AI Governance Advisor

Purpose

Define AI governance policies, roles, compliance mappings, and operational controls for responsible LLM deployment aligned with organizational and regulatory requirements.

Input: Organization context, jurisdiction/regulations, OWASP review or threat model (optional), use case catalog, risk appetite
Output: AI Governance Framework with policies, RACI matrix, compliance mapping, audit checklist, and lifecycle gates Examples: See examples.md for worked input/output.

Workflow

Step 1: Inventory AI use cases

Catalog deployed and planned AI systems:

Risk tier: Tier 1 (low — internal FAQ), Tier 2 (medium — customer-facing), Tier 3 (high — decisions affecting people/money).

Step 2: Define governance principles

Establish organization-level commitments:

• Transparency and explainability expectations
• Human oversight requirements by risk tier
• Data minimization and retention limits
• Prohibited use cases (e.g., covert profiling, unauthorized surveillance)
• Third-party model and vendor due diligence

Step 3: Map regulatory and standard obligations

Cross-reference OWASP LLM findings if available.

Step 4: Define policy documents

Step 5: Build RACI matrix

Step 6: Define lifecycle gates

Gate requirements by risk tier:

Step 7: Create audit and monitoring checklist

Operational controls to verify ongoing compliance:

• Model and prompt change log review
• Access and API key rotation
• User complaint and override tracking
• Vendor SLA and subprocessors review

Step 8: Validate

Run Validation checklist.

Decision Rules

Validation

• All in-scope use cases cataloged with risk tier
• Governance principles cover transparency, oversight, and prohibited uses
• Applicable regulations mapped with gap identification
• Core policy documents listed with owners and review cycles
• RACI matrix covers approval, deployment, change, and incident response
• Lifecycle gates differentiated by risk tier
• Audit checklist includes monitoring and change management
• No legal advice presented as definitive — flagged for legal review where needed

Anti-patterns

• Governance theater — policies exist but no lifecycle gates enforce them.
• One-size-fits-all tiers — same controls for internal FAQ and credit scoring.
• Missing ownership — RACI with empty Accountable column.
• Static compliance mapping — ignoring regulatory updates (EU AI Act phases).
• Decoupled from engineering — governance docs not linked to threat model and OWASP findings.

Best Practices

• Align risk tiers with ISO 42001 AI management system concepts where applicable.
• Integrate governance gates into existing SDLC (design review, release checklist).
• Maintain AI system registry as single source of truth for audits.
• Connect policy violations to incident response playbooks.

Output Structure

# AI Governance Framework: [Organization Name]

## Use Case Registry
| ID | Use case | Risk tier | Status |
|----|----------|-----------|--------|

## Governance Principles
1. [Principle with rationale]

## Compliance Mapping
| Standard | Applies | Requirements | Gap | Action |
|----------|---------|--------------|-----|--------|

## Policy Catalog
| Policy | Owner | Review cycle | Status |
|--------|-------|--------------|--------|

## RACI Matrix
[Table]

## Lifecycle Gates
| Gate | Tier 1 | Tier 2 | Tier 3 |
|------|--------|--------|--------|

## Audit Checklist
- [ ] [Control to verify]

## Open Items
- [ ] [Legal review needed]

Next Skills