governance-documentation

Governance Documentation

You cannot deploy an AI system without governance documentation. This skill generates the minimum required artefacts. Do not ship without completing every item.

What Must Exist Before Deployment

Document	Required For	Generated By
Model Card	All AI systems	This skill — Step 1
Risk Assessment	Tier 2+ systems	This skill — Step 2
ATRS Entry	UK public sector	This skill — Step 3
Incident Response Plan	All production systems	This skill — Step 4
Monitoring Plan	All production systems	This skill — Step 5

---

Step 1: Generate the Model Card

Run the model card generator:

python skills/governance-documentation/scripts/generate_model_card.py \
  --name "Your System Name" \
  --output docs/model-card.md

Or fill in this template manually:

# Model Card: [System Name]

## System Details
- **Name:** 
- **Version:** 
- **Date:** 
- **Type:** [Classification / Regression / NLP / Generative / Agent]
- **Owner:** 
- **Contact:** 

## Intended Use
- **Primary use:** 
- **Intended users:** 
- **Out-of-scope uses:**

## Training Data
- **Source:** 
- **Size:** 
- **Date range:** 
- **Known limitations:** 

## Performance
| Metric | Overall | Group A | Group B | Group C |
|---|---|---|---|---|
| Accuracy | | | | |
| F1 | | | | |
| FPR | | | | |

## Limitations
- 
- 

## Ethical Considerations
- Potential for harm: 
- Mitigations: 

## Human Oversight
- Who reviews outputs: 
- Override mechanism: 
- Override rate (target): 

---

Step 2: Complete the Risk Assessment

Answer every question. No blanks.

## AI Risk Assessment — [System Name]

### Impact Classification
- Affected population: 
- Decision reversibility: [Easily reversed / Difficult / Irreversible]
- Vulnerable groups affected: [Yes/No — specify]
- Maximum consequence of error: 
- Risk Tier: [1 / 2 / 3 / 4]

### Data Risks
- Personal data processed: [Yes/No]
- Special category data: [Yes/No — specify]
- DPIA completed: [Yes/No — date]
- Data minimisation applied: [Yes/No]

### Model Risks
- Bias assessment completed: [Yes/No — date]
- Fairness tests passing: [Yes/No]
- Known failure modes:
  1. 
  2. 
- Mitigation for each:
  1. 
  2. 

### Operational Risks
- What happens if system is unavailable: 
- Manual fallback process: 
- Time to restore service: 
- Monitoring in place: [Yes/No — describe]

### Residual Risk
- Overall residual risk: [Low / Medium / High / Critical]
- Accepted by (SRO name and date):