Antoine Louis and Malik Taiar shipped a side project called Lawvable a few months ago. A simple idea: lawyers, counsel, and academics could publish 'skills', instruction sets that teach Claude or other AI agents how to handle specific legal work the way a practitioner actually handles it. I was really excited about this platform and joined as a contributor. The format clicked for me immediately! I had been building skills for my own practice (EU regulatory work, GDPR, AI Act, NIS2) and a public venue with real quality control was exactly what the space needed. Some months later: 110+ skills, many monthly visitors and downloads and now an official Anthropic collaboration, MCP connector live inside claude.ai! Huge congrats to Antoine Louis and Malik Taiar and all other contributors. You saw what skills could be before most people did, and you built the venue with taste and care. Encoded expertise is the moat. Glad to have played a small part. Even gladder the format is now where it needed to be! Congrats to Lawve AI !!! ❤️🤖

The European Data Protection Board published its first harmonized DPIA template yesterday. Public consultation runs until 9 June. 𝐒𝐨, 𝐣𝐮𝐬𝐭 𝐚 𝐛𝐨𝐫𝐢𝐧𝐠 𝐭𝐞𝐦𝐩𝐥𝐚𝐭𝐞? 𝐈 𝐝𝐨𝐧'𝐭 𝐭𝐡𝐢𝐧𝐤 𝐬𝐨! 𝗧𝗵𝗲 𝘁𝗲𝗺𝗽𝗹𝗮𝘁𝗲 𝗶𝘀 𝗮 𝘀𝗰𝗵𝗲𝗺𝗮, 𝗻𝗼𝘁 𝗮 𝗳𝗼𝗿𝗺, 𝗮𝗻𝗱 𝘁𝗵𝗮𝘁'𝘀 𝘁𝗵𝗲 𝗽𝗼𝗶𝗻𝘁! The explainer doc says it explicitly: "the same fact serves different functions across sections." Data items in 1.1.1 feed 2.2.1, 2.3.1, and 3.1. 3.1 threats re-enter 4.1.3. Sections aren't independent boxes, they're normalized views of the same underlying facts. "𝗠𝗲𝘁𝗮-𝘁𝗲𝗺𝗽𝗹𝗮𝘁𝗲": EDPB explicitly says SAs will adopt this template as the framework national templates must be compatible with. DSK short-form DPIAs, CNIL PIA Tool exports, AEPD Gestión de Riesgo outputs, all eventually converge. That's not guidance but a welcomed standardization. 𝗧𝗵𝗲 𝗶𝗻𝗵𝗲𝗿𝗲𝗻𝘁 𝘃𝘀. 𝗼𝗽𝗲𝗿𝗮𝘁𝗶𝗼𝗻𝗮𝗹 𝗿𝗶𝘀𝗸 𝘀𝗽𝗹𝗶𝘁. 3.1 asks: what's risky when everything works as designed? 4.1.1 asks: what's risky when something deviates? Different risks, different mitigations. Inherent risk is reduced by changing the design. Operational risk is reduced by controls. Most DPIAs I know conflate the two. The template forces two passes! 𝗘𝘃𝗶𝗱𝗲𝗻𝘁𝗶𝗮𝗿𝘆 𝘀𝗵𝗶𝗳𝘁: Every safeguard in 2.3 (and 4.2.1) must be marked Planned / Partially implemented / Implemented, with explicit definition that "Implemented" means "evidence that the control works as intended" - not paper! 𝗠𝗼𝗱𝘂𝗹𝗮𝘁𝗶𝗻𝗴 𝗳𝗮𝗰𝘁𝗼𝗿𝘀 𝗰𝗼𝗱𝗶𝗳𝗶𝗲𝗱. Aggravating/mitigating factors formally separated from baseline Likelihood×Severity. Aligns with ENISA severity and breach notification logic. 𝗪𝗵𝗮𝘁'𝘀 𝗺𝗶𝘀𝘀𝗶𝗻𝗴: 𝗔𝗜/𝗔𝗗𝗠 & 𝗠𝗮𝗰𝗵𝗶𝗻𝗲-𝗿𝗲𝗮𝗱𝗮𝗯𝗹𝗲 𝘀𝗰𝗵𝗲𝗺𝗮! 🔺 Article 22 sits in 2.3.2 as a data subject right. Automated decision-making and profiling get a passing mention in 1.1.4. That's it. Given AI Act Art. 27 FRIA and the pending joint AI Act/GDPR guidelines, this is the template's most obvious omission. AI-impacted processing needs either a dedicated subsection or explicit cross-reference hooks! 🔺 The template is a schema but it ships as Word doc. Publishing a JSON or YAML representation alongside the .docx would let tooling vendors and in-house teams using Claude Skills or n8n - stop reverse-engineering the structure (so I'll do it 😆 ). 𝗪𝗵𝗮𝘁 𝗜 𝘄𝗶𝗹𝗹 𝗱𝗼. I'll integrate the EDPB template structure into my DPIA Navigator skill (implementing the schema and offer the EDPB as optional template) on Lawve AI and into my new Legal LLM Wiki (https://shorturl.at/R7MjE)! Again, the key competitive advantage does not lie in who writes the best narrative DPIA. Rather, it depends on who has such a thorough understanding of the subject matter that the narrative emerges naturally from the data.

𝐀𝐧𝐨𝐭𝐡𝐞𝐫 𝐝𝐚𝐲, 𝐚𝐧𝐨𝐭𝐡𝐞𝐫 𝐒𝐊𝐈𝐋𝐋: 𝐆𝐃𝐏𝐑 𝐋𝐞𝐠𝐢𝐭𝐢𝐦𝐚𝐭𝐞 𝐈𝐧𝐭𝐞𝐫𝐞𝐬𝐭 𝐀𝐬𝐬𝐞𝐬𝐬𝐦𝐞𝐧𝐭 - 𝐟𝐫𝐨𝐦 𝐃𝐢𝐫𝐞𝐜𝐭 𝐌𝐚𝐫𝐤𝐞𝐭𝐢𝐧𝐠 𝐭𝐨 𝐀𝐈 𝐓𝐫𝐚𝐢𝐧𝐢𝐧𝐠. 2,327 lines. 10 files. Every major source encoded: → EDPB Guidelines 1/2024 (three-step test) → EDPB Opinion 28/2024 (AI models + legitimate interest) → The brand-new EDPB OSS Case Digest by Dr. TJ McIntyre (62 decisions + 5 binding decisions) → CNIL AI guidance (June 2025) on web scraping + LI → ICO guidance including the new UK "Recognised Legitimate Interest" → 12 CJEU judgments from Meta to KNLTB to SCHUFA → National DPA positions from DE, FR, NL, AT, IT, ES → German DSK, Hamburg, Bavaria, Baden-Württemberg guidance What it does: Walk through the full Art. 6(1)(f) assessment: from pre-assessment gates through the three-step test to a documented LIA output (docx file). With real enforcement patterns baked in. Not theory but grounded in what DPAs actually decided. — 𝐁𝐮𝐭 𝐡𝐞𝐫𝐞'𝐬 𝐭𝐡𝐞 𝐛𝐢𝐠𝐠𝐞𝐫 𝐩𝐢𝐜𝐭𝐮𝐫𝐞. I'm building toward a modular skill library where each skill encodes deep domain expertise for specific compliance tasks. One skill = one task, done at expert level. Chain them = complex compliance workflows, automated. Equip an agent (squad) with the right skills = the work gets done at practitioner level. That's what turns a general-purpose LLM into a domain expert. Not the model itself, the encoded expertise you give it. The end state? Specialized Claude Code agents each loaded with the skills they need, handling the grunt work of GDPR, AI Act, NIS2, and other digital regulation compliance. The assessments. The documentation. The monitoring. So skills/agents will not replace the lawyer but the time-consuming manual labor that keeps the lawyer from doing what actually matters: judgment, strategy, client counsel. The Legitimate Interest Assessment skill is available on Lawve AI as part of my growing compliance skills library.

𝗔 𝗯𝗶𝗸𝗲 𝗺𝗮𝗻𝘂𝗳𝗮𝗰𝘁𝘂𝗿𝗲𝗿 𝘄𝗶𝘁𝗵 𝟮𝟬𝟬 𝗲𝗺𝗽𝗹𝗼𝘆𝗲𝗲𝘀 𝗷𝘂𝘀𝘁 𝗳𝗼𝘂𝗻𝗱 𝗼𝘂𝘁 𝘁𝗵𝗲𝘆 𝗳𝗮𝗹𝗹 𝘂𝗻𝗱𝗲𝗿 𝗡𝗜𝗦𝟮. Other transport equipment, NACE C.30, Annex II. Nobody told them — because under NIS2, nobody will. You have to figure it out yourself. NIS2 is what GDPR did for personal data, but for cybersecurity. If you provide services that matter to the economy and you're above a certain size you secure your IT systems, report incidents, prove you're doing both. Across the EU, manufacturing, food, chemicals, waste management are hitting cybersecurity regulation for the first time. That bike company now faces 10 mandatory risk management measures under Art. 21. A 24-hour incident reporting obligation — running parallel to GDPR's 72-hour track to a different authority. And management body liability: Art. 20 requires personal board engagement. Germany went further with § 38(2) BSIG: the Managing Director/CEO is personally liable. Not the company, the person. Transposition varies wildly in the EU. Germany in force since December 2025, no transition. Italy live since October 2024. France, Netherlands, Spain still pending. The German Federal Office for Information Security (BSI) offers a free scope check tool. It tells you whether you're affected. But it stops there. So I built a NIS2 Navigator - a Claude Skill that runs scope classification, gap analysis across all 10 measures, and a prioritized roadmap in 20 minutes. Deep German integration, plus profiles for Italy, France, Netherlands, Austria, Spain. Built on the Directive, ENISA guidance, and BSI nis2know packages.

A few weeks ago I published my GDPR Agent Skills on Lawvable. 𝐓𝐨𝐝𝐚𝐲 𝐈'𝐦 𝐫𝐞𝐥𝐞𝐚𝐬𝐢𝐧𝐠 𝐦𝐲 𝐄𝐔 𝐀𝐈 𝐀𝐜𝐭 𝐂𝐨𝐦𝐩𝐥𝐢𝐚𝐧𝐜𝐞 𝐒𝐤𝐢𝐥𝐥𝐬 𝐒𝐮𝐢𝐭𝐞! These are 5 interconnected skills (that also work standalone): ⚡ Quick Assessment → 15-min triage ◈ System Classifier → full Art. 3(1) test + risk tier ⊕ Role Determination → Art. 25 quasi-provider analysis ▦ Obligations Mapper → RACI matrix + GDPR crosswalk ⊞ Report Generator → 4 formats incl. .docx export 48 reference files. 14,000 lines of structured legal methodology. 8 EU jurisdictions with national overlays. The skills work best as a pipeline but each one works standalone too. 𝐘𝐞𝐬, the Commission's Digital Omnibus proposal could push the Annex III high-risk AI system deadline by up to 16 months. But prohibited practices and AI literacy already apply since February 2025, GPAI since August 2025, and the core Art. 50 transparency obligations stay on track for August 2026 regardless. If we do get more time for high-risk systems? More time for testing & refining the skills before enforcement hits :) For me, Agent Skills are the best example of how to actually leverage AI in the legal sector. Building them still requires deep domain expertise - you need to know the law, the edge cases, the jurisdictional quirks, gray zones. Even powerful AI models don't generate that out of the box. But AI is increasingly good at executing deterministic legal methodology and applying specific knowledge consistently, at scale. Will these skills replace proper legal reasoning or a review by a qualified lawyer? No. But will they save significant time and deliver better, more structured results than working off manual checklists and generic prompts? Absolutely! 𝐓𝐡𝐚𝐭 𝐬𝐚𝐢𝐝 — 𝐭𝐡𝐢𝐬 𝐢𝐬 𝐯𝟏.𝟎, and I'm treating it as a living project. The skills will be continuously updated as Commission guidelines land, harmonized standards are published, and enforcement practice develops. New reference files will be added, edge cases refined, jurisdiction coverage expanded. If you try them and something doesn't work, a classification feels off, or an obligation is missing - I'd love to hear about it. Open an issue on GitHub or DM me here. The best way to improve legal skills is feedback from practitioners who use them. 𝐁𝐈𝐆 𝐓𝐇𝐀𝐍𝐊𝐒 again to Antoine, Malik and Lawve AI for building the platform that makes it easy for lawyers like me to share their skills! And I'm not the only one building in this space. Werner published his own AI Act Classification skill on Lawvable just days ago. Great to see the legal skills ecosystem growing! 🎤👨🏻‍💻 𝐈'𝐥𝐥 𝐛𝐞 𝐬𝐩𝐞𝐚𝐤𝐢𝐧𝐠 𝐚𝐧𝐝 𝐝𝐨𝐢𝐧𝐠 𝐚 𝐥𝐢𝐯𝐞 𝐝𝐞𝐦𝐨 with the new skills 𝒕𝒐𝒎𝒐𝒓𝒓𝒐𝒘 at the German Institute for Legal Departments and Corporate Lawyers (diruj) Legal Ops GenAI Kongress 2026 in Cologne!

I just published three GDPR Agent Skills on Lawve AI - reusable instructions that teach AI agents how to handle data protection workflows. Think of Skills as portable legal expertise: draft once, deploy everywhere. Each Skill is a self-contained package of prompts, templates, and guidelines that AI agents can load on-demand. No coding required. Skills are an open standard established by Anthropic, so they work with Claude and are being adopted by other AI tools as well. I’ve built three skills (more in the pipeline): → Data Breach Response — guided incident assessment based on ENISA methodology and EDPB Guidelines, including Art. 33/34 notification analysis → Privacy Notice Generator — structured drafting of GDPR-style privacy notices with multi-jurisdictional awareness → DPIA Assessment — systematic Data Protection Impact Assessments following the Art. 35 framework and relevant guidelines/blacklists I built these based on my expertise and daily practice as a data protection lawyer. The goal: encode real legal knowledge into portable, reusable AI workflows that any privacy professional can use. Huge shoutout to Lawve AI (Antoine Louis Malik Taiar) — “The Ultimate Agent Skills Hub for Law” — for building the platform that makes this possible. And a big thank you to Antoine for the constant support! Skills are still early, probably not perfect (give feedback, modify and improve them!) — but I believe this is where legal AI is heading: lawyer-built, open, and practical.