Use this skill when the user wants an AI governance, legal-risk, privacy, compliance, procurement, or vendor-risk review of an internal AI use case, an AI product feature, an LLM workflow, or a third-party AI vendor. The skill asks intake and clarifying questions first when facts or evidence are missing, identifies required documentation and missing evidence, maps the use case to AI governance frameworks and applicable legal domains, and produces a preliminary or final governance review with sco
SkillScore82Maintained
Automatic
◆Legal & Contracts pack
Last verified 8/16/2026
What it changes
Passed 18 of 22 test cases with the skill, and 11 of 22 without it.
Without skill50%
With skill82%
Checks it passed that the model alone missed
The response classifies the system as a Hybrid or Multiple scenario deployment.
The response contains a legal disclaimer stating that the guidance is not legal advice.
The response asks between 3 and 5 direct core use case intake questions on the first turn.
and 10 more in the full report
10 fixed8 passed either way1 still failing3 broke
Pass-rate lift
+32 pp
Tokens
+128%
Agent turns
0%
Response time
-38%
Model gemini-3.6-flashMeasured 8/16/2026v118 of 22 cases passed with skill
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 10 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 10
Prompt
We are considering rolling out a third-party AI coding assistant tool to our 200 software engineers to accelerate internal development workflows. Before we sign the enterprise agreement, I need an AI governance evaluation covering risk classification, data privacy considerations, vendor risk, and compliance obligations. Please analyze this deployment and furnish a complete risk assessment breakdown.
What was checked, without and with the skill
Checked
Without skill
With skill
The response asks intake questions regarding the use case, data types, or controls before producing a complete risk assessment.
Missed
Passed
The response includes a legal disclaimer noting that the review is a draft and not formal legal representation.
Missed
Passed
case-02 · gemini-3.6-flash · 8/16/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md273 lines8 files
AI Governance Reviewer Skill
Use this skill for draft AI governance reviews involving:
Internal AI use by employees or contractors
AI-enabled product features or AI system deployments
Third-party AI vendors, subprocessors, or embedded AI services
This skill supports governance, privacy, security, procurement, and legal preparation. It does not provide legal advice.
LEGAL DISCLAIMER
Always include this disclaimer in the response:
This review assists with AI governance processes and does not replace a formal AI Governance, legal review or professional legal representation. This output is a draft and may contain errors or omissions. Verify all conclusions against company policies, primary regulatory sources, and with appropriate internal legal, privacy, security, and compliance teams. This is not legal advice.
Load These References
Read references/frameworks.md when making regulatory, governance, or source-citation claims.
Read references/responsible-ai-practice.md for operational responsible-AI best practices, escalation triggers, confidence discipline, and governance-program design guidance.
For legal frameworks, use the bundled files described in references/frameworks.md rather than relying on external URLs.
For ISO/IEC 23894:2023, do not use bundled local files. Use the ISO and iTeh URLs listed in references/frameworks.md.
Read exactly one or more scenario files based on the use case:
references/scenarios-internal.md
references/scenarios-product.md
references/scenarios-vendor.md
Read references/output-template.md before drafting the scorecard or remediation output.
Read references/example-outputs.md when you need a model for an intake-only response, a preliminary review, or a final review.
Analyse systématique d'un Data Processing Agreement (DPA) au regard de l'article 28 RGPD,
des lignes directrices EDPB 07/2020 et 02/2024, des CCT 2021 (décision d'exécution 2021/914),
des recommandations EDPB 01/2020 (mesures supplémentaires post-Schrems II), et du Règlement
(UE) 2024/1689 (Règlement IA). Produit un rapport structuré clause par clause (18 clauses :
13 obligatoires + 5 complémentaires) avec diagnostic 🟢/🟡/🔴, remédiations prêtes à
insérer, analyse détaillée des transferts internat