init: extract kurt-compliance-auditor from qognio-bot-widget-template@d2c816f
Source files (src/) and rendered bundle (www/) extracted on 2026-04-29T01:35:47+02:00. Adds nginx:alpine Dockerfile + docker-compose.yml (Caddy-labels) so the bot runs stand-alone or as a per-customer template clone. Parent monorepo commit: d2c816f3edbc9760802a11b29ff4151c7aad4b46 Bot version: 2026-04-25
This commit is contained in:
Qognio Bot Extract
commit
e679eedcc6
16 changed files with 3922 additions and 0 deletions
7
.dockerignore
Normal file
7
.dockerignore
Normal file
|
|
@ -0,0 +1,7 @@
|
|||
.git
|
||||
.gitignore
|
||||
README.md
|
||||
bot.json
|
||||
src/
|
||||
docker-compose.yml
|
||||
*.md
|
||||
4
.gitignore
vendored
Normal file
4
.gitignore
vendored
Normal file
|
|
@ -0,0 +1,4 @@
|
|||
.DS_Store
|
||||
*.log
|
||||
*.tmp
|
||||
node_modules/
|
||||
13
Dockerfile
Normal file
13
Dockerfile
Normal file
|
|
@ -0,0 +1,13 @@
|
|||
# Static-bundle bot — nginx:alpine serves www/ on port 80.
|
||||
FROM nginx:1.27-alpine
|
||||
|
||||
# nginx config: gzip + cache headers + index.html no-store
|
||||
COPY nginx.conf /etc/nginx/conf.d/default.conf
|
||||
|
||||
# Static bundle
|
||||
COPY www/ /usr/share/nginx/html/
|
||||
|
||||
# Run as non-root via nginx's built-in unprivileged image features
|
||||
EXPOSE 80
|
||||
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
|
||||
CMD wget -q --spider http://127.0.0.1/index.html || exit 1
|
||||
67
README.md
Normal file
67
README.md
Normal file
|
|
@ -0,0 +1,67 @@
|
|||
# KURT — DSGVO+AI-Act Kombi-Auditor
|
||||
|
||||
KURT — der integrierte Compliance-Auditor für DSGVO + EU AI Act. Crosswalk DSFA ↔ RMS, Art. 22 ↔ AI-Act Art. 13/14. Im deutschen Bunker.
|
||||
|
||||
```
|
||||
slug : kurt-compliance-auditor
|
||||
version : 2026-04-25
|
||||
accent : #7c3aed
|
||||
runtime : nginx:alpine (static bundle)
|
||||
template : qognio-bot-template-core (former qognio-bot-widget-template)
|
||||
```
|
||||
|
||||
## Layout
|
||||
|
||||
```
|
||||
.
|
||||
├── src/ source — config.yaml, welcome.html, curricula.json, etc.
|
||||
├── www/ rendered, directly servable static bundle
|
||||
├── Dockerfile nginx:alpine + www/ → port 80
|
||||
├── docker-compose.yml bot-host pattern (Caddy-labels, restart unless-stopped)
|
||||
├── nginx.conf gzip + cache + SPA fallback
|
||||
└── bot.json metadata + parent_core_commit
|
||||
```
|
||||
|
||||
## Run locally
|
||||
|
||||
```bash
|
||||
docker compose up --build
|
||||
# → http://localhost (you'll need to tweak ports for local-only use)
|
||||
```
|
||||
|
||||
## Re-render after upstream core changes
|
||||
|
||||
This repo only stores src + rendered output; the rendering engine lives in
|
||||
`qognio-bot-template-core`. To pull in core changes:
|
||||
|
||||
```bash
|
||||
cd /path/to/qognio-bot-template-core
|
||||
./scripts/render.sh kurt-compliance-auditor --bot-repo /path/to/this/repo
|
||||
git -C /path/to/this/repo commit -am "render: refresh from core@<sha>"
|
||||
```
|
||||
|
||||
## Per-customer copy (template usage)
|
||||
|
||||
This repo is a **template**. To clone for a customer:
|
||||
|
||||
```bash
|
||||
git clone <this-repo> my-customer-kurt-compliance-auditor
|
||||
cd my-customer-kurt-compliance-auditor
|
||||
# tweak src/config.yaml (slug, bot_key_value, accent), src/welcome.html, src/curricula.json
|
||||
docker compose -f docker-compose.yml up --build
|
||||
```
|
||||
|
||||
## Deploy to qognio bot-host (.42 LXC pattern — legacy)
|
||||
|
||||
The bot-manager spawns LXC containers named after the slug. Push www/ via:
|
||||
|
||||
```bash
|
||||
ssh fmh@46.243.203.42
|
||||
sudo lxc file push /tmp/www/* kurt-compliance-auditor/var/www/html/
|
||||
```
|
||||
|
||||
(Or run the docker-compose pattern on a Docker host — same network as Caddy.)
|
||||
|
||||
---
|
||||
|
||||
Generated by `qognio-bot-template-core/scripts/extract-to-repo.sh` on 2026-04-29T01:35:47+02:00.
|
||||
14
bot.json
Normal file
14
bot.json
Normal file
|
|
@ -0,0 +1,14 @@
|
|||
{
|
||||
"slug": "kurt-compliance-auditor",
|
||||
"name": "KURT",
|
||||
"title": "DSGVO+AI-Act Kombi-Auditor",
|
||||
"tagline": "Kombi-Auditor",
|
||||
"description": "KURT — der integrierte Compliance-Auditor für DSGVO + EU AI Act. Crosswalk DSFA ↔ RMS, Art. 22 ↔ AI-Act Art. 13/14. Im deutschen Bunker.",
|
||||
"version": "2026-04-25",
|
||||
"accent": "#7c3aed",
|
||||
"extracted_from": "qognio-bot-widget-template",
|
||||
"parent_core_commit": "d2c816f3edbc9760802a11b29ff4151c7aad4b46",
|
||||
"extracted_at": "2026-04-29T01:35:47+02:00",
|
||||
"runtime": "nginx:alpine",
|
||||
"default_port": 80
|
||||
}
|
||||
20
docker-compose.yml
Normal file
20
docker-compose.yml
Normal file
|
|
@ -0,0 +1,20 @@
|
|||
# Stand-alone bot container.
|
||||
# Designed for the "caddy" external network on the bot host (qognio pattern).
|
||||
# Override the hostname via SLUG env var if you reuse this template per customer.
|
||||
services:
|
||||
bot:
|
||||
build: .
|
||||
image: qognio/bot-kurt-compliance-auditor:${TAG:-latest}
|
||||
container_name: bot-kurt-compliance-auditor
|
||||
restart: unless-stopped
|
||||
networks:
|
||||
- caddy
|
||||
labels:
|
||||
caddy: "kurt-compliance-auditor.on.qognio.com"
|
||||
caddy.reverse_proxy: "{{upstreams 80}}"
|
||||
qognio.bot.slug: "kurt-compliance-auditor"
|
||||
qognio.bot.version: "2026-04-25"
|
||||
|
||||
networks:
|
||||
caddy:
|
||||
external: true
|
||||
27
nginx.conf
Normal file
27
nginx.conf
Normal file
|
|
@ -0,0 +1,27 @@
|
|||
server {
|
||||
listen 80;
|
||||
server_name _;
|
||||
root /usr/share/nginx/html;
|
||||
index index.html;
|
||||
|
||||
# gzip
|
||||
gzip on;
|
||||
gzip_vary on;
|
||||
gzip_types text/css application/javascript application/json image/svg+xml text/plain;
|
||||
gzip_min_length 512;
|
||||
|
||||
# index.html: never cache (so welcome screen / wiring updates land instantly)
|
||||
location = /index.html {
|
||||
add_header Cache-Control "no-store, must-revalidate" always;
|
||||
}
|
||||
|
||||
# static assets: cache 1h
|
||||
location ~* \.(?:css|js|json|svg|png|jpe?g|webp|gif|ico|woff2?)$ {
|
||||
add_header Cache-Control "public, max-age=3600" always;
|
||||
try_files $uri =404;
|
||||
}
|
||||
|
||||
location / {
|
||||
try_files $uri $uri/ /index.html;
|
||||
}
|
||||
}
|
||||
20
src/check-badges.js
Normal file
20
src/check-badges.js
Normal file
|
|
@ -0,0 +1,20 @@
|
|||
// Erste Audit — 1 Quiz im Integrations-Modul (warum DSGVO+AI-Act zusammen)
|
||||
if ((state.moduleCorrect && state.moduleCorrect['integration'] >= 1)) unlockBadge('erste_audit');
|
||||
// DSGVO-Kenner — 5 Quiz in DSGVO-Essenz-Modulen
|
||||
if ((state.moduleCorrect && state.moduleCorrect['dsgvo-essenz'] >= 5)) unlockBadge('dsgvo_kenner');
|
||||
// AI-Act-Kenner — 5 Quiz in AI-Act-Essenz-Modulen
|
||||
if ((state.moduleCorrect && state.moduleCorrect['ai-act-essenz'] >= 5)) unlockBadge('ai_act_kenner');
|
||||
// Crosswalk-Meister — 5 Quiz im Crosswalk-Modul (DSFA <-> RMS)
|
||||
if ((state.moduleCorrect && state.moduleCorrect['crosswalk'] >= 5)) unlockBadge('crosswalk_meister');
|
||||
// Art-22-Pro — 3 Quiz im Art-22-Modul
|
||||
if ((state.moduleCorrect && state.moduleCorrect['art22'] >= 3)) unlockBadge('art22_pro');
|
||||
// Register-Architekt — alle Flashcards des Risikoregister-Moduls bestanden
|
||||
if ((state.modulePassedFlash && state.modulePassedFlash['risikoregister'])) unlockBadge('register_architekt');
|
||||
// KURT-Meister — alle 5 Curricula komplett
|
||||
if ((state.completedCurricula || []).length >= 5) unlockBadge('kurt_meister');
|
||||
// Compliance-Disziplin — 14-Tage-Streak (etwas weicher als Cora's 30, weil KURT-Use-Cases punktuell)
|
||||
if (state.maxStreak >= 14) unlockBadge('streak_14');
|
||||
// Night Owl & Early Bird (beibehalten)
|
||||
const h = new Date().getHours();
|
||||
if (h >= 22) unlockBadge('night_owl');
|
||||
if (h < 7) unlockBadge('early_bird');
|
||||
39
src/config.yaml
Normal file
39
src/config.yaml
Normal file
|
|
@ -0,0 +1,39 @@
|
|||
slug: kurt-compliance-auditor
|
||||
bot_name: KURT
|
||||
bot_title: DSGVO+AI-Act Kombi-Auditor
|
||||
brand_letter: K
|
||||
title: "KURT · Dein DSGVO+AI-Act Kombi-Auditor"
|
||||
tagline: DSGVO+AI-Act Kombi-Auditor
|
||||
tagline_short: Kombi-Auditor
|
||||
meta_description: "KURT — der integrierte Compliance-Auditor für DSGVO + EU AI Act. Crosswalk DSFA ↔ RMS, Art. 22 ↔ AI-Act Art. 13/14. Im deutschen Bunker."
|
||||
bot_key_var: __KURT_KEY__
|
||||
bot_key_value: qb_ea1d0b1e8bbe
|
||||
ls_prefix: kurt
|
||||
bot_version: "2026-04-25"
|
||||
|
||||
# Color theme — deep violet, distinct from Luna (#a855f7) and Cora (#059669).
|
||||
# Symbolisiert die Brücke zwischen DSGVO (grün/Cora) und AI-Act (cyan/Kai).
|
||||
accent: "#7c3aed"
|
||||
accent_2: "#a78bfa"
|
||||
accent_dark: "#5b21b6"
|
||||
accent_rgb: "124, 58, 237"
|
||||
accent_rgb_compact: "124,58,237"
|
||||
success_color: "#22c55e"
|
||||
msg_strong_color: "#ddd6fe"
|
||||
|
||||
# UI Labels
|
||||
tab_flash_label: Karten
|
||||
tab_curriculum_label: Module
|
||||
curriculum_long_label: Crosswalk-Atlas
|
||||
|
||||
# Bot-personality strings
|
||||
quiz_intro_hint: "Wähle ein Modul — KURT generiert Szenario-Fragen aus dem Compliance-Alltag."
|
||||
quiz_verb: erstellt
|
||||
quiz_noun: "Audit-Szenarien"
|
||||
flash_intro_hint: "Karteikarten zu Artikeln, Crosswalks, Risiko-Klassen — mit Spaced-Repetition."
|
||||
flash_verb: generiert
|
||||
|
||||
# Levels-fallback, welcome.html, check-badges.js are sibling files
|
||||
# in this directory — render.sh injects their full contents into the
|
||||
# corresponding {{LEVELS_FALLBACK}}, {{WELCOME_HTML}}, {{CHECK_BADGES_BODY}}
|
||||
# placeholders verbatim.
|
||||
382
src/curricula.json
Normal file
382
src/curricula.json
Normal file
|
|
@ -0,0 +1,382 @@
|
|||
{
|
||||
"version": "2026-04-25",
|
||||
"updated": "2026-04-25",
|
||||
"curricula": [
|
||||
{
|
||||
"id": "warum-integrieren",
|
||||
"title": "1 · Warum integrieren",
|
||||
"short": "Warum DSGVO + AI Act zusammen denken",
|
||||
"icon": "shuffle",
|
||||
"color": "#7c3aed",
|
||||
"description": "Beide Verordnungen gelten parallel — keine ersetzt die andere. Die drei klassischen Doppelarbeits-Hotspots: DSFA <-> RMS, Art. 22 <-> AI-Act Art. 13/14, Daten-Governance <-> Art. 10. Zielbild: ein integriertes Risiko-Register.",
|
||||
"source_md": "00-warum-integrieren.md",
|
||||
"modules": [
|
||||
{
|
||||
"id": "integration",
|
||||
"title": "Warum überhaupt integrieren?",
|
||||
"objectives": [
|
||||
"Verstehen, warum DSGVO und AI Act parallel gelten",
|
||||
"Die expliziten Verweise des AI Act auf die DSGVO benennen",
|
||||
"Die drei Doppelarbeits-Hotspots identifizieren"
|
||||
],
|
||||
"topics": ["Art. 2 Abs. 7 AI Act", "Art. 26 Abs. 9 AI Act", "Erwägungsgrund 9", "Doppelarbeit"],
|
||||
"difficulty": "einfach",
|
||||
"source_heading": "Warum es einen integrierten Auditor braucht"
|
||||
},
|
||||
{
|
||||
"id": "begriffsklaerung",
|
||||
"title": "Begriffsklärung — Anbieter vs. Betreiber",
|
||||
"objectives": [
|
||||
"Anbieter (Provider) vs. Betreiber (Deployer) sicher abgrenzen",
|
||||
"DSGVO-Verantwortlicher vs. Auftragsverarbeiter zuordnen",
|
||||
"Mehrere Rollen pro Unternehmen: typische Konstellationen"
|
||||
],
|
||||
"topics": ["Art. 3 AI Act", "Art. 4 DSGVO", "Inverkehrbringen", "Inbetriebnahme"],
|
||||
"difficulty": "mittel",
|
||||
"source_heading": "Persönlicher Anwendungsbereich"
|
||||
},
|
||||
{
|
||||
"id": "rollen-konflikte",
|
||||
"title": "Rollen-Konflikte: DSB & AI-Officer",
|
||||
"objectives": [
|
||||
"DSB als Pflichtberuf nach DSGVO Art. 37 verstehen",
|
||||
"AI-Officer als organisatorische Notwendigkeit (kein Pflichtberuf)",
|
||||
"Personalunion möglich, Interessenskonflikt prüfen"
|
||||
],
|
||||
"topics": ["Art. 37 DSGVO", "Art. 38 DSGVO", "Personalunion", "Interessenkonflikt"],
|
||||
"difficulty": "mittel",
|
||||
"source_heading": "Rollen klären"
|
||||
},
|
||||
{
|
||||
"id": "zielbild-register",
|
||||
"title": "Zielbild: ein integriertes Risiko-Register",
|
||||
"objectives": [
|
||||
"Single-Source-of-Truth-Logik verstehen",
|
||||
"Verarbeitungsverzeichnis + Bestands-Inventar verschmelzen",
|
||||
"Quartals-Review-Rhythmus etablieren"
|
||||
],
|
||||
"topics": ["Art. 30 DSGVO", "Art. 11 AI Act", "Inventar", "Review-Rhythmus"],
|
||||
"difficulty": "einfach",
|
||||
"source_heading": "Zielbild: ein integriertes Risiko-Register"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "dsgvo-fuer-ai-leute",
|
||||
"title": "2 · DSGVO-Essenz für AI-Profis",
|
||||
"short": "Art. 5, 6, 9, 22, 25, 32, 35 in der AI-Übersetzung",
|
||||
"icon": "shield",
|
||||
"color": "#a78bfa",
|
||||
"description": "Für AI-Officer, Data-Scientists, ML-Engineers: das Pflicht-Set DSGVO. Die 7 wichtigsten Artikel mit AI-Bezug, Art. 9 für Bias-Audits, Privacy by Design im Pipeline-Kontext.",
|
||||
"source_md": "01-dsgvo-essenz-fuer-ai-leute.md",
|
||||
"modules": [
|
||||
{
|
||||
"id": "dsgvo-essenz",
|
||||
"title": "Die 7 Pflicht-Artikel (Art. 5/6/9/22/25/32/35)",
|
||||
"objectives": [
|
||||
"Alle 7 Artikel benennen und in AI-Pipelines einordnen",
|
||||
"Art. 22 als direkten AI-DSGVO-Hotspot erkennen",
|
||||
"Art. 9 als Bias-Audit-Stolperfalle verstehen"
|
||||
],
|
||||
"topics": ["Art. 5", "Art. 6", "Art. 9", "Art. 22", "Art. 25", "Art. 32", "Art. 35"],
|
||||
"difficulty": "mittel",
|
||||
"source_heading": "Die 7 Artikel, die für AI immer relevant sind"
|
||||
},
|
||||
{
|
||||
"id": "grundsaetze-ai",
|
||||
"title": "Art. 5 Grundsätze in AI-Übersetzung",
|
||||
"objectives": [
|
||||
"Zweckbindung in Trainings- vs. Inferenz-Phase trennen",
|
||||
"Datenminimierung als Modell-Verbesserer (nicht nur Pflicht)",
|
||||
"Speicherbegrenzung inkl. gelernter Repräsentationen"
|
||||
],
|
||||
"topics": ["Zweckbindung", "Datenminimierung", "Speicherbegrenzung", "Embeddings"],
|
||||
"difficulty": "schwer",
|
||||
"source_heading": "Art. 5 — die 7 Grundsätze in der AI-Übersetzung"
|
||||
},
|
||||
{
|
||||
"id": "rechtsgrundlagen-ai",
|
||||
"title": "Art. 6 Rechtsgrundlagen für AI-Pipelines",
|
||||
"objectives": [
|
||||
"Eine Grundlage für Training, eine andere für Inferenz wählen können",
|
||||
"Berechtigtes Interesse + LIA für Modell-Training begründen",
|
||||
"Einwilligung im Beschäftigtenverhältnis kritisch prüfen"
|
||||
],
|
||||
"topics": ["Art. 6 lit. a-f", "LIA", "Beschäftigtenverhältnis", "vorvertraglich"],
|
||||
"difficulty": "schwer",
|
||||
"source_heading": "Art. 6 — die 6 Rechtsgrundlagen im AI-Kontext"
|
||||
},
|
||||
{
|
||||
"id": "art9-bias",
|
||||
"title": "Art. 9 + Bias-Audit-Dilemma",
|
||||
"objectives": [
|
||||
"Besondere Kategorien benennen (Gesundheit, Ethnie, Religion, etc.)",
|
||||
"Verbots-Logik mit Ausnahmen Abs. 2 verstehen",
|
||||
"AI Act Art. 10 Abs. 5 als zusätzliche Erlaubnis-Norm einsetzen"
|
||||
],
|
||||
"topics": ["Art. 9 Abs. 1+2", "Bias-Audit", "Art. 10 Abs. 5 AI Act", "Pseudonymisierung"],
|
||||
"difficulty": "schwer",
|
||||
"source_heading": "Art. 9 — besondere Kategorien"
|
||||
},
|
||||
{
|
||||
"id": "privacy-by-design-ai",
|
||||
"title": "Art. 25 Privacy by Design in AI-Architektur",
|
||||
"objectives": [
|
||||
"Default kein PII in Embeddings (DP, Anonymisierung)",
|
||||
"Multi-Tenant-Isolation in Federated-Learning-Setups",
|
||||
"Kürzeste Retention als Default-Konfiguration"
|
||||
],
|
||||
"topics": ["Differential Privacy", "Federated Learning", "Retention", "Default"],
|
||||
"difficulty": "schwer",
|
||||
"source_heading": "Art. 25 — Privacy by Design + Default"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "ai-act-fuer-dsb",
|
||||
"title": "3 · AI-Act-Essenz für DSB",
|
||||
"short": "Risiko-Klassen, Anhang III, Art. 9-15, Konformität",
|
||||
"icon": "scale",
|
||||
"color": "#06b6d4",
|
||||
"description": "Für klassische DSB: das Pflicht-Set EU AI Act. Vier Risiko-Klassen, Anhang III als Hochrisiko-Liste (HR-Filter, Bonität, Bildung), die RMS-Familie Art. 9-15, Konformitätsbewertung + CE.",
|
||||
"source_md": "02-ai-act-essenz-fuer-dsb.md",
|
||||
"modules": [
|
||||
{
|
||||
"id": "ai-act-essenz",
|
||||
"title": "Die 4 Risiko-Klassen + GPAI",
|
||||
"objectives": [
|
||||
"Verboten / Hochrisiko / Limitiert / Minimal sicher zuordnen",
|
||||
"GPAI als eigene Säule erkennen (Art. 51-56)",
|
||||
"Stichtag-Logik bis 02.08.2027 verstehen"
|
||||
],
|
||||
"topics": ["Art. 5", "Art. 6", "Art. 50", "Anhang III", "GPAI", "Timeline"],
|
||||
"difficulty": "einfach",
|
||||
"source_heading": "Die vier Risiko-Klassen"
|
||||
},
|
||||
{
|
||||
"id": "anhang-iii",
|
||||
"title": "Anhang III — wo Mittelständler hängenbleiben",
|
||||
"objectives": [
|
||||
"HR-Bewerber-Filter als Hochrisiko erkennen",
|
||||
"Bonitäts-Scoring + Versicherungs-Risiko korrekt einordnen",
|
||||
"Bildungs-AI (Prüfungs-Auswertung etc.) als Hochrisiko"
|
||||
],
|
||||
"topics": ["Beschäftigung", "Bildung", "Bonität", "Kritische Infrastruktur"],
|
||||
"difficulty": "mittel",
|
||||
"source_heading": "Anhang III — wo die meisten Mittelständler hängen bleiben"
|
||||
},
|
||||
{
|
||||
"id": "rms-familie",
|
||||
"title": "RMS-Familie Art. 9-15",
|
||||
"objectives": [
|
||||
"Art. 9 RMS, Art. 10 Daten, Art. 11 Doku, Art. 12 Logging",
|
||||
"Art. 13 Transparenz, Art. 14 Aufsicht, Art. 15 Robustheit benennen",
|
||||
"Verbindung zu DSGVO-Pendants herstellen"
|
||||
],
|
||||
"topics": ["Art. 9", "Art. 10", "Art. 11", "Art. 12", "Art. 13", "Art. 14", "Art. 15"],
|
||||
"difficulty": "mittel",
|
||||
"source_heading": "Die Pflichten für Hochrisiko-Systeme"
|
||||
},
|
||||
{
|
||||
"id": "konformitaet-ce",
|
||||
"title": "Konformitätsbewertung + CE-Kennzeichnung",
|
||||
"objectives": [
|
||||
"Anhang VI (interne Kontrolle) vs. Anhang VII (Notified Body)",
|
||||
"CE-Kennzeichnung + EU-Konformitätserklärung + EU-Datenbank",
|
||||
"10-Jahre-Aufbewahrung der Tech-Doku"
|
||||
],
|
||||
"topics": ["Art. 43", "Art. 47", "Art. 48", "Art. 49", "Anhang VI/VII", "Notified Body"],
|
||||
"difficulty": "schwer",
|
||||
"source_heading": "Konformitätsbewertung & CE-Kennzeichnung"
|
||||
},
|
||||
{
|
||||
"id": "betreiber-pflichten",
|
||||
"title": "Betreiber-Pflichten Art. 26",
|
||||
"objectives": [
|
||||
"Anbieter-Anweisungen befolgen, Eingangs-Daten qualitätssichern",
|
||||
"Menschliche Aufsicht: qualifiziertes Personal sicherstellen",
|
||||
"Art. 26 Abs. 9: DSFA durchführen — direkter DSGVO-Hook!"
|
||||
],
|
||||
"topics": ["Art. 26", "Eingangs-Datenqualität", "Aufsicht", "Vorfalls-Meldung"],
|
||||
"difficulty": "mittel",
|
||||
"source_heading": "Pflichten der Betreiber"
|
||||
},
|
||||
{
|
||||
"id": "sanktionen-ai",
|
||||
"title": "Sanktionen Art. 99 + AI-Literacy Art. 4",
|
||||
"objectives": [
|
||||
"Verbotene Praxis: bis 35 Mio. € / 7 % Umsatz",
|
||||
"Andere Pflichten: bis 15 Mio. € / 3 %",
|
||||
"AI-Literacy-Pflicht seit 02.02.2025 für ALLE Anwender"
|
||||
],
|
||||
"topics": ["Art. 99", "Art. 4 AI-Literacy", "02.02.2025", "Schulung"],
|
||||
"difficulty": "einfach",
|
||||
"source_heading": "Sanktionen"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "hotspots",
|
||||
"title": "4 · Crosswalks + Hotspots",
|
||||
"short": "DSFA <-> RMS, Art. 22 <-> AI-Act, Daten-Governance",
|
||||
"icon": "git-branch",
|
||||
"color": "#5b21b6",
|
||||
"description": "Die drei zentralen Crosswalks: Art. 35 DSFA <-> Art. 9 RMS (was überlappt, was ist neu), Art. 22 DSGVO <-> AI-Act Art. 13/14 (EuGH Schufa!), Art. 5/9 DSGVO <-> Art. 10 AI Act (Bias-Audit-Dilemma).",
|
||||
"source_md": "03-crosswalk-art35-dsfa-vs-art9-rms.md",
|
||||
"modules": [
|
||||
{
|
||||
"id": "crosswalk",
|
||||
"title": "DSFA (Art. 35) <-> RMS (Art. 9)",
|
||||
"objectives": [
|
||||
"Sechs gemeinsame Risk-Engineering-Schritte erkennen",
|
||||
"Vier neue RMS-Dimensionen (Lifecycle, Drift, Oversight, FRIA)",
|
||||
"Drei DSFA-only Sektionen (DSB-Konsultation, Aufsichtsbehörde, Betroffenenrechte)"
|
||||
],
|
||||
"topics": ["Art. 35", "Art. 9", "Lifecycle", "FRIA", "Drift-Monitoring"],
|
||||
"difficulty": "schwer",
|
||||
"source_heading": "Die große Überlappung"
|
||||
},
|
||||
{
|
||||
"id": "art22",
|
||||
"title": "Art. 22 <-> AI-Act Art. 13/14",
|
||||
"objectives": [
|
||||
"Drei Tatbestandsmerkmale Art. 22 erkennen",
|
||||
"EuGH Schufa (C-634/21) verstehen — abgesenkte Schwelle",
|
||||
"Substanzielle menschliche Aufsicht (Art. 14) operationalisieren"
|
||||
],
|
||||
"topics": ["Art. 22 Abs. 1+3", "EuGH Schufa", "Art. 13", "Art. 14", "Recht auf Erklärung Art. 86"],
|
||||
"difficulty": "schwer",
|
||||
"source_heading": "Was Art. 22 DSGVO sagt"
|
||||
},
|
||||
{
|
||||
"id": "art10-daten",
|
||||
"title": "Art. 5 + 9 DSGVO <-> Art. 10 AI Act",
|
||||
"objectives": [
|
||||
"Datenqualität gleichzeitig DSGVO + AI-Act-Pflicht",
|
||||
"Art. 10 Abs. 5 als eigenständige Erlaubnis-Norm für Bias-Tests",
|
||||
"Membership-Inference: Modell-Gewichte als personenbezogene Daten"
|
||||
],
|
||||
"topics": ["Art. 10 AI Act", "Bias-Test-Erlaubnis", "Membership Inference", "Provenance"],
|
||||
"difficulty": "schwer",
|
||||
"source_heading": "Crosswalk-Tabelle Daten-Pflichten"
|
||||
},
|
||||
{
|
||||
"id": "tom-konformitaet",
|
||||
"title": "TOMs (Art. 32) <-> Konformität (Art. 43+)",
|
||||
"objectives": [
|
||||
"Doppelnutzbare Maßnahmen identifizieren (Verschlüsselung, Logging)",
|
||||
"AI-only Maßnahmen ergänzen (Drift, Bias, Adversarial)",
|
||||
"Eine Maßnahmen-Datenbank, zwei Doku-Stränge"
|
||||
],
|
||||
"topics": ["Art. 32", "Art. 43", "Anhang IV", "Maßnahmen-DB"],
|
||||
"difficulty": "mittel",
|
||||
"source_heading": "Crosswalk: Sicherheits-Maßnahmen"
|
||||
},
|
||||
{
|
||||
"id": "behoerden-mapping",
|
||||
"title": "DPAs <-> Marktüberwachung",
|
||||
"objectives": [
|
||||
"Doppelmeldung bei Vorfall: Art. 33 DSGVO + Art. 73 AI Act",
|
||||
"Behörden-Architektur DE in Übergangsphase",
|
||||
"Strengere Anforderung erfüllen bei divergierenden Auslegungen"
|
||||
],
|
||||
"topics": ["BfDI", "Landes-DPA", "BNetzA", "AI Office", "Doppelmeldung"],
|
||||
"difficulty": "mittel",
|
||||
"source_heading": "Crosswalk: Wer für was zuständig"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "praxis-register",
|
||||
"title": "5 · Risikoregister + Praxis-Workflow",
|
||||
"short": "Integriertes Inventar + Vorfalls-Workflow + FAQ",
|
||||
"icon": "list-checks",
|
||||
"color": "#22c55e",
|
||||
"description": "Der Praxis-Teil: integriertes System-Inventar als SSoT, Vorfalls-Meldeprozess mit zwei Strecken, typische DSB+AI-Officer-Praxis-Fragen.",
|
||||
"source_md": "08-template-integriertes-risikoregister.md",
|
||||
"modules": [
|
||||
{
|
||||
"id": "risikoregister",
|
||||
"title": "Integriertes Risikoregister aufsetzen",
|
||||
"objectives": [
|
||||
"Mindest-Spalten-Set anwenden",
|
||||
"Crosswalk-Einsparungen pro System dokumentieren",
|
||||
"Quartals-Review + Trigger-basierte Updates etablieren"
|
||||
],
|
||||
"topics": ["Art. 30 DSGVO", "Art. 11 AI Act", "SSoT", "Quartals-Review"],
|
||||
"difficulty": "mittel",
|
||||
"source_heading": "Spalten-Definition"
|
||||
},
|
||||
{
|
||||
"id": "beispiel-hr",
|
||||
"title": "Beispiel HR-Bewerber-Filter — Ende-zu-Ende",
|
||||
"objectives": [
|
||||
"Klassifikation Hochrisiko + Art. 22-Check parallel",
|
||||
"DSFA + RMS + Tech-Doku als integriertes Paket",
|
||||
"Vendor-Vertrag mit AI-Act-Anbieter-Pflichten-Klausel"
|
||||
],
|
||||
"topics": ["HR-Filter", "DSFA", "RMS", "Vendor-AVV"],
|
||||
"difficulty": "schwer",
|
||||
"source_heading": "Beispiel-Eintrag: HR-Bewerbungsfilter"
|
||||
},
|
||||
{
|
||||
"id": "vorfalls-prozess",
|
||||
"title": "Integrierter Vorfalls-Meldeprozess",
|
||||
"objectives": [
|
||||
"DSGVO Art. 33 (72h) + AI Act Art. 73 (unverzüglich) parallel",
|
||||
"Trigger-Erkennung gemeinsam, Klassifizierung getrennt",
|
||||
"Gemeinsame Vorfalls-Doku mit zwei Anhängen"
|
||||
],
|
||||
"topics": ["Art. 33", "Art. 34", "Art. 73", "Frühwarn-System"],
|
||||
"difficulty": "mittel",
|
||||
"source_heading": "Doppelmeldung bei Vorfällen"
|
||||
},
|
||||
{
|
||||
"id": "ai-literacy",
|
||||
"title": "AI-Literacy + Schulungs-Konzept",
|
||||
"objectives": [
|
||||
"Art. 4 AI Act seit 02.02.2025 als Pflicht für ALLE Anwender",
|
||||
"Rollen-spezifische Schulungs-Curricula",
|
||||
"Schulungs-Doku als TOM (DSGVO Art. 32) zweitnutzen"
|
||||
],
|
||||
"topics": ["Art. 4 AI Act", "Schulung", "Rollen", "TOM"],
|
||||
"difficulty": "einfach",
|
||||
"source_heading": "AI-Literacy übersehen"
|
||||
},
|
||||
{
|
||||
"id": "faq-praxis",
|
||||
"title": "Praxis-FAQ DSB & AI-Officer",
|
||||
"objectives": [
|
||||
"Typische Personalunion-Frage beantworten",
|
||||
"ChatGPT-für-HR-Sichtung-Falle erkennen",
|
||||
"Membership-Inference + Lösch-Anfragen einordnen"
|
||||
],
|
||||
"topics": ["Personalunion", "ChatGPT-HR", "Lösch-Anfrage", "Modell-Gewichte"],
|
||||
"difficulty": "mittel",
|
||||
"source_heading": "Häufige Fragen"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"badges": [
|
||||
{"id": "erste_audit", "title": "Erste Audit", "icon": "shuffle", "description": "1. Quiz im Integrations-Modul erfolgreich — du hast den Crosswalk-Gedanken verinnerlicht."},
|
||||
{"id": "dsgvo_kenner", "title": "DSGVO-Kenner", "icon": "shield", "description": "5 Quiz im DSGVO-Essenz-Modul korrekt — die 7 Pflicht-Artikel sitzen."},
|
||||
{"id": "ai_act_kenner", "title": "AI-Act-Kenner", "icon": "scale", "description": "5 Quiz im AI-Act-Essenz-Modul korrekt — Risiko-Klassen + Anhang III sitzen."},
|
||||
{"id": "crosswalk_meister", "title": "Crosswalk-Meister", "icon": "git-branch", "description": "5 Quiz im Crosswalk-Modul korrekt — DSFA <-> RMS-Mapping sitzt."},
|
||||
{"id": "art22_pro", "title": "Art-22-Pro", "icon": "user-check", "description": "3 Quiz im Art-22-Modul korrekt — automatisierte Einzelentscheidungen sicher einordnen."},
|
||||
{"id": "register_architekt", "title": "Register-Architekt", "icon": "list-checks", "description": "Alle Flashcards des Risikoregister-Moduls bestanden — SSoT-Konzept verinnerlicht."},
|
||||
{"id": "kurt_meister", "title": "KURT-Meister", "icon": "crown", "description": "Alle 5 Curricula mit >=80% abgeschlossen — DSGVO+AI-Act parallel im Griff."},
|
||||
{"id": "streak_14", "title": "14-Tage-Streak", "icon": "flame", "description": "14 Tage in Folge aktiv — Compliance-Disziplin sichtbar."},
|
||||
{"id": "night_owl", "title": "Nachteule", "icon": "moon", "description": "Nach 22 Uhr gelernt."},
|
||||
{"id": "early_bird", "title": "Frühaufsteher", "icon": "sun", "description": "Vor 7 Uhr gelernt."}
|
||||
],
|
||||
"levels": [
|
||||
{"min": 0, "title": "Compliance-Lernende"},
|
||||
{"min": 50, "title": "DSB-Junior"},
|
||||
{"min": 200, "title": "DSB / AI-Officer"},
|
||||
{"min": 500, "title": "Senior-DSB / Senior-AI-Officer"},
|
||||
{"min": 1250, "title": "Compliance-Lead"},
|
||||
{"min": 2500, "title": "Chief Compliance Officer"},
|
||||
{"min": 5000, "title": "Aufsichtsbehörde-Veteran"}
|
||||
]
|
||||
}
|
||||
4
src/levels-fallback.js
Normal file
4
src/levels-fallback.js
Normal file
|
|
@ -0,0 +1,4 @@
|
|||
{ min: 0, title: 'Compliance-Lernende' }, { min: 50, title: 'DSB-Junior' },
|
||||
{ min: 200, title: 'DSB / AI-Officer' }, { min: 500, title: 'Senior-DSB / Senior-AI-Officer' },
|
||||
{ min: 1250, title: 'Compliance-Lead' }, { min: 2500, title: 'Chief Compliance Officer' },
|
||||
{ min: 5000, title: 'Aufsichtsbehörde-Veteran' }
|
||||
29
src/welcome.html
Normal file
29
src/welcome.html
Normal file
|
|
@ -0,0 +1,29 @@
|
|||
<h2>Hi, ich bin KURT.</h2>
|
||||
<p>Ich nehm dir die Doppelarbeit zwischen <strong>DSGVO</strong> und <strong>EU AI Act</strong> ab — Crosswalk statt Excel-Hölle. Beide Regimes parallel, ohne dass du dieselbe Risiko-Bewertung zweimal schreibst. Sag mir: was treibt dich gerade — DSFA-Update, AI-System-Klassifikation, Audit-Vorbereitung? Erstmal die grobe Lage, dann gehen wir tief.</p>
|
||||
<div class="mode-grid">
|
||||
<button class="mode-card" data-goto="chat">
|
||||
<strong>Chat</strong>
|
||||
<span>Frag mich alles zu DSGVO + AI Act Schnittstellen.</span>
|
||||
</button>
|
||||
<button class="mode-card" data-goto="quiz">
|
||||
<strong>Quiz</strong>
|
||||
<span>Audit-Szenarien aus dem Compliance-Alltag, mit XP.</span>
|
||||
</button>
|
||||
<button class="mode-card" data-goto="flash">
|
||||
<strong>Flashcards</strong>
|
||||
<span>Artikel, Crosswalks, Risiko-Klassen — mit Spaced-Repetition.</span>
|
||||
</button>
|
||||
<button class="mode-card" data-goto="progress">
|
||||
<strong>Fortschritt</strong>
|
||||
<span>XP, Streaks, Badges, Level.</span>
|
||||
</button>
|
||||
<button class="mode-card" data-goto="curriculum">
|
||||
<strong>Module</strong>
|
||||
<span>5 Curricula / 25 Module: Integration · DSGVO-Essenz · AI-Act-Essenz · Hotspots · Risikoregister.</span>
|
||||
</button>
|
||||
<button class="mode-card" data-prompt="AUDIT_REQUEST: Mein KI-System ist [Use-Case]. Klassifiziere DSGVO + AI-Act + erforderliche Artefakte.">
|
||||
<strong>Audit-Klassifikation</strong>
|
||||
<span><code>AUDIT_REQUEST</code> + Use-Case → DSGVO + AI-Act-Klassifikation mit Artefakt-Liste als Karte.</span>
|
||||
</button>
|
||||
</div>
|
||||
<p style="font-size:.82rem;color:var(--text-mute)">Drei Sätze: Klassifizier dein AI-System (DSGVO + AI Act parallel) → Lass dir Crosswalk-Mapping erklären → Verstehe wo Doppelarbeit vermeidbar ist. KURT ist der Brückenbauer — DSGVO-tief? Ruf Cora. AI-Act-Audit-Tiefe? Ruf VESTIGIA.</p>
|
||||
1751
www/app.js
Normal file
1751
www/app.js
Normal file
File diff suppressed because it is too large
Load diff
382
www/curricula.json
Normal file
382
www/curricula.json
Normal file
|
|
@ -0,0 +1,382 @@
|
|||
{
|
||||
"version": "2026-04-25",
|
||||
"updated": "2026-04-25",
|
||||
"curricula": [
|
||||
{
|
||||
"id": "warum-integrieren",
|
||||
"title": "1 · Warum integrieren",
|
||||
"short": "Warum DSGVO + AI Act zusammen denken",
|
||||
"icon": "shuffle",
|
||||
"color": "#7c3aed",
|
||||
"description": "Beide Verordnungen gelten parallel — keine ersetzt die andere. Die drei klassischen Doppelarbeits-Hotspots: DSFA <-> RMS, Art. 22 <-> AI-Act Art. 13/14, Daten-Governance <-> Art. 10. Zielbild: ein integriertes Risiko-Register.",
|
||||
"source_md": "00-warum-integrieren.md",
|
||||
"modules": [
|
||||
{
|
||||
"id": "integration",
|
||||
"title": "Warum überhaupt integrieren?",
|
||||
"objectives": [
|
||||
"Verstehen, warum DSGVO und AI Act parallel gelten",
|
||||
"Die expliziten Verweise des AI Act auf die DSGVO benennen",
|
||||
"Die drei Doppelarbeits-Hotspots identifizieren"
|
||||
],
|
||||
"topics": ["Art. 2 Abs. 7 AI Act", "Art. 26 Abs. 9 AI Act", "Erwägungsgrund 9", "Doppelarbeit"],
|
||||
"difficulty": "einfach",
|
||||
"source_heading": "Warum es einen integrierten Auditor braucht"
|
||||
},
|
||||
{
|
||||
"id": "begriffsklaerung",
|
||||
"title": "Begriffsklärung — Anbieter vs. Betreiber",
|
||||
"objectives": [
|
||||
"Anbieter (Provider) vs. Betreiber (Deployer) sicher abgrenzen",
|
||||
"DSGVO-Verantwortlicher vs. Auftragsverarbeiter zuordnen",
|
||||
"Mehrere Rollen pro Unternehmen: typische Konstellationen"
|
||||
],
|
||||
"topics": ["Art. 3 AI Act", "Art. 4 DSGVO", "Inverkehrbringen", "Inbetriebnahme"],
|
||||
"difficulty": "mittel",
|
||||
"source_heading": "Persönlicher Anwendungsbereich"
|
||||
},
|
||||
{
|
||||
"id": "rollen-konflikte",
|
||||
"title": "Rollen-Konflikte: DSB & AI-Officer",
|
||||
"objectives": [
|
||||
"DSB als Pflichtberuf nach DSGVO Art. 37 verstehen",
|
||||
"AI-Officer als organisatorische Notwendigkeit (kein Pflichtberuf)",
|
||||
"Personalunion möglich, Interessenskonflikt prüfen"
|
||||
],
|
||||
"topics": ["Art. 37 DSGVO", "Art. 38 DSGVO", "Personalunion", "Interessenkonflikt"],
|
||||
"difficulty": "mittel",
|
||||
"source_heading": "Rollen klären"
|
||||
},
|
||||
{
|
||||
"id": "zielbild-register",
|
||||
"title": "Zielbild: ein integriertes Risiko-Register",
|
||||
"objectives": [
|
||||
"Single-Source-of-Truth-Logik verstehen",
|
||||
"Verarbeitungsverzeichnis + Bestands-Inventar verschmelzen",
|
||||
"Quartals-Review-Rhythmus etablieren"
|
||||
],
|
||||
"topics": ["Art. 30 DSGVO", "Art. 11 AI Act", "Inventar", "Review-Rhythmus"],
|
||||
"difficulty": "einfach",
|
||||
"source_heading": "Zielbild: ein integriertes Risiko-Register"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "dsgvo-fuer-ai-leute",
|
||||
"title": "2 · DSGVO-Essenz für AI-Profis",
|
||||
"short": "Art. 5, 6, 9, 22, 25, 32, 35 in der AI-Übersetzung",
|
||||
"icon": "shield",
|
||||
"color": "#a78bfa",
|
||||
"description": "Für AI-Officer, Data-Scientists, ML-Engineers: das Pflicht-Set DSGVO. Die 7 wichtigsten Artikel mit AI-Bezug, Art. 9 für Bias-Audits, Privacy by Design im Pipeline-Kontext.",
|
||||
"source_md": "01-dsgvo-essenz-fuer-ai-leute.md",
|
||||
"modules": [
|
||||
{
|
||||
"id": "dsgvo-essenz",
|
||||
"title": "Die 7 Pflicht-Artikel (Art. 5/6/9/22/25/32/35)",
|
||||
"objectives": [
|
||||
"Alle 7 Artikel benennen und in AI-Pipelines einordnen",
|
||||
"Art. 22 als direkten AI-DSGVO-Hotspot erkennen",
|
||||
"Art. 9 als Bias-Audit-Stolperfalle verstehen"
|
||||
],
|
||||
"topics": ["Art. 5", "Art. 6", "Art. 9", "Art. 22", "Art. 25", "Art. 32", "Art. 35"],
|
||||
"difficulty": "mittel",
|
||||
"source_heading": "Die 7 Artikel, die für AI immer relevant sind"
|
||||
},
|
||||
{
|
||||
"id": "grundsaetze-ai",
|
||||
"title": "Art. 5 Grundsätze in AI-Übersetzung",
|
||||
"objectives": [
|
||||
"Zweckbindung in Trainings- vs. Inferenz-Phase trennen",
|
||||
"Datenminimierung als Modell-Verbesserer (nicht nur Pflicht)",
|
||||
"Speicherbegrenzung inkl. gelernter Repräsentationen"
|
||||
],
|
||||
"topics": ["Zweckbindung", "Datenminimierung", "Speicherbegrenzung", "Embeddings"],
|
||||
"difficulty": "schwer",
|
||||
"source_heading": "Art. 5 — die 7 Grundsätze in der AI-Übersetzung"
|
||||
},
|
||||
{
|
||||
"id": "rechtsgrundlagen-ai",
|
||||
"title": "Art. 6 Rechtsgrundlagen für AI-Pipelines",
|
||||
"objectives": [
|
||||
"Eine Grundlage für Training, eine andere für Inferenz wählen können",
|
||||
"Berechtigtes Interesse + LIA für Modell-Training begründen",
|
||||
"Einwilligung im Beschäftigtenverhältnis kritisch prüfen"
|
||||
],
|
||||
"topics": ["Art. 6 lit. a-f", "LIA", "Beschäftigtenverhältnis", "vorvertraglich"],
|
||||
"difficulty": "schwer",
|
||||
"source_heading": "Art. 6 — die 6 Rechtsgrundlagen im AI-Kontext"
|
||||
},
|
||||
{
|
||||
"id": "art9-bias",
|
||||
"title": "Art. 9 + Bias-Audit-Dilemma",
|
||||
"objectives": [
|
||||
"Besondere Kategorien benennen (Gesundheit, Ethnie, Religion, etc.)",
|
||||
"Verbots-Logik mit Ausnahmen Abs. 2 verstehen",
|
||||
"AI Act Art. 10 Abs. 5 als zusätzliche Erlaubnis-Norm einsetzen"
|
||||
],
|
||||
"topics": ["Art. 9 Abs. 1+2", "Bias-Audit", "Art. 10 Abs. 5 AI Act", "Pseudonymisierung"],
|
||||
"difficulty": "schwer",
|
||||
"source_heading": "Art. 9 — besondere Kategorien"
|
||||
},
|
||||
{
|
||||
"id": "privacy-by-design-ai",
|
||||
"title": "Art. 25 Privacy by Design in AI-Architektur",
|
||||
"objectives": [
|
||||
"Default kein PII in Embeddings (DP, Anonymisierung)",
|
||||
"Multi-Tenant-Isolation in Federated-Learning-Setups",
|
||||
"Kürzeste Retention als Default-Konfiguration"
|
||||
],
|
||||
"topics": ["Differential Privacy", "Federated Learning", "Retention", "Default"],
|
||||
"difficulty": "schwer",
|
||||
"source_heading": "Art. 25 — Privacy by Design + Default"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "ai-act-fuer-dsb",
|
||||
"title": "3 · AI-Act-Essenz für DSB",
|
||||
"short": "Risiko-Klassen, Anhang III, Art. 9-15, Konformität",
|
||||
"icon": "scale",
|
||||
"color": "#06b6d4",
|
||||
"description": "Für klassische DSB: das Pflicht-Set EU AI Act. Vier Risiko-Klassen, Anhang III als Hochrisiko-Liste (HR-Filter, Bonität, Bildung), die RMS-Familie Art. 9-15, Konformitätsbewertung + CE.",
|
||||
"source_md": "02-ai-act-essenz-fuer-dsb.md",
|
||||
"modules": [
|
||||
{
|
||||
"id": "ai-act-essenz",
|
||||
"title": "Die 4 Risiko-Klassen + GPAI",
|
||||
"objectives": [
|
||||
"Verboten / Hochrisiko / Limitiert / Minimal sicher zuordnen",
|
||||
"GPAI als eigene Säule erkennen (Art. 51-56)",
|
||||
"Stichtag-Logik bis 02.08.2027 verstehen"
|
||||
],
|
||||
"topics": ["Art. 5", "Art. 6", "Art. 50", "Anhang III", "GPAI", "Timeline"],
|
||||
"difficulty": "einfach",
|
||||
"source_heading": "Die vier Risiko-Klassen"
|
||||
},
|
||||
{
|
||||
"id": "anhang-iii",
|
||||
"title": "Anhang III — wo Mittelständler hängenbleiben",
|
||||
"objectives": [
|
||||
"HR-Bewerber-Filter als Hochrisiko erkennen",
|
||||
"Bonitäts-Scoring + Versicherungs-Risiko korrekt einordnen",
|
||||
"Bildungs-AI (Prüfungs-Auswertung etc.) als Hochrisiko"
|
||||
],
|
||||
"topics": ["Beschäftigung", "Bildung", "Bonität", "Kritische Infrastruktur"],
|
||||
"difficulty": "mittel",
|
||||
"source_heading": "Anhang III — wo die meisten Mittelständler hängen bleiben"
|
||||
},
|
||||
{
|
||||
"id": "rms-familie",
|
||||
"title": "RMS-Familie Art. 9-15",
|
||||
"objectives": [
|
||||
"Art. 9 RMS, Art. 10 Daten, Art. 11 Doku, Art. 12 Logging",
|
||||
"Art. 13 Transparenz, Art. 14 Aufsicht, Art. 15 Robustheit benennen",
|
||||
"Verbindung zu DSGVO-Pendants herstellen"
|
||||
],
|
||||
"topics": ["Art. 9", "Art. 10", "Art. 11", "Art. 12", "Art. 13", "Art. 14", "Art. 15"],
|
||||
"difficulty": "mittel",
|
||||
"source_heading": "Die Pflichten für Hochrisiko-Systeme"
|
||||
},
|
||||
{
|
||||
"id": "konformitaet-ce",
|
||||
"title": "Konformitätsbewertung + CE-Kennzeichnung",
|
||||
"objectives": [
|
||||
"Anhang VI (interne Kontrolle) vs. Anhang VII (Notified Body)",
|
||||
"CE-Kennzeichnung + EU-Konformitätserklärung + EU-Datenbank",
|
||||
"10-Jahre-Aufbewahrung der Tech-Doku"
|
||||
],
|
||||
"topics": ["Art. 43", "Art. 47", "Art. 48", "Art. 49", "Anhang VI/VII", "Notified Body"],
|
||||
"difficulty": "schwer",
|
||||
"source_heading": "Konformitätsbewertung & CE-Kennzeichnung"
|
||||
},
|
||||
{
|
||||
"id": "betreiber-pflichten",
|
||||
"title": "Betreiber-Pflichten Art. 26",
|
||||
"objectives": [
|
||||
"Anbieter-Anweisungen befolgen, Eingangs-Daten qualitätssichern",
|
||||
"Menschliche Aufsicht: qualifiziertes Personal sicherstellen",
|
||||
"Art. 26 Abs. 9: DSFA durchführen — direkter DSGVO-Hook!"
|
||||
],
|
||||
"topics": ["Art. 26", "Eingangs-Datenqualität", "Aufsicht", "Vorfalls-Meldung"],
|
||||
"difficulty": "mittel",
|
||||
"source_heading": "Pflichten der Betreiber"
|
||||
},
|
||||
{
|
||||
"id": "sanktionen-ai",
|
||||
"title": "Sanktionen Art. 99 + AI-Literacy Art. 4",
|
||||
"objectives": [
|
||||
"Verbotene Praxis: bis 35 Mio. € / 7 % Umsatz",
|
||||
"Andere Pflichten: bis 15 Mio. € / 3 %",
|
||||
"AI-Literacy-Pflicht seit 02.02.2025 für ALLE Anwender"
|
||||
],
|
||||
"topics": ["Art. 99", "Art. 4 AI-Literacy", "02.02.2025", "Schulung"],
|
||||
"difficulty": "einfach",
|
||||
"source_heading": "Sanktionen"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "hotspots",
|
||||
"title": "4 · Crosswalks + Hotspots",
|
||||
"short": "DSFA <-> RMS, Art. 22 <-> AI-Act, Daten-Governance",
|
||||
"icon": "git-branch",
|
||||
"color": "#5b21b6",
|
||||
"description": "Die drei zentralen Crosswalks: Art. 35 DSFA <-> Art. 9 RMS (was überlappt, was ist neu), Art. 22 DSGVO <-> AI-Act Art. 13/14 (EuGH Schufa!), Art. 5/9 DSGVO <-> Art. 10 AI Act (Bias-Audit-Dilemma).",
|
||||
"source_md": "03-crosswalk-art35-dsfa-vs-art9-rms.md",
|
||||
"modules": [
|
||||
{
|
||||
"id": "crosswalk",
|
||||
"title": "DSFA (Art. 35) <-> RMS (Art. 9)",
|
||||
"objectives": [
|
||||
"Sechs gemeinsame Risk-Engineering-Schritte erkennen",
|
||||
"Vier neue RMS-Dimensionen (Lifecycle, Drift, Oversight, FRIA)",
|
||||
"Drei DSFA-only Sektionen (DSB-Konsultation, Aufsichtsbehörde, Betroffenenrechte)"
|
||||
],
|
||||
"topics": ["Art. 35", "Art. 9", "Lifecycle", "FRIA", "Drift-Monitoring"],
|
||||
"difficulty": "schwer",
|
||||
"source_heading": "Die große Überlappung"
|
||||
},
|
||||
{
|
||||
"id": "art22",
|
||||
"title": "Art. 22 <-> AI-Act Art. 13/14",
|
||||
"objectives": [
|
||||
"Drei Tatbestandsmerkmale Art. 22 erkennen",
|
||||
"EuGH Schufa (C-634/21) verstehen — abgesenkte Schwelle",
|
||||
"Substanzielle menschliche Aufsicht (Art. 14) operationalisieren"
|
||||
],
|
||||
"topics": ["Art. 22 Abs. 1+3", "EuGH Schufa", "Art. 13", "Art. 14", "Recht auf Erklärung Art. 86"],
|
||||
"difficulty": "schwer",
|
||||
"source_heading": "Was Art. 22 DSGVO sagt"
|
||||
},
|
||||
{
|
||||
"id": "art10-daten",
|
||||
"title": "Art. 5 + 9 DSGVO <-> Art. 10 AI Act",
|
||||
"objectives": [
|
||||
"Datenqualität gleichzeitig DSGVO + AI-Act-Pflicht",
|
||||
"Art. 10 Abs. 5 als eigenständige Erlaubnis-Norm für Bias-Tests",
|
||||
"Membership-Inference: Modell-Gewichte als personenbezogene Daten"
|
||||
],
|
||||
"topics": ["Art. 10 AI Act", "Bias-Test-Erlaubnis", "Membership Inference", "Provenance"],
|
||||
"difficulty": "schwer",
|
||||
"source_heading": "Crosswalk-Tabelle Daten-Pflichten"
|
||||
},
|
||||
{
|
||||
"id": "tom-konformitaet",
|
||||
"title": "TOMs (Art. 32) <-> Konformität (Art. 43+)",
|
||||
"objectives": [
|
||||
"Doppelnutzbare Maßnahmen identifizieren (Verschlüsselung, Logging)",
|
||||
"AI-only Maßnahmen ergänzen (Drift, Bias, Adversarial)",
|
||||
"Eine Maßnahmen-Datenbank, zwei Doku-Stränge"
|
||||
],
|
||||
"topics": ["Art. 32", "Art. 43", "Anhang IV", "Maßnahmen-DB"],
|
||||
"difficulty": "mittel",
|
||||
"source_heading": "Crosswalk: Sicherheits-Maßnahmen"
|
||||
},
|
||||
{
|
||||
"id": "behoerden-mapping",
|
||||
"title": "DPAs <-> Marktüberwachung",
|
||||
"objectives": [
|
||||
"Doppelmeldung bei Vorfall: Art. 33 DSGVO + Art. 73 AI Act",
|
||||
"Behörden-Architektur DE in Übergangsphase",
|
||||
"Strengere Anforderung erfüllen bei divergierenden Auslegungen"
|
||||
],
|
||||
"topics": ["BfDI", "Landes-DPA", "BNetzA", "AI Office", "Doppelmeldung"],
|
||||
"difficulty": "mittel",
|
||||
"source_heading": "Crosswalk: Wer für was zuständig"
|
||||
}
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "praxis-register",
|
||||
"title": "5 · Risikoregister + Praxis-Workflow",
|
||||
"short": "Integriertes Inventar + Vorfalls-Workflow + FAQ",
|
||||
"icon": "list-checks",
|
||||
"color": "#22c55e",
|
||||
"description": "Der Praxis-Teil: integriertes System-Inventar als SSoT, Vorfalls-Meldeprozess mit zwei Strecken, typische DSB+AI-Officer-Praxis-Fragen.",
|
||||
"source_md": "08-template-integriertes-risikoregister.md",
|
||||
"modules": [
|
||||
{
|
||||
"id": "risikoregister",
|
||||
"title": "Integriertes Risikoregister aufsetzen",
|
||||
"objectives": [
|
||||
"Mindest-Spalten-Set anwenden",
|
||||
"Crosswalk-Einsparungen pro System dokumentieren",
|
||||
"Quartals-Review + Trigger-basierte Updates etablieren"
|
||||
],
|
||||
"topics": ["Art. 30 DSGVO", "Art. 11 AI Act", "SSoT", "Quartals-Review"],
|
||||
"difficulty": "mittel",
|
||||
"source_heading": "Spalten-Definition"
|
||||
},
|
||||
{
|
||||
"id": "beispiel-hr",
|
||||
"title": "Beispiel HR-Bewerber-Filter — Ende-zu-Ende",
|
||||
"objectives": [
|
||||
"Klassifikation Hochrisiko + Art. 22-Check parallel",
|
||||
"DSFA + RMS + Tech-Doku als integriertes Paket",
|
||||
"Vendor-Vertrag mit AI-Act-Anbieter-Pflichten-Klausel"
|
||||
],
|
||||
"topics": ["HR-Filter", "DSFA", "RMS", "Vendor-AVV"],
|
||||
"difficulty": "schwer",
|
||||
"source_heading": "Beispiel-Eintrag: HR-Bewerbungsfilter"
|
||||
},
|
||||
{
|
||||
"id": "vorfalls-prozess",
|
||||
"title": "Integrierter Vorfalls-Meldeprozess",
|
||||
"objectives": [
|
||||
"DSGVO Art. 33 (72h) + AI Act Art. 73 (unverzüglich) parallel",
|
||||
"Trigger-Erkennung gemeinsam, Klassifizierung getrennt",
|
||||
"Gemeinsame Vorfalls-Doku mit zwei Anhängen"
|
||||
],
|
||||
"topics": ["Art. 33", "Art. 34", "Art. 73", "Frühwarn-System"],
|
||||
"difficulty": "mittel",
|
||||
"source_heading": "Doppelmeldung bei Vorfällen"
|
||||
},
|
||||
{
|
||||
"id": "ai-literacy",
|
||||
"title": "AI-Literacy + Schulungs-Konzept",
|
||||
"objectives": [
|
||||
"Art. 4 AI Act seit 02.02.2025 als Pflicht für ALLE Anwender",
|
||||
"Rollen-spezifische Schulungs-Curricula",
|
||||
"Schulungs-Doku als TOM (DSGVO Art. 32) zweitnutzen"
|
||||
],
|
||||
"topics": ["Art. 4 AI Act", "Schulung", "Rollen", "TOM"],
|
||||
"difficulty": "einfach",
|
||||
"source_heading": "AI-Literacy übersehen"
|
||||
},
|
||||
{
|
||||
"id": "faq-praxis",
|
||||
"title": "Praxis-FAQ DSB & AI-Officer",
|
||||
"objectives": [
|
||||
"Typische Personalunion-Frage beantworten",
|
||||
"ChatGPT-für-HR-Sichtung-Falle erkennen",
|
||||
"Membership-Inference + Lösch-Anfragen einordnen"
|
||||
],
|
||||
"topics": ["Personalunion", "ChatGPT-HR", "Lösch-Anfrage", "Modell-Gewichte"],
|
||||
"difficulty": "mittel",
|
||||
"source_heading": "Häufige Fragen"
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"badges": [
|
||||
{"id": "erste_audit", "title": "Erste Audit", "icon": "shuffle", "description": "1. Quiz im Integrations-Modul erfolgreich — du hast den Crosswalk-Gedanken verinnerlicht."},
|
||||
{"id": "dsgvo_kenner", "title": "DSGVO-Kenner", "icon": "shield", "description": "5 Quiz im DSGVO-Essenz-Modul korrekt — die 7 Pflicht-Artikel sitzen."},
|
||||
{"id": "ai_act_kenner", "title": "AI-Act-Kenner", "icon": "scale", "description": "5 Quiz im AI-Act-Essenz-Modul korrekt — Risiko-Klassen + Anhang III sitzen."},
|
||||
{"id": "crosswalk_meister", "title": "Crosswalk-Meister", "icon": "git-branch", "description": "5 Quiz im Crosswalk-Modul korrekt — DSFA <-> RMS-Mapping sitzt."},
|
||||
{"id": "art22_pro", "title": "Art-22-Pro", "icon": "user-check", "description": "3 Quiz im Art-22-Modul korrekt — automatisierte Einzelentscheidungen sicher einordnen."},
|
||||
{"id": "register_architekt", "title": "Register-Architekt", "icon": "list-checks", "description": "Alle Flashcards des Risikoregister-Moduls bestanden — SSoT-Konzept verinnerlicht."},
|
||||
{"id": "kurt_meister", "title": "KURT-Meister", "icon": "crown", "description": "Alle 5 Curricula mit >=80% abgeschlossen — DSGVO+AI-Act parallel im Griff."},
|
||||
{"id": "streak_14", "title": "14-Tage-Streak", "icon": "flame", "description": "14 Tage in Folge aktiv — Compliance-Disziplin sichtbar."},
|
||||
{"id": "night_owl", "title": "Nachteule", "icon": "moon", "description": "Nach 22 Uhr gelernt."},
|
||||
{"id": "early_bird", "title": "Frühaufsteher", "icon": "sun", "description": "Vor 7 Uhr gelernt."}
|
||||
],
|
||||
"levels": [
|
||||
{"min": 0, "title": "Compliance-Lernende"},
|
||||
{"min": 50, "title": "DSB-Junior"},
|
||||
{"min": 200, "title": "DSB / AI-Officer"},
|
||||
{"min": 500, "title": "Senior-DSB / Senior-AI-Officer"},
|
||||
{"min": 1250, "title": "Compliance-Lead"},
|
||||
{"min": 2500, "title": "Chief Compliance Officer"},
|
||||
{"min": 5000, "title": "Aufsichtsbehörde-Veteran"}
|
||||
]
|
||||
}
|
||||
125
www/index.html
Normal file
125
www/index.html
Normal file
|
|
@ -0,0 +1,125 @@
|
|||
<!DOCTYPE html>
|
||||
<html lang="de">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<title>KURT · Dein DSGVO+AI-Act Kombi-Auditor</title>
|
||||
<meta name="viewport" content="width=device-width,initial-scale=1,viewport-fit=cover">
|
||||
<meta name="theme-color" content="#0a0a0f">
|
||||
<meta name="description" content="KURT — der integrierte Compliance-Auditor für DSGVO + EU AI Act. Crosswalk DSFA ↔ RMS, Art. 22 ↔ AI-Act Art. 13/14. Im deutschen Bunker.">
|
||||
<link rel="stylesheet" href="styles.css">
|
||||
<script>window.__KURT_KEY__ = 'qb_ea1d0b1e8bbe';</script>
|
||||
</head>
|
||||
<body>
|
||||
<div class="app" role="application" aria-label="KURT DSGVO+AI-Act Kombi-Auditor">
|
||||
|
||||
<header class="topbar">
|
||||
<div class="brand">
|
||||
<span class="brand-icon" aria-hidden="true">K</span>
|
||||
<span>KURT <small>Kombi-Auditor</small></span>
|
||||
</div>
|
||||
<div class="spacer"></div>
|
||||
<span class="status" role="status" aria-live="polite">Online</span>
|
||||
</header>
|
||||
|
||||
<nav class="tabbar" role="tablist" aria-label="Modi">
|
||||
<button class="tab" role="tab" aria-selected="true" aria-controls="view-chat" data-mode="chat">
|
||||
Chat
|
||||
<span class="tab-kbd">⌃1</span>
|
||||
</button>
|
||||
<button class="tab" role="tab" aria-selected="false" aria-controls="view-quiz" data-mode="quiz">
|
||||
Quiz
|
||||
<span class="tab-kbd">⌃2</span>
|
||||
</button>
|
||||
<button class="tab" role="tab" aria-selected="false" aria-controls="view-flash" data-mode="flash">
|
||||
Karten
|
||||
<span class="tab-kbd">⌃3</span>
|
||||
</button>
|
||||
<button class="tab" role="tab" aria-selected="false" aria-controls="view-progress" data-mode="progress">
|
||||
Fortschritt
|
||||
<span class="tab-kbd">⌃4</span>
|
||||
</button>
|
||||
<button class="tab" role="tab" aria-selected="false" aria-controls="view-curriculum" data-mode="curriculum">
|
||||
Module
|
||||
<span class="tab-kbd">⌃5</span>
|
||||
</button>
|
||||
</nav>
|
||||
|
||||
<main class="main">
|
||||
<!-- CHAT -->
|
||||
<section id="view-chat" class="view" role="tabpanel" aria-labelledby="tab-chat" data-active="true">
|
||||
<div id="welcome-screen" class="welcome hidden" aria-hidden="true">
|
||||
<h2>Hi, ich bin KURT.</h2>
|
||||
<p>Ich nehm dir die Doppelarbeit zwischen <strong>DSGVO</strong> und <strong>EU AI Act</strong> ab — Crosswalk statt Excel-Hölle. Beide Regimes parallel, ohne dass du dieselbe Risiko-Bewertung zweimal schreibst. Sag mir: was treibt dich gerade — DSFA-Update, AI-System-Klassifikation, Audit-Vorbereitung? Erstmal die grobe Lage, dann gehen wir tief.</p>
|
||||
<div class="mode-grid">
|
||||
<button class="mode-card" data-goto="chat">
|
||||
<strong>Chat</strong>
|
||||
<span>Frag mich alles zu DSGVO + AI Act Schnittstellen.</span>
|
||||
</button>
|
||||
<button class="mode-card" data-goto="quiz">
|
||||
<strong>Quiz</strong>
|
||||
<span>Audit-Szenarien aus dem Compliance-Alltag, mit XP.</span>
|
||||
</button>
|
||||
<button class="mode-card" data-goto="flash">
|
||||
<strong>Flashcards</strong>
|
||||
<span>Artikel, Crosswalks, Risiko-Klassen — mit Spaced-Repetition.</span>
|
||||
</button>
|
||||
<button class="mode-card" data-goto="progress">
|
||||
<strong>Fortschritt</strong>
|
||||
<span>XP, Streaks, Badges, Level.</span>
|
||||
</button>
|
||||
<button class="mode-card" data-goto="curriculum">
|
||||
<strong>Module</strong>
|
||||
<span>5 Curricula / 25 Module: Integration · DSGVO-Essenz · AI-Act-Essenz · Hotspots · Risikoregister.</span>
|
||||
</button>
|
||||
<button class="mode-card" data-prompt="AUDIT_REQUEST: Mein KI-System ist [Use-Case]. Klassifiziere DSGVO + AI-Act + erforderliche Artefakte.">
|
||||
<strong>Audit-Klassifikation</strong>
|
||||
<span><code>AUDIT_REQUEST</code> + Use-Case → DSGVO + AI-Act-Klassifikation mit Artefakt-Liste als Karte.</span>
|
||||
</button>
|
||||
</div>
|
||||
<p style="font-size:.82rem;color:var(--text-mute)">Drei Sätze: Klassifizier dein AI-System (DSGVO + AI Act parallel) → Lass dir Crosswalk-Mapping erklären → Verstehe wo Doppelarbeit vermeidbar ist. KURT ist der Brückenbauer — DSGVO-tief? Ruf Cora. AI-Act-Audit-Tiefe? Ruf VESTIGIA.</p>
|
||||
</div>
|
||||
|
||||
<div id="chat-box" class="chat-box" aria-live="polite" aria-label="Gespräch"></div>
|
||||
</section>
|
||||
|
||||
<!-- QUIZ -->
|
||||
<section id="view-quiz" class="view" role="tabpanel" aria-labelledby="tab-quiz">
|
||||
<div id="quiz-host"></div>
|
||||
</section>
|
||||
|
||||
<!-- FLASHCARDS -->
|
||||
<section id="view-flash" class="view" role="tabpanel" aria-labelledby="tab-flash">
|
||||
<div id="flash-host"></div>
|
||||
</section>
|
||||
|
||||
<!-- PROGRESS -->
|
||||
<section id="view-progress" class="view" role="tabpanel" aria-labelledby="tab-progress">
|
||||
<div id="progress-host"></div>
|
||||
</section>
|
||||
|
||||
<!-- CURRICULUM -->
|
||||
<section id="view-curriculum" class="view" role="tabpanel" aria-labelledby="tab-curr">
|
||||
<div id="curr-host"></div>
|
||||
</section>
|
||||
</main>
|
||||
|
||||
<form id="composer-form" class="composer" aria-label="Nachricht verfassen">
|
||||
<div id="attach-strip" class="attach-strip" aria-live="polite"></div>
|
||||
<div class="composer-row">
|
||||
<button type="button" class="btn-attach" id="composer-attach" aria-label="Datei anhängen" title="Datei anhängen (PDF, Bild, Text — max 5 Dateien, 8 MB)">📎</button>
|
||||
<input type="file" id="composer-file" multiple accept=".pdf,.txt,.md,.csv,.json,.xml,.yaml,.yml,.log,.png,.jpg,.jpeg,.webp,.gif" hidden>
|
||||
<textarea id="composer" rows="1" placeholder="Frag KURT — Enter zum Senden, Shift+Enter für Zeilenumbruch" aria-label="Nachricht"></textarea>
|
||||
<button type="submit" class="btn-primary" id="composer-send">Senden</button>
|
||||
</div>
|
||||
</form>
|
||||
|
||||
<footer class="footer">
|
||||
Sovereign AI · Deutscher Bunker · <a href="https://qognio.com">Qognio</a> · DSGVO-konform · Keine externen Fonts · Keine Cookies
|
||||
</footer>
|
||||
</div>
|
||||
|
||||
<div id="toast-stack" class="toast-stack" aria-live="polite"></div>
|
||||
|
||||
<script src="app.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
1038
www/styles.css
Normal file
1038
www/styles.css
Normal file
File diff suppressed because it is too large
Load diff
Loading…
Reference in a new issue