🤖 AI Governance Skill

🎯 Purpose

Enforce comprehensive AI risk management and EU AI Act compliance, based on AI Policy.

Key Principle: "AI systems require systematic risk management and human oversight."

📚 Scope

• 🤖 AI System Classification (EU AI Act risk levels)

• 🛡️ LLM Usage Governance (GitHub Copilot, ChatGPT)

• 👁️ Human Oversight Requirements

• ⚖️ Bias and Fairness Controls

• 📊 AI Risk Assessment

• 🔍 Transparency and Explainability

⚙️ Security Rules

MUST Requirements

ai_system_classification: unacceptable_risk: prohibited_systems: - social_scoring: government_or_private_social_credit - real_time_biometric: public_space_surveillance_without_warrant - subliminal_manipulation: ai_that_manipulates_behavior - exploit_vulnerabilities: ai_targeting_vulnerable_groups action: never_develop_deploy_or_use

high_risk_systems: examples: - recruitment_ai: candidate_screening_or_selection - credit_scoring: loan_approval_algorithms - law_enforcement: predictive_policing_tools requirements: - risk_assessment: comprehensive_before_deployment - data_quality: high_quality_representative_datasets - documentation: technical_docs_and_user_manuals - human_oversight: meaningful_human_review_required - transparency: users_informed_of_ai_involvement - conformity_assessment: third_party_audit_required

limited_risk_systems: examples: - chatbots: customer_service_bots - deepfakes: synthetic_media_generation requirements: - transparency_obligations: users_informed_interacting_with_ai - disclosure: ai_generated_content_labeled

minimal_risk_systems: examples: - spam_filters: email_filtering - ai_video_games: entertainment_applications - github_copilot: code_completion_assistance requirements: - voluntary_codes: follow_best_practices - basic_transparency: disclose_ai_use_in_documentation

llm_usage_governance: github_copilot: approved_use: - code_completion: autocomplete_and_suggestions - documentation: generating_code_comments - test_generation: creating_unit_test_scaffolding

security_controls:
  - code_review: all_ai_generated_code_manually_reviewed
  - secret_scanning: automated_pre_commit_hooks
  - license_compliance: verify_suggested_code_licenses
  - no_sensitive_data: never_input_customer_or_confidential_data

prohibited_use:
  - production_secrets: entering_api_keys_or_passwords
  - customer_data: inputting_personal_or_business_data
  - unreviewed_deployment: deploying_ai_code_without_review

chatgpt_claude: approved_use: - research: general_information_gathering - brainstorming: idea_generation_and_planning - documentation: writing_assistance_for_public_docs

prohibited_use:
  - confidential_data: client_information_or_trade_secrets
  - source_code: proprietary_code_or_algorithms
  - personal_data: customer_or_employee_information

human_oversight: ai_decisions: code_generation: - review_required: all_copilot_suggestions_reviewed - testing: ai_code_must_pass_automated_tests - security_scan: sast_sca_checks_mandatory

business_decisions:
  - ai_as_advisor: ai_provides_recommendations_only
  - human_final_decision: ceo_makes_final_call
  - documentation: record_ai_input_and_human_decision

MUST NOT Prohibitions

prohibited_ai_practices:

• unclassified_systems: deploying_ai_without_risk_assessment
• no_human_oversight: fully_automated_critical_decisions
• biased_training_data: using_unrepresentative_datasets
• black_box_systems: unexplainable_ai_for_high_risk_decisions
• sensitive_data_training: training_ai_on_personal_data_without_consent
• bypassing_controls: using_personal_ai_for_business_without_approval

💡 Examples

Example 1: GitHub Copilot Secure Usage

copilot_workflow: development: enable_copilot: vscode_github_copilot_extension use_suggestions: - code_completion: accept_for_boilerplate_code - function_generation: review_logic_before_accepting - test_scaffolding: verify_test_coverage_and_assertions

security_checks: pre_commit: - secret_scanning: gitleaks_pre_commit_hook - code_review: manual_review_of_ai_suggestions - license_check: verify_no_copyleft_violations

ci_cd_pipeline:
  - sast: sonarcloud_static_analysis
  - sca: dependabot_vulnerability_scanning
  - test_coverage: minimum_80_percent_coverage

prohibited_inputs: never_type: - api_keys: aws_access_keys_database_passwords - customer_data: email_addresses_names_personal_info - proprietary_algorithms: trade_secret_business_logic - production_configs: database_connection_strings

documentation: - attribution: note_ai_assisted_code_in_comments - review_notes: document_manual_changes_to_ai_suggestions - lessons_learned: track_copilot_false_positives_for_training

Example 2: AI Risk Assessment Process

ai_risk_assessment: system_identification: name: recruitment_candidate_screening_tool classification: HIGH_RISK_per_eu_ai_act trigger: involves_employment_decisions

risk_analysis: potential_harms: - discrimination: algorithm_may_have_gender_or_age_bias - privacy: processes_personal_data_from_resumes - transparency: candidates_unaware_of_ai_involvement

likelihood: MEDIUM
impact: HIGH
overall_risk: HIGH

risk_mitigation: technical_measures: - bias_testing: fairness_metrics_on_diverse_test_set - explainability: shap_or_lime_for_decision_explanations - data_quality: representative_training_dataset

organizational_measures:
  - human_review: recruiter_reviews_all_ai_recommendations
  - transparency: candidates_informed_of_ai_use
  - appeal_process: candidates_can_request_human_review
  - audit: annual_third_party_fairness_audit

compliance_obligations: eu_ai_act: - risk_management_system: implemented_and_documented - data_governance: high_quality_training_data_verified - technical_documentation: available_for_authorities - conformity_assessment: third_party_audit_planned

gdpr:
  - lawful_basis: legitimate_interest_assessment
  - data_minimization: only_relevant_resume_data_processed
  - automated_decision: human_review_prevents_art_22_violation

approval: decision: APPROVED_WITH_CONDITIONS approver: CEO date: 2026_02_10 review_date: 2026_08_10_semi_annual conditions: - quarterly_bias_testing - monthly_human_override_rate_monitoring - annual_external_audit

Example 3: Prohibited AI Use (Corrected)

❌ Non-Compliant:

incorrect_chatgpt_use: prompt: "Review this customer database schema and suggest optimizations" attached: production_database_dump_with_customer_emails risk: exposing_personal_data_to_third_party_ai

✅ Corrected:

compliant_chatgpt_use: data_anonymization: - remove_personal_data: replace_emails_with_placeholders - sanitize_schema: generic_field_names_only - sample_data: synthetic_test_data_not_production

prompt: "Review this anonymized schema and suggest optimizations" attached: sanitized_schema_with_no_real_data

verification: - no_personal_data: verified_before_submission - no_secrets: no_connection_strings_or_credentials - documented: ai_consultation_logged_in_project_notes

🔗 Integration

Policies: AI Policy, Information Security

Skills: owasp-llm-security, data-classification, privacy-policy

Frameworks: EU AI Act, NIST AI RMF, ISO 42001 (draft)

📋 Document Control

• Version: 1.0 | Updated: 2026-02-10

• License: Apache-2.0

• Classification: