compliance

A control map to ISO 27001, TISAX, NIS2, and the GDPR by clause and article number, an AI Act triage, and a legal baseline for a website.

• Version 0.1.0
• 3 skills
• 2 gate checks
• Running on this site: Standards space

What it does

Compliance groundwork kept in the repository. A control map links the team's own controls and evidence to ISO/IEC 27001 Annex A, TISAX (VDA ISA), NIS2 and GDPR by number. An AI register triages every AI use under the EU AI Act and prepares the questions for legal review. A legal baseline gives a public website an Impressum, a privacy page, a security.txt and pages that load nothing from third parties. Two gate checks report an expired or incomplete security.txt and third-party loads in HTML.

The module holds no text of any standard. Standards are licensed: under the terms of the standards publishers (for example DIN Media AGB 5.4), processing their text with AI tools needs a separate licence. The templates and skills use clause, control and question numbers only, and the client fills the titles from their own licensed copy. EU legal acts are cited by article number with a link to EUR-Lex.

The skills prepare work for auditors and legal counsel. They do not replace either.

Install

Add the marketplace at release v0.1.0 once, then install the plugin and restart Claude Code.

claude plugin marketplace add uncovertechtalent/cto-powersuit#v0.1.0
claude plugin install compliance@cto-powersuit

Skills

• /compliance:ai-act-triage

  Triage every AI use in a register under the EU AI Act: classify each one as a prohibited practice (Art 5), high-risk (Annex III use case or Annex I product safety), transparency obligations (Art 50) or minimal, record provider obligations for general-purpose AI models, and note the date from which each obligation applies.

• /compliance:control-map

  Map the team's existing controls and their evidence to ISO 27001 Annex A control numbers, TISAX (VDA ISA question numbers), NIS2 articles and GDPR articles, in one CSV with control id, owner, evidence link, status and gap per row.

• /compliance:legal-baseline

  Set up the legal baseline of a website: an Impressum under German law (§ 5 DDG), a privacy page with the information of GDPR Art 13, a /.well-known/security.txt with Contact and Expires (RFC 9116), and no third-party requests on page load (fonts, scripts and styles self-hosted, no analytics without consent).

Gate checks

The checks this plugin adds to the deploy gate of the gate module, each with a pass fixture and a fail fixture:

• compliance.no-third-party
• compliance.security-txt

Source

The CTO powersuit is a set of agent skills, one module per CTO function from the deploy gate to the hand-over, that one person uses to run a company's whole engineering platform. compliance is one of its 18 plugins, published by Stefan Coetzee.

The skills, templates, checks, fixtures, and the full README of compliance at release v0.1.0: github.com/uncovertechtalent/cto-powersuit/tree/v0.1.0/plugins/compliance. License: MIT. Every plugin of the powersuit: CTO powersuit.