tomevault-io 🤖 AI Governance Skill
🎯 Purpose
Enforce comprehensive AI risk management and EU AI Act compliance, based on AI Policy.
Key Principle: "AI systems require systematic risk management and human oversight."
📚 Scope
- 🤖 AI System Classification (EU AI Act risk levels)
- 🛡️ LLM Usage Governance (GitHub Copilot, ChatGPT)
- 👁️ Human Oversight Requirements
- ⚖️ Bias and Fairness Controls
- 📊 AI Risk Assessment
- 🔍 Transparency and Explainability
⚙️ Security Rules
MUST Requirements
ai_system_classification:
unacceptable_risk:
prohibited_systems:
- social_scoring: government_or_private_social_credit
- real_time_biometric: public_space_surveillance_without_warrant
- subliminal_manipulation: ai_that_manipulates_behavior
- exploit_vulnerabilities: ai_targeting_vulnerable_groups
action: never_develop_deploy_or_use
high_risk_systems:
examples:
- recruitment_ai: candidate_screening_or_selection
- credit_scoring: loan_approval_algorithms
- law_enforcement: predictive_policing_tools
requirements:
- risk_assessment: comprehensive_before_deployment
- data_quality: high_quality_representative_datasets
- documentation: technical_docs_and_user_manuals
- human_oversight: meaningful_human_review_required
- transparency: users_informed_of_ai_involvement
- conformity_assessment: third_party_audit_required
limited_risk_systems:
examples:
- chatbots: customer_service_bots
- deepfakes: synthetic_media_generation
requirements:
- transparency_obligations: users_informed_interacting_with_ai
- disclosure: ai_generated_content_labeled
minimal_risk_systems:
examples:
- spam_filters: email_filtering
- ai_video_games: entertainment_applications
- github_copilot: code_completion_assistance
requirements:
- voluntary_codes: follow_best_practices
- basic_transparency: disclose_ai_use_in_documentation
llm_usage_governance:
github_copilot:
approved_use:
- code_completion: autocomplete_and_suggestions
- documentation: generating_code_comments
- test_generation: creating_unit_test_scaffolding
security_controls:
- code_review: all_ai_generated_code_manually_reviewed
- secret_scanning: automated_pre_commit_hooks
- license_compliance: verify_suggested_code_licenses
- no_sensitive_data: never_input_customer_or_confidential_data
prohibited_use:
- production_secrets: entering_api_keys_or_passwords
- customer_data: inputting_personal_or_business_data
- unreviewed_deployment: deploying_ai_code_without_review
chatgpt_claude:
approved_use:
- research: general_information_gathering
- brainstorming: idea_generation_and_planning
- documentation: writing_assistance_for_public_docs
prohibited_use:
- confidential_data: client_information_or_trade_secrets
- source_code: proprietary_code_or_algorithms
- personal_data: customer_or_employee_information
human_oversight:
ai_decisions:
code_generation:
- review_required: all_copilot_suggestions_reviewed
- testing: ai_code_must_pass_automated_tests
- security_scan: sast_sca_checks_mandatory
business_decisions:
- ai_as_advisor: ai_provides_recommendations_only
- human_final_decision: ceo_makes_final_call
- documentation: record_ai_input_and_human_decision
MUST NOT Prohibitions
prohibited_ai_practices:
- unclassified_systems: deploying_ai_without_risk_assessment
- no_human_oversight: fully_automated_critical_decisions
- biased_training_data: using_unrepresentative_datasets
- black_box_systems: unexplainable_ai_for_high_risk_decisions
- sensitive_data_training: training_ai_on_personal_data_without_consent
- bypassing_controls: using_personal_ai_for_business_without_approval
💡 Examples
Example 1: GitHub Copilot Secure Usage
copilot_workflow:
development:
enable_copilot: vscode_github_copilot_extension
use_suggestions:
- code_completion: accept_for_boilerplate_code
- function_generation: review_logic_before_accepting
- test_scaffolding: verify_test_coverage_and_assertions
security_checks:
pre_commit:
- secret_scanning: gitleaks_pre_commit_hook
- code_review: manual_review_of_ai_suggestions
- license_check: verify_no_copyleft_violations
ci_cd_pipeline:
- sast: sonarcloud_static_analysis
- sca: dependabot_vulnerability_scanning
- test_coverage: minimum_80_percent_coverage
prohibited_inputs:
never_type:
- api_keys: aws_access_keys_database_passwords
- customer_data: email_addresses_names_personal_info
- proprietary_algorithms: trade_secret_business_logic
- production_configs: database_connection_strings
documentation:
- attribution: note_ai_assisted_code_in_comments
- review_notes: document_manual_changes_to_ai_suggestions
- lessons_learned: track_copilot_false_positives_for_training
Example 2: AI Risk Assessment Process
ai_risk_assessment:
system_identification:
name: recruitment_candidate_screening_tool
classification: HIGH_RISK_per_eu_ai_act
trigger: involves_employment_decisions
risk_analysis:
potential_harms:
- discrimination: algorithm_may_have_gender_or_age_bias
- privacy: processes_personal_data_from_resumes
- transparency: candidates_unaware_of_ai_involvement
likelihood: MEDIUM
impact: HIGH
overall_risk: HIGH
risk_mitigation:
technical_measures:
- bias_testing: fairness_metrics_on_diverse_test_set
- explainability: shap_or_lime_for_decision_explanations
- data_quality: representative_training_dataset
organizational_measures:
- human_review: recruiter_reviews_all_ai_recommendations
- transparency: candidates_informed_of_ai_use
- appeal_process: candidates_can_request_human_review
- audit: annual_third_party_fairness_audit
compliance_obligations:
eu_ai_act:
- risk_management_system: implemented_and_documented
- data_governance: high_quality_training_data_verified
- technical_documentation: available_for_authorities
- conformity_assessment: third_party_audit_planned
gdpr:
- lawful_basis: legitimate_interest_assessment
- data_minimization: only_relevant_resume_data_processed
- automated_decision: human_review_prevents_art_22_violation
approval:
decision: APPROVED_WITH_CONDITIONS
approver: CEO
date: 2026_02_10
review_date: 2026_08_10_semi_annual
conditions:
- quarterly_bias_testing
- monthly_human_override_rate_monitoring
- annual_external_audit
Example 3: Prohibited AI Use (Corrected)
❌ Non-Compliant:
incorrect_chatgpt_use:
prompt: "Review this customer database schema and suggest optimizations"
attached: production_database_dump_with_customer_emails
risk: exposing_personal_data_to_third_party_ai
✅ Corrected:
compliant_chatgpt_use:
data_anonymization:
- remove_personal_data: replace_emails_with_placeholders
- sanitize_schema: generic_field_names_only
- sample_data: synthetic_test_data_not_production
prompt: "Review this anonymized schema and suggest optimizations"
attached: sanitized_schema_with_no_real_data
verification:
- no_personal_data: verified_before_submission
- no_secrets: no_connection_strings_or_credentials
- documented: ai_consultation_logged_in_project_notes
🔗 Integration
Policies: AI Policy, Information Security
Skills: owasp-llm-security, data-classification, privacy-policy
Frameworks: EU AI Act, NIST AI RMF, ISO 42001 (draft)
📋 Document Control
Converted and distributed by TomeVault — claim your Tome and manage your conversions.