Add EU regulation skills

[jabrena]

Description

Create and maintain Java enterprise regulation skills for the EU regulatory stack identified in #848 and expanded in the issue discussion.

These skills translate EU regulatory concerns into reviewable Java engineering controls. They are not legal advice. Applicability, classification, legal interpretation, regulatory reporting, and final compliance decisions must be escalated to the appropriate legal, compliance, privacy, security, risk, resilience, product, platform, trust-and-safety, data-governance, or business owners.

Scope

Covered baseline

• AI Act (Regulation (EU) 2024/1689): implemented as 801-regulations-eu-ai-act. AI-specific rules, GPAI, transparency, human oversight, governance evidence, and AI-system classification.
• DORA (Regulation (EU) 2022/2554): implemented as 802-regulations-dora. ICT risk management and digital operational resilience in financial-sector or critical ICT contexts. Source: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R2554
• GDPR (Regulation (EU) 2016/679): implemented as 803-regulations-gdpr. Personal-data processing, privacy controls, data-subject rights, retention, transfers, and breach evidence. Source: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679

EU regulation additions

• NIS2 (Directive (EU) 2022/2555): implemented as 804-regulations-eu-nis2. Cybersecurity risk management, critical-sector security, supply-chain security, incident escalation, continuity, and operational evidence. Source: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022L2555. Merged in feat(skills): add EU NIS2 regulation skill #862
• Cyber Resilience Act / CRA (Regulation (EU) 2024/2847): implemented as 805-regulations-eu-cyber-resilience-act. Security-by-design, vulnerability handling, security updates, product security documentation, SBOM/dependency evidence, and coordinated disclosure. Source: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32024R2847. Merged in feat(skills): add EU Cyber Resilience Act regulation skill #866
• Data Act (Regulation (EU) 2023/2854): implemented as 806-regulations-eu-data-act. Data access, sharing, portability, interoperability, cloud switching, non-personal data governance, and data-request workflows. Source: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32023R2854. Merged in feat(skills): add EU Data Act regulation skill #868
• Digital Services Act / DSA (Regulation (EU) 2022/2065): implemented as 807-regulations-eu-digital-services-act. Intermediary and platform controls, notice-and-action workflows, recommender and advertising transparency, user redress, systemic-risk evidence, and trust-and-safety escalation. Source: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R2065. Merged in feat(skills): add EU Digital Services Act regulation skill #865
• Digital Markets Act / DMA (Regulation (EU) 2022/1925): implemented as 808-regulations-eu-digital-markets-act. Gatekeeper platform concerns, interoperability, business-user data access, consent-dependent data combination, self-preferencing evidence, and platform-control safeguards. Source: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32022R1925. Merged in feat(skills): add EU Digital Markets Act regulation skill #867
• Digital Omnibus (2025): implemented as 809-regulations-eu-digital-omnibus. Cross-cutting EU digital simplification proposals affecting AI, cybersecurity, data, privacy, and reporting workflows. Treat as proposal-stage simplification tracking, not a settled single-regulation checklist. Sources: https://commission.europa.eu/news-and-media/news/simpler-digital-rules-help-eu-businesses-grow-2025-11-19_en and https://digital-strategy.ec.europa.eu/en/policies/digital-rulebook. Merged in feat(skills): add EU Digital Omnibus regulation skill #864

Regulation skill numbering

• EU regulation skills use 801-809 for the current baseline and completed EU stack.
• UK regulation skills start at 821.
• USA regulation skills start at 831.

Expected Outcome

• Maintain the existing 801, 802, and 803 EU regulation skills as the baseline pattern.
• Add one OpenSpec change per pending EU regulation item: NIS2, CRA, Data Act, DSA, DMA, and Digital Omnibus.
• Add regulation-aware Java engineering guidance for each EU regulation.
• Keep all guidance framed as engineering controls, not legal advice.
• Preserve source-first review, evidence-driven findings, explicit owner escalation, and generated-output boundaries.
• Keep generated public skills/ output out of scope unless a release profile is intentionally run later.

OpenSpec Changes

Completed / archived baseline

• documentation/openspec/changes/archive/2026-06-14-add-eu-regulation-skills

Completed per-regulation changes

• documentation/openspec/changes/add-eu-nis2-regulation-skill — feat(skills): add EU NIS2 regulation skill #862
• documentation/openspec/changes/add-eu-cyber-resilience-act-regulation-skill — feat(skills): add EU Cyber Resilience Act regulation skill #866
• documentation/openspec/changes/add-eu-data-act-regulation-skill — feat(skills): add EU Data Act regulation skill #868
• documentation/openspec/changes/add-eu-digital-services-act-regulation-skill — feat(skills): add EU Digital Services Act regulation skill #865
• documentation/openspec/changes/add-eu-digital-markets-act-regulation-skill — feat(skills): add EU Digital Markets Act regulation skill #867
• documentation/openspec/changes/add-eu-digital-omnibus-regulation-skill — feat(skills): add EU Digital Omnibus regulation skill #864

Implementation Check

• skills-generator/src/main/resources/skill-indexes/801-skill.xml through 809-skill.xml exist on main.
• skills-generator/src/main/resources/skills.xml registers skills 801 through 809.
• Gherkin acceptance feature files exist for 801 through 809.
• Merged EU regulation PRs #862, #864, #865, #866, #867, and #868 have successful check rollups.

Source

Derived from #848 and the GenAI Regulatory Stack (EU) issue comment in this issue.

[jabrena]

#832

[jabrena]

GenAI Regulatory Stack (EU)
├── AI Act (2024/1689) → AI-specific rules, GPAI, transparency
├── GDPR (2016/679) → Personal data in training/inference
├── DORA (2022/2554) → ICT resilience in financial sector
├── NIS2 (2022/2555) → Cybersecurity for critical sectors
├── CRA (2024/2847) → Security-by-design for AI products
├── Data Act (2023/2854) → Data access & portability
├── DSA (2022/2065) → Algorithmic transparency on platforms
├── DMA (2022/1925) → Gatekeeper obligations
└── Digital Omnibus (2025) → Cross-cutting simplification of above

[jabrena]

#862

[jabrena]

#863