ai-governance

What this skill does

# AI Governance Planning

Comprehensive guidance for AI governance, regulatory compliance, and responsible AI practices before development begins.

## When to Use This Skill

- Building AI/ML systems that may fall under EU AI Act
- Implementing NIST AI Risk Management Framework
- Establishing responsible AI practices and governance
- Conducting AI risk classification and impact assessments
- Creating AI documentation and transparency reports

## EU AI Act Overview

### Risk-Based Classification

The EU AI Act categorizes AI systems by risk level:

```text
┌─────────────────────────────────────────────────────┐
│ UNACCEPTABLE RISK (Prohibited)                      │
│ • Social scoring by governments                     │
│ • Subliminal manipulation                           │
│ • Exploitation of vulnerabilities                   │
│ • Real-time biometric ID in public (exceptions)     │
├─────────────────────────────────────────────────────┤
│ HIGH RISK (Strict Requirements)                     │
│ • Biometric identification                          │
│ • Critical infrastructure management                │
│ • Education/vocational training access              │
│ • Employment, worker management, recruitment        │
│ • Essential services access (credit, insurance)     │
│ • Law enforcement                                   │
│ • Migration, asylum, border control                 │
│ • Justice and democratic processes                  │
├─────────────────────────────────────────────────────┤
│ LIMITED RISK (Transparency Obligations)             │
│ • Chatbots (must disclose AI interaction)           │
│ • Emotion recognition systems                       │
│ • Biometric categorization                          │
│ • Deepfakes (must label as generated)               │
├─────────────────────────────────────────────────────┤
│ MINIMAL RISK (No Specific Requirements)             │
│ • AI-enabled video games                            │
│ • Spam filters                                      │
│ • Inventory management                              │
└─────────────────────────────────────────────────────┘
```

### High-Risk AI Requirements

| Requirement | Description | Implementation |
|-------------|-------------|----------------|
| **Risk Management** | Continuous risk management system | Risk assessment process |
| **Data Governance** | Training data quality and governance | Data documentation |
| **Technical Documentation** | Detailed system documentation | System spec + model cards |
| **Record Keeping** | Automatic logging of events | Audit trail |
| **Transparency** | Clear instructions for users | User documentation |
| **Human Oversight** | Ability for human intervention | HITL mechanisms |
| **Accuracy, Robustness, Cybersecurity** | Appropriate performance levels | Testing + monitoring |

### Risk Classification Decision Tree

```csharp
public class EuAiActClassifier
{
    public AiRiskCategory Classify(AiSystemDescription system)
    {
        // Check for prohibited practices first
        if (IsProhibited(system))
            return AiRiskCategory.Unacceptable;

        // Check Annex III high-risk categories
        if (IsHighRiskCategory(system))
            return AiRiskCategory.High;

        // Check Annex I product safety legislation
        if (RequiresProductConformity(system))
            return AiRiskCategory.High;

        // Check for transparency obligations
        if (RequiresTransparency(system))
            return AiRiskCategory.Limited;

        return AiRiskCategory.Minimal;
    }

    private bool IsProhibited(AiSystemDescription system)
    {
        return system.UseCases.Any(uc =>
            uc.Type == UseCaseType.SocialScoring ||
            uc.Type == UseCaseType.SubliminalManipulation ||
            uc.Type == UseCaseType.VulnerabilityExploitation ||
            (uc.Type == UseCaseType.RealTimeBiometricId &&
             uc.Context == Context.PublicSpace &&
             !uc.HasLawEnforcementException));
    }

    private bool IsHighRiskCategory(AiSystemDescription system)
    {
        var highRiskCategories = new[]
        {
            Domain.BiometricIdentification,
            Domain.CriticalInfrastructure,
            Domain.EducationAccess,
            Domain.Employment,
            Domain.EssentialServices,
            Domain.LawEnforcement,
            Domain.MigrationAsylum,
            Domain.JusticeProcesses
        };

        return highRiskCategories.Contains(system.Domain);
    }
}

public enum AiRiskCategory
{
    Unacceptable,
    High,
    Limited,
    Minimal
}
```

## NIST AI Risk Management Framework

### The Four Functions

```text
┌─────────────────────────────────────────────────────────────┐
│                         GOVERN                               │
│  Culture, policies, accountability structures               │
│  ↓                                                          │
├─────────────────────────────────────────────────────────────┤
│        MAP              MEASURE           MANAGE            │
│  Context & risks →  Assess risks →   Prioritize &          │
│  identification     & impacts        mitigate               │
└─────────────────────────────────────────────────────────────┘
```

### Govern Function

Establish AI governance structures:

```markdown
## AI Governance Structure

### Roles and Responsibilities
| Role | Responsibilities |
|------|------------------|
| AI Governance Board | Strategic oversight, policy approval |
| AI Ethics Officer | Ethics review, bias assessment |
| AI Risk Manager | Risk identification, mitigation tracking |
| Model Owner | Lifecycle management, performance |
| Technical Lead | Implementation, testing, monitoring |

### Policies Required
- [ ] AI Development Policy
- [ ] Model Risk Management Policy
- [ ] AI Ethics Guidelines
- [ ] Data Quality Standards
- [ ] Human Oversight Requirements
- [ ] Incident Response for AI Failures
```

### Map Function

Understand context and identify risks:

```csharp
public class AiContextMapping
{
    public record AiSystemContext
    {
        public required string SystemName { get; init; }
        public required string Purpose { get; init; }
        public required List<string> Stakeholders { get; init; }
        public required List<string> ImpactedGroups { get; init; }
        public required string DecisionType { get; init; } // Augment vs Automate
        public required bool InvolvesVulnerablePopulations { get; init; }
        public required List<string> PotentialHarms { get; init; }
        public required List<string> PotentialBenefits { get; init; }
        public required List<string> LegalConstraints { get; init; }
    }

    public ContextAssessment Assess(AiSystemContext context)
    {
        var risks = new List<IdentifiedRisk>();

        // Assess stakeholder impacts
        foreach (var group in context.ImpactedGroups)
        {
            risks.Add(new IdentifiedRisk
            {
                Category = "Stakeholder Impact",
                Description = $"Potential impact on {group}",
                Severity = context.InvolvesVulnerablePopulations
                    ? RiskSeverity.High
                    : RiskSeverity.Medium
            });
        }

        // Assess potential harms
        foreach (var harm in context.PotentialHarms)
        {
            risks.Add(new IdentifiedRisk
            {
                Category = "Potential Harm",
                Description = harm,
                Severity = DetermineHarmSeverity(harm)
            });
        }

        return new ContextAssessment
        {
            Context = context,
            IdentifiedRisks = risks,
            RecommendedMitigations = GenerateMitigations(risks)
        };
    }
}
```

### Measure Function

Assess and analyze AI risks:

```markdown
## Risk Assessment Framework

### Trustworthiness Characteristics

| Characteristic | Assessment Questions |
|----------------|---------------------|
| **Valid