docs: amend constitution to v1.10.0 (EU AI Act risk classification refinement)

[kaaloo]

Summary

This PR updates the ai-kit constitution from v1.9.0 → v1.10.0 with comprehensive EU AI Act risk classification guidance based on domain expert input on French Government AI use cases.

Key Changes

1. French Government High-Risk Use Cases (New Section in Principle I)

Added two categories of High-Risk AI use cases:

Category A: French State Services (Primary ALLiaNCE Scope)

• Legal Assistance Systems (Annex III, Point 8)
  • Examples: Conseil d'État legal assistant, employment law response assistants
• Social Benefits Eligibility Systems (Annex III, Point 5(b))
  • Examples: Benefits eligibility calculators, rights information for ayants droit
• Speech-to-Text & Audio Transcription Systems (Context-Dependent Risk)
  • Examples: OpenGateLLM transcription, meeting minutes, accessibility services
  • Dual classification: Limited Risk (most common) vs. High-Risk (administrative/legal contexts)

Category B: Critical Infrastructure & Specialized Sectors (Advisory Scope)

• Food Safety & Supply Chain, Energy & Critical Infrastructure, Defense & Security Systems
• Note: Outside typical ALLiaNCE scope; requires specialized compliance frameworks

2. Risk Assessment Workflow (5-Step Process)

Mandatory workflow for all ai-kit projects:

1. Identify Use Case (map to Annex III categories)
2. Document Classification (record in spec.md)
3. High-Risk Trigger (activate compliance workflow if High-Risk)
4. Compliance Validation (include in Constitution Check)
5. Ongoing Monitoring (quarterly review for production systems)

3. Transcription Audio Risk Assessment Decision Tree

3-question decision tree for context-dependent transcription systems to determine Limited Risk vs. High-Risk classification.

4. High-Risk AI Mandatory Artifacts

Specified 8 required documentation categories for High-Risk AI systems:

• Risk Management Documentation
• Data Governance Plan
• Technical Documentation (model cards, performance metrics)
• Human Oversight Design
• Audit Trail System
• Instructions for Deployers
• Incident Response Plan
• Context Classification Document (for context-dependent systems)

5. Template Updates

spec-template.md: Added mandatory "EU AI Act Risk Classification" section

• Risk level determination with Annex III reference
• Context-dependent classification table
• High-Risk compliance trigger checklist

plan-template.md: Updated "Constitution Check" section

• Detailed EU AI Act sub-checklist
• "High-Risk AI Mandatory Artifacts Checklist" section
• Documentation location guidance

6. Scope Clarification

Clarified that ai-kit is designed for French State services (l'État), serving both:

• Agent-facing services for State public servants (agents publics d'État)
• Citizen-facing public services

Primary mission concerns the State, not territorial collectivities or hospitals.

Impact

BREAKING CHANGE

All new features MUST include EU AI Act risk classification in spec.md

Benefits

1. Legal Protection: Clear documentation of risk assessment and compliance measures
2. Homologation Alignment: Mandatory artifacts align with ANSSI homologation dossier requirements
3. Traceability: Integration with SpecKit ensures all compliance decisions are documented
4. Actionable Guidance: Concrete examples from ALLiaNCE incubations make compliance practical
5. Scope Management: Clear boundaries prevent Limited Risk systems from drifting into High-Risk territory

Files Changed

• .specify/memory/constitution.md - Constitution v1.10.0 (266 additions)
• .specify/templates/spec-template.md - EU AI Act Risk Classification section (50 additions)
• .specify/templates/plan-template.md - High-Risk AI compliance checklist (72 additions)
• .specify/memory/constitution-update-summary-v1.10.0.md - Summary for review (184 additions, NEW)

Next Steps

After merge:

1. Update existing feature specs to include EU AI Act risk classification
2. Create OpenGateLLM Compliance Guide documenting transcription risk classification
3. Develop bias testing and explainability tool templates for ai-kit
4. Create audit logging and human oversight UI pattern library
5. Communicate updated constitution to ALLiaNCE teams

Review Checklist

• Constitution version bumped (1.9.0 → 1.10.0)
• Sync Impact Report updated
• Templates updated for consistency
• Concrete examples from ALLiaNCE incubations included
• Decision trees for context-dependent systems provided
• Mandatory artifacts specified with documentation locations
• Scope clarification (French State services: agent-facing + citizen-facing)
• ALLiaNCE spelling convention applied consistently

---

Based on domain expert input on EU AI Act compliance for French Government digital services.