aia-generation

name	aia-generation
description	AI Impact Assessment (AIA) — formal documentation для AI use case рассматриваемого как medium/high risk. РФ specifics: AIA combines AI-specific risks с ОВПД framework (152-ФЗ ст.18.1) если processing ПДн. Структура: scope + risks + mitigation + approval. Subject to compliance officer / AI Officer / outside-адв ФПА review.
argument-hint	[use case ID или description]
user_invocable	true
ported_from	ai-governance-legal/aia-generation
ported_at	"2026-05-19T00:00:00.000Z"
adaptation_category	B
last_legislative_update	2026-05

/aia-generation

Назначение

Generate formal AI Impact Assessment document. Required after /use-case-triage classified use case как IMPACT ASSESS level.

Pre-flight

• /use-case-triage completed — IMPACT ASSESS classified
• Stakeholders identified (technical, business, legal, security, ethics)
• Готовы spend several days на полную AIA

AIA structure

# AI Impact Assessment
# Use case: [name]

**Version:** 1.0
**Date:** [DD.MM.YYYY]
**Authors:** [names + roles]
**Status:** [Draft / Under Review / Approved]
**Privilege framing:** [Privileged через outside-адв ФПА / Business-confidential]

Section 1: Use case description

## 1. Use case description

### 1.1. Purpose

[What this AI system is supposed to do, who benefits, what value]

### 1.2. Scope

[Specific functions, boundaries, what it doesn't do]

### 1.3. Stakeholders

| Role | Specific persons | Interest in this AI |
|------|------------------|---------------------|
| Customer | [...] | [...] |
| End user | [...] | [...] |
| Internal team | [...] | [...] |
| Regulator | [Минцифры / ЦБ / ФАС / etc.] | [oversight] |

### 1.4. Stages of usage

- Training / fine-tuning
- Deployment
- Production usage
- Periodic retraining / updates
- Decommissioning

Section 2: Technical details

## 2. Technical details

### 2.1. Underlying technology

- **Type:** [LLM / classical ML / CV / иное]
- **Vendor or self-hosted:** [...]
- **Model architecture:** [transformer / RNN / classical / иное]
- **Training data:** [source — internal / public / purchased / mixed]
- **Fine-tuning?** [Y/N + on what data]

### 2.2. Input / Output

- **Inputs accepted:** [data types, examples]
- **Outputs produced:** [data types, examples]
- **Decision authority:** [AI alone / AI + human / AI assists]

### 2.3. Performance characteristics

- **Expected accuracy:** [%]
- **Throughput:** [N requests / second]
- **Latency:** [seconds]
- **Failure modes:** [known limitations]

### 2.4. Update / maintenance

- Retraining frequency
- Monitoring metrics
- Performance degradation triggers

Section 3: Legal compliance analysis

## 3. Legal compliance

### 3.1. 152-ФЗ (если ПДн обрабатываются)

- **Processing roles:** [we as operator / vendor as processor]
- **Categories ПДн:** [...]
- **Legal basis:** [contract / consent / законные интересы / иное]
- **Special category** (ст.10) — health, биометрия, политика и пр.: [Y/N + safeguards]
- **Локализация (ст.18 ч.5):** processing в РФ confirmed
- **Cross-border transfer:** [Y/N + основание]
- **Уведомление РКН подано:** [Y/N + when]
- **ОВПД (ст.18.1) — оценка вреда:** done или not required?

### 3.2. Sectoral compliance

[Если применимо]

- **Финансовое (Банк России):** ФЗ-353 / 218 / 115 — compliance
- **Медицинское (Минздрав):** ФЗ-323 / лицензирование / Росздравнадзор регистрация AI as medical device
- **Образовательное (Минобрнауки):** ФЗ-273
- **Гос.услуги:** ПП 1503 / ФЗ-258 sandbox

### 3.3. Anti-discrimination

- **Risk:** AI может дискриминировать по защищённым категориям (раса, пол, возраст, инвалидность, и пр.)?
- **Mitigation:** [bias testing, fairness metrics, audit logs]
- **Legal basis для defense:** [ст.3 ТК если employment-related; ФЗ-181 если касается инвалидов]

### 3.4. Transparency requirements

- **Disclosure к user:** [что это AI, не человек] — see `/user-disclosure-check`
- **Explanation:** [right to explanation of automated decision — ст.16 152-ФЗ]
- **Documentation publicly available:** [policy / FAQ]

### 3.5. Intellectual property

- **Training data IP:** licensed properly? (см. `/training-data-review`)
- **Output IP:** ownership clear?
- **Copyright risks:** outputs similar к existing works?

Section 4: Risk assessment

## 4. Risk assessment

### 4.1. Identified risks

| # | Risk | Likelihood (1-5) | Impact (1-5) | Composite | Mitigation |
|---|------|-------------------|----------------|-----------|------------|
| 1 | Hallucination в production user-facing answer | 4 | 3 | 12 | Confidence scoring + disclaimers + human review для high-stakes |
| 2 | ПДн leakage в logs | 2 | 5 | 10 | Encryption + access controls + log redaction |
| 3 | Discrimination в outputs | 3 | 4 | 12 | Bias testing pre-deployment + ongoing monitoring + appeal process |
| 4 | Sanctions-related vendor unavailability | 3 | 4 | 12 | Backup Russian alternative + open-source fallback |
| 5 | Regulatory change requires rework | 3 | 3 | 9 | Periodic regulatory monitoring (см. `data-protection/reg-gap-analysis`) |
| 6 | ... | | | | |

### 4.2. Acceptable residual risk

[After mitigation — is the remaining risk acceptable?]

[Y/N + reasoning]

Section 5: Mitigations + controls

## 5. Mitigations + controls

### 5.1. Technical mitigations

- [ ] Input validation / sanitization
- [ ] Output filtering / content moderation
- [ ] Rate limiting per user
- [ ] Anomaly detection
- [ ] A/B testing pre-rollout
- [ ] Confidence scoring with thresholds
- [ ] Fallback to human для low-confidence cases

### 5.2. Procedural mitigations

- [ ] Human-in-the-loop для significant decisions
- [ ] Right to human review (ст.16 152-ФЗ если applicable)
- [ ] Appeal / dispute mechanism
- [ ] Periodic accuracy / fairness audits
- [ ] Incident reporting process
- [ ] User feedback channels

### 5.3. Documentation

- [ ] Internal documentation полная
- [ ] User-facing explanations
- [ ] Model cards (industry best practice)
- [ ] Datasheet for training data

### 5.4. Monitoring + alerts

- Performance metrics tracked
- Drift detection
- Adverse outcome notifications
- Quarterly review meetings

Section 6: Stakeholder consultation

## 6. Stakeholder consultation

| Stakeholder | Date consulted | Concerns raised | Resolution |
|-------------|----------------|-------------------|-------------|
| Legal | DD.MM.YYYY | ... | ... |
| Compliance | DD.MM.YYYY | ... | ... |
| InfoSec | DD.MM.YYYY | ... | ... |
| Affected business unit | DD.MM.YYYY | ... | ... |
| (External) outside-адв ФПА | DD.MM.YYYY | ... | ... |
| (External) AI ethics board | DD.MM.YYYY | ... | ... |

Section 7: Recommendation

## 7. Recommendation

[APPROVE FOR DEPLOYMENT / APPROVE WITH CONDITIONS / NEEDS REWORK / DO NOT APPROVE]

### Conditions (если applicable)

1. [Concrete condition]
2. ...

### Approvers required

- [ ] AI Officer
- [ ] Compliance Officer
- [ ] CISO (для security implications)
- [ ] Legal (in-house GC)
- [ ] (Material) Outside-адв ФПА review
- [ ] (Material) Board / Executive committee

Section 8: Implementation plan

## 8. Implementation plan

### Pre-deployment

| Action | Owner | Deadline |
|--------|-------|----------|
| [...] | [...] | [...] |

### Deployment

[Rollout plan — gradual / pilot / full]

### Post-deployment monitoring

[Schedule + metrics + escalation triggers]

Section 9: Review schedule

## 9. Review schedule

- **Initial review post-deployment:** [DD.MM.YYYY] (1-3 months)
- **Annual review:** [DD.MM.YYYY]
- **Trigger-based review:** [conditions — adverse outcome, regulatory change, material model update]

Workflow

Шаг 1. Set up document

Create AIA document for the specific use case. Pull data from PROFILE.md и /use-case-triage outputs.

Шаг 2. Fill in sections

Sections 1-2 — technical input from product team / data scientists.

Sections 3-5 — legal / compliance analysis. Это major value-add от skill.

Section 6 — track consultations.

Sections 7-9 — recommendations + plan.

Шаг 3. Review + iteration

• Internal review (legal + compliance)
• Stakeholder feedback
• (Material) outside-адв ФПА review
• Updates based on feedback

Шаг 4. Approval

• Sign-off от required approvers
• Document approval chain
• Store в AIA registry

Шаг 5. Post-AIA monitoring

• Track that mitigations actually implemented
• Periodic re-AIA при material changes
• Incident tracking + reporting

Что НЕ делает

• Не делает technical AI testing (это data science / ML engineers)
• Не replaces outside-адв legal opinion для material matters
• Не выполняет actual implementation — это product / engineering

Attribution

Adapted from ai-governance-legal/aia-generation by Anthropic (Apache 2.0).

Категория B:

• EU AI Act FRAIA / NIST AI RMF template → adapted к РФ context
• 152-ФЗ ст.18.1 ОВПД integration — РФ-specific
• ст.16 152-ФЗ право на review automated decisions — РФ-specific
• Sectoral overlays РФ (Банк России / Минздрав / Росздравнадзор) вместо US/EU
• Sanctions risk dimension — РФ-specific
• Outside-адв ФПА involvement для privilege — РФ-specific

Original copyright: © 2026 Anthropic PBC, Apache 2.0.

---

⚠ Юридический disclaimer

Данный skill — техническая платформа, не оказывает юридических услуг по ст.2 ФЗ-63 «Об адвокатской деятельности». Outputs не заменяют консультацию лицензированного юриста / адвоката ФПА.

AI может галлюцинировать, выдавать устаревшие нормы, неверно интерпретировать факты. Material decisions (увольнение, M&A, налоговый спор, IP litigation) — обязательно engage outside-адв ФПА с релевантной специализацией.

Проект ru-legal и его contributors не несут ответственности за решения, принятые на основе outputs системы. Использование — на свой риск.