Votre agent de code, branché sur l'AI Act.

You are setting up Reguardian (EU AI Act compliance) for this project. Follow these steps now, in order, and report each result.

1. Add the Reguardian MCP server.
Run: claude mcp add --transport http reguardian https://mcp.reguardian.eu
Then run /mcp inside Claude Code to check that the server named reguardian is connected.

2. Complete the OAuth authorization in the browser when it opens, then confirm the connection is active. If the client asks for a token or a key, stop: Reguardian only uses OAuth.

3. Run the first verification test. Take the module I most recently changed in this working tree and call analyze_code_snippet with its code, its filePath, and a taskDescription describing what it does. Then report the risk tier from get_business_context, every obligation verdict, the cited AI Act articles, and the concrete fixes each verdict requires.

4. Install the skill file at .claude/skills/reguardian/SKILL.md.
Save this file content exactly as written (YAML frontmatter included):

---
name: reguardian
description: Verify EU AI Act compliance for AI features in this repository with the Reguardian MCP server. Use before writing or modifying code that uses AI models, processes personal data through AI, or automates decisions about people; after applying a compliance fix to log it; and when a compliance question needs an article-grounded answer.
---

# Reguardian

Reguardian checks planned and applied changes against the EU AI Act (Regulation (EU) 2024/1689) through the MCP server at https://mcp.reguardian.eu. The server returns article-grounded verdicts and keeps a compliance record for this project. Reguardian is a decision aid, not legal advice.

## When to run an analysis

Call `analyze_code_snippet` before writing or modifying code that:

- calls an AI model (chat, generation, classification, recommendation, scoring, ranking);
- processes personal data through AI;
- automates or supports a decision about a person (hiring, credit, pricing, moderation, support triage);
- ships user-facing AI disclosure, logging, or human-review requirements.

Pass `taskDescription` when the change is not written yet: it states what you are about to do and lets Reguardian count the violation as prevented. Pass `filePath` so verdicts are attributable to the file.

## Reading verdicts and risk tiers

`analyze_code_snippet` returns per-obligation verdicts: `violation`, `concern`, or `compliant`, plus a remediation type: `mechanical` (the agent can apply it) or `structural` (a human must decide).

`get_business_context` returns the project risk tier:

| Tier | Meaning | What it obliges |
| --- | --- | --- |
| `NO_OBLIGATION` | Outside the Act's obligations | Keep the record; re-check when the feature changes |
| `LIMITED_RISK` | Transparency duties | Disclose AI interaction, label AI-generated content |
| `HIGH_RISK` | Annex III use cases | Risk management, logging, human oversight, documentation |
| `UNACCEPTABLE` | Prohibited practices | Stop: the feature must not ship as designed |

Quote the article references returned by the server (article_refs). Never invent article numbers, verdicts, or metrics.

## Logging fixes

Call `log_fix` after applying a correction:

- `obligationId`: the obligation ID from `analyze_code_snippet` or `get_business_context`;
- `summary`: feed-ready, at most 160 characters, for example "Added the AI disclosure banner to the support chat";
- `files`: the files you touched (shown as files_touched on the dashboard);
- `newCodeSnippet`: the corrected code, so the server can verify it;
- `kind`: `fixed` after applying the correction, `prevented` when the check stopped a violation before it shipped.

Only verified fixes move the score. If verification fails, the score is untouched: fix the code and call `log_fix` again.

## Surfacing what was avoided

The project feed shows what Reguardian helped avoid (évité). It is built from logged events only. Report only what the server confirmed: prevented analyses and verified fixes, with their article references and files. Never invent, estimate, or reword an avoided entry, and never claim a fix you did not log.

## Decisions

`request_decision` opens a structural decision when an obligation needs human judgment (prohibited or limited scope, Annex III scope, provider or deployer role). Present the returned `presentToUser` text to the user exactly as returned, then record the answer with `record_decision` before continuing. Never apply a structural obligation silently.

`get_score` returns the current score and counters. `search_regulation` searches the Act itself when an article-grounded explanation is needed.

5. Bind analyses to this project. The connection is bound to the Reguardian project I selected during OAuth. Confirm the bound project name with get_business_context. If several projects exist and the binding is wrong, stop and ask me which project to use before logging anything.

6. Finish with one short paragraph: connection state, skill file path, bound project, verdicts, and the fixes you will apply next. Do not log a fix until you have applied it.