# AI Governance Plugin

In-house AI governance counsel workflows: use case triage, AI impact assessments,
vendor AI review, and regulation-to-policy gap analysis. Built around a team practice profile
learned from your AI policy, a reference impact assessment, and your key vendor AI
agreements.

**Every output is a draft for attorney review — cited, flagged, and gated — not a legal conclusion.** The plugin does the work: reads the documents, applies your playbook, finds the issues, drafts the memo. A lawyer reviews, verifies, and decides. Citations are tagged by source so you know which ones came from a research tool and which ones need checking. Privilege markers are applied conservatively so nothing waives by accident. Consequential actions — filing, sending, executing — are gated behind explicit confirmation.

## Who this is for

| Role | Primary workflows |
|---|---|
| **Privacy counsel / AI governance counsel** | Impact assessments, vendor AI review, reg gap analysis |
| **Product counsel** | Use case triage, launch review with AI component |
| **GC / Legal ops** | AI policy governance, escalation, board-level issues |
| **Procurement / legal** | Vendor AI contract review |

## First run: the cold-start interview

The plugin interviews you to learn: are you a builder, deployer, or both — which
regulations actually apply — what your use case red lines are — and what good impact
assessment looks like here. Then it reads your seed documents and learns your real
positions and house style.

```
/ai-governance-legal:cold-start-interview
```

## Commands

| Command | Does |
|---|---|
| `/ai-governance-legal:cold-start-interview` | Cold-start interview — writes your practice profile |
| `/ai-governance-legal:ai-inventory [list \| add \| edit \| classify \| show]` | Manage the EU AI Act per-system inventory — track each system's role and risk tier |
| `/ai-governance-legal:use-case-triage [use case]` | Classify a use case against your registry (approved / conditional / never) |
| `/ai-governance-legal:aia-generation [use case]` | Run an AI impact assessment (AIA) in your house style |
| `/ai-governance-legal:vendor-ai-review [vendor/file]` | Review a vendor AI agreement against your positions |
| `/ai-governance-legal:reg-gap-analysis [regulation]` | Diff a new regulation or guidance against current policy/practice |
| `/ai-governance-legal:policy-monitor` | Weekly sweep for AI policy drift, or direct query for a proposed new practice |
| `/ai-governance-legal:policy-starter` | Draft a firm AI usage policy from published model policies, adapted to your practice profile (draft for attorney review) |
| `/ai-governance-legal:matter-workspace` | Manage matter workspaces (multi-client private practice only) — new, list, switch, close, none |

## Skills

| Skill | Purpose |
|---|---|
| **cold-start-interview** | Writes `~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md` from interview + seed docs |
| **ai-inventory** | EU AI Act per-system inventory — role (provider, deployer, importer, distributor, authorized rep, product manufacturer) and risk tier per system |
| **use-case-triage** | Classifies use cases against the registry; flags missing assessments |
| **aia-generation** | AI impact assessment (AIA) in house format |
| **vendor-ai-review** | AI-specific vendor contract review against governance positions |
| **reg-gap-analysis** | New reg/guidance vs. current state, remediation plan |
| **policy-monitor** | Crawls outputs for practice drift; drafts AI policy language updates |
| **policy-starter** | Produces a first-draft AI usage policy sourced from published model policies (ABA, state bars, ILTA, CLOC, NIST, EU AI Act, peer policies), adapted to your practice profile — draft for attorney review, not a finished policy |
| **matter-workspace** | Create, list, switch, and close matter workspaces for multi-client practices; isolates each client/matter so context does not leak across them |

## Quick start

### 1. Setup

```
/ai-governance-legal:cold-start-interview
```

Have ready (if they exist): your AI or acceptable use policy, one prior impact assessment,
key vendor AI agreements, model inventory or approved tool list.

Your configuration is stored at `~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md` and survives plugin updates.

### 2. Triage a new use case

```
/ai-governance-legal:use-case-triage "Sales team wants to use AI to score leads automatically"
```

Output: risk tier, registry match or gap, required conditions, impact assessment needed
or not.

### 3. Run an impact assessment

```
/ai-governance-legal:aia-generation "AI-powered resume screening for HR"
```

Intake questions → impact assessment in your house format → policy consistency check →
mitigation conditions.

### 4. Review a vendor AI agreement

```
/ai-governance-legal:vendor-ai-review openai-terms.pdf
```

Output: term-by-term vs. your positions, proposed redlines, gaps to escalate.

## Plugin triangle: AI governance ↔ product counsel ↔ privacy

These three plugins are designed to work together. AI governance is the third leg.

- **Product counsel** detects when a launch has an AI component → hands off to
  `/ai-governance-legal:use-case-triage` and `/ai-governance-legal:aia-generation`
- **Privacy** detects when an AI use case involves personal data → hands off to
  `/privacy-legal:pia-generation`, if the plugin is installed
- **AI governance** detects when an impact assessment raises data protection issues →
  hands off to `/privacy-legal:pia-generation`, if the plugin is installed

The handoff is explicit: each plugin flags when the other is needed and states what
question to answer there.

## File structure

```
ai-governance-legal/
├── CLAUDE.md
├── README.md
└── skills/
    ├── cold-start-interview/
    ├── use-case-triage/
    ├── aia-generation/
    ├── vendor-ai-review/
    ├── reg-gap-analysis/
    ├── policy-monitor/
    ├── policy-starter/
    └── matter-workspace/
```

## How it learns

Your practice profile at `~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md` isn't static — it improves as you use the plugin. Skills tell you when an output used a default you should tune. The `policy-monitor` agent watches for drift between your AI governance policy and your practice and proposes updates. You can re-run setup, edit the file directly, or tell a skill to record a new position.

## Notes

- Gap check (`reg-gap-analysis`) handles incoming regulations. Policy monitor handles internal practice drift. Different tools for different directions of change.
- Policy monitor requires an outputs folder to be configured (set during setup) for the sweep to work. Direct-query mode works without it.
- Use case triage is only as good as the registry. Spend the setup interview getting
  the red lines right — they drive everything.
- Impact assessment format comes from your seed assessment. If you didn't provide one
  during setup, it uses a baseline structure — re-run setup with a reference to improve it.
- Builder and deployer obligations are treated separately. If you're both, the skills
  ask which hat you're wearing for each task.
- Gap analysis is manual (you point it at a regulation or guidance doc). For automated
  monitoring, pair with the `regulatory-legal` plugin, if the plugin is installed.
- The `## Company profile` section is the first block of `~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md` by convention. If
  you run other `-counsel` plugins, you can copy it across rather than re-entering
  the same context.
