deployment-review

name	deployment-review
description	RU-unique. Pre-deployment review AI system перед production. Final gates: AIA approved, technical safeguards implemented, monitoring set up, incident response ready, training данных compliant, vendor contracts signed. Differs от AIA — это checklist на действительной готовности.
argument-hint	[AI system ID или name]
user_invocable	true
ported_at	"2026-05-19T00:00:00.000Z"
adaptation_category	D
last_legislative_update	2026-05

/deployment-review

Назначение

Pre-production go/no-go review для AI system. Final checkpoint перед deployment.

Pre-flight

• AI system development complete
• /aia-generation completed (если IMPACT ASSESS level)
• Technical testing done
• Stakeholders готовы для deployment

Workflow

Шаг 1. Verify AIA + approvals

## AIA + approvals verification

- [ ] `/use-case-triage` completed: [PROCEED / IMPACT ASSESS / RESTRICT]
- [ ] AIA document exists + signed: [link, date]
- [ ] AI Officer approval: [signed]
- [ ] Compliance Officer approval (для ПДн / 115-ФЗ): [signed]
- [ ] CISO approval (для security): [signed]
- [ ] (Material) Outside-адв ФПА review: [signed]
- [ ] (Material) Board approval: [signed if required]

[Stop if any gap]

Шаг 2. Verify technical safeguards

## Technical safeguards

### Pre-deployment

- [ ] Input validation implemented
- [ ] Output filtering / content moderation set up
- [ ] Rate limiting configured
- [ ] Authentication / authorization verified
- [ ] Logging implemented (without ПДн leakage)
- [ ] Encryption at rest + in transit verified
- [ ] Access controls reviewed
- [ ] Backup / disaster recovery plan
- [ ] (For LLM) Confidence scoring + thresholds
- [ ] (For LLM) Fallback к human для low-confidence

### Bias / fairness (если applicable)

- [ ] Bias testing done на representative datasets
- [ ] Fairness metrics meet thresholds
- [ ] Subgroup performance acceptable
- [ ] Adversarial testing done (если applicable)

### Adversarial robustness (если applicable)

- [ ] Prompt injection testing (для LLM)
- [ ] Model evasion testing (для security AI)
- [ ] Data poisoning safeguards

Шаг 3. Verify data compliance

## Data compliance

### 152-ФЗ (если processing ПДн)

- [ ] Legal basis documented в РКН уведомлении
- [ ] Specific consents collected где требуется
- [ ] Локализация confirmed (storage в РФ)
- [ ] Cross-border transfers — уведомления поданы
- [ ] Data retention period defined
- [ ] ПДн deletion mechanism implemented
- [ ] User rights (доступ, удаление) implemented
- [ ] ОВПД (ст.18.1) на disk
- [ ] DPO consulted

### Training data

- [ ] Sources licensed properly (см. `/training-data-review`)
- [ ] No copyright violations
- [ ] No ПДн leakage в training data (без legal basis)
- [ ] Sensitive content filtered

### Production data

- [ ] Data sources documented
- [ ] Data quality verified
- [ ] Anomaly detection set up

Шаг 4. Verify monitoring

## Monitoring

### Performance

- [ ] Accuracy / quality metrics dashboard
- [ ] Latency / throughput metrics
- [ ] Error rate monitoring
- [ ] Alerting thresholds set

### Bias / fairness ongoing

- [ ] Subgroup performance tracked
- [ ] Drift detection (для accuracy)
- [ ] Drift detection (для fairness)
- [ ] Periodic re-audit scheduled

### Security

- [ ] Anomalous query patterns detected
- [ ] Failed auth attempts monitored
- [ ] Adversarial input detection

### Logs

- [ ] Audit logs implemented
- [ ] User actions tracked (для appeal / dispute)
- [ ] Logs immutable / tamper-evident
- [ ] Logs retention policy meets compliance

Шаг 5. Verify incident response

## Incident response

- [ ] Incident response plan documented
- [ ] On-call rotation established
- [ ] Escalation chain clear (technical → AI Officer → executives)
- [ ] User-facing incident communication procedure
- [ ] Regulator notification procedure (если applicable)
- [ ] Post-incident review process
- [ ] Severity classification (P0 / P1 / P2 / P3)
- [ ] Common incidents practiced (table-top exercise recommended)

Шаг 6. Verify user disclosures

См. /user-disclosure-check для full framework.

## User disclosures

- [ ] AI usage disclosed to users где applicable
- [ ] Right to human review explained (для automated decisions)
- [ ] Privacy policy updated к include AI processing
- [ ] Terms of service updated
- [ ] FAQs / help docs prepared
- [ ] Customer support trained на handling AI-related queries

Шаг 7. Verify vendor relationships (если vendor-based)

## Vendor relationships

- [ ] Contract signed (см. `/vendor-ai-review`)
- [ ] DPA в place (если ПДн processing)
- [ ] No training on our data confirmed
- [ ] Data location confirmed
- [ ] SLA defined
- [ ] Exit / portability plan
- [ ] Backup vendor identified (для sanctions / continuity risk)

Шаг 8. Verify training / awareness

## Training

### Internal users (employees using AI tool)

- [ ] Initial training conducted
- [ ] Acceptable use policy acknowledged
- [ ] Reporting issues understood

### Operators (team running AI system)

- [ ] Technical training on operating model
- [ ] Incident response training
- [ ] Bias monitoring training

### Customer-facing teams

- [ ] How to explain AI usage to customers
- [ ] Appeal / dispute process training
- [ ] Escalation procedures

Шаг 9. Verify rollout plan

## Rollout plan

### Approach

- [ ] Gradual / pilot / full rollout? [...]
- [ ] Specific phases planned
- [ ] Rollback procedure defined
- [ ] Success criteria per phase

### Initial monitoring

- [ ] Enhanced monitoring для первых 30 days
- [ ] Daily / weekly review meetings scheduled
- [ ] Threshold для pausing rollout если issues

### Communication

- [ ] Stakeholders informed
- [ ] Users (если customer-facing) — communication plan
- [ ] Internal teams ready

Шаг 10. Final go/no-go

## Decision

[GO / NO-GO / CONDITIONAL GO]

### If CONDITIONAL GO

Specific conditions to meet before final go:

- [ ] [condition 1]
- [ ] [condition 2]

Re-review scheduled: [DD.MM.YYYY]

### If NO-GO

Reasons:
- [...]

Remediation plan:
- [...]

Re-review: [DD.MM.YYYY]

Post-deployment immediate actions

## T+0 to T+30

### Daily

- [ ] Monitoring dashboard reviewed
- [ ] Incident log reviewed
- [ ] User feedback channels checked

### Weekly

- [ ] Team review meeting (technical + business + compliance)
- [ ] Performance trends analyzed
- [ ] Any incidents discussed + RCA

### After 30 days

- [ ] Post-deployment AIA review (does AIA still accurate?)
- [ ] Performance vs predicted
- [ ] User satisfaction (если customer-facing)
- [ ] Updated risk assessment

Что НЕ делает

• Не replaces formal AIA — это /aia-generation
• Не handles technical testing — это QA / data science teams
• Не replaces outside-адв legal opinion для material matters

Why RU-unique

US/EU AI deployment frameworks (NIST AI RMF / EU AI Act conformity assessment) — different checkpoints + actors. РФ — combination 152-ФЗ + sectoral + АI Officer + DPO в local context.

Правовая основа:

• 152-ФЗ + ОВПД ст.18.1
• 115-ФЗ если AI в AML
• Sectoral regulations
• Указ 490/2019 — национальная стратегия AI
• Внутренняя AI policy организации (см. /policy-starter)

---

⚠ Юридический disclaimer

Данный skill — техническая платформа, не оказывает юридических услуг по ст.2 ФЗ-63 «Об адвокатской деятельности». Outputs не заменяют консультацию лицензированного юриста / адвоката ФПА.

AI может галлюцинировать, выдавать устаревшие нормы, неверно интерпретировать факты. Material decisions (увольнение, M&A, налоговый спор, IP litigation) — обязательно engage outside-адв ФПА с релевантной специализацией.

Проект ru-legal и его contributors не несут ответственности за решения, принятые на основе outputs системы. Использование — на свой риск.