Governance documentation
Skill lexbeam-software/eu-ai-governance-plugin/skills/governance-documentation
Create, review, or organise EU AI Act governance evidence. Use for Article 11 and Annex IV technical documentation, logs, quality management, conformity records, declarations, registration, deployer records, post-market monitoring, incident files, evidence indexes, or review packs.From its SKILL.md
npx -y skills add lexbeam-software/eu-ai-governance-plugin --skill governance-documentationAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
SKILL.md
3.5 KB, as published. Nobody here has run it
Build governance documentation
Create an evidence map before drafting prose. Identify the system, version, intended purpose, actors, classification, applicable articles, owner, retention rule, source, approval, and change history for every artifact.
Follow LEGAL-SOURCE-PROTOCOL.md and AI-ACT-DECISION-MAP.md. Use euaiact_annex_iv_checklist, euaiact_get_obligations, and the versioned summary and official URL returned by euaiact_get_article when the Lexbeam EU AI Act MCP is available. Read the official full text for exact wording.
Map evidence to the correct anchor
- Article 11 and Annex IV: provider technical documentation before market placement or putting into service; keep it current.
- Article 12: technical capability for automatic logging over the system lifetime.
- Article 13: information and instructions supplied to deployers.
- Article 14: designed human-oversight measures.
- Article 17: provider quality management system.
- Article 18: provider documentation keeping for 10 years after market placement or putting into service, subject to the article’s scope and sector rules.
- Article 19: provider retention of automatically generated logs under its control for an appropriate period of at least six months, unless other law provides otherwise.
- Article 26(6): deployer retention of logs under its control on the same minimum-period logic.
- Article 43: conformity assessment.
- Article 47: EU declaration of conformity.
- Article 48: CE marking.
- Article 49: registration, including Article 49(2) for an Article 6(3) non-high-risk determination.
- Article 72: provider post-market monitoring.
- Article 73: provider serious-incident reporting.
Never label Article 18 as conformity assessment or Article 19 as the EU declaration of conformity.
Build an evidence index
For each requirement record:
| Field | Required content |
|---|---|
| Requirement | Exact article, paragraph, point, or Annex item |
| Actor | Provider, deployer, or other role |
| Applicability | Applies, does not apply with reason, or not established |
| Artifact | File, system record, log, decision, or external evidence |
| Version and date | Effective version, approval date, review date |
| Owner and approver | Accountable role and recorded approval |
| Integrity | Repository, checksum or immutable record where proportionate |
| Retention | Legal or organisational basis and disposal trigger |
| Gap | Missing, stale, conflicting, inaccessible, or complete |
Do not call a folder “auditor-ready” merely because files exist. Test traceability from requirement to approved artifact and from artifact to source data.
Assemble the pack
Include a cover note with scope, system versions, roles, classification, legal baseline, limitations, and outstanding gaps; an evidence index; the selected artifacts; a decision log; and a source note. Preserve originals. Redact personal, privileged, confidential, and trade-secret material according to the audience.
For ISO/IEC 42001, NIST AI RMF, or internal-control mappings, label them as assurance-framework mappings rather than EU AI Act duties.