arckit-cli 6.1.1__py3-none-any.whl

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/eu-ai-act-template.md

@@ -0,0 +1,227 @@
+# EU AI Act Compliance Assessment
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:eu-ai-act`
+>
+> ⚠️ **Community-contributed** — not yet validated against current ANSSI/CNIL/EU regulatory text. Verify all citations before relying on output.
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time to _partials/document-control-uk.md or _partials/document-control-uae.md based on plugin userConfig classification_scheme + governance_framework. See _partials/RENDERING.md (when present). -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:eu-ai-act` | [PENDING] | [PENDING] |
+
+## Executive Summary
+
+| Area | Risk Class | Status | Key Findings |
+|------|-----------|--------|-------------|
+| Risk Classification | [Prohibited / High / Limited / Minimal] | [Compliant / Partial / Gap] | [Summary] |
+| Transparency Obligations | [Required / N/A] | [Compliant / Partial / Gap] | [Summary] |
+| Technical Requirements | [Applicable / N/A] | [Compliant / Partial / Gap] | [Summary] |
+| GPAI Obligations | [Applicable / N/A] | [Compliant / Partial / Gap] | [Summary] |
+
+---
+
+## 1. AI System Classification
+
+### 1.1 Is this an AI System under the AI Act?
+
+| Criterion | Assessment |
+|-----------|-----------|
+| Machine-based system infers outputs (predictions, recommendations, decisions, content) | ☐ Yes ☐ No |
+| Operates with varying degrees of autonomy | ☐ Yes ☐ No |
+| Designed for explicit or implicit objectives | ☐ Yes ☐ No |
+| Output influences physical or virtual environments | ☐ Yes ☐ No |
+
+**In scope**: ☐ Yes ☐ No (if No, stop here)
+
+### 1.2 GPAI Model Assessment
+
+| Criterion | Assessment |
+|-----------|-----------|
+| General-purpose AI model (trained on broad data, capable of wide range of tasks) | ☐ Yes ☐ No |
+| Systemic risk model (> 10²⁵ FLOPs training compute) | ☐ Yes ☐ No |
+
+**GPAI model**: ☐ Yes — apply Section 5 | ☐ No
+
+### 1.3 Risk Classification
+
+| Risk Level | Category | Applicable |
+|-----------|---------|-----------|
+| **Prohibited** (Article 5) | Social scoring by public authorities; exploitation of vulnerabilities; subliminal manipulation; real-time remote biometric ID in public spaces (with exceptions); emotion recognition in workplace/education; biometric categorisation on sensitive characteristics | ☐ |
+| **High Risk — Annex I** (safety component of product) | Machinery, toys, medical devices, aviation, vehicles covered by sector legislation | ☐ |
+| **High Risk — Annex III** (standalone AI) | Critical infrastructure; education/vocational training; employment and worker management; essential private/public services; law enforcement; migration/border control; administration of justice; democratic processes | ☐ |
+| **Limited Risk** | Chatbots, deepfake generation, emotion recognition, biometric categorisation | ☐ |
+| **Minimal Risk** | AI-enabled video games, spam filters, recommendation systems (non-high-risk) | ☐ |
+
+**Classification**: [Prohibited / High Risk / Limited Risk / Minimal Risk]
+
+## 2. Prohibited AI Practices (Article 5)
+
+[Complete if prohibited classification possible — if confirmed prohibited, the system cannot be placed on the EU market]
+
+| Prohibited Practice | Applicable | Assessment |
+|--------------------|-----------|-----------|
+| Social scoring by public authorities | ☐ | |
+| Exploitation of psychological/physical vulnerabilities | ☐ | |
+| Subliminal manipulation beyond person's consciousness | ☐ | |
+| Real-time remote biometric identification in public spaces (with limited exceptions) | ☐ | |
+| Post-remote biometric identification (except for serious crimes) | ☐ | |
+| Emotion recognition in workplace or educational institutions | ☐ | |
+| Biometric categorisation based on sensitive characteristics (politics, religion, sex life) | ☐ | |
+
+## 3. High-Risk AI Requirements (Articles 8–17)
+
+[Complete if classified as High Risk]
+
+### 3.1 Risk Management System (Article 9)
+
+| Requirement | Status | Evidence |
+|-------------|--------|---------|
+| Risk management system established and maintained throughout lifecycle | ☐ | |
+| Risks to health, safety, and fundamental rights identified | ☐ | |
+| Risk estimation and evaluation conducted | ☐ | |
+| Residual risk levels acceptable | ☐ | |
+
+### 3.2 Data Governance (Article 10)
+
+| Requirement | Status |
+|-------------|--------|
+| Training, validation, and testing datasets identified | ☐ |
+| Data governance practices documented | ☐ |
+| Training data relevant, sufficiently representative, and free from errors | ☐ |
+| Biases identified and addressed | ☐ |
+| Special category data in training sets handled appropriately | ☐ |
+
+### 3.3 Technical Documentation (Article 11 + Annex IV)
+
+| Document | Status |
+|----------|--------|
+| General description of AI system | ☐ |
+| Development process and testing methodology | ☐ |
+| Monitoring, functioning, and control | ☐ |
+| Computational requirements | ☐ |
+| Risk management system documentation | ☐ |
+| Changes to pre-trained models | ☐ |
+| EU Declaration of Conformity | ☐ |
+
+### 3.4 Record-Keeping / Logging (Article 12)
+
+| Requirement | Status |
+|-------------|--------|
+| Automatic logging enabled | ☐ |
+| Logs retained for at least 6 months (or as required) | ☐ |
+| Logs accessible to deployer and authority | ☐ |
+
+### 3.5 Transparency and Information to Deployers (Article 13)
+
+| Requirement | Status |
+|-------------|--------|
+| Instructions for use provided to deployers | ☐ |
+| Capabilities and limitations disclosed | ☐ |
+| Intended purpose documented | ☐ |
+| Performance metrics on specific persons/groups included | ☐ |
+
+### 3.6 Human Oversight (Article 14)
+
+| Requirement | Status |
+|-------------|--------|
+| Human oversight measures designed into the system | ☐ |
+| Natural persons assigned to oversee identified | ☐ |
+| Ability to understand output | ☐ |
+| Ability to disregard/override/intervene | ☐ |
+| Ability to stop operation | ☐ |
+
+### 3.7 Accuracy, Robustness, and Cybersecurity (Article 15)
+
+| Requirement | Status |
+|-------------|--------|
+| Appropriate accuracy levels documented | ☐ |
+| Robustness against errors and inconsistencies | ☐ |
+| Resilience against adversarial manipulation | ☐ |
+| Cybersecurity measures proportionate to risk | ☐ |
+
+## 4. Transparency Obligations for Limited Risk (Articles 50–52)
+
+[Complete for chatbots, synthetic content, emotion recognition, biometric categorisation]
+
+| Obligation | Applicable AI Type | Status |
+|-----------|-------------------|--------|
+| Disclose AI interaction to users (chatbots) | Chatbots | ☐ |
+| Label AI-generated content (deepfakes, synthetic media) | Generative AI | ☐ |
+| Disclose emotion recognition use | Emotion recognition | ☐ |
+| Disclose biometric categorisation use | Biometric systems | ☐ |
+
+## 5. GPAI Model Obligations (Articles 53–55)
+
+[Complete if the system uses or is a General-Purpose AI model]
+
+### 5.1 Standard GPAI Obligations (Article 53)
+
+| Obligation | Status |
+|-----------|--------|
+| Technical documentation maintained | ☐ |
+| Copyright compliance policy in place | ☐ |
+| Summary of training data published | ☐ |
+| Information provided to downstream providers | ☐ |
+
+### 5.2 Systemic Risk GPAI (Article 55) — Models > 10²⁵ FLOPs
+
+| Obligation | Status |
+|-----------|--------|
+| Adversarial testing (red-teaming) conducted | ☐ |
+| Serious incident reporting to AI Office | ☐ |
+| Cybersecurity measures for model weights | ☐ |
+| Energy efficiency metrics reported | ☐ |
+
+## 6. Conformity Assessment and Registration
+
+### 6.1 Conformity Assessment Route (High Risk only)
+
+| Route | Applicable To | Notified Body Required |
+|-------|--------------|----------------------|
+| Internal control (Annex VI) | High-risk AI not in Annex I product | No |
+| Third-party assessment (Annex VII) | High-risk AI in Annex I product category | Yes |
+| Quality management system (Annex VII/VIII) | High-risk AI where harmonised standards apply | Depends |
+
+### 6.2 EU AI Act Registration (Article 49)
+
+| Requirement | Status |
+|-------------|--------|
+| System registered in EU AI Act database (if high risk, deployer in public sector) | ☐ |
+| CE marking affixed (if high risk, Article 48) | ☐ |
+| EU Declaration of Conformity issued | ☐ |
+
+## 7. French Market Context
+
+| Authority | Role |
+|-----------|------|
+| ANSSI | Cybersecurity requirements for AI systems; technical advisory |
+| CNIL | GDPR interface with AI Act; AI and fundamental rights |
+| French AI Office (future) | Market surveillance for AI Act |
+| Comité National de l'IA | Government AI strategy coordination |
+
+## 8. Gap Analysis and Roadmap
+
+| Gap | Article | Priority | Owner | AI Act Deadline |
+|-----|---------|---------|-------|----------------|
+| [Gap description] | [Art. XX] | 🔴 High | [Role] | [Date] |
+
+**Key AI Act application dates**:
+
+- February 2025: Prohibited AI practices apply
+- August 2025: GPAI model obligations apply
+- August 2026: High-risk AI (Annex III) obligations apply
+- August 2027: High-risk AI (Annex I products) obligations apply
+
+---
+
+**Generated by**: ArcKit `/arckit:eu-ai-act` command
+**Generated on**: [YYYY-MM-DD]
+**ArcKit Version**: [VERSION]
+**Project**: [PROJECT_NAME]
+**Model**: [AI_MODEL]

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/eu-cra-template.md

@@ -0,0 +1,176 @@
+# EU Cyber Resilience Act Compliance Assessment
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:eu-cra`
+>
+> ⚠️ **Community-contributed** — not yet validated against current ANSSI/CNIL/EU regulatory text. Verify all citations before relying on output.
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time to _partials/document-control-uk.md or _partials/document-control-uae.md based on plugin userConfig classification_scheme + governance_framework. See _partials/RENDERING.md (when present). -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:eu-cra` | [PENDING] | [PENDING] |
+
+## Executive Summary
+
+| Area | Classification | Status | Key Gaps |
+|------|---------------|--------|---------|
+| Product Scope | [In scope / Out of scope] | — | — |
+| Risk Classification | [Default / Class I / Class II] | [Compliant / Partial / Gap] | [Count] |
+| Security by Design | — | [Compliant / Partial / Gap] | [Count] |
+| Vulnerability Management | — | [Compliant / Partial / Gap] | [Count] |
+| Reporting Capability | — | [Compliant / Partial / Gap] | [Count] |
+| Conformity Assessment | — | [Compliant / Partial / Gap] | [Count] |
+
+---
+
+## 1. Scope and Classification
+
+### 1.1 In-Scope Assessment
+
+| Criterion | Assessment |
+|-----------|-----------|
+| Product with digital elements (hardware or software) | ☐ Yes ☐ No |
+| Placed or made available on EU market | ☐ Yes ☐ No |
+| Excluded category (medical devices, aviation, automotive, marine, civil aviation regulated by sector law) | ☐ Yes ☐ No — if yes, check sector regulation |
+
+**CRA In Scope**: ☐ Yes ☐ No
+
+### 1.2 Risk Classification
+
+| Class | Annex | Description | Examples | Conformity Route |
+|-------|-------|-------------|---------|-----------------|
+| **Default** | — | All products not in Class I or II | Most software, consumer IoT | Internal self-assessment |
+| **Important (Class I)** | Annex III, Part I | Higher cybersecurity risk | Identity management software, browsers, password managers, VPNs, network monitoring, industrial control systems, smart home security | Self-assessment with harmonised standards |
+| **Critical (Class II)** | Annex III, Part II | Highest cybersecurity risk | HSMs, secure elements, smart meters, critical infrastructure components, industrial automation, card readers | Third-party assessment (notified body) |
+
+**Product Classification**: ☐ Default | ☐ Important (Class I) | ☐ Critical (Class II)
+
+### 1.3 Open Source Assessment
+
+| Scenario | CRA Applicability |
+|---------|-----------------|
+| Purely open source, no commercial activity | Out of scope |
+| Open source with paid support/services | In scope for supported product |
+| Integrating open source in commercial product | In scope — manufacturer responsible for full product |
+| Open source foundation / steward | Lighter obligations (security policies, CVE participation) |
+
+**Open source scenario**: [Scenario] | **CRA applicability**: [Yes / No / Partial]
+
+## 2. Security Requirements by Design (Annex I, Part I)
+
+| Requirement | Description | Status | Gap | Remediation |
+|-------------|-------------|--------|-----|-------------|
+| No known exploitable vulnerabilities | Place on market without known exploitable vulnerabilities | ☐ | | |
+| Secure by default configuration | Products delivered with secure default settings, no unnecessary features enabled | ☐ | | |
+| Protection against unauthorised access | Authentication, access control, attack surface reduction | ☐ | | |
+| Data confidentiality and integrity | Encryption of data at rest and in transit | ☐ | | |
+| Minimal data collection | Process only data strictly necessary for intended purpose | ☐ | | |
+| Availability protection | Measures against DoS attacks | ☐ | | |
+| Limit attack surface | Disable unused interfaces; minimise exposed components | ☐ | | |
+| Reduce exploitable vulnerabilities | Least privilege, defence in depth, secure coding | ☐ | | |
+| Integrity monitoring | Verify integrity of software and data | ☐ | | |
+| Security audit logging | Log security-relevant events, tamper-resistant logs | ☐ | | |
+| Secure update mechanism | Signed updates, rollback capability | ☐ | | |
+| End-of-support transparency | Communicate end-of-support date to users | ☐ | | |
+
+## 3. Vulnerability Management Requirements (Annex I, Part II)
+
+| Requirement | Description | Status | Gap |
+|-------------|-------------|--------|-----|
+| Vulnerability disclosure policy (VDP) | Published, accessible VDP with contact mechanism | ☐ | |
+| SBOM (Software Bill of Materials) | Machine-readable SBOM covering top-level dependencies (minimum) | ☐ | |
+| CVE registry participation | Register CVEs in MITRE/NVD for product vulnerabilities | ☐ | |
+| Free security updates | Provide security updates throughout support lifetime at no extra cost | ☐ | |
+| Coordinated disclosure | Responsibly disclose to national CSIRT and ENISA | ☐ | |
+| 24-hour incident reporting | Report actively exploited vulnerabilities to ENISA and national CSIRT | ☐ | |
+| Documented support period | End-of-life date communicated to users | ☐ | |
+
+### 3.1 SBOM Requirements
+
+| SBOM Element | Status |
+|-------------|--------|
+| Top-level component inventory | ☐ |
+| Machine-readable format (SPDX, CycloneDX) | ☐ |
+| Dependency relationships documented | ☐ |
+| License information included | ☐ |
+| Known vulnerabilities linked (CVE IDs) | ☐ |
+
+## 4. Reporting Obligations
+
+| Event | Deadline | Recipient | Status |
+|-------|---------|-----------|--------|
+| Awareness of actively exploited vulnerability | **24 hours** — early warning | ENISA + national CSIRT (FR: CERT-FR) | ☐ |
+| Incident with impact on security of product | **24 hours** — early warning | ENISA + national CSIRT | ☐ |
+| Full incident notification | **72 hours** | ENISA + national CSIRT | ☐ |
+| Final incident report | **14 days** after mitigation deployed | ENISA + national CSIRT | ☐ |
+
+**24-hour reporting capability in place**: ☐ Yes ☐ No
+
+## 5. Conformity Assessment
+
+### 5.1 Conformity Route
+
+| Product Class | Conformity Route | Notified Body Required | Status |
+|--------------|-----------------|----------------------|--------|
+| Default | Module A (internal control) | No | ☐ |
+| Important (Class I) — with harmonised standards | Module A with standards | No | ☐ |
+| Important (Class I) — without harmonised standards | Module B + C | Yes | ☐ |
+| Critical (Class II) | Module B + C or H | Yes | ☐ |
+
+### 5.2 Technical Documentation (Required Before Market Placement)
+
+- [ ] Product description and intended use
+- [ ] Design and manufacturing documentation
+- [ ] Cybersecurity risk assessment
+- [ ] SBOM
+- [ ] Security testing results
+- [ ] Vulnerability handling procedures
+- [ ] EU Declaration of Conformity (Annex V)
+- [ ] CE marking
+
+### 5.3 CE Marking
+
+| Requirement | Status |
+|-------------|--------|
+| CE marking affixed to product | ☐ |
+| EU Declaration of Conformity issued | ☐ |
+| Declaration references applicable CRA requirements | ☐ |
+| Notified body (if required) certificate obtained | ☐ |
+
+## 6. French Market Surveillance
+
+| Authority | Role |
+|-----------|------|
+| ANSSI | Technical lead for cybersecurity aspects; designated market surveillance authority for CRA in France |
+| DGCCRF | General consumer protection market surveillance; coordination with ANSSI |
+| CERT-FR | Receives vulnerability and incident reports under CRA Articles 14–15 |
+
+## 7. Gap Analysis and Timeline
+
+| Requirement | Status | Gap Description | Remediation Action | CRA Deadline |
+|-------------|--------|----------------|-------------------|-------------|
+| Secure by default | ☐ | [Description] | [Action] | Dec 2027 |
+| SBOM generation | ☐ | [Description] | [Action] | Dec 2027 |
+| VDP published | ☐ | [Description] | [Action] | Dec 2027 |
+| 24h reporting capability | ☐ | [Description] | [Action] | Dec 2027 |
+| Technical documentation | ☐ | [Description] | [Action] | Dec 2027 |
+| CE marking process | ☐ | [Description] | [Action] | Dec 2027 |
+| Notified body engaged (if Class I/II) | ☐ | [Description] | [Action] | Sep 2026 (notification bodies) |
+
+**Key CRA dates**:
+
+- 11 September 2026: Notification body obligations apply
+- 11 December 2027: Full CRA obligations apply
+
+---
+
+**Generated by**: ArcKit `/arckit:eu-cra` command
+**Generated on**: [YYYY-MM-DD]
+**ArcKit Version**: [VERSION]
+**Project**: [PROJECT_NAME]
+**Model**: [AI_MODEL]

arckit_cli-6.1.1.data/data/share/arckit/.arckit/templates/eu-data-act-template.md

@@ -0,0 +1,175 @@
+# EU Data Act Compliance Assessment
+
+> **Template Origin**: Community | **ArcKit Version**: [VERSION] | **Command**: `/arckit:eu-data-act`
+>
+> ⚠️ **Community-contributed** — not yet validated against current ANSSI/CNIL/EU regulatory text. Verify all citations before relying on output.
+
+## Document Control
+
+<!-- DOC-CONTROL-HEADER -->
+<!-- Resolved at command-execution time to _partials/document-control-uk.md or _partials/document-control-uae.md based on plugin userConfig classification_scheme + governance_framework. See _partials/RENDERING.md (when present). -->
+
+## Revision History
+
+| Version | Date | Author | Changes | Approved By | Approval Date |
+|---------|------|--------|---------|-------------|---------------|
+| [VERSION] | [YYYY-MM-DD] | ArcKit AI | Initial creation from `/arckit:eu-data-act` | [PENDING] | [PENDING] |
+
+## Executive Summary
+
+| Obligation Area | Status | Critical Gaps |
+|----------------|--------|--------------|
+| Role Determination | [Classified] | — |
+| Connected Product Data Sharing | [Compliant / Partial / Gap / N/A] | [Count] |
+| B2B Data Sharing | [Compliant / Partial / Gap / N/A] | [Count] |
+| Public Sector Exceptional Access | [Compliant / Partial / Gap / N/A] | [Count] |
+| Cloud Switching (DAPS) | [Compliant / Partial / Gap / N/A] | [Count] |
+| Trade Secrets Protection | [Compliant / Partial / Gap / N/A] | [Count] |
+| Interoperability | [Compliant / Partial / Gap / N/A] | [Count] |
+
+---
+
+## 1. Role Determination and Scope
+
+### 1.1 Role in the Data Value Chain
+
+| Role | Definition | Applicable |
+|------|-----------|-----------|
+| Manufacturer of a connected product | Makes/imports product that generates data | ☐ |
+| Provider of related service | Provides digital service related to connected product | ☐ |
+| Data holder | Person/entity that has right or obligation to make data available | ☐ |
+| Data recipient | Entity to whom data is made available | ☐ |
+| Data processing service provider (DAPS) | IaaS, PaaS, SaaS, edge cloud provider | ☐ |
+| Public sector body | Government / public body requesting emergency data access | ☐ |
+
+### 1.2 Connected Product Assessment
+
+[Complete if manufacturing or selling connected products — IoT devices, smart appliances, industrial machinery, vehicles, medical devices, etc.]
+
+| Criterion | Assessment |
+|-----------|-----------|
+| Product generates data by virtue of its use | ☐ Yes ☐ No |
+| Data is collected by the manufacturer or related service | ☐ Yes ☐ No |
+| Product placed on EU market | ☐ Yes ☐ No |
+
+**Connected product in scope**: ☐ Yes ☐ No
+
+## 2. User Data Access Rights (Chapter II, Articles 4–6)
+
+[Complete if Manufacturer / Provider of related service / Data holder]
+
+### 2.1 Access Rights for Users
+
+| Obligation | Article | Status | Gap |
+|-----------|---------|--------|-----|
+| Users informed before purchase of data generated by product | Art. 3 | ☐ | |
+| Users can access data generated by their use in real time | Art. 4 | ☐ | |
+| Data provided free of charge to users | Art. 4(1) | ☐ | |
+| Data provided in structured, commonly used, machine-readable format | Art. 4(1) | ☐ | |
+| Contact point established for data access requests | Art. 4(3) | ☐ | |
+
+### 2.2 Third-Party Sharing at User Request (Article 5)
+
+| Obligation | Status |
+|-----------|--------|
+| User can instruct sharing with designated third party | ☐ |
+| Data shared under same conditions as to the user | ☐ |
+| Sharing request fulfilled without undue delay | ☐ |
+| Trade secret protection mechanism in place | ☐ |
+
+## 3. B2B Data Sharing Obligations (Chapter III, Articles 8–12)
+
+[Complete if Data holder obliged to share with data recipient]
+
+| Obligation | Article | Status |
+|-----------|---------|--------|
+| Data sharing agreement in place | Art. 8 | ☐ |
+| Data sharing terms fair, reasonable, non-discriminatory (FRAND) | Art. 8(1) | ☐ |
+| SME protection — compensation capped at cost of sharing | Art. 9 | ☐ |
+| Dispute resolution mechanism available | Art. 10 | ☐ |
+| Trade secrets protected in shared data | Art. 12 | ☐ |
+| Use restriction clauses: no re-identification, no use to compete | Art. 8(4) | ☐ |
+
+## 4. Public Sector Exceptional Access (Chapter V, Articles 14–22)
+
+[Complete if operating in sector with public interest data — emergency situations]
+
+| Situation | Article | Applicable | Status |
+|---------|---------|-----------|--------|
+| Exceptional necessity (public emergency, natural disaster) | Art. 15 | ☐ | |
+| Specific real and immediate need (disaster response) | Art. 15 | ☐ | |
+| Data cannot be obtained otherwise | Art. 15 | ☐ | |
+
+| Obligation for Data Holders | Status |
+|----------------------------|--------|
+| Response to public sector request within reasonable time | ☐ |
+| Provide data in machine-readable format | ☐ |
+| Compensation at cost recovery only (no profit) | ☐ |
+
+## 5. Data Processing Service Switching (Chapter VI, Articles 23–31)
+
+[Complete if operating cloud / data processing services (IaaS, PaaS, SaaS, edge)]
+
+### 5.1 Switching Obligations (DAPS)
+
+| Obligation | Article | Status | Gap |
+|-----------|---------|--------|-----|
+| Switching process (from one DAPS to equivalent) enabled | Art. 23 | ☐ | |
+| Maximum 30-day notice for switching initiation | Art. 25 | ☐ | |
+| Switching completed within maximum 180 days | Art. 25 | ☐ | |
+| No financial/technical barriers to switching | Art. 25 | ☐ | |
+| Customer data exported in interoperable format | Art. 26 | ☐ | |
+| Egress charges eliminated by September 2027 | Art. 29 | ☐ | |
+
+### 5.2 Functional Equivalence
+
+| Requirement | Status |
+|-------------|--------|
+| Register of services published with interoperability information | ☐ |
+| Technical means to export data documented | ☐ |
+
+## 6. International Data Transfer Restrictions (Article 27)
+
+| Obligation | Status |
+|-----------|--------|
+| Non-EU government access without lawful EU/member state basis prohibited | ☐ |
+| Technical, organisational, and legal measures to prevent unlawful transfer | ☐ |
+| Unlawful transfer requests contested (with authority notification) | ☐ |
+
+> **Context**: The Data Act restricts cloud providers from providing non-EU government authorities access to EU data (analogous to SecNumCloud and DINUM cloud doctrine in France). This complements GDPR Chapter V transfer restrictions.
+
+## 7. Interoperability Requirements (Chapter VII, Articles 33–38)
+
+| Obligation | Article | Status |
+|-----------|---------|--------|
+| Open interoperability specifications for data exchange | Art. 33 | ☐ |
+| Smart contracts — essential requirements met | Art. 36 | ☐ |
+| Automated data sharing through smart contracts enabled (where applicable) | Art. 37 | ☐ |
+
+## 8. Trade Secret Protection (Article 12 and Recitals)
+
+| Safeguard | Status |
+|-----------|--------|
+| Data holder may refuse sharing if trade secret at risk (with justification) | ☐ |
+| Confidentiality agreement required of data recipients before access | ☐ |
+| Technical and organisational measures to protect trade secrets in shared data | ☐ |
+| Process to identify and flag trade secrets in data sets | ☐ |
+
+## 9. Gap Analysis and Action Plan
+
+| Gap | Article | Priority | Owner | Data Act Deadline |
+|-----|---------|---------|-------|------------------|
+| [Gap description] | [Art. XX] | 🔴 High | [Role] | [Date] |
+
+**Key Data Act dates**:
+
+- 12 September 2025: Most Data Act obligations apply
+- 12 September 2027: Egress charge elimination for switching
+
+---
+
+**Generated by**: ArcKit `/arckit:eu-data-act` command
+**Generated on**: [YYYY-MM-DD]
+**ArcKit Version**: [VERSION]
+**Project**: [PROJECT_NAME]
+**Model**: [AI_MODEL]