1. Read

   ~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md

   . Confirm regulatory footprint and use case registry are populated.
2. Use the framework below.
3. Scope: does this regulation apply? (Jurisdiction, threshold, builder/deployer, sector.) If not, one line and done.
4. Extract requirements. Diff against current state in

   ~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md

   .
5. Prioritize gaps. Output: remediation plan with must-do / should-do / already compliant / accepted gaps.
6. Save as dated markdown doc for the file.

/ai-governance-legal:reg-gap-analysis "EU AI Act high-risk provisions"

~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md

• ## Regulatory footprint

  — what already applies

• ## Use case registry

  — what AI you're actually running, and under what conditions

• ## AI policy commitments

  — what you've publicly or contractually committed to

• ## Vendor AI governance

  — what vendor positions are in place

• ## Impact assessment house style

  — what assessment practices exist

• Scope — who's covered (provider/builder vs. deployer vs. distributor vs. user; sectoral carve-outs).
• Applicability thresholds — revenue, user count, headcount, compute, model category, affected-population size.
• Risk-tier definitions — how the regime distinguishes tiers (prohibited / high-risk / limited-risk / minimal), what's in each.
• Substantive obligations — transparency, documentation, human oversight, bias testing, registration, incident reporting, vendor flow-down.
• Enforcement mechanism — which regulator, what penalties, any private right of action.
• Effective dates — many AI laws phase in obligations over 2-4 years; note which obligations are live vs. upcoming.

• Does it apply? Jurisdiction, threshold, sector carve-outs, builder vs. deployer distinction. Research the specific scoping rules in the regulation — don't assume.
  Builder/deployer matters a lot here. Many AI regimes impose different obligations on the entity that develops/provides the AI system versus the entity that deploys/uses it. Research which role the company occupies under each regime's definitions. Scope first; don't gap-analyze a law that doesn't apply.
• When? Effective date. Enforcement date (often different). Phase-in periods for specific provisions. Verify currency.
• What's actually new? Some "new" AI laws largely restate existing legal principles (consumer protection, anti-discrimination, sectoral risk management) applied to AI. Others are genuinely new obligations. Identify the delta from what you already do, not the full text of the law.

• Transparency — disclosures to users, employees, or affected parties about AI use
• Impact assessment — required documentation before deployment
• Human oversight — mandatory human review, override, or appeals mechanisms
• Accuracy / testing — bias testing, accuracy documentation, validation
• Governance — registration, record-keeping, designated responsible persons
• Vendor flow-down — obligations to pass down to AI vendors or pass up from AI vendors
• Prohibited practices — outright bans on specific AI capabilities or uses
• Rights — what affected parties can request or invoke

1. Hard deadline with teeth — effective date + active enforcement + real penalties
2. Prohibited practice — if the gap is a prohibition, not a process requirement, that's the first priority regardless of enforcement date
3. Effort-to-impact ratio — updating policy language is cheap; adding human oversight to a deployed system is not
4. Use case overlap — gaps that affect multiple use cases in the registry are higher priority than single-use-case gaps

• Which obligations apply to the company's role (provider/builder, deployer, importer, distributor)?
• Which tier does the system fall into under the regime's own classification (prohibited / high-risk / limited-risk / minimal, or the regime's equivalent)?
• What are the live vs. phase-in dates for each obligation?
• Are there delegated acts, implementing acts, or regulator guidance that affect interpretation?
• For builder contexts: are there model-level obligations (technical documentation, training data transparency, copyright compliance, systemic-risk testing)?
• For prohibited-practice categories: check any use case in the registry that might touch them and flag as critical regardless of enforcement date.

No silent supplement. If a research query to the configured legal research tool (Westlaw, EUR-Lex, regulator sites, or firm platform) returns few or no results for a regime's text, delegated act, or guidance, report what was found and stop. Do NOT fill the gap from web search or model knowledge without asking. Say: "The search returned [N] results from [tool]. Coverage appears thin for [regime / topic]. Options: (1) broaden the search query, (2) try a different research tool, (3) search the web — results will be tagged

[web search — verify]

and should be checked against the issuing authority before relying, or (4) flag as unverified and stop. Which would you like?" A lawyer decides whether to accept lower-confidence sources.

Source attribution tiering. Tag every citation in the gap analysis with its source. For model-knowledge citations, use one of three tiers rather than a single blanket "verify" tag:

• [settled]

  — stable, well-known statutory and regulatory references unlikely to have changed (e.g., GDPR Art. 22, the existence of Regulation (EU) 2024/1689 as the EU AI Act, Colorado AI Act as C.R.S. § 6-1-1701 et seq.). Still verify before filing, but lower priority.

• [verify]

  — model-knowledge citations that are real but should be verified: specific delegated / implementing acts, regulator guidance, standards, enforcement actions, case holdings, thresholds, effective dates, phase-in provisions, harmonized-standards references.

• [verify-pinpoint]

  — pinpoint citations (specific article numbers, annex references, subsection letters, paragraph numbers, standard-clause references) carry the highest fabrication risk and should ALWAYS be verified against a primary source. EU AI Act article numbers in particular shifted during consolidation; every pinpoint cite to the Act should be verified against the Official Journal text.

Tool-retrieved citations keep their source tag (

[Westlaw]

,

[EUR-Lex]

,

[regulator site]

, or the MCP tool name); web-search citations remain

[web search — verify]

; user-supplied citations remain

[user provided]

. The tiering surfaces the real verification work — a reader who verifies everything verifies nothing. Never strip or collapse the tags.

For non-lawyer users, uncertain dates, thresholds, and phase-in provisions go in a confirm-list, not inline. A

[verify]

tag on "effective February 1, 2026" reads as "effective February 1, 2026" to a non-lawyer who doesn't know what the tag means. Read

## Who's using this

in

~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md

. If Role is Non-lawyer and a date, deadline, phase-in, threshold, or effective-date assertion is uncertain (would carry

[verify]

or

[verify-pinpoint]

if inline), replace the inline assertion with "effective date: confirm with counsel" (or "threshold: confirm with counsel") and collect all uncertain items in a final gap-analysis section titled: "Things I'm not certain about — ask your attorney to confirm before relying on this:" with each item listed (what I said, what's uncertain, why it matters to the gap). Lawyer-role users keep the inline

[verify]

treatment.

• It doesn't interpret ambiguous regulatory language authoritatively. The EU AI Act in particular has significant interpretive questions that aren't resolved yet. When the reg is genuinely ambiguous: say so, state the conservative read, and flag for outside counsel if the issue is material.
• It doesn't track regulatory changes proactively. It runs when you point it at a change. For proactive monitoring, see the

  regulatory-legal

  plugin, if the plugin is installed.
• It doesn't implement fixes. It plans them.
• It doesn't substitute for sector-specific legal counsel where specialized knowledge is required (healthcare AI, financial services model risk management, etc.).