AI Risk & Governance

When to Use

• Classifying AI use cases by risk tier and impact
• Drafting AI acceptable-use policies and governance frameworks
• Building AI risk registers with likelihood/severity/mitigation tracking
• Preparing model cards, system cards, or DPIAs for AI deployments
• Reviewing third-party LLM vendors (data terms, fine-tuning, safety commitments)
• Mapping AI products to frameworks (NIST AI RMF, ISO 42001, EU AI Act concepts)
• Aligning product and engineering teams with compliance requirements
• Designing human-in-the-loop oversight for consequential AI decisions

When NOT to Use

• Implementing RAG pipelines, agents, or production features → ai-engineer
• Running jailbreak tests or adversarial campaigns → ai-redteam
• SOC 2/ISO evidence automation and technical control mapping → compliance-engineer
• General SOC 2 IT controls without AI scope → cybersecurity
• Commercial/enterprise AI solution architecture → applied-ai-architect-commercial-enterprise
• Skills portfolio governance and publish gates → ai-skill-manager

Related skills

Core Workflows

1. Use-case intake and classification

Capture:

Risk tier (example):

See references/risk_classification.md for EU AI Act–oriented mapping (non-legal).

2. Risk assessment

Use structured worksheet:

1. Identify hazards (bias, hallucination, leakage, misuse, dependency)
2. Estimate likelihood and severity
3. Define mitigations (technical, process, legal)
4. Assign owner and review date
5. Residual risk acceptance sign-off

See references/risk_assessment.md for worksheets and NIST AI RMF functions.

3. Documentation artifacts

See references/documentation.md for model card sections and change log.

4. Policy and oversight

• Acceptable use policy (prohibited uses, approval paths)
• Human oversight rules for consequential decisions
• Escalation for policy violations and serious incidents
• Training for builders and reviewers

See references/policy_oversight.md for governance committee cadence.

5. Vendor and third-party models

Review: data processing terms, subprocessors, retention, fine-tuning on customer data, safety commitments, breach notification, exit plan.

See references/vendor_review.md for vendor questionnaire topics.

When to load references

• Tiering and regulation mapping → references/risk_classification.md
• Assessments and frameworks → references/risk_assessment.md
• Model cards → references/documentation.md
• Policies and committees → references/policy_oversight.md
• Vendors → references/vendor_review.md