This is a practical checklist, not legal advice. It covers the rules that most often decide whether a pack can be listed here at all. Dates follow the AI Act’s phased application; the Digital Omnibus proposals of 2026 may move the high-risk dates, so check the current state before relying on any of them.
1. Prohibited practices (AI Act Art. 5): never
Some uses are banned outright, not merely regulated. The ones creators run into: emotion recognition in the workplace or in education, social scoring, manipulative techniques that distort behaviour, untargeted scraping of facial images. A pack that does any of these is not listed, whatever its other merits. This catalog’s validator rejects a pack without an explicit art5_excluded: yes.
2. Transparency (AI Act Art. 50): disclose
If your agent sends messages to people (outreach, support replies, generated letters), the recipient must be told they are dealing with an AI system. If it generates synthetic text, audio or images for the public, the output must be marked. Build the disclosure into every outbound template; do not leave it to the operator.
3. High-risk domains (AI Act Annex III): a human decides
Employment and worker management, access to education, credit scoring, insurance pricing, essential services, law enforcement, migration, justice. A pack that recommends, ranks or drafts in these domains can be fine; a pack that decides is not. The practical line: every adverse outcome has a named human approver, the inputs and the approval are logged, and the agent can only recommend with reasons. The catalog lists a verified pack in a high-risk profession only when it keeps that human in the loop.
4. Consumer law for digital content (Directive 2019/770 and the Omnibus rules)
Selling a pack to a consumer in the EU means: the pack must conform to what you described, security updates are owed for the period the consumer can reasonably expect, the price including VAT is shown before purchase, and the buyer is told whether the seller is a business or a private person. If a platform sells on your behalf, it may become the deemed supplier for VAT on electronic services (Implementing Regulation 282/2011, Art. 9a).
5. Platform obligations (DSA)
A platform that lets third parties sell to consumers has trader-traceability duties (DSA Art. 30: identity, payment account, self-certification) and notice-and-action procedures. This is one reason this catalog takes no payments on behalf of creators: it lists, links and verifies, and every purchase happens on the creator’s own page or on an established marketplace.
6. Data
A pack is often tested on real data by its creator. Do not ship examples that contain personal data; use synthetic cases. Under GDPR a candidate’s CV or a customer’s e-mail in a prompt example is still personal data.
The one-line version
No Art. 5 practice; disclosure in every message; a human on every decision about a person; synthetic examples only; a clear price and a clear seller. Packs that meet these five lines can be listed; the rest cannot.