init: extract kurt-compliance-auditor from qognio-bot-widget-template@d2c816f
Source files (src/) and rendered bundle (www/) extracted on 2026-04-29T01:35:47+02:00. Adds nginx:alpine Dockerfile + docker-compose.yml (Caddy-labels) so the bot runs stand-alone or as a per-customer template clone. Parent monorepo commit: d2c816f3edbc9760802a11b29ff4151c7aad4b46 Bot version: 2026-04-25
This commit is contained in:
Qognio Bot Extract
commit
e679eedcc6
16 changed files with 3922 additions and 0 deletions
7
.dockerignore
Normal file
7
.dockerignore
Normal file
|
|
@ -0,0 +1,7 @@
|
||||||
|
.git
|
||||||
|
.gitignore
|
||||||
|
README.md
|
||||||
|
bot.json
|
||||||
|
src/
|
||||||
|
docker-compose.yml
|
||||||
|
*.md
|
||||||
4
.gitignore
vendored
Normal file
4
.gitignore
vendored
Normal file
|
|
@ -0,0 +1,4 @@
|
||||||
|
.DS_Store
|
||||||
|
*.log
|
||||||
|
*.tmp
|
||||||
|
node_modules/
|
||||||
13
Dockerfile
Normal file
13
Dockerfile
Normal file
|
|
@ -0,0 +1,13 @@
|
||||||
|
# Static-bundle bot — nginx:alpine serves www/ on port 80.
|
||||||
|
FROM nginx:1.27-alpine
|
||||||
|
|
||||||
|
# nginx config: gzip + cache headers + index.html no-store
|
||||||
|
COPY nginx.conf /etc/nginx/conf.d/default.conf
|
||||||
|
|
||||||
|
# Static bundle
|
||||||
|
COPY www/ /usr/share/nginx/html/
|
||||||
|
|
||||||
|
# Run as non-root via nginx's built-in unprivileged image features
|
||||||
|
EXPOSE 80
|
||||||
|
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
|
||||||
|
CMD wget -q --spider http://127.0.0.1/index.html || exit 1
|
||||||
67
README.md
Normal file
67
README.md
Normal file
|
|
@ -0,0 +1,67 @@
|
||||||
|
# KURT — DSGVO+AI-Act Kombi-Auditor
|
||||||
|
|
||||||
|
KURT — der integrierte Compliance-Auditor für DSGVO + EU AI Act. Crosswalk DSFA ↔ RMS, Art. 22 ↔ AI-Act Art. 13/14. Im deutschen Bunker.
|
||||||
|
|
||||||
|
```
|
||||||
|
slug : kurt-compliance-auditor
|
||||||
|
version : 2026-04-25
|
||||||
|
accent : #7c3aed
|
||||||
|
runtime : nginx:alpine (static bundle)
|
||||||
|
template : qognio-bot-template-core (former qognio-bot-widget-template)
|
||||||
|
```
|
||||||
|
|
||||||
|
## Layout
|
||||||
|
|
||||||
|
```
|
||||||
|
.
|
||||||
|
├── src/ source — config.yaml, welcome.html, curricula.json, etc.
|
||||||
|
├── www/ rendered, directly servable static bundle
|
||||||
|
├── Dockerfile nginx:alpine + www/ → port 80
|
||||||
|
├── docker-compose.yml bot-host pattern (Caddy-labels, restart unless-stopped)
|
||||||
|
├── nginx.conf gzip + cache + SPA fallback
|
||||||
|
└── bot.json metadata + parent_core_commit
|
||||||
|
```
|
||||||
|
|
||||||
|
## Run locally
|
||||||
|
|
||||||
|
```bash
|
||||||
|
docker compose up --build
|
||||||
|
# → http://localhost (you'll need to tweak ports for local-only use)
|
||||||
|
```
|
||||||
|
|
||||||
|
## Re-render after upstream core changes
|
||||||
|
|
||||||
|
This repo only stores src + rendered output; the rendering engine lives in
|
||||||
|
`qognio-bot-template-core`. To pull in core changes:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cd /path/to/qognio-bot-template-core
|
||||||
|
./scripts/render.sh kurt-compliance-auditor --bot-repo /path/to/this/repo
|
||||||
|
git -C /path/to/this/repo commit -am "render: refresh from core@<sha>"
|
||||||
|
```
|
||||||
|
|
||||||
|
## Per-customer copy (template usage)
|
||||||
|
|
||||||
|
This repo is a **template**. To clone for a customer:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
git clone <this-repo> my-customer-kurt-compliance-auditor
|
||||||
|
cd my-customer-kurt-compliance-auditor
|
||||||
|
# tweak src/config.yaml (slug, bot_key_value, accent), src/welcome.html, src/curricula.json
|
||||||
|
docker compose -f docker-compose.yml up --build
|
||||||
|
```
|
||||||
|
|
||||||
|
## Deploy to qognio bot-host (.42 LXC pattern — legacy)
|
||||||
|
|
||||||
|
The bot-manager spawns LXC containers named after the slug. Push www/ via:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
ssh fmh@46.243.203.42
|
||||||
|
sudo lxc file push /tmp/www/* kurt-compliance-auditor/var/www/html/
|
||||||
|
```
|
||||||
|
|
||||||
|
(Or run the docker-compose pattern on a Docker host — same network as Caddy.)
|
||||||
|
|
||||||
|
---
|
||||||
|
|
||||||
|
Generated by `qognio-bot-template-core/scripts/extract-to-repo.sh` on 2026-04-29T01:35:47+02:00.
|
||||||
14
bot.json
Normal file
14
bot.json
Normal file
|
|
@ -0,0 +1,14 @@
|
||||||
|
{
|
||||||
|
"slug": "kurt-compliance-auditor",
|
||||||
|
"name": "KURT",
|
||||||
|
"title": "DSGVO+AI-Act Kombi-Auditor",
|
||||||
|
"tagline": "Kombi-Auditor",
|
||||||
|
"description": "KURT — der integrierte Compliance-Auditor für DSGVO + EU AI Act. Crosswalk DSFA ↔ RMS, Art. 22 ↔ AI-Act Art. 13/14. Im deutschen Bunker.",
|
||||||
|
"version": "2026-04-25",
|
||||||
|
"accent": "#7c3aed",
|
||||||
|
"extracted_from": "qognio-bot-widget-template",
|
||||||
|
"parent_core_commit": "d2c816f3edbc9760802a11b29ff4151c7aad4b46",
|
||||||
|
"extracted_at": "2026-04-29T01:35:47+02:00",
|
||||||
|
"runtime": "nginx:alpine",
|
||||||
|
"default_port": 80
|
||||||
|
}
|
||||||
20
docker-compose.yml
Normal file
20
docker-compose.yml
Normal file
|
|
@ -0,0 +1,20 @@
|
||||||
|
# Stand-alone bot container.
|
||||||
|
# Designed for the "caddy" external network on the bot host (qognio pattern).
|
||||||
|
# Override the hostname via SLUG env var if you reuse this template per customer.
|
||||||
|
services:
|
||||||
|
bot:
|
||||||
|
build: .
|
||||||
|
image: qognio/bot-kurt-compliance-auditor:${TAG:-latest}
|
||||||
|
container_name: bot-kurt-compliance-auditor
|
||||||
|
restart: unless-stopped
|
||||||
|
networks:
|
||||||
|
- caddy
|
||||||
|
labels:
|
||||||
|
caddy: "kurt-compliance-auditor.on.qognio.com"
|
||||||
|
caddy.reverse_proxy: "{{upstreams 80}}"
|
||||||
|
qognio.bot.slug: "kurt-compliance-auditor"
|
||||||
|
qognio.bot.version: "2026-04-25"
|
||||||
|
|
||||||
|
networks:
|
||||||
|
caddy:
|
||||||
|
external: true
|
||||||
27
nginx.conf
Normal file
27
nginx.conf
Normal file
|
|
@ -0,0 +1,27 @@
|
||||||
|
server {
|
||||||
|
listen 80;
|
||||||
|
server_name _;
|
||||||
|
root /usr/share/nginx/html;
|
||||||
|
index index.html;
|
||||||
|
|
||||||
|
# gzip
|
||||||
|
gzip on;
|
||||||
|
gzip_vary on;
|
||||||
|
gzip_types text/css application/javascript application/json image/svg+xml text/plain;
|
||||||
|
gzip_min_length 512;
|
||||||
|
|
||||||
|
# index.html: never cache (so welcome screen / wiring updates land instantly)
|
||||||
|
location = /index.html {
|
||||||
|
add_header Cache-Control "no-store, must-revalidate" always;
|
||||||
|
}
|
||||||
|
|
||||||
|
# static assets: cache 1h
|
||||||
|
location ~* \.(?:css|js|json|svg|png|jpe?g|webp|gif|ico|woff2?)$ {
|
||||||
|
add_header Cache-Control "public, max-age=3600" always;
|
||||||
|
try_files $uri =404;
|
||||||
|
}
|
||||||
|
|
||||||
|
location / {
|
||||||
|
try_files $uri $uri/ /index.html;
|
||||||
|
}
|
||||||
|
}
|
||||||
20
src/check-badges.js
Normal file
20
src/check-badges.js
Normal file
|
|
@ -0,0 +1,20 @@
|
||||||
|
// Erste Audit — 1 Quiz im Integrations-Modul (warum DSGVO+AI-Act zusammen)
|
||||||
|
if ((state.moduleCorrect && state.moduleCorrect['integration'] >= 1)) unlockBadge('erste_audit');
|
||||||
|
// DSGVO-Kenner — 5 Quiz in DSGVO-Essenz-Modulen
|
||||||
|
if ((state.moduleCorrect && state.moduleCorrect['dsgvo-essenz'] >= 5)) unlockBadge('dsgvo_kenner');
|
||||||
|
// AI-Act-Kenner — 5 Quiz in AI-Act-Essenz-Modulen
|
||||||
|
if ((state.moduleCorrect && state.moduleCorrect['ai-act-essenz'] >= 5)) unlockBadge('ai_act_kenner');
|
||||||
|
// Crosswalk-Meister — 5 Quiz im Crosswalk-Modul (DSFA <-> RMS)
|
||||||
|
if ((state.moduleCorrect && state.moduleCorrect['crosswalk'] >= 5)) unlockBadge('crosswalk_meister');
|
||||||
|
// Art-22-Pro — 3 Quiz im Art-22-Modul
|
||||||
|
if ((state.moduleCorrect && state.moduleCorrect['art22'] >= 3)) unlockBadge('art22_pro');
|
||||||
|
// Register-Architekt — alle Flashcards des Risikoregister-Moduls bestanden
|
||||||
|
if ((state.modulePassedFlash && state.modulePassedFlash['risikoregister'])) unlockBadge('register_architekt');
|
||||||
|
// KURT-Meister — alle 5 Curricula komplett
|
||||||
|
if ((state.completedCurricula || []).length >= 5) unlockBadge('kurt_meister');
|
||||||
|
// Compliance-Disziplin — 14-Tage-Streak (etwas weicher als Cora's 30, weil KURT-Use-Cases punktuell)
|
||||||
|
if (state.maxStreak >= 14) unlockBadge('streak_14');
|
||||||
|
// Night Owl & Early Bird (beibehalten)
|
||||||
|
const h = new Date().getHours();
|
||||||
|
if (h >= 22) unlockBadge('night_owl');
|
||||||
|
if (h < 7) unlockBadge('early_bird');
|
||||||
39
src/config.yaml
Normal file
39
src/config.yaml
Normal file
|
|
@ -0,0 +1,39 @@
|
||||||
|
slug: kurt-compliance-auditor
|
||||||
|
bot_name: KURT
|
||||||
|
bot_title: DSGVO+AI-Act Kombi-Auditor
|
||||||
|
brand_letter: K
|
||||||
|
title: "KURT · Dein DSGVO+AI-Act Kombi-Auditor"
|
||||||
|
tagline: DSGVO+AI-Act Kombi-Auditor
|
||||||
|
tagline_short: Kombi-Auditor
|
||||||
|
meta_description: "KURT — der integrierte Compliance-Auditor für DSGVO + EU AI Act. Crosswalk DSFA ↔ RMS, Art. 22 ↔ AI-Act Art. 13/14. Im deutschen Bunker."
|
||||||
|
bot_key_var: __KURT_KEY__
|
||||||
|
bot_key_value: qb_ea1d0b1e8bbe
|
||||||
|
ls_prefix: kurt
|
||||||
|
bot_version: "2026-04-25"
|
||||||
|
|
||||||
|
# Color theme — deep violet, distinct from Luna (#a855f7) and Cora (#059669).
|
||||||
|
# Symbolisiert die Brücke zwischen DSGVO (grün/Cora) und AI-Act (cyan/Kai).
|
||||||
|
accent: "#7c3aed"
|
||||||
|
accent_2: "#a78bfa"
|
||||||
|
accent_dark: "#5b21b6"
|
||||||
|
accent_rgb: "124, 58, 237"
|
||||||
|
accent_rgb_compact: "124,58,237"
|
||||||
|
success_color: "#22c55e"
|
||||||
|
msg_strong_color: "#ddd6fe"
|
||||||
|
|
||||||
|
# UI Labels
|
||||||
|
tab_flash_label: Karten
|
||||||
|
tab_curriculum_label: Module
|
||||||
|
curriculum_long_label: Crosswalk-Atlas
|
||||||
|
|
||||||
|
# Bot-personality strings
|
||||||
|
quiz_intro_hint: "Wähle ein Modul — KURT generiert Szenario-Fragen aus dem Compliance-Alltag."
|
||||||
|
quiz_verb: erstellt
|
||||||
|
quiz_noun: "Audit-Szenarien"
|
||||||
|
flash_intro_hint: "Karteikarten zu Artikeln, Crosswalks, Risiko-Klassen — mit Spaced-Repetition."
|
||||||
|
flash_verb: generiert
|
||||||
|
|
||||||
|
# Levels-fallback, welcome.html, check-badges.js are sibling files
|
||||||
|
# in this directory — render.sh injects their full contents into the
|
||||||
|
# corresponding {{LEVELS_FALLBACK}}, {{WELCOME_HTML}}, {{CHECK_BADGES_BODY}}
|
||||||
|
# placeholders verbatim.
|
||||||
382
src/curricula.json
Normal file
382
src/curricula.json
Normal file
|
|
@ -0,0 +1,382 @@
|
||||||
|
{
|
||||||
|
"version": "2026-04-25",
|
||||||
|
"updated": "2026-04-25",
|
||||||
|
"curricula": [
|
||||||
|
{
|
||||||
|
"id": "warum-integrieren",
|
||||||
|
"title": "1 · Warum integrieren",
|
||||||
|
"short": "Warum DSGVO + AI Act zusammen denken",
|
||||||
|
"icon": "shuffle",
|
||||||
|
"color": "#7c3aed",
|
||||||
|
"description": "Beide Verordnungen gelten parallel — keine ersetzt die andere. Die drei klassischen Doppelarbeits-Hotspots: DSFA <-> RMS, Art. 22 <-> AI-Act Art. 13/14, Daten-Governance <-> Art. 10. Zielbild: ein integriertes Risiko-Register.",
|
||||||
|
"source_md": "00-warum-integrieren.md",
|
||||||
|
"modules": [
|
||||||
|
{
|
||||||
|
"id": "integration",
|
||||||
|
"title": "Warum überhaupt integrieren?",
|
||||||
|
"objectives": [
|
||||||
|
"Verstehen, warum DSGVO und AI Act parallel gelten",
|
||||||
|
"Die expliziten Verweise des AI Act auf die DSGVO benennen",
|
||||||
|
"Die drei Doppelarbeits-Hotspots identifizieren"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 2 Abs. 7 AI Act", "Art. 26 Abs. 9 AI Act", "Erwägungsgrund 9", "Doppelarbeit"],
|
||||||
|
"difficulty": "einfach",
|
||||||
|
"source_heading": "Warum es einen integrierten Auditor braucht"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "begriffsklaerung",
|
||||||
|
"title": "Begriffsklärung — Anbieter vs. Betreiber",
|
||||||
|
"objectives": [
|
||||||
|
"Anbieter (Provider) vs. Betreiber (Deployer) sicher abgrenzen",
|
||||||
|
"DSGVO-Verantwortlicher vs. Auftragsverarbeiter zuordnen",
|
||||||
|
"Mehrere Rollen pro Unternehmen: typische Konstellationen"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 3 AI Act", "Art. 4 DSGVO", "Inverkehrbringen", "Inbetriebnahme"],
|
||||||
|
"difficulty": "mittel",
|
||||||
|
"source_heading": "Persönlicher Anwendungsbereich"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "rollen-konflikte",
|
||||||
|
"title": "Rollen-Konflikte: DSB & AI-Officer",
|
||||||
|
"objectives": [
|
||||||
|
"DSB als Pflichtberuf nach DSGVO Art. 37 verstehen",
|
||||||
|
"AI-Officer als organisatorische Notwendigkeit (kein Pflichtberuf)",
|
||||||
|
"Personalunion möglich, Interessenskonflikt prüfen"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 37 DSGVO", "Art. 38 DSGVO", "Personalunion", "Interessenkonflikt"],
|
||||||
|
"difficulty": "mittel",
|
||||||
|
"source_heading": "Rollen klären"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "zielbild-register",
|
||||||
|
"title": "Zielbild: ein integriertes Risiko-Register",
|
||||||
|
"objectives": [
|
||||||
|
"Single-Source-of-Truth-Logik verstehen",
|
||||||
|
"Verarbeitungsverzeichnis + Bestands-Inventar verschmelzen",
|
||||||
|
"Quartals-Review-Rhythmus etablieren"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 30 DSGVO", "Art. 11 AI Act", "Inventar", "Review-Rhythmus"],
|
||||||
|
"difficulty": "einfach",
|
||||||
|
"source_heading": "Zielbild: ein integriertes Risiko-Register"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "dsgvo-fuer-ai-leute",
|
||||||
|
"title": "2 · DSGVO-Essenz für AI-Profis",
|
||||||
|
"short": "Art. 5, 6, 9, 22, 25, 32, 35 in der AI-Übersetzung",
|
||||||
|
"icon": "shield",
|
||||||
|
"color": "#a78bfa",
|
||||||
|
"description": "Für AI-Officer, Data-Scientists, ML-Engineers: das Pflicht-Set DSGVO. Die 7 wichtigsten Artikel mit AI-Bezug, Art. 9 für Bias-Audits, Privacy by Design im Pipeline-Kontext.",
|
||||||
|
"source_md": "01-dsgvo-essenz-fuer-ai-leute.md",
|
||||||
|
"modules": [
|
||||||
|
{
|
||||||
|
"id": "dsgvo-essenz",
|
||||||
|
"title": "Die 7 Pflicht-Artikel (Art. 5/6/9/22/25/32/35)",
|
||||||
|
"objectives": [
|
||||||
|
"Alle 7 Artikel benennen und in AI-Pipelines einordnen",
|
||||||
|
"Art. 22 als direkten AI-DSGVO-Hotspot erkennen",
|
||||||
|
"Art. 9 als Bias-Audit-Stolperfalle verstehen"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 5", "Art. 6", "Art. 9", "Art. 22", "Art. 25", "Art. 32", "Art. 35"],
|
||||||
|
"difficulty": "mittel",
|
||||||
|
"source_heading": "Die 7 Artikel, die für AI immer relevant sind"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "grundsaetze-ai",
|
||||||
|
"title": "Art. 5 Grundsätze in AI-Übersetzung",
|
||||||
|
"objectives": [
|
||||||
|
"Zweckbindung in Trainings- vs. Inferenz-Phase trennen",
|
||||||
|
"Datenminimierung als Modell-Verbesserer (nicht nur Pflicht)",
|
||||||
|
"Speicherbegrenzung inkl. gelernter Repräsentationen"
|
||||||
|
],
|
||||||
|
"topics": ["Zweckbindung", "Datenminimierung", "Speicherbegrenzung", "Embeddings"],
|
||||||
|
"difficulty": "schwer",
|
||||||
|
"source_heading": "Art. 5 — die 7 Grundsätze in der AI-Übersetzung"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "rechtsgrundlagen-ai",
|
||||||
|
"title": "Art. 6 Rechtsgrundlagen für AI-Pipelines",
|
||||||
|
"objectives": [
|
||||||
|
"Eine Grundlage für Training, eine andere für Inferenz wählen können",
|
||||||
|
"Berechtigtes Interesse + LIA für Modell-Training begründen",
|
||||||
|
"Einwilligung im Beschäftigtenverhältnis kritisch prüfen"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 6 lit. a-f", "LIA", "Beschäftigtenverhältnis", "vorvertraglich"],
|
||||||
|
"difficulty": "schwer",
|
||||||
|
"source_heading": "Art. 6 — die 6 Rechtsgrundlagen im AI-Kontext"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "art9-bias",
|
||||||
|
"title": "Art. 9 + Bias-Audit-Dilemma",
|
||||||
|
"objectives": [
|
||||||
|
"Besondere Kategorien benennen (Gesundheit, Ethnie, Religion, etc.)",
|
||||||
|
"Verbots-Logik mit Ausnahmen Abs. 2 verstehen",
|
||||||
|
"AI Act Art. 10 Abs. 5 als zusätzliche Erlaubnis-Norm einsetzen"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 9 Abs. 1+2", "Bias-Audit", "Art. 10 Abs. 5 AI Act", "Pseudonymisierung"],
|
||||||
|
"difficulty": "schwer",
|
||||||
|
"source_heading": "Art. 9 — besondere Kategorien"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "privacy-by-design-ai",
|
||||||
|
"title": "Art. 25 Privacy by Design in AI-Architektur",
|
||||||
|
"objectives": [
|
||||||
|
"Default kein PII in Embeddings (DP, Anonymisierung)",
|
||||||
|
"Multi-Tenant-Isolation in Federated-Learning-Setups",
|
||||||
|
"Kürzeste Retention als Default-Konfiguration"
|
||||||
|
],
|
||||||
|
"topics": ["Differential Privacy", "Federated Learning", "Retention", "Default"],
|
||||||
|
"difficulty": "schwer",
|
||||||
|
"source_heading": "Art. 25 — Privacy by Design + Default"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "ai-act-fuer-dsb",
|
||||||
|
"title": "3 · AI-Act-Essenz für DSB",
|
||||||
|
"short": "Risiko-Klassen, Anhang III, Art. 9-15, Konformität",
|
||||||
|
"icon": "scale",
|
||||||
|
"color": "#06b6d4",
|
||||||
|
"description": "Für klassische DSB: das Pflicht-Set EU AI Act. Vier Risiko-Klassen, Anhang III als Hochrisiko-Liste (HR-Filter, Bonität, Bildung), die RMS-Familie Art. 9-15, Konformitätsbewertung + CE.",
|
||||||
|
"source_md": "02-ai-act-essenz-fuer-dsb.md",
|
||||||
|
"modules": [
|
||||||
|
{
|
||||||
|
"id": "ai-act-essenz",
|
||||||
|
"title": "Die 4 Risiko-Klassen + GPAI",
|
||||||
|
"objectives": [
|
||||||
|
"Verboten / Hochrisiko / Limitiert / Minimal sicher zuordnen",
|
||||||
|
"GPAI als eigene Säule erkennen (Art. 51-56)",
|
||||||
|
"Stichtag-Logik bis 02.08.2027 verstehen"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 5", "Art. 6", "Art. 50", "Anhang III", "GPAI", "Timeline"],
|
||||||
|
"difficulty": "einfach",
|
||||||
|
"source_heading": "Die vier Risiko-Klassen"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "anhang-iii",
|
||||||
|
"title": "Anhang III — wo Mittelständler hängenbleiben",
|
||||||
|
"objectives": [
|
||||||
|
"HR-Bewerber-Filter als Hochrisiko erkennen",
|
||||||
|
"Bonitäts-Scoring + Versicherungs-Risiko korrekt einordnen",
|
||||||
|
"Bildungs-AI (Prüfungs-Auswertung etc.) als Hochrisiko"
|
||||||
|
],
|
||||||
|
"topics": ["Beschäftigung", "Bildung", "Bonität", "Kritische Infrastruktur"],
|
||||||
|
"difficulty": "mittel",
|
||||||
|
"source_heading": "Anhang III — wo die meisten Mittelständler hängen bleiben"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "rms-familie",
|
||||||
|
"title": "RMS-Familie Art. 9-15",
|
||||||
|
"objectives": [
|
||||||
|
"Art. 9 RMS, Art. 10 Daten, Art. 11 Doku, Art. 12 Logging",
|
||||||
|
"Art. 13 Transparenz, Art. 14 Aufsicht, Art. 15 Robustheit benennen",
|
||||||
|
"Verbindung zu DSGVO-Pendants herstellen"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 9", "Art. 10", "Art. 11", "Art. 12", "Art. 13", "Art. 14", "Art. 15"],
|
||||||
|
"difficulty": "mittel",
|
||||||
|
"source_heading": "Die Pflichten für Hochrisiko-Systeme"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "konformitaet-ce",
|
||||||
|
"title": "Konformitätsbewertung + CE-Kennzeichnung",
|
||||||
|
"objectives": [
|
||||||
|
"Anhang VI (interne Kontrolle) vs. Anhang VII (Notified Body)",
|
||||||
|
"CE-Kennzeichnung + EU-Konformitätserklärung + EU-Datenbank",
|
||||||
|
"10-Jahre-Aufbewahrung der Tech-Doku"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 43", "Art. 47", "Art. 48", "Art. 49", "Anhang VI/VII", "Notified Body"],
|
||||||
|
"difficulty": "schwer",
|
||||||
|
"source_heading": "Konformitätsbewertung & CE-Kennzeichnung"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "betreiber-pflichten",
|
||||||
|
"title": "Betreiber-Pflichten Art. 26",
|
||||||
|
"objectives": [
|
||||||
|
"Anbieter-Anweisungen befolgen, Eingangs-Daten qualitätssichern",
|
||||||
|
"Menschliche Aufsicht: qualifiziertes Personal sicherstellen",
|
||||||
|
"Art. 26 Abs. 9: DSFA durchführen — direkter DSGVO-Hook!"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 26", "Eingangs-Datenqualität", "Aufsicht", "Vorfalls-Meldung"],
|
||||||
|
"difficulty": "mittel",
|
||||||
|
"source_heading": "Pflichten der Betreiber"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "sanktionen-ai",
|
||||||
|
"title": "Sanktionen Art. 99 + AI-Literacy Art. 4",
|
||||||
|
"objectives": [
|
||||||
|
"Verbotene Praxis: bis 35 Mio. € / 7 % Umsatz",
|
||||||
|
"Andere Pflichten: bis 15 Mio. € / 3 %",
|
||||||
|
"AI-Literacy-Pflicht seit 02.02.2025 für ALLE Anwender"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 99", "Art. 4 AI-Literacy", "02.02.2025", "Schulung"],
|
||||||
|
"difficulty": "einfach",
|
||||||
|
"source_heading": "Sanktionen"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "hotspots",
|
||||||
|
"title": "4 · Crosswalks + Hotspots",
|
||||||
|
"short": "DSFA <-> RMS, Art. 22 <-> AI-Act, Daten-Governance",
|
||||||
|
"icon": "git-branch",
|
||||||
|
"color": "#5b21b6",
|
||||||
|
"description": "Die drei zentralen Crosswalks: Art. 35 DSFA <-> Art. 9 RMS (was überlappt, was ist neu), Art. 22 DSGVO <-> AI-Act Art. 13/14 (EuGH Schufa!), Art. 5/9 DSGVO <-> Art. 10 AI Act (Bias-Audit-Dilemma).",
|
||||||
|
"source_md": "03-crosswalk-art35-dsfa-vs-art9-rms.md",
|
||||||
|
"modules": [
|
||||||
|
{
|
||||||
|
"id": "crosswalk",
|
||||||
|
"title": "DSFA (Art. 35) <-> RMS (Art. 9)",
|
||||||
|
"objectives": [
|
||||||
|
"Sechs gemeinsame Risk-Engineering-Schritte erkennen",
|
||||||
|
"Vier neue RMS-Dimensionen (Lifecycle, Drift, Oversight, FRIA)",
|
||||||
|
"Drei DSFA-only Sektionen (DSB-Konsultation, Aufsichtsbehörde, Betroffenenrechte)"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 35", "Art. 9", "Lifecycle", "FRIA", "Drift-Monitoring"],
|
||||||
|
"difficulty": "schwer",
|
||||||
|
"source_heading": "Die große Überlappung"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "art22",
|
||||||
|
"title": "Art. 22 <-> AI-Act Art. 13/14",
|
||||||
|
"objectives": [
|
||||||
|
"Drei Tatbestandsmerkmale Art. 22 erkennen",
|
||||||
|
"EuGH Schufa (C-634/21) verstehen — abgesenkte Schwelle",
|
||||||
|
"Substanzielle menschliche Aufsicht (Art. 14) operationalisieren"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 22 Abs. 1+3", "EuGH Schufa", "Art. 13", "Art. 14", "Recht auf Erklärung Art. 86"],
|
||||||
|
"difficulty": "schwer",
|
||||||
|
"source_heading": "Was Art. 22 DSGVO sagt"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "art10-daten",
|
||||||
|
"title": "Art. 5 + 9 DSGVO <-> Art. 10 AI Act",
|
||||||
|
"objectives": [
|
||||||
|
"Datenqualität gleichzeitig DSGVO + AI-Act-Pflicht",
|
||||||
|
"Art. 10 Abs. 5 als eigenständige Erlaubnis-Norm für Bias-Tests",
|
||||||
|
"Membership-Inference: Modell-Gewichte als personenbezogene Daten"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 10 AI Act", "Bias-Test-Erlaubnis", "Membership Inference", "Provenance"],
|
||||||
|
"difficulty": "schwer",
|
||||||
|
"source_heading": "Crosswalk-Tabelle Daten-Pflichten"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "tom-konformitaet",
|
||||||
|
"title": "TOMs (Art. 32) <-> Konformität (Art. 43+)",
|
||||||
|
"objectives": [
|
||||||
|
"Doppelnutzbare Maßnahmen identifizieren (Verschlüsselung, Logging)",
|
||||||
|
"AI-only Maßnahmen ergänzen (Drift, Bias, Adversarial)",
|
||||||
|
"Eine Maßnahmen-Datenbank, zwei Doku-Stränge"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 32", "Art. 43", "Anhang IV", "Maßnahmen-DB"],
|
||||||
|
"difficulty": "mittel",
|
||||||
|
"source_heading": "Crosswalk: Sicherheits-Maßnahmen"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "behoerden-mapping",
|
||||||
|
"title": "DPAs <-> Marktüberwachung",
|
||||||
|
"objectives": [
|
||||||
|
"Doppelmeldung bei Vorfall: Art. 33 DSGVO + Art. 73 AI Act",
|
||||||
|
"Behörden-Architektur DE in Übergangsphase",
|
||||||
|
"Strengere Anforderung erfüllen bei divergierenden Auslegungen"
|
||||||
|
],
|
||||||
|
"topics": ["BfDI", "Landes-DPA", "BNetzA", "AI Office", "Doppelmeldung"],
|
||||||
|
"difficulty": "mittel",
|
||||||
|
"source_heading": "Crosswalk: Wer für was zuständig"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "praxis-register",
|
||||||
|
"title": "5 · Risikoregister + Praxis-Workflow",
|
||||||
|
"short": "Integriertes Inventar + Vorfalls-Workflow + FAQ",
|
||||||
|
"icon": "list-checks",
|
||||||
|
"color": "#22c55e",
|
||||||
|
"description": "Der Praxis-Teil: integriertes System-Inventar als SSoT, Vorfalls-Meldeprozess mit zwei Strecken, typische DSB+AI-Officer-Praxis-Fragen.",
|
||||||
|
"source_md": "08-template-integriertes-risikoregister.md",
|
||||||
|
"modules": [
|
||||||
|
{
|
||||||
|
"id": "risikoregister",
|
||||||
|
"title": "Integriertes Risikoregister aufsetzen",
|
||||||
|
"objectives": [
|
||||||
|
"Mindest-Spalten-Set anwenden",
|
||||||
|
"Crosswalk-Einsparungen pro System dokumentieren",
|
||||||
|
"Quartals-Review + Trigger-basierte Updates etablieren"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 30 DSGVO", "Art. 11 AI Act", "SSoT", "Quartals-Review"],
|
||||||
|
"difficulty": "mittel",
|
||||||
|
"source_heading": "Spalten-Definition"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "beispiel-hr",
|
||||||
|
"title": "Beispiel HR-Bewerber-Filter — Ende-zu-Ende",
|
||||||
|
"objectives": [
|
||||||
|
"Klassifikation Hochrisiko + Art. 22-Check parallel",
|
||||||
|
"DSFA + RMS + Tech-Doku als integriertes Paket",
|
||||||
|
"Vendor-Vertrag mit AI-Act-Anbieter-Pflichten-Klausel"
|
||||||
|
],
|
||||||
|
"topics": ["HR-Filter", "DSFA", "RMS", "Vendor-AVV"],
|
||||||
|
"difficulty": "schwer",
|
||||||
|
"source_heading": "Beispiel-Eintrag: HR-Bewerbungsfilter"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "vorfalls-prozess",
|
||||||
|
"title": "Integrierter Vorfalls-Meldeprozess",
|
||||||
|
"objectives": [
|
||||||
|
"DSGVO Art. 33 (72h) + AI Act Art. 73 (unverzüglich) parallel",
|
||||||
|
"Trigger-Erkennung gemeinsam, Klassifizierung getrennt",
|
||||||
|
"Gemeinsame Vorfalls-Doku mit zwei Anhängen"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 33", "Art. 34", "Art. 73", "Frühwarn-System"],
|
||||||
|
"difficulty": "mittel",
|
||||||
|
"source_heading": "Doppelmeldung bei Vorfällen"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "ai-literacy",
|
||||||
|
"title": "AI-Literacy + Schulungs-Konzept",
|
||||||
|
"objectives": [
|
||||||
|
"Art. 4 AI Act seit 02.02.2025 als Pflicht für ALLE Anwender",
|
||||||
|
"Rollen-spezifische Schulungs-Curricula",
|
||||||
|
"Schulungs-Doku als TOM (DSGVO Art. 32) zweitnutzen"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 4 AI Act", "Schulung", "Rollen", "TOM"],
|
||||||
|
"difficulty": "einfach",
|
||||||
|
"source_heading": "AI-Literacy übersehen"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "faq-praxis",
|
||||||
|
"title": "Praxis-FAQ DSB & AI-Officer",
|
||||||
|
"objectives": [
|
||||||
|
"Typische Personalunion-Frage beantworten",
|
||||||
|
"ChatGPT-für-HR-Sichtung-Falle erkennen",
|
||||||
|
"Membership-Inference + Lösch-Anfragen einordnen"
|
||||||
|
],
|
||||||
|
"topics": ["Personalunion", "ChatGPT-HR", "Lösch-Anfrage", "Modell-Gewichte"],
|
||||||
|
"difficulty": "mittel",
|
||||||
|
"source_heading": "Häufige Fragen"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"badges": [
|
||||||
|
{"id": "erste_audit", "title": "Erste Audit", "icon": "shuffle", "description": "1. Quiz im Integrations-Modul erfolgreich — du hast den Crosswalk-Gedanken verinnerlicht."},
|
||||||
|
{"id": "dsgvo_kenner", "title": "DSGVO-Kenner", "icon": "shield", "description": "5 Quiz im DSGVO-Essenz-Modul korrekt — die 7 Pflicht-Artikel sitzen."},
|
||||||
|
{"id": "ai_act_kenner", "title": "AI-Act-Kenner", "icon": "scale", "description": "5 Quiz im AI-Act-Essenz-Modul korrekt — Risiko-Klassen + Anhang III sitzen."},
|
||||||
|
{"id": "crosswalk_meister", "title": "Crosswalk-Meister", "icon": "git-branch", "description": "5 Quiz im Crosswalk-Modul korrekt — DSFA <-> RMS-Mapping sitzt."},
|
||||||
|
{"id": "art22_pro", "title": "Art-22-Pro", "icon": "user-check", "description": "3 Quiz im Art-22-Modul korrekt — automatisierte Einzelentscheidungen sicher einordnen."},
|
||||||
|
{"id": "register_architekt", "title": "Register-Architekt", "icon": "list-checks", "description": "Alle Flashcards des Risikoregister-Moduls bestanden — SSoT-Konzept verinnerlicht."},
|
||||||
|
{"id": "kurt_meister", "title": "KURT-Meister", "icon": "crown", "description": "Alle 5 Curricula mit >=80% abgeschlossen — DSGVO+AI-Act parallel im Griff."},
|
||||||
|
{"id": "streak_14", "title": "14-Tage-Streak", "icon": "flame", "description": "14 Tage in Folge aktiv — Compliance-Disziplin sichtbar."},
|
||||||
|
{"id": "night_owl", "title": "Nachteule", "icon": "moon", "description": "Nach 22 Uhr gelernt."},
|
||||||
|
{"id": "early_bird", "title": "Frühaufsteher", "icon": "sun", "description": "Vor 7 Uhr gelernt."}
|
||||||
|
],
|
||||||
|
"levels": [
|
||||||
|
{"min": 0, "title": "Compliance-Lernende"},
|
||||||
|
{"min": 50, "title": "DSB-Junior"},
|
||||||
|
{"min": 200, "title": "DSB / AI-Officer"},
|
||||||
|
{"min": 500, "title": "Senior-DSB / Senior-AI-Officer"},
|
||||||
|
{"min": 1250, "title": "Compliance-Lead"},
|
||||||
|
{"min": 2500, "title": "Chief Compliance Officer"},
|
||||||
|
{"min": 5000, "title": "Aufsichtsbehörde-Veteran"}
|
||||||
|
]
|
||||||
|
}
|
||||||
4
src/levels-fallback.js
Normal file
4
src/levels-fallback.js
Normal file
|
|
@ -0,0 +1,4 @@
|
||||||
|
{ min: 0, title: 'Compliance-Lernende' }, { min: 50, title: 'DSB-Junior' },
|
||||||
|
{ min: 200, title: 'DSB / AI-Officer' }, { min: 500, title: 'Senior-DSB / Senior-AI-Officer' },
|
||||||
|
{ min: 1250, title: 'Compliance-Lead' }, { min: 2500, title: 'Chief Compliance Officer' },
|
||||||
|
{ min: 5000, title: 'Aufsichtsbehörde-Veteran' }
|
||||||
29
src/welcome.html
Normal file
29
src/welcome.html
Normal file
|
|
@ -0,0 +1,29 @@
|
||||||
|
<h2>Hi, ich bin KURT.</h2>
|
||||||
|
<p>Ich nehm dir die Doppelarbeit zwischen <strong>DSGVO</strong> und <strong>EU AI Act</strong> ab — Crosswalk statt Excel-Hölle. Beide Regimes parallel, ohne dass du dieselbe Risiko-Bewertung zweimal schreibst. Sag mir: was treibt dich gerade — DSFA-Update, AI-System-Klassifikation, Audit-Vorbereitung? Erstmal die grobe Lage, dann gehen wir tief.</p>
|
||||||
|
<div class="mode-grid">
|
||||||
|
<button class="mode-card" data-goto="chat">
|
||||||
|
<strong>Chat</strong>
|
||||||
|
<span>Frag mich alles zu DSGVO + AI Act Schnittstellen.</span>
|
||||||
|
</button>
|
||||||
|
<button class="mode-card" data-goto="quiz">
|
||||||
|
<strong>Quiz</strong>
|
||||||
|
<span>Audit-Szenarien aus dem Compliance-Alltag, mit XP.</span>
|
||||||
|
</button>
|
||||||
|
<button class="mode-card" data-goto="flash">
|
||||||
|
<strong>Flashcards</strong>
|
||||||
|
<span>Artikel, Crosswalks, Risiko-Klassen — mit Spaced-Repetition.</span>
|
||||||
|
</button>
|
||||||
|
<button class="mode-card" data-goto="progress">
|
||||||
|
<strong>Fortschritt</strong>
|
||||||
|
<span>XP, Streaks, Badges, Level.</span>
|
||||||
|
</button>
|
||||||
|
<button class="mode-card" data-goto="curriculum">
|
||||||
|
<strong>Module</strong>
|
||||||
|
<span>5 Curricula / 25 Module: Integration · DSGVO-Essenz · AI-Act-Essenz · Hotspots · Risikoregister.</span>
|
||||||
|
</button>
|
||||||
|
<button class="mode-card" data-prompt="AUDIT_REQUEST: Mein KI-System ist [Use-Case]. Klassifiziere DSGVO + AI-Act + erforderliche Artefakte.">
|
||||||
|
<strong>Audit-Klassifikation</strong>
|
||||||
|
<span><code>AUDIT_REQUEST</code> + Use-Case → DSGVO + AI-Act-Klassifikation mit Artefakt-Liste als Karte.</span>
|
||||||
|
</button>
|
||||||
|
</div>
|
||||||
|
<p style="font-size:.82rem;color:var(--text-mute)">Drei Sätze: Klassifizier dein AI-System (DSGVO + AI Act parallel) → Lass dir Crosswalk-Mapping erklären → Verstehe wo Doppelarbeit vermeidbar ist. KURT ist der Brückenbauer — DSGVO-tief? Ruf Cora. AI-Act-Audit-Tiefe? Ruf VESTIGIA.</p>
|
||||||
1751
www/app.js
Normal file
1751
www/app.js
Normal file
File diff suppressed because it is too large
Load diff
382
www/curricula.json
Normal file
382
www/curricula.json
Normal file
|
|
@ -0,0 +1,382 @@
|
||||||
|
{
|
||||||
|
"version": "2026-04-25",
|
||||||
|
"updated": "2026-04-25",
|
||||||
|
"curricula": [
|
||||||
|
{
|
||||||
|
"id": "warum-integrieren",
|
||||||
|
"title": "1 · Warum integrieren",
|
||||||
|
"short": "Warum DSGVO + AI Act zusammen denken",
|
||||||
|
"icon": "shuffle",
|
||||||
|
"color": "#7c3aed",
|
||||||
|
"description": "Beide Verordnungen gelten parallel — keine ersetzt die andere. Die drei klassischen Doppelarbeits-Hotspots: DSFA <-> RMS, Art. 22 <-> AI-Act Art. 13/14, Daten-Governance <-> Art. 10. Zielbild: ein integriertes Risiko-Register.",
|
||||||
|
"source_md": "00-warum-integrieren.md",
|
||||||
|
"modules": [
|
||||||
|
{
|
||||||
|
"id": "integration",
|
||||||
|
"title": "Warum überhaupt integrieren?",
|
||||||
|
"objectives": [
|
||||||
|
"Verstehen, warum DSGVO und AI Act parallel gelten",
|
||||||
|
"Die expliziten Verweise des AI Act auf die DSGVO benennen",
|
||||||
|
"Die drei Doppelarbeits-Hotspots identifizieren"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 2 Abs. 7 AI Act", "Art. 26 Abs. 9 AI Act", "Erwägungsgrund 9", "Doppelarbeit"],
|
||||||
|
"difficulty": "einfach",
|
||||||
|
"source_heading": "Warum es einen integrierten Auditor braucht"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "begriffsklaerung",
|
||||||
|
"title": "Begriffsklärung — Anbieter vs. Betreiber",
|
||||||
|
"objectives": [
|
||||||
|
"Anbieter (Provider) vs. Betreiber (Deployer) sicher abgrenzen",
|
||||||
|
"DSGVO-Verantwortlicher vs. Auftragsverarbeiter zuordnen",
|
||||||
|
"Mehrere Rollen pro Unternehmen: typische Konstellationen"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 3 AI Act", "Art. 4 DSGVO", "Inverkehrbringen", "Inbetriebnahme"],
|
||||||
|
"difficulty": "mittel",
|
||||||
|
"source_heading": "Persönlicher Anwendungsbereich"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "rollen-konflikte",
|
||||||
|
"title": "Rollen-Konflikte: DSB & AI-Officer",
|
||||||
|
"objectives": [
|
||||||
|
"DSB als Pflichtberuf nach DSGVO Art. 37 verstehen",
|
||||||
|
"AI-Officer als organisatorische Notwendigkeit (kein Pflichtberuf)",
|
||||||
|
"Personalunion möglich, Interessenskonflikt prüfen"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 37 DSGVO", "Art. 38 DSGVO", "Personalunion", "Interessenkonflikt"],
|
||||||
|
"difficulty": "mittel",
|
||||||
|
"source_heading": "Rollen klären"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "zielbild-register",
|
||||||
|
"title": "Zielbild: ein integriertes Risiko-Register",
|
||||||
|
"objectives": [
|
||||||
|
"Single-Source-of-Truth-Logik verstehen",
|
||||||
|
"Verarbeitungsverzeichnis + Bestands-Inventar verschmelzen",
|
||||||
|
"Quartals-Review-Rhythmus etablieren"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 30 DSGVO", "Art. 11 AI Act", "Inventar", "Review-Rhythmus"],
|
||||||
|
"difficulty": "einfach",
|
||||||
|
"source_heading": "Zielbild: ein integriertes Risiko-Register"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "dsgvo-fuer-ai-leute",
|
||||||
|
"title": "2 · DSGVO-Essenz für AI-Profis",
|
||||||
|
"short": "Art. 5, 6, 9, 22, 25, 32, 35 in der AI-Übersetzung",
|
||||||
|
"icon": "shield",
|
||||||
|
"color": "#a78bfa",
|
||||||
|
"description": "Für AI-Officer, Data-Scientists, ML-Engineers: das Pflicht-Set DSGVO. Die 7 wichtigsten Artikel mit AI-Bezug, Art. 9 für Bias-Audits, Privacy by Design im Pipeline-Kontext.",
|
||||||
|
"source_md": "01-dsgvo-essenz-fuer-ai-leute.md",
|
||||||
|
"modules": [
|
||||||
|
{
|
||||||
|
"id": "dsgvo-essenz",
|
||||||
|
"title": "Die 7 Pflicht-Artikel (Art. 5/6/9/22/25/32/35)",
|
||||||
|
"objectives": [
|
||||||
|
"Alle 7 Artikel benennen und in AI-Pipelines einordnen",
|
||||||
|
"Art. 22 als direkten AI-DSGVO-Hotspot erkennen",
|
||||||
|
"Art. 9 als Bias-Audit-Stolperfalle verstehen"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 5", "Art. 6", "Art. 9", "Art. 22", "Art. 25", "Art. 32", "Art. 35"],
|
||||||
|
"difficulty": "mittel",
|
||||||
|
"source_heading": "Die 7 Artikel, die für AI immer relevant sind"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "grundsaetze-ai",
|
||||||
|
"title": "Art. 5 Grundsätze in AI-Übersetzung",
|
||||||
|
"objectives": [
|
||||||
|
"Zweckbindung in Trainings- vs. Inferenz-Phase trennen",
|
||||||
|
"Datenminimierung als Modell-Verbesserer (nicht nur Pflicht)",
|
||||||
|
"Speicherbegrenzung inkl. gelernter Repräsentationen"
|
||||||
|
],
|
||||||
|
"topics": ["Zweckbindung", "Datenminimierung", "Speicherbegrenzung", "Embeddings"],
|
||||||
|
"difficulty": "schwer",
|
||||||
|
"source_heading": "Art. 5 — die 7 Grundsätze in der AI-Übersetzung"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "rechtsgrundlagen-ai",
|
||||||
|
"title": "Art. 6 Rechtsgrundlagen für AI-Pipelines",
|
||||||
|
"objectives": [
|
||||||
|
"Eine Grundlage für Training, eine andere für Inferenz wählen können",
|
||||||
|
"Berechtigtes Interesse + LIA für Modell-Training begründen",
|
||||||
|
"Einwilligung im Beschäftigtenverhältnis kritisch prüfen"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 6 lit. a-f", "LIA", "Beschäftigtenverhältnis", "vorvertraglich"],
|
||||||
|
"difficulty": "schwer",
|
||||||
|
"source_heading": "Art. 6 — die 6 Rechtsgrundlagen im AI-Kontext"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "art9-bias",
|
||||||
|
"title": "Art. 9 + Bias-Audit-Dilemma",
|
||||||
|
"objectives": [
|
||||||
|
"Besondere Kategorien benennen (Gesundheit, Ethnie, Religion, etc.)",
|
||||||
|
"Verbots-Logik mit Ausnahmen Abs. 2 verstehen",
|
||||||
|
"AI Act Art. 10 Abs. 5 als zusätzliche Erlaubnis-Norm einsetzen"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 9 Abs. 1+2", "Bias-Audit", "Art. 10 Abs. 5 AI Act", "Pseudonymisierung"],
|
||||||
|
"difficulty": "schwer",
|
||||||
|
"source_heading": "Art. 9 — besondere Kategorien"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "privacy-by-design-ai",
|
||||||
|
"title": "Art. 25 Privacy by Design in AI-Architektur",
|
||||||
|
"objectives": [
|
||||||
|
"Default kein PII in Embeddings (DP, Anonymisierung)",
|
||||||
|
"Multi-Tenant-Isolation in Federated-Learning-Setups",
|
||||||
|
"Kürzeste Retention als Default-Konfiguration"
|
||||||
|
],
|
||||||
|
"topics": ["Differential Privacy", "Federated Learning", "Retention", "Default"],
|
||||||
|
"difficulty": "schwer",
|
||||||
|
"source_heading": "Art. 25 — Privacy by Design + Default"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "ai-act-fuer-dsb",
|
||||||
|
"title": "3 · AI-Act-Essenz für DSB",
|
||||||
|
"short": "Risiko-Klassen, Anhang III, Art. 9-15, Konformität",
|
||||||
|
"icon": "scale",
|
||||||
|
"color": "#06b6d4",
|
||||||
|
"description": "Für klassische DSB: das Pflicht-Set EU AI Act. Vier Risiko-Klassen, Anhang III als Hochrisiko-Liste (HR-Filter, Bonität, Bildung), die RMS-Familie Art. 9-15, Konformitätsbewertung + CE.",
|
||||||
|
"source_md": "02-ai-act-essenz-fuer-dsb.md",
|
||||||
|
"modules": [
|
||||||
|
{
|
||||||
|
"id": "ai-act-essenz",
|
||||||
|
"title": "Die 4 Risiko-Klassen + GPAI",
|
||||||
|
"objectives": [
|
||||||
|
"Verboten / Hochrisiko / Limitiert / Minimal sicher zuordnen",
|
||||||
|
"GPAI als eigene Säule erkennen (Art. 51-56)",
|
||||||
|
"Stichtag-Logik bis 02.08.2027 verstehen"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 5", "Art. 6", "Art. 50", "Anhang III", "GPAI", "Timeline"],
|
||||||
|
"difficulty": "einfach",
|
||||||
|
"source_heading": "Die vier Risiko-Klassen"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "anhang-iii",
|
||||||
|
"title": "Anhang III — wo Mittelständler hängenbleiben",
|
||||||
|
"objectives": [
|
||||||
|
"HR-Bewerber-Filter als Hochrisiko erkennen",
|
||||||
|
"Bonitäts-Scoring + Versicherungs-Risiko korrekt einordnen",
|
||||||
|
"Bildungs-AI (Prüfungs-Auswertung etc.) als Hochrisiko"
|
||||||
|
],
|
||||||
|
"topics": ["Beschäftigung", "Bildung", "Bonität", "Kritische Infrastruktur"],
|
||||||
|
"difficulty": "mittel",
|
||||||
|
"source_heading": "Anhang III — wo die meisten Mittelständler hängen bleiben"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "rms-familie",
|
||||||
|
"title": "RMS-Familie Art. 9-15",
|
||||||
|
"objectives": [
|
||||||
|
"Art. 9 RMS, Art. 10 Daten, Art. 11 Doku, Art. 12 Logging",
|
||||||
|
"Art. 13 Transparenz, Art. 14 Aufsicht, Art. 15 Robustheit benennen",
|
||||||
|
"Verbindung zu DSGVO-Pendants herstellen"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 9", "Art. 10", "Art. 11", "Art. 12", "Art. 13", "Art. 14", "Art. 15"],
|
||||||
|
"difficulty": "mittel",
|
||||||
|
"source_heading": "Die Pflichten für Hochrisiko-Systeme"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "konformitaet-ce",
|
||||||
|
"title": "Konformitätsbewertung + CE-Kennzeichnung",
|
||||||
|
"objectives": [
|
||||||
|
"Anhang VI (interne Kontrolle) vs. Anhang VII (Notified Body)",
|
||||||
|
"CE-Kennzeichnung + EU-Konformitätserklärung + EU-Datenbank",
|
||||||
|
"10-Jahre-Aufbewahrung der Tech-Doku"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 43", "Art. 47", "Art. 48", "Art. 49", "Anhang VI/VII", "Notified Body"],
|
||||||
|
"difficulty": "schwer",
|
||||||
|
"source_heading": "Konformitätsbewertung & CE-Kennzeichnung"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "betreiber-pflichten",
|
||||||
|
"title": "Betreiber-Pflichten Art. 26",
|
||||||
|
"objectives": [
|
||||||
|
"Anbieter-Anweisungen befolgen, Eingangs-Daten qualitätssichern",
|
||||||
|
"Menschliche Aufsicht: qualifiziertes Personal sicherstellen",
|
||||||
|
"Art. 26 Abs. 9: DSFA durchführen — direkter DSGVO-Hook!"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 26", "Eingangs-Datenqualität", "Aufsicht", "Vorfalls-Meldung"],
|
||||||
|
"difficulty": "mittel",
|
||||||
|
"source_heading": "Pflichten der Betreiber"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "sanktionen-ai",
|
||||||
|
"title": "Sanktionen Art. 99 + AI-Literacy Art. 4",
|
||||||
|
"objectives": [
|
||||||
|
"Verbotene Praxis: bis 35 Mio. € / 7 % Umsatz",
|
||||||
|
"Andere Pflichten: bis 15 Mio. € / 3 %",
|
||||||
|
"AI-Literacy-Pflicht seit 02.02.2025 für ALLE Anwender"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 99", "Art. 4 AI-Literacy", "02.02.2025", "Schulung"],
|
||||||
|
"difficulty": "einfach",
|
||||||
|
"source_heading": "Sanktionen"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "hotspots",
|
||||||
|
"title": "4 · Crosswalks + Hotspots",
|
||||||
|
"short": "DSFA <-> RMS, Art. 22 <-> AI-Act, Daten-Governance",
|
||||||
|
"icon": "git-branch",
|
||||||
|
"color": "#5b21b6",
|
||||||
|
"description": "Die drei zentralen Crosswalks: Art. 35 DSFA <-> Art. 9 RMS (was überlappt, was ist neu), Art. 22 DSGVO <-> AI-Act Art. 13/14 (EuGH Schufa!), Art. 5/9 DSGVO <-> Art. 10 AI Act (Bias-Audit-Dilemma).",
|
||||||
|
"source_md": "03-crosswalk-art35-dsfa-vs-art9-rms.md",
|
||||||
|
"modules": [
|
||||||
|
{
|
||||||
|
"id": "crosswalk",
|
||||||
|
"title": "DSFA (Art. 35) <-> RMS (Art. 9)",
|
||||||
|
"objectives": [
|
||||||
|
"Sechs gemeinsame Risk-Engineering-Schritte erkennen",
|
||||||
|
"Vier neue RMS-Dimensionen (Lifecycle, Drift, Oversight, FRIA)",
|
||||||
|
"Drei DSFA-only Sektionen (DSB-Konsultation, Aufsichtsbehörde, Betroffenenrechte)"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 35", "Art. 9", "Lifecycle", "FRIA", "Drift-Monitoring"],
|
||||||
|
"difficulty": "schwer",
|
||||||
|
"source_heading": "Die große Überlappung"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "art22",
|
||||||
|
"title": "Art. 22 <-> AI-Act Art. 13/14",
|
||||||
|
"objectives": [
|
||||||
|
"Drei Tatbestandsmerkmale Art. 22 erkennen",
|
||||||
|
"EuGH Schufa (C-634/21) verstehen — abgesenkte Schwelle",
|
||||||
|
"Substanzielle menschliche Aufsicht (Art. 14) operationalisieren"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 22 Abs. 1+3", "EuGH Schufa", "Art. 13", "Art. 14", "Recht auf Erklärung Art. 86"],
|
||||||
|
"difficulty": "schwer",
|
||||||
|
"source_heading": "Was Art. 22 DSGVO sagt"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "art10-daten",
|
||||||
|
"title": "Art. 5 + 9 DSGVO <-> Art. 10 AI Act",
|
||||||
|
"objectives": [
|
||||||
|
"Datenqualität gleichzeitig DSGVO + AI-Act-Pflicht",
|
||||||
|
"Art. 10 Abs. 5 als eigenständige Erlaubnis-Norm für Bias-Tests",
|
||||||
|
"Membership-Inference: Modell-Gewichte als personenbezogene Daten"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 10 AI Act", "Bias-Test-Erlaubnis", "Membership Inference", "Provenance"],
|
||||||
|
"difficulty": "schwer",
|
||||||
|
"source_heading": "Crosswalk-Tabelle Daten-Pflichten"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "tom-konformitaet",
|
||||||
|
"title": "TOMs (Art. 32) <-> Konformität (Art. 43+)",
|
||||||
|
"objectives": [
|
||||||
|
"Doppelnutzbare Maßnahmen identifizieren (Verschlüsselung, Logging)",
|
||||||
|
"AI-only Maßnahmen ergänzen (Drift, Bias, Adversarial)",
|
||||||
|
"Eine Maßnahmen-Datenbank, zwei Doku-Stränge"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 32", "Art. 43", "Anhang IV", "Maßnahmen-DB"],
|
||||||
|
"difficulty": "mittel",
|
||||||
|
"source_heading": "Crosswalk: Sicherheits-Maßnahmen"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "behoerden-mapping",
|
||||||
|
"title": "DPAs <-> Marktüberwachung",
|
||||||
|
"objectives": [
|
||||||
|
"Doppelmeldung bei Vorfall: Art. 33 DSGVO + Art. 73 AI Act",
|
||||||
|
"Behörden-Architektur DE in Übergangsphase",
|
||||||
|
"Strengere Anforderung erfüllen bei divergierenden Auslegungen"
|
||||||
|
],
|
||||||
|
"topics": ["BfDI", "Landes-DPA", "BNetzA", "AI Office", "Doppelmeldung"],
|
||||||
|
"difficulty": "mittel",
|
||||||
|
"source_heading": "Crosswalk: Wer für was zuständig"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "praxis-register",
|
||||||
|
"title": "5 · Risikoregister + Praxis-Workflow",
|
||||||
|
"short": "Integriertes Inventar + Vorfalls-Workflow + FAQ",
|
||||||
|
"icon": "list-checks",
|
||||||
|
"color": "#22c55e",
|
||||||
|
"description": "Der Praxis-Teil: integriertes System-Inventar als SSoT, Vorfalls-Meldeprozess mit zwei Strecken, typische DSB+AI-Officer-Praxis-Fragen.",
|
||||||
|
"source_md": "08-template-integriertes-risikoregister.md",
|
||||||
|
"modules": [
|
||||||
|
{
|
||||||
|
"id": "risikoregister",
|
||||||
|
"title": "Integriertes Risikoregister aufsetzen",
|
||||||
|
"objectives": [
|
||||||
|
"Mindest-Spalten-Set anwenden",
|
||||||
|
"Crosswalk-Einsparungen pro System dokumentieren",
|
||||||
|
"Quartals-Review + Trigger-basierte Updates etablieren"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 30 DSGVO", "Art. 11 AI Act", "SSoT", "Quartals-Review"],
|
||||||
|
"difficulty": "mittel",
|
||||||
|
"source_heading": "Spalten-Definition"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "beispiel-hr",
|
||||||
|
"title": "Beispiel HR-Bewerber-Filter — Ende-zu-Ende",
|
||||||
|
"objectives": [
|
||||||
|
"Klassifikation Hochrisiko + Art. 22-Check parallel",
|
||||||
|
"DSFA + RMS + Tech-Doku als integriertes Paket",
|
||||||
|
"Vendor-Vertrag mit AI-Act-Anbieter-Pflichten-Klausel"
|
||||||
|
],
|
||||||
|
"topics": ["HR-Filter", "DSFA", "RMS", "Vendor-AVV"],
|
||||||
|
"difficulty": "schwer",
|
||||||
|
"source_heading": "Beispiel-Eintrag: HR-Bewerbungsfilter"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "vorfalls-prozess",
|
||||||
|
"title": "Integrierter Vorfalls-Meldeprozess",
|
||||||
|
"objectives": [
|
||||||
|
"DSGVO Art. 33 (72h) + AI Act Art. 73 (unverzüglich) parallel",
|
||||||
|
"Trigger-Erkennung gemeinsam, Klassifizierung getrennt",
|
||||||
|
"Gemeinsame Vorfalls-Doku mit zwei Anhängen"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 33", "Art. 34", "Art. 73", "Frühwarn-System"],
|
||||||
|
"difficulty": "mittel",
|
||||||
|
"source_heading": "Doppelmeldung bei Vorfällen"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "ai-literacy",
|
||||||
|
"title": "AI-Literacy + Schulungs-Konzept",
|
||||||
|
"objectives": [
|
||||||
|
"Art. 4 AI Act seit 02.02.2025 als Pflicht für ALLE Anwender",
|
||||||
|
"Rollen-spezifische Schulungs-Curricula",
|
||||||
|
"Schulungs-Doku als TOM (DSGVO Art. 32) zweitnutzen"
|
||||||
|
],
|
||||||
|
"topics": ["Art. 4 AI Act", "Schulung", "Rollen", "TOM"],
|
||||||
|
"difficulty": "einfach",
|
||||||
|
"source_heading": "AI-Literacy übersehen"
|
||||||
|
},
|
||||||
|
{
|
||||||
|
"id": "faq-praxis",
|
||||||
|
"title": "Praxis-FAQ DSB & AI-Officer",
|
||||||
|
"objectives": [
|
||||||
|
"Typische Personalunion-Frage beantworten",
|
||||||
|
"ChatGPT-für-HR-Sichtung-Falle erkennen",
|
||||||
|
"Membership-Inference + Lösch-Anfragen einordnen"
|
||||||
|
],
|
||||||
|
"topics": ["Personalunion", "ChatGPT-HR", "Lösch-Anfrage", "Modell-Gewichte"],
|
||||||
|
"difficulty": "mittel",
|
||||||
|
"source_heading": "Häufige Fragen"
|
||||||
|
}
|
||||||
|
]
|
||||||
|
}
|
||||||
|
],
|
||||||
|
"badges": [
|
||||||
|
{"id": "erste_audit", "title": "Erste Audit", "icon": "shuffle", "description": "1. Quiz im Integrations-Modul erfolgreich — du hast den Crosswalk-Gedanken verinnerlicht."},
|
||||||
|
{"id": "dsgvo_kenner", "title": "DSGVO-Kenner", "icon": "shield", "description": "5 Quiz im DSGVO-Essenz-Modul korrekt — die 7 Pflicht-Artikel sitzen."},
|
||||||
|
{"id": "ai_act_kenner", "title": "AI-Act-Kenner", "icon": "scale", "description": "5 Quiz im AI-Act-Essenz-Modul korrekt — Risiko-Klassen + Anhang III sitzen."},
|
||||||
|
{"id": "crosswalk_meister", "title": "Crosswalk-Meister", "icon": "git-branch", "description": "5 Quiz im Crosswalk-Modul korrekt — DSFA <-> RMS-Mapping sitzt."},
|
||||||
|
{"id": "art22_pro", "title": "Art-22-Pro", "icon": "user-check", "description": "3 Quiz im Art-22-Modul korrekt — automatisierte Einzelentscheidungen sicher einordnen."},
|
||||||
|
{"id": "register_architekt", "title": "Register-Architekt", "icon": "list-checks", "description": "Alle Flashcards des Risikoregister-Moduls bestanden — SSoT-Konzept verinnerlicht."},
|
||||||
|
{"id": "kurt_meister", "title": "KURT-Meister", "icon": "crown", "description": "Alle 5 Curricula mit >=80% abgeschlossen — DSGVO+AI-Act parallel im Griff."},
|
||||||
|
{"id": "streak_14", "title": "14-Tage-Streak", "icon": "flame", "description": "14 Tage in Folge aktiv — Compliance-Disziplin sichtbar."},
|
||||||
|
{"id": "night_owl", "title": "Nachteule", "icon": "moon", "description": "Nach 22 Uhr gelernt."},
|
||||||
|
{"id": "early_bird", "title": "Frühaufsteher", "icon": "sun", "description": "Vor 7 Uhr gelernt."}
|
||||||
|
],
|
||||||
|
"levels": [
|
||||||
|
{"min": 0, "title": "Compliance-Lernende"},
|
||||||
|
{"min": 50, "title": "DSB-Junior"},
|
||||||
|
{"min": 200, "title": "DSB / AI-Officer"},
|
||||||
|
{"min": 500, "title": "Senior-DSB / Senior-AI-Officer"},
|
||||||
|
{"min": 1250, "title": "Compliance-Lead"},
|
||||||
|
{"min": 2500, "title": "Chief Compliance Officer"},
|
||||||
|
{"min": 5000, "title": "Aufsichtsbehörde-Veteran"}
|
||||||
|
]
|
||||||
|
}
|
||||||
125
www/index.html
Normal file
125
www/index.html
Normal file
|
|
@ -0,0 +1,125 @@
|
||||||
|
<!DOCTYPE html>
|
||||||
|
<html lang="de">
|
||||||
|
<head>
|
||||||
|
<meta charset="utf-8">
|
||||||
|
<title>KURT · Dein DSGVO+AI-Act Kombi-Auditor</title>
|
||||||
|
<meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover">
|
||||||
|
<meta name="theme-color" content="#0a0a0f">
|
||||||
|
<meta name="description" content="KURT — der integrierte Compliance-Auditor für DSGVO + EU AI Act. Crosswalk DSFA ↔ RMS, Art. 22 ↔ AI-Act Art. 13/14. Im deutschen Bunker.">
|
||||||
|
<link rel="stylesheet" href="styles.css">
|
||||||
|
<script>window.__KURT_KEY__ = 'qb_ea1d0b1e8bbe';</script>
|
||||||
|
</head>
|
||||||
|
<body>
|
||||||
|
<div class="app" role="application" aria-label="KURT DSGVO+AI-Act Kombi-Auditor">
|
||||||
|
|
||||||
|
<header class="topbar">
|
||||||
|
<div class="brand">
|
||||||
|
<span class="brand-icon" aria-hidden="true">K</span>
|
||||||
|
<span>KURT <small>Kombi-Auditor</small></span>
|
||||||
|
</div>
|
||||||
|
<div class="spacer"></div>
|
||||||
|
<span class="status" role="status" aria-live="polite">Online</span>
|
||||||
|
</header>
|
||||||
|
|
||||||
|
<nav class="tabbar" role="tablist" aria-label="Modi">
|
||||||
|
<button class="tab" role="tab" aria-selected="true" aria-controls="view-chat" data-mode="chat">
|
||||||
|
Chat
|
||||||
|
<span class="tab-kbd">⌃1</span>
|
||||||
|
</button>
|
||||||
|
<button class="tab" role="tab" aria-selected="false" aria-controls="view-quiz" data-mode="quiz">
|
||||||
|
Quiz
|
||||||
|
<span class="tab-kbd">⌃2</span>
|
||||||
|
</button>
|
||||||
|
<button class="tab" role="tab" aria-selected="false" aria-controls="view-flash" data-mode="flash">
|
||||||
|
Karten
|
||||||
|
<span class="tab-kbd">⌃3</span>
|
||||||
|
</button>
|
||||||
|
<button class="tab" role="tab" aria-selected="false" aria-controls="view-progress" data-mode="progress">
|
||||||
|
Fortschritt
|
||||||
|
<span class="tab-kbd">⌃4</span>
|
||||||
|
</button>
|
||||||
|
<button class="tab" role="tab" aria-selected="false" aria-controls="view-curriculum" data-mode="curriculum">
|
||||||
|
Module
|
||||||
|
<span class="tab-kbd">⌃5</span>
|
||||||
|
</button>
|
||||||
|
</nav>
|
||||||
|
|
||||||
|
<main class="main">
|
||||||
|
<!-- CHAT -->
|
||||||
|
<section id="view-chat" class="view" role="tabpanel" aria-labelledby="tab-chat" data-active="true">
|
||||||
|
<div id="welcome-screen" class="welcome hidden" aria-hidden="true">
|
||||||
|
<h2>Hi, ich bin KURT.</h2>
|
||||||
|
<p>Ich nehm dir die Doppelarbeit zwischen <strong>DSGVO</strong> und <strong>EU AI Act</strong> ab — Crosswalk statt Excel-Hölle. Beide Regimes parallel, ohne dass du dieselbe Risiko-Bewertung zweimal schreibst. Sag mir: was treibt dich gerade — DSFA-Update, AI-System-Klassifikation, Audit-Vorbereitung? Erstmal die grobe Lage, dann gehen wir tief.</p>
|
||||||
|
<div class="mode-grid">
|
||||||
|
<button class="mode-card" data-goto="chat">
|
||||||
|
<strong>Chat</strong>
|
||||||
|
<span>Frag mich alles zu DSGVO + AI Act Schnittstellen.</span>
|
||||||
|
</button>
|
||||||
|
<button class="mode-card" data-goto="quiz">
|
||||||
|
<strong>Quiz</strong>
|
||||||
|
<span>Audit-Szenarien aus dem Compliance-Alltag, mit XP.</span>
|
||||||
|
</button>
|
||||||
|
<button class="mode-card" data-goto="flash">
|
||||||
|
<strong>Flashcards</strong>
|
||||||
|
<span>Artikel, Crosswalks, Risiko-Klassen — mit Spaced-Repetition.</span>
|
||||||
|
</button>
|
||||||
|
<button class="mode-card" data-goto="progress">
|
||||||
|
<strong>Fortschritt</strong>
|
||||||
|
<span>XP, Streaks, Badges, Level.</span>
|
||||||
|
</button>
|
||||||
|
<button class="mode-card" data-goto="curriculum">
|
||||||
|
<strong>Module</strong>
|
||||||
|
<span>5 Curricula / 25 Module: Integration · DSGVO-Essenz · AI-Act-Essenz · Hotspots · Risikoregister.</span>
|
||||||
|
</button>
|
||||||
|
<button class="mode-card" data-prompt="AUDIT_REQUEST: Mein KI-System ist [Use-Case]. Klassifiziere DSGVO + AI-Act + erforderliche Artefakte.">
|
||||||
|
<strong>Audit-Klassifikation</strong>
|
||||||
|
<span><code>AUDIT_REQUEST</code> + Use-Case → DSGVO + AI-Act-Klassifikation mit Artefakt-Liste als Karte.</span>
|
||||||
|
</button>
|
||||||
|
</div>
|
||||||
|
<p style="font-size:.82rem;color:var(--text-mute)">Drei Sätze: Klassifizier dein AI-System (DSGVO + AI Act parallel) → Lass dir Crosswalk-Mapping erklären → Verstehe wo Doppelarbeit vermeidbar ist. KURT ist der Brückenbauer — DSGVO-tief? Ruf Cora. AI-Act-Audit-Tiefe? Ruf VESTIGIA.</p>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div id="chat-box" class="chat-box" aria-live="polite" aria-label="Gespräch"></div>
|
||||||
|
</section>
|
||||||
|
|
||||||
|
<!-- QUIZ -->
|
||||||
|
<section id="view-quiz" class="view" role="tabpanel" aria-labelledby="tab-quiz">
|
||||||
|
<div id="quiz-host"></div>
|
||||||
|
</section>
|
||||||
|
|
||||||
|
<!-- FLASHCARDS -->
|
||||||
|
<section id="view-flash" class="view" role="tabpanel" aria-labelledby="tab-flash">
|
||||||
|
<div id="flash-host"></div>
|
||||||
|
</section>
|
||||||
|
|
||||||
|
<!-- PROGRESS -->
|
||||||
|
<section id="view-progress" class="view" role="tabpanel" aria-labelledby="tab-progress">
|
||||||
|
<div id="progress-host"></div>
|
||||||
|
</section>
|
||||||
|
|
||||||
|
<!-- CURRICULUM -->
|
||||||
|
<section id="view-curriculum" class="view" role="tabpanel" aria-labelledby="tab-curr">
|
||||||
|
<div id="curr-host"></div>
|
||||||
|
</section>
|
||||||
|
</main>
|
||||||
|
|
||||||
|
<form id="composer-form" class="composer" aria-label="Nachricht verfassen">
|
||||||
|
<div id="attach-strip" class="attach-strip" aria-live="polite"></div>
|
||||||
|
<div class="composer-row">
|
||||||
|
<button type="button" class="btn-attach" id="composer-attach" aria-label="Datei anhängen" title="Datei anhängen (PDF, Bild, Text — max 5 Dateien, 8 MB)">📎</button>
|
||||||
|
<input type="file" id="composer-file" multiple accept=".pdf,.txt,.md,.csv,.json,.xml,.yaml,.yml,.log,.png,.jpg,.jpeg,.webp,.gif" hidden>
|
||||||
|
<textarea id="composer" rows="1" placeholder="Frag KURT — Enter zum Senden, Shift+Enter für Zeilenumbruch" aria-label="Nachricht"></textarea>
|
||||||
|
<button type="submit" class="btn-primary" id="composer-send">Senden</button>
|
||||||
|
</div>
|
||||||
|
</form>
|
||||||
|
|
||||||
|
<footer class="footer">
|
||||||
|
Sovereign AI · Deutscher Bunker · <a href="https://qognio.com">Qognio</a> · DSGVO-konform · Keine externen Fonts · Keine Cookies
|
||||||
|
</footer>
|
||||||
|
</div>
|
||||||
|
|
||||||
|
<div id="toast-stack" class="toast-stack" aria-live="polite"></div>
|
||||||
|
|
||||||
|
<script src="app.js"></script>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
1038
www/styles.css
Normal file
1038
www/styles.css
Normal file
File diff suppressed because it is too large
Load diff
Loading…
Reference in a new issue