/aia-generation

name: aia-generation
description: >
  Run an AI impact assessment — structured intake, risk analysis, regulatory
  classification per regime in scope, policy consistency diff, and recommendation
  with conditions. Uses the house-style structure learned from the seed impact
  assessment in `~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md`.
  Use when user says "impact assessment for", "assess this AI use case", "run an
  AIA", "generate an AIA", "we need to document this AI system", "AI risk
  assessment for X", or follows a conditional triage result.
argument-hint: "[describe the use case or system, or pass a triage result]"

/aia-generation

1. Read `~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md`. Confirm impact assessment house style is populated. 2. Determine risk track (fast or full) from governance tier and use case characteristics, using the framework below. 3. Run intake — conversational, not a form. 4. Regulatory classification for each regime in the footprint — research tier, prohibited-practice exposure, and applicable obligations; cite primary sources. 5. Write assessment in house style (from seed doc, or default if none captured). 6. Policy diff against `~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md` AI policy commitments. 7. Output: assessment doc + conditions list + handoff flags (privacy PIA, vendor review if needed).

/ai-governance-legal:aia-generation "AI résumé screening for HR"

---

Matter context

**Matter context.** Check `## Matter workspaces` in the practice-level CLAUDE.md. If `Enabled` is `✗` (the default for in-house users), skip the rest of this paragraph — skills use practice-level context and the matter machinery is invisible. If enabled and there is no active matter, ask: "Which matter is this for? Run `/ai-governance-legal:matter-workspace switch <slug>` or say `practice-level`." Load the active matter's `matter.md` for matter-specific context and overrides. Write outputs to the matter folder at `~/.claude/plugins/config/claude-for-legal/ai-governance-legal/matters/<matter-slug>/`. Never read another matter's files unless `Cross-matter context` is `on`.

---

Purpose

An AI impact assessment is a documented decision, not a form. It answers: what does this AI system do, how does it reach its outputs, who's affected if it's wrong, what's the oversight, and is it okay to deploy. This skill structures that conversation and writes the output in this team's format — the one learned from the seed impact assessment during cold-start.

An AI impact assessment is not the same as a PIA. A PIA asks whether personal data is handled lawfully. An AIA asks whether the AI system is designed and deployed responsibly. They often need to happen in parallel; they're not substitutes.

Load house style

Read `~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md` → `## Impact assessment house style`. That has:

• What triggers an impact assessment at this company
• The structure template extracted from the seed assessment
• Typical depth
• Who signs off

If the seed structure is in `~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md`, **use it**. The point is that this assessment looks like the other assessments this team produces.

**Jurisdictional scope.** This assessment applies the regulatory regimes listed in `## Regulatory footprint` in `~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md`. AI legal rules, risk classifications, and deployment obligations vary materially by jurisdiction and are moving fast. If this system is (or will be) deployed outside that footprint, or if a choice-of-law question is in play, this analysis may not apply as written — re-run or expand the footprint.

---

Step 0: Is an impact assessment needed?

Check the trigger criteria in `~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md`.

**Also check these regardless:**

• Does this AI make or materially influence a decision affecting a person (employment,

credit, access, pricing, content moderation)?

• Does this AI process personal data about individuals?
• Is this a customer-facing AI system rather than purely internal?
• Does this AI use a third-party model where the company is the deployer?
• Is the use case in the elevated or high governance tier per `~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md`?

If none of the above and the house trigger isn't met: > "Doesn't look like this needs a full impact assessment. Here's a one-paragraph > record for the file explaining why — in case anyone asks later."

---

Step 1: Risk track

Before intake, determine which track to run. The tier definitions and the fast-track criteria come from `~/.claude/plugins/config/claude-for-legal/ai-governance-legal/CLAUDE.md` (`## Use case registry` and `## Governance tiers`), not from any hardcoded regime-specific framework.

Research the applicable risk classification framework for each regime in the user's regulatory footprint. Many regimes distinguish by risk tier, affected population, and decision consequentiality — research the specific criteria. Note that most regimes treat employee data as personal data and employee monitoring as consequential; don't assume internal-only systems are out of scope.

> **No silent supplement.** If a research query to the configured legal research tool (Westlaw, EUR-Lex, regulator sites, or firm platform) returns few or no results for a regime's risk tiers or triggers, report what was found and stop. Do NOT fill the gap from web search or model knowledge without asking. Say: "The search returned [N] results from [tool]. Coverage appears thin for [regime / topic]. Options: (1) broaden the search query, (2) try a different research tool, (3) search the web — results will be tagged `[web search — verify]` and should be checked against the issuing authority before relying, or