.
3. "Is any part of the group in a regulated sector — finance, health, energy, transport, telecoms, public administration?" Sectoral regimes (DORA, MDR, NIS2) stack on top of everything else and are easy to miss when scoping a product rather than an entity.
4. "Has anyone — counsel, a DPO, an auditor — already scoped this?" If yes, read theirs. Your job becomes checking it against current facts, not producing a competing document that disagrees with it.

What the law requires

There is no "applicability assessment" obligation by that name. There are three duties that make one necessary:

• GDPR Art. 5(2) accountability — you must be able to demonstrate compliance, which presupposes knowing what you are complying with.
• GDPR Art. 30 — the record of processing is itself a scoping document, and it must exist before you can claim to know your obligations.
• AI Act Art. 6 and Annex III — classification is a duty placed on the provider, and Art. 6(3)'s derogation is only available if you document the assessment before placing the system on the market. An undocumented conclusion that you are not high-risk is not a derogation.

And commercially: an unscoped product is one that cannot answer a security questionnaire, survive diligence, or price its own compliance work.

The trigger table

Evaluate each in order. references/regime-map.md has the dates, the penalties and the primary sources.

Thresholds that need arithmetic, not judgement

Get these exactly right; they are where scoping is most often wrong, and they are testable at the boundary.

def nis2_size_cap(headcount: int, turnover_eur: float, balance_sheet_eur: float) -> bool:
    """Medium enterprise or above: the trigger is OR, not AND."""
    return headcount >= 50 or turnover_eur > 10_000_000 or balance_sheet_eur > 10_000_000


def eaa_service_microenterprise(headcount: int, turnover_eur: float,
                                balance_sheet_eur: float) -> bool:
    """Exempt for SERVICES only, and only when BOTH limbs are satisfied."""
    return headcount < 10 and (turnover_eur <= 2_000_000 or balance_sheet_eur <= 2_000_000)


def dsa_section3_exempt(headcount: int, turnover_eur: float) -> bool:
    """Micro and small enterprises are exempt from the online-platform duties in
    Section 3. Hosting duties (Arts. 16-18) still apply."""
    return headcount < 50 and turnover_eur <= 10_000_000

Three traps in those three functions, and each has cost somebody a scoping error:

• NIS2 uses OR; the EAA microenterprise test uses AND. Swapping them gets the answer backwards.
• The DSA exemption is partial. A small startup hosting user content is exempt from Section 3 and still owes notice-and-action under Art. 16. "We are too small for the DSA" is wrong.
• Use group-level figures where the relevant law says to. A subsidiary under the cap inside a group over it is usually not exempt.

The AI Act Art. 6(3) derogation, done honestly

The most commonly abused provision in current practice. A system listed in Annex III is not high-risk if it performs a narrow procedural task, improves the result of a prior human activity, detects decision patterns without replacing human assessment, or performs a preparatory task — unless it profiles natural persons, in which case the derogation is unavailable.

def art_6_3_available(system) -> tuple[bool, str]:
    if system.profiles_natural_persons:
        return False, ("Art. 6(3) third subparagraph: the derogation is not "
                       "available where the system performs profiling of natural persons")
    if not system.derogation_ground:
        return False, "no Art. 6(3) ground asserted"
    return True, f"asserted ground: {system.derogation_ground} - requires documented assessment"

Two things to carry into the brief:

• Profiling kills it. Scoring, ranking or categorising individuals is profiling. Most Annex III candidates people want to except are exactly this.
• Relying on it is not free. The assessment must be documented before the system is placed on the market, and the system must still be registered in the EU database. A derogation you did not write down is a conclusion, not a derogation.

What to produce

Fill both lists in compliance.yaml. The exclusion entries are the valuable part and every field is load-bearing:

regimes:
  applicable:
    - regime: gdpr
      trigger: "Art. 3(2) - offers a service to applicants in DE, FI, NL"
      deciding_facts: [A-01, orient-2]
      duties_skill: eu-gdpr-data-map
    - regime: ai_act
      trigger: "provider of an AI system placed on the EU market"
      deciding_facts: [B-07]
      open_question: "Annex III(4)(a) classification - counsel to confirm"
      duties_skill: eu-ai-act

  ruled_out:
    - regime: nis2
      reason: "below the size cap in every Member State of establishment"
      deciding_fact: "E-01: 28 staff, EUR 4.2M turnover, EUR 3.1M balance sheet"
      rule: "medium enterprise = headcount >= 50 OR turnover > 10M OR balance sheet > 10M"
      confirmed_by: "counsel, 2026-09-10"
      expires_if: "headcount >= 50 or turnover_eur > 10000000 or balance_sheet_eur > 10000000"
    - regime: dsa
      reason: "stores no information provided by a recipient of the service"
      deciding_fact: "F-01: no user-visible content from other users"
      expires_if: "any feature lets one user publish content another user can see"
    - regime: cra
      reason: "hosted SaaS only; nothing is placed on the market as a product"
      deciding_fact: "orient-4"
      expires_if: "an on-premise build, agent, SDK or device is distributed"

Rules for the ruled-out list:

• expires_if is mandatory and must be machine-evaluable where possible. eu-compliance-gates evaluates it on every push; a prose-only condition degrades to a reminder, which is better than nothing and much worse than a check.
• deciding_fact cites a question id. An exclusion whose basis is not traceable to an answer is an assertion.
• confirmed_by is optional but changes the weight. "Counsel confirmed on this date" and "the agent's read of the size cap" are different artifacts; render both honestly rather than flattening them.
• Never rule out GDPR on "we're not in the EU." Art. 3(2) exists. If you are genuinely outside it, say which limb fails and why.

Then write, in the Markdown brief, a short "what we are not doing and why" section. It is the most-read section of the document.

Every assessment carries a certainty. Each finding, each applicable or ruled-out regime, and the headline of the brief carry certainty (0–100) — the honest percent of the assessment that rests on verified sources and confirmed facts rather than inference, open unknowns and interpretation. Wherever you state an applicability, a classification, a citation-backed obligation or a finding, show the percentage and the single largest reason it is not higher: "ruled out NIS2 — certainty 66%: the national transposition was not read". references/certainty.md holds the anchors; the rules that matter here: an answer graded UNKNOWN caps anything resting on it at 70, an unread Directive transposition caps at 60, a classification pending counsel caps at 50, and a 100 requires every deciding fact SPECIFIC, every citation verified on EUR-Lex, every transposition read and every regime screened. Certainty is visibility, not a free pass — VAGUE stays rejected, an open blocker stays blocked.

Failure modes

• Only the applicable list is produced. The brief reads as thorough and answers none of the questions diligence asks. Half a document.

• Exclusions with no expiry condition. True on the day, silently false six months later, and nothing notices. The 50th hire is the classic.

• Scoping the product, not the entity. NIS2, DORA and the management duties attach to the organisation. A perfect product scope misses them entirely.

• Swapping AND for OR in the size caps. NIS2 is OR; the EAA microenterprise test is AND. Test both at the boundary.

• "We're too small for the DSA." The hosting duties have no size exemption. Only Section 3 does.

• Claiming Art. 6(3) because the output is advisory. If it profiles people, the derogation is unavailable regardless of how advisory the output is.

• Treating a Directive as settled by its own text. NIS2, ePrivacy, the EAA and the PLD bind through national law, which differs and is sometimes late. Name the Member State and say when you could not read its transposition.

• Producing a conclusion where a question belongs. "The AI Act does not apply" is a legal conclusion. "No AI system was identified in the answers to orient-3 and B-01; if that changes, the AI Act applies" is a finding.

Verify

Follow references/verification.md. For this skill specifically:

1. Tier 0 — install, --help, run against a fixture brief and get both lists.

2. Tier 1 — pytest -q, offline:

def test_both_lists_are_produced(brief):
    result = assess(brief)
    assert result.applicable and result.ruled_out


def test_every_exclusion_has_an_expiry_and_a_deciding_fact(brief):
    for exclusion in assess(brief).ruled_out:
        assert exclusion["expires_if"]
        assert exclusion["deciding_fact"]


def test_nis2_size_cap_at_the_boundary():
    assert nis2_size_cap(49, 9_000_000, 9_000_000) is False
    assert nis2_size_cap(50, 0, 0) is True                  # OR, not AND
    assert nis2_size_cap(10, 10_000_001, 0) is True


def test_eaa_microenterprise_needs_both_limbs():
    assert eaa_service_microenterprise(9, 1_000_000, 1_000_000) is True
    assert eaa_service_microenterprise(11, 1_000_000, 1_000_000) is False
    assert eaa_service_microenterprise(9, 5_000_000, 5_000_000) is False


def test_dsa_exemption_is_partial(brief_small_host):
    duties = assess(brief_small_host).duties_for("dsa")
    assert "Art. 16" in duties                              # hosting duties survive
    assert "Art. 20" not in duties                          # Section 3 does not


def test_exclusion_flips_when_the_deciding_fact_changes(brief):
    brief.subject["headcount"] = 60
    assert "nis2" in {r["regime"] for r in assess(brief).applicable}


def test_gdpr_is_not_ruled_out_on_non_establishment(brief_us_company):
    result = assess(brief_us_company)
    assert "gdpr" in {r["regime"] for r in result.applicable}


def test_profiling_blocks_the_art_6_3_derogation():
    available, reason = art_6_3_available(system(profiles_natural_persons=True,
                                                 derogation_ground="preparatory task"))
    assert available is False and "profiling" in reason


def test_no_legal_conclusions_in_the_rendered_output(brief):
    text = render(assess(brief)).lower()
    assert "does not apply to you" not in text
    assert "you are compliant" not in text

3. Tier 2 — report the counts: regimes applicable, ruled out, and how many exclusions have a machine-evaluable expires_if. That last ratio is the one that predicts whether the scoping survives contact with a growing company.

4. Tier 3 — counsel reviews the ruled-out list specifically. That is where a scoping error hides, and it is cheap to check and expensive to get wrong.

Then tell the user which exclusions rest on your reading rather than on confirmed advice, and name every national transposition you could not read.