@diottodev/runic 1.0.0 → 1.1.0

package/c-level/change-management/SKILL.md

@@ -0,0 +1,253 @@
+---
+name: "change-management"
+description: "Framework for rolling out organizational changes without chaos. Covers the ADKAR model adapted for startups, communication templates, resistance patterns, and change fatigue management. Handles process changes, org restructures, strategy pivots, and culture changes. Use when announcing a reorg, switching tools, pivoting strategy, killing a product, changing leadership, or when user mentions change management, change rollout, managing resistance, org change, reorg, or pivot communication."
+license: MIT
+metadata:
+  version: 1.0.0
+  author: Alireza Rezvani
+  category: c-level
+  domain: change-management
+  updated: 2026-03-05
+  frameworks: change-playbook
+---
+
+# Change Management Playbook
+
+Most changes fail at implementation, not design. The ADKAR model tells you why and how to fix it.
+
+## Keywords
+change management, ADKAR, organizational change, reorg, process change, tool migration, strategy pivot, change resistance, change fatigue, change communication, stakeholder management, adoption, compliance, change rollout, transition
+
+## Core Model: ADKAR Adapted for Startups
+
+ADKAR is a change management model by Prosci. Original version is for enterprises. This is the startup-speed adaptation.
+
+### A — Awareness
+
+**What it is:** People understand WHY the change is happening — the business reason, not just the announcement.
+
+**The mistake:** Communicating the WHAT before the WHY. "We're moving to a new CRM" before "here's why our current process is killing us."
+
+**What people need to hear:**
+- What is the problem we're solving? (Be honest. If it's "we need to cut costs," say that.)
+- Why now? What would happen if we didn't change?
+- Who made this decision and how?
+
+**Startup shortcut:** A 5-minute video from the CEO or decision-maker explaining the "why" in plain language beats a formal change announcement document every time.
+
+---
+
+### D — Desire
+
+**What it is:** People want to make the change happen — or at least don't actively resist it.
+
+**The mistake:** Assuming communication creates desire. Awareness ≠ desire. People can understand a change and still hate it.
+
+**What creates desire:**
+- "What's in it for me?" — answer this for each stakeholder group, honestly
+- Involving people in the "how" even if the "what" is decided
+- Addressing fears directly: "Some people are worried this means their role is changing. Here's the truth: [honest answer]"
+
+**What destroys desire:**
+- Pretending the change is better for everyone than it is
+- Ignoring the legitimate losses people will experience
+- Making announcements without any consultation
+
+**Startup shortcut:** Run a short "concerns and questions" session within 48 hours of announcement. Not to reverse the decision — to address the fears and show you're listening.
+
+---
+
+### K — Knowledge
+
+**What it is:** People know HOW to operate in the new world — the specific skills, behaviors, and processes.
+
+**The mistake:** Announcing the change and assuming people will figure it out.
+
+**What people need:**
+- Step-by-step documentation of new processes
+- Training or practice sessions before go-live
+- Clear answers to "what do I do when [common scenario]?"
+- Who to ask when they're stuck
+
+**Types of knowledge transfer:**
+| Method | Best for | When |
+|--------|---------|------|
+| Live training | Skill-based changes, complex tools | Before go-live |
+| Documentation | Process changes, reference material | Always |
+| Video walkthroughs | Tool migrations | Available 24/7, self-paced |
+| Shadowing / peer learning | Behavior changes | Weeks 2–4 after launch |
+| Office hours | Any change with many edge cases | First 4–6 weeks |
+
+---
+
+### A — Ability
+
+**What it is:** People have the time, tools, and support to actually do things differently.
+
+**The mistake:** "We've trained everyone" ≠ "everyone can now do it." Training is knowledge. Ability is practice.
+
+**What creates ability:**
+- Time to practice before being evaluated
+- A safe environment to make mistakes (no public shaming for early struggles)
+- Reduced load during transition (if you're asking people to learn new skills, don't simultaneously pile on new work)
+- Access to help (a Slack channel, a point person, documentation)
+
+**Signs of ability gap:**
+- People revert to old behavior under pressure
+- Workarounds emerge (people invent their own way around the new system)
+- Training scores are high but actual behavior hasn't changed
+
+---
+
+### R — Reinforcement
+
+**What it is:** The change sticks. The new behavior becomes the default.
+
+**The mistake:** Declaring victory at go-live. Changes fail because they're never reinforced.
+
+**What creates reinforcement:**
+- Visible measurement (are we tracking adoption?)
+- Recognition of early adopters ("Sarah fully migrated to the new workflow in week 2 — ask her how")
+- Leader modeling (if the CEO uses the old way, everyone will)
+- Removing the old option (when possible — eliminate the path of least resistance)
+- Consequences for non-adoption (stated clearly, applied consistently)
+
+**Adoption vs. compliance:**
+- **Compliance:** People do it when watched, revert when not
+- **Adoption:** People do it because they believe it's better
+
+Only reinforcement creates adoption. Compliance is the result of enforcement. Aim for adoption.
+
+---
+
+## Change Types and ADKAR Application
+
+### Process Change (new tools, new workflows)
+
+**Timeline:** 4–8 weeks for full adoption
+**Hardest phase:** Ability (people know what to do but haven't built the habit)
+**Critical reinforcement:** Remove or deprecate the old tool/process
+
+**Communication sequence:**
+1. Week -2: Announce the why + go-live date
+2. Week -1: Training sessions available
+3. Week 0 (go-live): Launch + point person available
+4. Week 2: Adoption check-in (who's using it? Who isn't?)
+5. Week 4: Feedback collection + public wins
+6. Week 8: Old system deprecated
+
+---
+
+### Org Change (reorg, new leader, team splits/merges)
+
+**Timeline:** 3–6 months for full stabilization
+**Hardest phase:** Desire (people fear for their roles and relationships)
+**Critical reinforcement:** Consistent behavior from new leadership
+
+**Communication sequence:**
+1. Day 0: Announce the change with the "why" — in person or synchronous video
+2. Day 1: 1:1s with most affected team members by their manager
+3. Week 1: FAQ published with honest answers to the 10 most common concerns
+4. Week 2–4: New structure is operating (don't delay implementation)
+5. Month 2: First retrospective — what's working, what needs adjustment
+6. Month 3–6: Regular check-ins on team health and morale
+
+**What to say when a leader is leaving or being replaced:**
+Be honest about what you can share. Never: "We can't share the reasons." Always: either a truthful explanation or "we're not able to share the specifics, but I can tell you [what this means for you]."
+
+---
+
+### Strategy Pivot (new direction, killed products)
+
+**Timeline:** 3–12 months for full alignment
+**Hardest phase:** Awareness (people don't believe the pivot is real)
+**Critical reinforcement:** Resource reallocation that visibly proves the pivot is happening
+
+**Communication sequence:**
+1. Internal first, always. Employees should never hear about a pivot from a press release.
+2. All-hands with full context: what changed in the market, what you're doing, what it means for teams
+3. Each team leader runs a "what does this mean for us?" conversation with their team
+4. Resource reallocation announced within 2 weeks (if the money doesn't move, people won't believe the pivot)
+5. First milestone of the new direction celebrated publicly
+
+**What kills pivots:** Announcing a new direction while still funding the old one at the same level.
+
+---
+
+### Culture Change (values refresh, behavior expectations)
+
+**Timeline:** 12–24 months for genuine behavior change
+**Hardest phase:** Reinforcement (behavior doesn't change just because values were announced)
+**Critical reinforcement:** Visible decisions that reflect the new values
+
+**Communication sequence:**
+1. Build with input: involve a representative sample of the company in defining the change
+2. Announce with story: "Here's what we observed, here's what we're changing and why"
+3. Behavior anchors: for each culture change, state the specific behavior in observable terms
+4. Leader behavior: leadership team must visibly model the new behavior first
+5. Performance integration: new expected behaviors appear in reviews within one cycle
+6. Celebrate the right behaviors: when someone exemplifies the new culture, name it publicly
+
+---
+
+## Resistance Patterns
+
+Resistance is information, not defiance. Diagnose before responding.
+
+| Resistance pattern | What it signals | Response |
+|-------------------|-----------------|---------|
+| "This won't work" | Awareness gap or credibility gap | Explain the evidence base for the change |
+| "Why now?" | Awareness gap | Explain urgency — what happens if we don't change |
+| "I wasn't consulted" | Desire gap | Acknowledge the gap; involve them in the "how" now |
+| "I don't have time for this" | Ability gap | Reduce their load or push the timeline |
+| "We tried this before" | Trust gap | Acknowledge what's different this time. Be specific. |
+| Silent non-compliance | Could be any gap | 1:1 conversation to diagnose |
+
+**The worst response to resistance:** Dismissing it. "Some people are resistant to change" as if resistance is a personality flaw rather than a signal.
+
+---
+
+## Change Fatigue
+
+When organizations change too fast, people stop believing any change will stick.
+
+### Signals
+- Eye-rolls during change announcements ("here we go again")
+- Low attendance at change-related sessions
+- Fast compliance on paper, slow adoption in practice
+- "Last month we were doing X, now we're doing Y" comments
+
+### Prevention
+- **Finish what you start.** Don't announce a new change while the last one is still being absorbed.
+- **Space changes.** One significant change at a time. Give 2–3 months of stability between major changes.
+- **Announce what's NOT changing.** People in change-fatigue need to know what's stable.
+- **Show results.** Publish what the previous change achieved before launching the next.
+
+### When you're already in change fatigue
+- Pause non-critical changes
+- Run a "change inventory": how many changes are in progress simultaneously?
+- Prioritize ruthlessly: which changes are essential now? Which can wait?
+- Communicate stability: "Here's what is NOT changing this quarter"
+
+---
+
+## Key Questions for Change Management
+
+- "Who are the most skeptical people about this change? Have we talked to them directly?"
+- "Do people understand why we're doing this, or just what we're doing?"
+- "Have we given people time to practice before we measure performance on the new way?"
+- "Is the old way still available? If so, people will use it."
+- "Are leaders modeling the new behavior themselves?"
+- "How many changes are we running simultaneously right now?"
+
+## Red Flags
+
+- Change announced on Friday afternoon (people stew over the weekend)
+- "This is final, questions are not welcome" framing
+- No published FAQ or way to ask questions safely
+- Old system/process still running 6 weeks after "go-live"
+- Leaders exempted from the change they're asking everyone else to make
+- No measurement of adoption — assuming go-live = success
+
+## Detailed References
+- `references/change-playbook.md` — ADKAR deep dive, resistance counter-strategies, communication templates, change fatigue management

package/c-level/chief-ai-officer-advisor/SKILL.md

@@ -0,0 +1,236 @@
+---
+name: "chief-ai-officer-advisor"
+description: "Chief AI Officer advisory for startups: model build-vs-buy decisions (API vs fine-tune vs in-house), AI risk classification under EU AI Act + US state patchwork, AI cost economics (API-to-self-hosted breakeven), and AI team org evolution. Use when deciding whether to call an API or fine-tune, classifying AI use cases for regulatory risk, calculating when self-hosting pays off, sequencing AI hires, or when user mentions CAIO, AI strategy, model selection, foundation model, fine-tuning, EU AI Act, NIST AI RMF, AI governance, model risk, or AI economics. Strategic only — does not duplicate engineering AI/ML skills."
+license: MIT
+metadata:
+  version: 1.0.0
+  author: Alireza Rezvani
+  category: c-level
+  domain: chief-ai-officer-leadership
+  updated: 2026-05-12
+  python-tools: model_buildvsbuy_calculator.py, ai_risk_classifier.py, ai_cost_economics.py
+  frameworks: model-buildvsbuy, ai-risk-governance, ai-economics, ai-team-org
+---
+
+# Chief AI Officer Advisor
+
+Strategic AI leadership for startup CAIOs and founders without one. **Four decisions, no AI hype:**
+
+1. **Should we use an API, fine-tune, or build our own?** — model build-vs-buy with 3-year TCO
+2. **Is this AI use case high-risk under regulation, and how do we govern it?** — EU AI Act + NIST AI RMF + US state patchwork
+3. **When do we switch from API to self-hosted, and at what cost?** — token economics with breakeven analysis
+4. **What AI role do we hire next?** — stage-to-role map (AI engineer ≠ ML engineer ≠ research scientist)
+
+This skill does **not** cover tactical AI/ML engineering. For RAG implementation, agent design, prompt engineering, eval infrastructure, model deployment, or cost optimization, see `engineering/rag-architect/`, `engineering/agent-designer/`, `engineering/prompt-governance/`, `engineering/self-eval/`, `engineering/llm-cost-optimizer/`.
+
+## Keywords
+
+CAIO, chief AI officer, AI strategy, model selection, foundation model, fine-tuning, RLHF, DPO, LoRA, QLoRA, build vs buy, AI build-vs-buy, model risk tier, EU AI Act, AI Act Article 6, Article 9, Article 10, Annex III, prohibited AI, high-risk AI, NIST AI RMF, AI risk management framework, NYC Local Law 144, Colorado SB 21-169, Illinois HB 53, model card, eval set, eval harness, hallucination rate, jailbreak risk, prompt injection, AI red team, AI safety, alignment, model lifecycle, model registry, API-to-self-hosted breakeven, GPU economics, A100, H100, inference cost, fine-tuning cost, AI team, AI engineer, ML engineer, research scientist, MLOps, AI platform
+
+## Quick Start
+
+```bash
+# Decision A: API vs fine-tune vs build
+python scripts/model_buildvsbuy_calculator.py                          # embedded customer-support sample
+python scripts/model_buildvsbuy_calculator.py path/to/use_case.json
+
+# Decision B: Risk classification under EU AI Act + US state laws
+python scripts/ai_risk_classifier.py                                   # embedded hiring-AI sample
+python scripts/ai_risk_classifier.py path/to/use_case.json
+
+# Decision C: API vs self-hosted economics
+python scripts/ai_cost_economics.py                                    # embedded 5M tokens/day sample
+python scripts/ai_cost_economics.py path/to/workload.json
+```
+
+## Key Questions (ask these first)
+
+- **What does this AI need to be good at, and how would you measure it?** (If no eval set, no ship.)
+- **What's the SLO on hallucination / error rate?** (Without one, "AI quality" is a vibe.)
+- **What happens when the model is wrong?** (Fallback behavior, human-in-the-loop, blast radius.)
+- **What's the risk tier under EU AI Act, and is conformity assessment required?** (Determines product launch timeline.)
+- **At what monthly token volume does self-hosting beat API?** (Almost never below 100M tokens/month at frontier quality.)
+- **Are we hiring an AI engineer or an ML research scientist?** (Different jobs; founders confuse them.)
+
+## Core Responsibilities
+
+### 1. Model Build-vs-Buy
+
+The decision is not "use AI or not" — it's **API vs fine-tune vs in-house** for each use case. Each path has a different TCO curve, latency profile, and capability ceiling.
+
+**Default path: API (frontier model)**
+- Use when: well-served by frontier (Claude, GPT, Gemini), QPS < 100, latency budget > 1s, cost < $50K/month
+- Why: frontier APIs are 10-100x more capable than what most teams can fine-tune in-house
+- Failure mode: API rate limits at scale, vendor lock-in, capability drift between model versions
+
+**Fine-tune a smaller model**
+- Use when: domain-specific behavior the API can't be prompted into (medical coding, legal redlining), high volume reducing API cost, latency budget < 500ms, specific style/format consistency required
+- Approaches: full fine-tune (rare), LoRA/QLoRA (common), RLHF/DPO (when alignment matters)
+- Failure mode: fine-tuned model lags frontier capability within 6-12 months; ongoing retraining cost
+
+**Build from scratch / pre-train**
+- Use when: almost never. You're a foundation-model company, OR you have a unique data corpus, $50M+ funding, and 18+ month patience.
+- Failure mode: by the time you ship, frontier models have caught up and your sunk cost is unrecoverable
+
+**Run** `model_buildvsbuy_calculator.py` for a use-case-specific recommendation with 3-year TCO. See `references/model_buildvsbuy_strategy.md` for full decision tree.
+
+### 2. AI Risk Classification & Governance
+
+The 2026 question every founder is facing: **does this AI use case trigger high-risk regulatory obligations?**
+
+**EU AI Act (in force 2026) tiers:**
+
+| Tier | Examples | Obligations |
+|---|---|---|
+| **Prohibited** | Social scoring, real-time biometric surveillance, manipulative AI | Cannot deploy in EU |
+| **High-risk** | Employment screening, credit scoring, education access, critical infrastructure, law enforcement, biometric ID | Conformity assessment, registration, post-market monitoring, transparency, human oversight |
+| **Limited-risk** | Chatbots, deepfakes, emotion recognition | Transparency: user must know they're interacting with AI |
+| **Minimal-risk** | Recommendation systems, spam filters, most B2B SaaS internals | No specific obligations |
+
+**Run** `ai_risk_classifier.py` to classify a use case and get the required-controls list.
+
+**US state patchwork (non-exhaustive):**
+
+- NYC LL 144 — Automated Employment Decision Tools (AEDTs) require annual bias audit + candidate notice
+- Colorado AI Act / SB 21-169 — AI in consumer decisions (credit, insurance, employment, housing)
+- Illinois HB 53 — AI in interview/hiring
+- California SB 1001 — Bot disclosure
+- Texas TCPA — Biometric identifier capture
+- Federal NIST AI RMF — voluntary; increasingly referenced in contracts
+
+**Industry-specific overlays:**
+
+- Healthcare: FDA AI/ML guidance (2023), MDR (EU) for medical-device AI, 510(k) pathway for AI/ML-enabled medical devices
+- Financial: NYDFS Reg 23, FTC Section 5, ECOA for credit decisions
+- Insurance: NAIC model bulletin, state insurance commissioner rules
+
+See `references/ai_risk_governance.md` for the full regulatory landscape + governance program checklist.
+
+### 3. AI Cost Economics
+
+**The breakeven question:** at what monthly token volume does self-hosted inference beat API costs?
+
+**Key components:**
+
+- **API cost** — variable, per-token. Frontier models 2026: Claude Sonnet 4.6 ~$3/$15 per M tokens (input/output), GPT-4o ~$2.50/$10, Gemini 2.5 ~$1.25/$5
+- **Self-hosted cost** — fixed (GPU commitment) + variable (electricity). H100 spot ~$2-5/hour, A100 spot ~$1-3/hour. Llama 3.1 70B / Qwen 2.5 72B: ~$0.50-2.00 per million output tokens at 70% utilization
+- **Hidden costs of self-hosting** — ops on-call, monitoring, model updates, scaling overhead, idle time penalty
+- **Hidden costs of API** — rate limits requiring multi-vendor failover, vendor lock-in, capability drift between versions, data residency
+
+**Typical breakeven (frontier-quality):** 100M–500M tokens/month, depending on model size and acceptable quality tradeoff. Below this, API wins. Above this, run the calculator.
+
+**Run** `ai_cost_economics.py` with workload characteristics for a breakeven point + sensitivity to GPU rates and model size.
+
+See `references/ai_cost_economics.md` for the full economics model and operational considerations.
+
+### 4. AI Team Org Evolution
+
+**The wrong question:** "Should we hire an ML engineer or a research scientist?"
+**The right question:** "What's the next AI capability we need to ship, and what role unblocks that?"
+
+Stage-to-role map:
+
+| Stage | First AI hire | Then | Then |
+|---|---|---|---|
+| Pre-PMF | Founder + 1 ML-curious engineer playing with prompts | — | — |
+| Series A | **AI engineer** (applied, full-stack; owns prompts/evals/deployment) | Second AI engineer for evals/quality | — |
+| Series B | AI/ML platform engineer (inference, evals, observability) | Third AI engineer for production reliability | Data scientist if model is core IP |
+| Series C | Manager of AI | ML research scientist (only if model IS the product) | AI safety / red team (if customer-facing AI) |
+| Late-stage | Head of AI → CAIO | Multiple research scientists, platform team, safety/red team | Federated AI leads per business unit |
+
+**Critical distinctions:**
+
+- **AI engineer** ≠ **ML engineer** ≠ **research scientist**
+  - AI engineer: full-stack + prompts + evals + deployment. Most startups need this, not the others.
+  - ML engineer: production deployment, monitoring, retraining infrastructure. Hire after data engineer.
+  - Research scientist: model invention, novel architectures. Only at Series C+ if model is core IP.
+
+**Centralize-vs-embed for AI:** AI starts centralized (one team) and stays there longer than data team, because the surface area is smaller. Embed only when AI is being deployed in 4+ product surfaces.
+
+See `references/ai_team_org_evolution.md`.
+
+## Workflows
+
+### Workflow 1: Model Selection Decision (1 hour)
+**Goal:** Decide whether a specific use case should use API, fine-tune, or build.
+
+```bash
+# 1. Define use_case.json (volume, latency, accuracy, team size, budget)
+python scripts/model_buildvsbuy_calculator.py use_case.json
+# 2. Review 3-year TCO + breakeven
+# 3. Cross-check with cs-cfo-advisor on budget commitment
+# 4. Cross-check with cs-cto-advisor on engineering capacity (esp. for fine-tune)
+# 5. Log via /cs:decide; consider /cs:freeze 60 on multi-year vendor commitment
+```
+
+### Workflow 2: AI Risk Classification (2-4 hours)
+**Goal:** Classify a use case under EU AI Act + US state laws, identify required controls.
+
+```bash
+# 1. Define use_case.json (decisions affected, users, geography, sector)
+python scripts/ai_risk_classifier.py use_case.json
+# 2. For HIGH-RISK: budget conformity assessment + registration
+# 3. For LIMITED-RISK: implement transparency requirements
+# 4. Cross-check with cs-general-counsel-advisor on contractual implications
+# 5. Cross-check with cs-ciso-advisor on technical safeguards
+# 6. Log via /cs:decide
+```
+
+### Workflow 3: API-to-Self-Hosted Breakeven (1 day)
+**Goal:** Decide when (and whether) to migrate from API to self-hosted inference.
+
+```bash
+# 1. Build workload.json (tokens/day, model size, latency, quality tolerance)
+python scripts/ai_cost_economics.py workload.json
+# 2. Run sensitivity scenarios (low/mid/high GPU rates)
+# 3. Estimate migration cost (engineering time + risk)
+# 4. Cross-check with cs-cfo-advisor on capex commitment
+# 5. Cross-check with cs-cto-advisor on platform readiness
+# 6. Log via /cs:decide; pair with /cs:freeze if signing GPU commitment
+```
+
+### Workflow 4: AI Team Roadmap (1 week)
+**Goal:** Sequence next 18 months of AI hires aligned to capabilities to ship.
+
+1. List top 5 AI capabilities the product needs in 12 months
+2. Map each capability to the role that ships it (see `ai_team_org_evolution.md`)
+3. Sequence hires (one role at a time, ramp before next)
+4. Cross-check with cs-chro-advisor on comp + leveling
+5. Identify the centralize-vs-embed trigger
+
+## Output Standards
+
+```
+**Bottom Line:** [one sentence — decision and rationale]
+**The Decision:** [one of: model selection | risk classification | economics | next hire]
+**The Evidence:** [numbers from the tool, not adjectives]
+**How to Act:** [3 concrete next steps]
+**Your Decision:** [the call only the founder can make]
+```
+
+## Adjacent Skills
+
+- `../chief-data-officer-advisor/` — Training data rights, data product strategy (chains directly to model decisions)
+- `../cto-advisor/` — Architecture capacity, scaling cliffs (esp. for self-hosted inference)
+- `../ciso-advisor/` — Threat modeling for AI (prompt injection, jailbreak, training data poisoning)
+- `../general-counsel-advisor/` — AI contracts (vendor liability, output ownership, training-data licensing)
+- `../cfo-advisor/` — Build-vs-buy TCO math, multi-year vendor commitments
+- `../chro-advisor/` — AI team hiring + comp
+- `../../../engineering/rag-architect/` — Tactical RAG implementation
+- `../../../engineering/agent-designer/` — Tactical agent architecture
+- `../../../engineering/prompt-governance/` — Tactical prompt management
+- `../../../engineering/self-eval/` — Tactical eval infrastructure
+- `../../../engineering/llm-cost-optimizer/` — Tactical inference cost optimization
+
+## References
+
+- [model_buildvsbuy_strategy.md](references/model_buildvsbuy_strategy.md) — Full decision tree + 3-year TCO components + when each path fails
+- [ai_risk_governance.md](references/ai_risk_governance.md) — EU AI Act + NIST AI RMF + US state patchwork + industry overlays + governance program
+- [ai_cost_economics.md](references/ai_cost_economics.md) — API pricing 2026 + GPU rental economics + utilization realities + migration cost
+- [ai_team_org_evolution.md](references/ai_team_org_evolution.md) — Stage-to-role map + role definitions (AI engineer ≠ ML engineer ≠ scientist) + anti-patterns
+
+---
+
+**Version:** 1.0.0
+**Status:** Production Ready
+**Disclaimer:** AI regulation is evolving rapidly. This skill surfaces decisions and tradeoffs as of 2026 but cannot replace qualified AI counsel for binding compliance decisions, especially under EU AI Act conformity assessments.