ai-policy-generator

Name: ai-policy-generator
Author: travisjneuman

github.com/travisjneuman其他106147 次安装1 天前更新

代码仓库

关于 ai-policy-generator

面向组织制定 AI 治理规则的技能，提供涵盖风险、合规、伦理、数据处理、培训与维护的政策框架和模板。

主要功能

01AI 政策模板
02用例风险分类
03可接受使用指南
04法规合规映射
05AI 伦理与偏差测试
06数据处理和培训指南

适用场景

01起草组织级 AI 政策
02评估拟议 AI 用例的风险
03将政策控制映射到法规
04规划员工 AI 培训

安装

复制下面的命令，在终端中运行。

$npx skills add https://github.com/travisjneuman/.claude --skill ai-policy-generator

安装后在 Claude Code 中输入/ai-policy-generator确认已加载。

详细介绍

AI Policy Generator

用于制定组织 AI 治理政策的综合框架，涵盖可接受使用、风险管理、伦理准则、数据处理和合规要求。

AI 政策结构

标准 AI 政策模板

AI GOVERNANCE POLICY — [ORGANIZATION NAME]

1. PURPOSE AND SCOPE
   - Why this policy exists
   - Who it applies to (employees, contractors, vendors)
   - What AI systems are covered
   - Effective date and review cadence

2. DEFINITIONS
   - AI / Machine Learning
   - Generative AI
   - Automated decision-making
   - Personal data / Sensitive data
   - High-risk AI use cases

3. ACCEPTABLE USE
   - Approved AI tools and platforms
   - Permitted use cases by department
   - Prohibited uses (explicit list)
   - Approval process for new AI tools

4. DATA AND PRIVACY
   - Data classification for AI inputs
   - Prohibited data types (PII, PHI, confidential)
   - Data retention and deletion
   - Third-party data sharing restrictions

5. RISK ASSESSMENT
   - Risk classification framework (low/medium/high/critical)
   - Required assessments by risk level
   - Approval chain for high-risk deployments
   - Ongoing monitoring requirements

6. TRANSPARENCY AND DISCLOSURE
   - When to disclose AI use to stakeholders
   - Labeling AI-generated content
   - Customer/client notification requirements
   - Internal documentation standards

7. HUMAN OVERSIGHT
   - Human-in-the-loop requirements
   - Decision review thresholds
   - Escalation procedures
   - Override authority

8. BIAS AND FAIRNESS
   - Bias testing requirements
   - Fairness metrics and thresholds
   - Protected class considerations
   - Remediation procedures

9. SECURITY
   - AI-specific security controls
   - Prompt injection prevention
   - Model access controls
   - Incident response for AI failures

10. COMPLIANCE
    - Applicable regulations (EU AI Act, state laws, industry)
    - Audit requirements
    - Record-keeping obligations
    - Reporting requirements

11. TRAINING AND AWARENESS
    - Required training by role
    - Training frequency
    - Competency assessment

12. ENFORCEMENT
    - Violation reporting
    - Consequences framework
    - Appeal process

13. GOVERNANCE
    - AI governance committee composition
    - Review and update cadence
    - Policy exception process
    - Version control

风险分类框架

AI 用例风险等级

风险等级	说明	示例	要求
低	对个人或运营的影响最小	总结会议纪要、起草内部邮件、代码格式化	自助使用、基础培训
中	影响适中，决策可撤销	客户服务回复草稿、内容生成、数据分析	经理审批、人工审核
高	对个人或财务有重大影响	招聘筛选、信贷决策、医疗分诊	委员会审批、偏见审计、监控
严重	可能造成严重伤害或法律责任	影响权利的自主决策、对安全至关重要的系统	董事会审批、外部审计、持续审查

风险评估清单

AI USE CASE RISK ASSESSMENT

Use Case: _____________________
Department: ___________________
Requested By: _________________
Date: ________________________

IMPACT ASSESSMENT:
  [ ] Affects individual rights or opportunities?
  [ ] Involves personal or sensitive data?
  [ ] Makes or influences financial decisions?
  [ ] Affects health, safety, or welfare?
  [ ] Has legal or regulatory implications?
  [ ] Could cause reputational harm?
  [ ] Involves vulnerable populations?

DATA ASSESSMENT:
  [ ] What data types are used as inputs?
  [ ] Is PII/PHI/confidential data involved?
  [ ] Where is data stored and processed?
  [ ] What third parties receive data?
  [ ] Is data retention compliant with policy?

TRANSPARENCY ASSESSMENT:
  [ ] Are affected parties informed of AI use?
  [ ] Is the AI's role in decisions clear?
  [ ] Can decisions be explained?
  [ ] Is there an appeal/override mechanism?

RISK LEVEL: [ ] Low  [ ] Medium  [ ] High  [ ] Critical

REQUIRED APPROVALS:
  [ ] Manager (all levels)
  [ ] AI Governance Committee (medium+)
  [ ] Legal review (high+)
  [ ] Board approval (critical)
  [ ] External audit (critical)

可接受使用指南

获批与禁止的用途

APPROVED USES (with appropriate safeguards):

CONTENT AND COMMUNICATION:
  + Drafting internal communications
  + Summarizing documents and meetings
  + Translating content between languages
  + Brainstorming and ideation
  + Editing and proofreading

RESEARCH AND ANALYSIS:
  + Market research synthesis
  + Data analysis and visualization
  + Literature review assistance
  + Trend identification
  + Competitive analysis

PRODUCTIVITY:
  + Code generation and review
  + Template creation
  + Process documentation
  + FAQ and knowledge base content
  + Scheduling optimization

PROHIBITED USES:

  - Inputting confidential business data into public AI tools
  - Uploading PII, PHI, or financial records to unapproved platforms
  - Using AI for final hiring, firing, or disciplinary decisions
  - Generating content that impersonates real individuals
  - Making autonomous decisions that affect individual rights
  - Bypassing security controls or access restrictions
  - Generating misleading, deceptive, or fraudulent content
  - Using AI to surveil employees without disclosure
  - Submitting AI-generated work as original without disclosure
  - Using AI for any illegal purpose

监管环境

各司法辖区的主要法规

法规	司法辖区	主要要求	生效时间
EU AI Act	欧盟	基于风险的分类、禁止用途、透明度	2024-2027（分阶段实施）
Colorado AI Act	美国科罗拉多州	防止算法歧视、影响评估	2026
NYC Local Law 144	纽约市	对自动化就业决策进行偏见审计	2023
CPRA	美国加利福尼亚州	有权选择退出自动化决策	2023
GDPR Art. 22	欧盟/欧洲经济区	有权不受完全自动化决策约束	2018
Executive Order 14110	美国联邦	AI 安全标准、风险管理	2023
NIST AI RMF	美国（自愿）	AI 系统风险管理框架	2023
ISO/IEC 42001	国际	AI 管理体系标准	2023

合规映射模板

COMPLIANCE MAPPING:

Regulation: [Name]
Applicable: [ ] Yes  [ ] No  [ ] Partially
Scope: [Which AI uses fall under this regulation]

REQUIREMENT                          | STATUS    | OWNER     | DUE DATE
Risk assessment completed            | [ ]       | [Name]    | [Date]
Transparency notices deployed        | [ ]       | [Name]    | [Date]
Bias audit conducted                 | [ ]       | [Name]    | [Date]
Data protection measures in place    | [ ]       | [Name]    | [Date]
Human oversight mechanism active     | [ ]       | [Name]    | [Date]
Documentation/records maintained     | [ ]       | [Name]    | [Date]
Training completed for staff         | [ ]       | [Name]    | [Date]
Incident response plan updated       | [ ]       | [Name]    | [Date]

伦理 AI 框架

基于原则的方法

原则	定义	实施方式
公平性	AI 不应歧视或造成不同群体之间的不平等影响	定期进行偏见审计，审查训练数据的多样性
透明度	AI 的使用和决策过程应易于理解	可解释性要求、披露政策
问责制	明确 AI 决策及结果的责任归属	治理结构、审计跟踪记录
隐私	尊重数据权利并尽量减少数据收集	数据分类、同意框架
安全性	AI 不应伤害个人或群体	测试规程、人工监督、紧急停止开关
增益	AI 应造福组织和社会	影响评估、利益相关方参与

偏见测试规程

BIAS TESTING PROTOCOL:

PRE-DEPLOYMENT:
  1. Define protected characteristics relevant to use case
  2. Prepare representative test datasets
  3. Run model outputs across demographic groups
  4. Calculate disparate impact ratios
  5. Document results and remediation if needed

ONGOING MONITORING:
  Frequency: [Monthly / Quarterly / per regulation]
  Metrics:
    - Demographic parity: Equal selection rates across groups
    - Equalized odds: Equal error rates across groups
    - Calibration: Equal accuracy across groups
  Threshold: Disparate impact ratio < 0.8 triggers review

REMEDIATION:
  1. Identify root cause (data, model, process)
  2. Document corrective action plan
  3. Implement fix and retest
  4. Report to governance committee

数据处理指南

AI 数据分类

分类	是否允许作为 AI 输入？	条件	示例
公开	是，任何获批工具均可	遵循标准使用政策	已发布的报告、新闻稿
内部	是，仅限获批的企业工具	不得使用公共 AI 工具	内部备忘录、战略文件
机密	有限允许，需经审批	使用获批工具 + 已签订 DPA	财务数据、客户信息
受限	否（或须采取严格管控）	需 CTO/CISO 审批 + 加密	PII、PHI、商业秘密、凭据

供应商评估清单

AI VENDOR ASSESSMENT:

Vendor: _____________________
Tool/Service: _______________
Assessment Date: _____________

DATA HANDLING:
  [ ] Data processing agreement (DPA) in place?
  [ ] Where is data processed and stored?
  [ ] Is data used to train vendor's models?
  [ ] Can training opt-out be enforced?
  [ ] Data retention and deletion policies?
  [ ] Encryption at rest and in transit?
  [ ] SOC 2 Type II or equivalent certification?

SECURITY:
  [ ] Access controls and authentication?
  [ ] Audit logging available?
  [ ] Incident response procedures?
  [ ] Penetration testing conducted?
  [ ] Vulnerability management program?

COMPLIANCE:
  [ ] GDPR compliance (if applicable)?
  [ ] HIPAA compliance (if applicable)?
  [ ] Sector-specific certifications?
  [ ] Subprocessor transparency?

RECOMMENDATION: [ ] Approve  [ ] Conditional  [ ] Reject

培训计划设计

基于角色的培训要求

角色	培训主题	频率	评估方式
所有员工	AI 政策概述、可接受的使用方式、数据处理	每年	测验（80% 及格）
管理者	风险评估、审批工作流、监督	每年 + 复习培训	基于情景的评估
IT/Engineering	安全控制、提示词注入、模型管理	每半年	技术评估
Legal/Compliance	监管环境、审计流程、事件响应	每半年	案例研究审查
AI Governance Committee	完整政策、新兴法规、行业最佳实践	每季度	基于参与度的评估
高管	战略影响、责任、治理	每年	参加简报会

政策维护

审查和更新频率

POLICY REVIEW SCHEDULE:

ANNUAL REVIEW (minimum):
  - Full policy review by governance committee
  - Regulatory landscape update
  - Incident review and lessons learned
  - Stakeholder feedback incorporation

TRIGGERED REVIEWS:
  - New regulation enacted affecting AI use
  - Significant AI incident (internal or industry)
  - Major new AI tool adoption
  - Organizational restructure
  - Merger/acquisition
  - Audit finding requiring policy change

VERSION CONTROL:
  Version: [X.X]
  Last Updated: [Date]
  Approved By: [Name/Committee]
  Next Review: [Date]
  Change Log: [Summary of changes per version]

另请参阅

支持 Markdown

登录后评论

基本信息

作者: travisjneuman
仓库: travisjneuman/.claude
分类: 其他
安装次数: 147
GitHub Stars: 106

报告问题