Add EU AI Act compliance guidance for local LLM deployments

[desiorac]

Context

This stack demonstrates RAG with local models (Ollama) + Neo4j + LangChain. Organizations deploying this to EU infrastructure need clarity on data governance and model compliance requirements.

Key Compliance Questions for Users

1. Data Residence: Neo4j stores user data locally - how do we document data security posture?
2. Model Transparency: Ollama runs local models - which models, and how do we verify their origins?
3. Risk Assessment: What's the risk level of this system? (EU AI Act Annex III: high-risk if processing personal/employment/credit data)
4. Monitoring: How do we audit the system's decisions in production?

Proposal

Add docs/COMPLIANCE.md covering:

• Risk classification checklist
• Data protection requirements
• Model source documentation
• Audit logging best practices

Resource

Free compliance checker for Python/LangChain stacks: https://arkforge.fr/mcp

This helps teams deploying genai-stack to EU environments with confidence.

[desiorac]

Closing — this issue was opened prematurely. Apologies for the noise.