Skip to content
This repository was archived by the owner on Jan 31, 2026. It is now read-only.

Commit 60fc331

Browse files
kaalookaaloo
authored
Merge pull request #8 from etalab-ia/feat/constitution-update-eu-ai-act
docs: amend constitution to v1.10.0 (EU AI Act risk classification refinement)
2 parents 0abc3ce + b23f5bf commit 60fc331

4 files changed

Lines changed: 548 additions & 24 deletions

File tree

‎.specify/memory/constitution-update-summary-v1.10.0.md‎

Lines changed: 184 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,184 @@
1+
# Constitution Update Summary - Version 1.10.0
2+
3+
**Date**: 2025-10-16
4+
**Type**: MINOR version bump (1.9.0 → 1.10.0)
5+
**Focus**: Risk Classification Refinement for EU AI Act Compliance
6+
7+
## Executive Summary
8+
9+
Updated the ai-kit constitution with concrete guidance on EU AI Act risk classification based on domain expert input on French Government AI use cases. The update provides actionable workflows, decision trees, and mandatory artifacts for High-Risk AI systems.
10+
11+
## Key Changes
12+
13+
### 1. French Government High-Risk Use Cases (New Section in Principle I)
14+
15+
Added two categories of High-Risk AI use cases:
16+
17+
#### **Category A: French State Services (Primary ALLiaNCE Scope)**
18+
19+
Includes both agent-facing services (for State public servants) and citizen-facing services.
20+
21+
1. **Legal Assistance Systems** (Annex III, Point 8)
22+
- Examples: Conseil d'État legal assistant, employment law response assistants (droit de réponse au travail)
23+
- Requirements: Human oversight mandatory, full audit trail, transparency about AI limitations
24+
- ai-kit Responsibilities: Audit logging, human-in-the-loop UI patterns, explainability tools
25+
26+
2. **Social Benefits Eligibility Systems** (Annex III, Point 5(b))
27+
- Examples: Benefits eligibility calculators, rights information for ayants droit, social aid attribution
28+
- Requirements: Non-discrimination testing, explainability, human review for denials, appeal mechanisms
29+
- ai-kit Responsibilities: Bias testing tools, explainability frameworks, human review workflows
30+
31+
3. **Speech-to-Text & Audio Transcription Systems** (Context-Dependent Risk)
32+
- Examples: OpenGateLLM transcription, meeting minutes, accessibility services
33+
- **Dual Classification**:
34+
- **Limited Risk** (most common): Internal meetings, accessibility, documentation
35+
- **High-Risk**: Administrative decision-making, official proceedings, legal records
36+
- Includes decision tree for risk determination
37+
- OpenGateLLM-specific compliance guidance
38+
39+
#### **Category B: Critical Infrastructure & Specialized Sectors (Advisory Scope)**
40+
41+
1. **Food Safety & Supply Chain** (Annex III, Point 2)
42+
- Example: Food traceability systems
43+
- Note: ALLiaNCE does not typically incubate; guidance for other administrations
44+
45+
2. **Energy & Critical Infrastructure** (Annex III, Point 2)
46+
- Energy production, distribution, grid stability systems
47+
- Note: Requires specialized compliance frameworks beyond ai-kit
48+
49+
3. **Defense & Security Systems** (Annex III, Point 1)
50+
- Weapons systems, military applications
51+
- Note: Outside ALLiaNCE scope; specialized defense frameworks apply
52+
53+
### 2. Risk Assessment Workflow (New Section in Principle I)
54+
55+
Added mandatory 5-step risk classification process:
56+
57+
1. **Identify Use Case**: Map to Annex III categories using EU AI Act Compliance Checker
58+
2. **Document Classification**: Record risk level in `spec.md` with rationale
59+
3. **High-Risk Trigger**: Activate compliance workflow if High-Risk
60+
4. **Compliance Validation**: Include in Constitution Check of all design artifacts
61+
5. **Ongoing Monitoring**: Quarterly review for production systems, immediate re-assessment for scope changes
62+
63+
### 3. Transcription Audio Risk Assessment Decision Tree (New)
64+
65+
Added 3-question decision tree for context-dependent transcription systems:
66+
67+
1. Is transcription used to inform administrative decisions?
68+
2. Does it feed into systems determining benefits, legal outcomes, or official records?
69+
3. Is it used for internal collaboration, accessibility, or general documentation?
70+
71+
**Principle**: When in doubt, classify as High-Risk and conduct full compliance assessment.
72+
73+
### 4. High-Risk AI Mandatory Artifacts (New Section in Principle I)
74+
75+
Specified 8 required documentation categories for High-Risk AI systems:
76+
77+
1. **Risk Management Documentation**: Lifecycle assessment, mitigation strategies, residual risk acceptance
78+
2. **Data Governance Plan**: Quality assurance, bias testing, representativeness validation, data provenance
79+
3. **Technical Documentation**: Architecture, model cards, performance metrics, limitations
80+
4. **Human Oversight Design**: Intervention mechanisms, override capabilities, training requirements
81+
5. **Audit Trail System**: Automatic logging, retention policies, audit capabilities
82+
6. **Instructions for Deployers**: Proper use guidance, limitations, oversight requirements
83+
7. **Incident Response Plan**: Failure handling, bias remediation, compliance breach reporting
84+
8. **Context Classification Document**: For context-dependent systems, controls to prevent risk migration
85+
86+
Each artifact includes documentation location guidance (e.g., `plan.md`, `data-model.md`, `contracts/`).
87+
88+
## Template Updates
89+
90+
### ✅ spec-template.md (COMPLETED)
91+
92+
Added mandatory "EU AI Act Risk Classification" section:
93+
- Risk level determination with Annex III reference
94+
- Context-dependent classification table for multi-use-case systems
95+
- High-Risk compliance trigger checklist (8 mandatory artifacts)
96+
- Scope change monitoring requirements
97+
98+
### ✅ plan-template.md (COMPLETED)
99+
100+
Updated "Constitution Check" section:
101+
- Detailed EU AI Act sub-checklist (6 validation points)
102+
- New "High-Risk AI Mandatory Artifacts Checklist" section
103+
- Documentation location guidance for each artifact type
104+
- Compliance status tracking and gap identification
105+
106+
### ⚠️ tasks-template.md (PENDING)
107+
108+
To be updated with High-Risk AI task categories:
109+
- Risk management documentation tasks
110+
- Data governance and bias testing tasks
111+
- Audit trail implementation tasks
112+
- Human oversight UI/UX tasks
113+
- Deployer instructions documentation tasks
114+
115+
## Impact on Existing Projects
116+
117+
### Immediate Actions Required
118+
119+
1. **All Projects**: Review and classify AI risk level using new workflow
120+
2. **High-Risk Projects**: Verify all 8 mandatory artifacts are planned/documented
121+
3. **Transcription Projects**: Use decision tree to classify each use case
122+
4. **Existing Specs**: Add "EU AI Act Risk Classification" section to `spec.md`
123+
124+
### Follow-Up TODOs
125+
126+
1. Create **OpenGateLLM Compliance Guide** documenting transcription risk classification
127+
2. Update existing feature specs to include EU AI Act risk classification
128+
3. Create example High-Risk AI project demonstrating mandatory artifacts
129+
4. Develop bias testing and explainability tool templates for ai-kit
130+
5. Create audit logging and human oversight UI pattern library
131+
132+
## Compliance Benefits
133+
134+
1. **Legal Protection**: Clear documentation of risk assessment and compliance measures
135+
2. **Homologation Alignment**: Mandatory artifacts align with ANSSI homologation dossier requirements
136+
3. **Traceability**: Integration with SpecKit ensures all compliance decisions are documented
137+
4. **Actionable Guidance**: Concrete examples from ALLiaNCE incubations make compliance practical
138+
5. **Scope Management**: Clear boundaries prevent Limited Risk systems from drifting into High-Risk territory
139+
140+
## Suggested Commit Message
141+
142+
```
143+
docs: amend constitution to v1.10.0 (EU AI Act risk classification refinement)
144+
145+
- Add French Government High-Risk Use Cases with ALLiaNCE examples
146+
- Add Risk Assessment Workflow with 5-step process
147+
- Add Transcription Audio Risk Assessment Decision Tree
148+
- Add High-Risk AI Mandatory Artifacts specification
149+
- Update spec-template.md with EU AI Act Risk Classification section
150+
- Update plan-template.md with High-Risk AI compliance checklist
151+
152+
Based on domain expert input on EU AI Act compliance for French Government
153+
digital services. Provides concrete guidance for legal assistance, social
154+
benefits, and transcription systems common in ALLiaNCE incubations.
155+
156+
BREAKING: All new features MUST include EU AI Act risk classification in spec.md
157+
```
158+
159+
## Next Steps for Review
160+
161+
1. **Expert Review**: Share this summary with your EU AI Act domain expert for validation
162+
2. **Refinement**: Gather feedback on:
163+
- Completeness of use case categories
164+
- Accuracy of risk classifications
165+
- Practicality of mandatory artifacts
166+
- Clarity of decision trees
167+
3. **Iteration**: Update constitution based on expert feedback if needed
168+
4. **Communication**: Share updated constitution with ALLiaNCE teams
169+
5. **Training**: Consider workshop on new risk assessment workflow
170+
171+
## Questions for Expert Follow-Up
172+
173+
1. Are there additional High-Risk use cases in Category A we should document?
174+
2. Is the transcription risk classification decision tree accurate and complete?
175+
3. Are the 8 mandatory artifacts sufficient for EU AI Act compliance?
176+
4. Should we add specific guidance for other OpenGateLLM features (RAG, vectorization)?
177+
5. Are there specific Annex III points we should emphasize more?
178+
179+
---
180+
181+
**Constitution Version**: 1.10.0
182+
**Ratified**: 2025-10-11
183+
**Last Amended**: 2025-10-16
184+
**Full Constitution**: `.specify/memory/constitution.md`

0 commit comments

Comments
 (0)