hitl-compliance-gate

HITL Compliance Gate

A reusable, plug-in compliance checkpoint for any AI workflow. When a human is about to approve AI-generated content, a decision, or a system output, this skill surfaces the right compliance questions for the relevant framework — so the reviewer knows exactly what to look for before signing off.

---

Step 1 — Detect Context

Before presenting any checklist, orient yourself:

1. What is being reviewed? (content, a model decision, a dataset, a system deployment, a report, etc.)
2. What stage is the workflow at? (design, development, testing, deployment, post-deployment monitoring)
3. Which framework(s) apply? — Use the table below to auto-select based on context clues.

Signal in context	Load reference
"EU", "Europe", "GDPR", "high-risk AI", "Article 13", "CE marking"	references/eu-ai-act.md
"NIST", "RMF", "Govern / Map / Measure / Manage", "AI risk profile"	references/nist-ai-rmf.md
"ISO", "42001", "AIMS", "management system", "audit", "certification"	references/iso-42001.md
Multiple signals, or user says "all frameworks"	Load all three
No signal — ambiguous	Ask: "Which framework should I check against? EU AI Act, NIST AI RMF, ISO 42001, or all three?"

---

Step 2 — Load the Relevant Reference File(s)

Read the appropriate file(s) from references/ before generating the checklist. Each file contains: framework overview, risk-tiering logic, key obligations by stage, and ready-to-use reviewer questions.

• references/eu-ai-act.md
• references/nist-ai-rmf.md
• references/iso-42001.md

---

Step 3 — Generate the Compliance Checkpoint

Output a structured Compliance Gate block using this format:

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
🔒 COMPLIANCE GATE — [FRAMEWORK NAME]
Stage: [design / development / testing / deployment / monitoring]
Item under review: [brief description]
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

⚠️ ADVISORY NOTICE
───────────────────
This output is generated by an AI skill and is provided for informational and
governance support purposes only. It does not constitute legal advice, regulatory
advice, or a formal compliance determination. Do not rely on this output as a
substitute for advice from qualified legal counsel, a licensed compliance
professional, or a certified auditor. Review all outputs with appropriate human
expertise before taking compliance action.
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

REVIEWER CHECKLIST
──────────────────
For each item, mark: ✅ Confirmed | ⚠️ Needs work | ❌ Blocker | N/A

[ ] [Question 1]
[ ] [Question 2]
[ ] [Question 3]
...

MANDATORY SIGN-OFF QUESTIONS (must be ✅ to proceed)
─────────────────────────────────────────────────────
[ ] [Critical question 1]
[ ] [Critical question 2]

DECISION
────────
☐ APPROVED — all mandatory items confirmed
☐ CONDITIONALLY APPROVED — proceed with noted remediation items
☐ BLOCKED — one or more mandatory items unresolved

Reviewer name / role: ___________________
Timestamp: ___________________
Notes: ___________________
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Populate the checklist with questions drawn from the loaded reference file, scoped to the detected workflow stage and item type.

---

Step 4 — Post-Review Handling

After the human completes the checklist:

• APPROVED: Confirm the gate is cleared. Optionally offer to log the sign-off to a markdown file or append to a compliance log.
• CONDITIONALLY APPROVED: Summarize the remediation items as a numbered action list. Offer to create a reminder or ticket stub for each.
• BLOCKED: Clearly state which mandatory items failed. Do not proceed. Offer to draft a findings report or escalation note.

---

Key Principles

• Advisory only — All outputs produced by this skill are for informational and governance support purposes only. They do not constitute legal advice, regulatory advice, or a formal compliance determination. No output from this skill should be relied upon as a substitute for advice from qualified legal counsel, a licensed compliance professional, or a certified auditor with jurisdiction-specific expertise.
• Never skip the gate if the user invokes it — even under time pressure.
• Scope questions to the stage — don't ask deployment questions during design review.
• Be concise but complete — 8–15 checklist items is the target range. More than 20 becomes noise.
• Flag cross-framework conflicts if multiple frameworks are loaded and they have contradictory requirements.
• Offer to save the completed gate as a .md file for audit trail purposes.