responsible-ai-assessment

Goal

A governance gap analysis: where the system/program stands against the chosen framework(s), the gaps, and a prioritized roadmap to close them.

Steps

1. Pick the framework(s) for the context:
   • NIST AI RMF — lifecycle functions: Govern, Map, Measure, Manage.
   • EU AI Act — first classify the risk tier (unacceptable / high / limited / minimal); high-risk triggers specific obligations.
   • ISO/IEC 42001 — AI management system controls (org governance).
   • OECD principles — values-level checkpoints. (See harm-modeling/reference.md for the framework map.)
2. Assess each control/function: governance & accountability (who owns AI risk), risk mapping (intended use, harms — reuse harm-modeling), measurement (evals, bias, monitoring — reuse safety-evaluation, bias-fairness-assessment), transparency (model/data cards, user disclosures), human oversight, data governance, incident response, and ongoing monitoring/drift.
3. Score each (e.g. absent / partial / met) with evidence.
4. Prioritize the roadmap by risk (and regulatory deadline, for EU AI Act high-risk), with owners.

Output

A gap-analysis table: framework area · requirement · status · evidence · gap · priority · owner, plus a phased roadmap. Use security-reporting for the report and an executive summary for leadership; this feeds a CISO/CTO or ai-safety-engineer program view.

Notes

Governance ties the technical safety work (harm modeling, evals, guardrails, fairness) to organizational accountability and regulation. Start by classifying the use case's risk tier — it determines how much rigor each control needs. Verify current framework versions and any jurisdiction-specific obligations.