- Read
~/.claude/plugins/config/claude-for-legal-zh/ai-governance-legal/CLAUDE.md→ regulatory registry (applicable regulations, thresholds, obligations), AI system inventory, tech ethics review configuration. - Run the following workflow.
- Determine whether to take the fast track or the comprehensive track. Extract system description → determine regulatory role and risk level → generate assessment.
- Output: classification + assessment document, including specific action items, owners, and deadlines.
/ai-governance-legal:aia-generation "客户信用评分模型 v2"
AI System Assessment Generation
Matter Context
Matter context. Check the practice-level CLAUDE.md for ## 事务工作区. If 已启用 is ✗(the default for legal internal users), skip the rest of this section—the skill uses practice-level context and the matter mechanism is not visible. If enabled and there is no active matter, ask: "Which matter does this matter belong to? Run /ai-governance-legal:matter-workspace switch <slug> or answer 实践级." Load the active matter's matter.md to get matter-specific context and overrides. Write output to the matter folder ~/.claude/plugins/config/claude-for-legal-zh/ai-governance-legal/matters/<matter-slug>/. Unless 跨事务上下文 is 开, never read files from other matters.
Purpose
Some AI regulations require formal assessments—before deploying high-risk systems, before business model changes, and when training data or decision logic undergoes substantive changes. This skill generates assessments and retains records as required by regulations.
Applicable Regulations
China's AI governance framework consists of multiple regulations and normative documents, and different assessment requirements apply depending on system type and risk level:
- Measures for the Administration of Generative Artificial Intelligence Services: Those providing generative AI services to the public must conduct security assessments and algorithm filing (Article 17
[法条原文]） - Measures for Scientific and Technological Ethics Review (Trial): Scientific and technological activities involving life and health, personal information, public social interests, etc. require ethics review
[法条原文] - Provisions on the Administration of Algorithm Recommendations for Internet Information Services: Those using algorithm recommendation technology must conduct algorithm filing (Article 24
[法条原文]) and security assessment (Article 27[法条原文]） - Provisions on the Administration of Deep Synthesis of Internet Information Services: Those providing deep synthesis services must conduct security assessment (Article 15
[法条原文]） - Personal Information Protection Law: AI systems involving personal information processing must conduct personal information protection impact assessments (Articles 55-56
[法条原文]）
Load Current State
Read ~/.claude/plugins/config/claude-for-legal-zh/ai-governance-legal/CLAUDE.md：
## AI系统清单— the role and level of each AI system in the system## 监管注册表— applicable regulations and thresholds## 科技伦理审查配置— ethics review committee setup and review trigger conditions
Workflow
Step 1: Track Determination
| Characteristic | Fast Track | Comprehensive Track |
|---|---|---|
| System Type | Low-risk internal tools (not public-facing) | High-risk systems or public-facing systems |
| Data Processing | Does not involve personal information or involves only internal employee data | Involves users' personal information, sensitive personal information, or large-scale data processing |
| Algorithm filing | No filing required | Algorithm filing required or may be required |
| Deep synthesis/generative | Not involved | Involves generated synthetic content or deep synthesis |
| Assessment history | There is a recent comprehensive assessment record, only minor updates are needed | First assessment or substantive change |
If the system clearly matches all characteristics in the left column → fast track. Otherwise → full track.
Step 2: Regulatory role determination
Determine the regulatory role based on the nature of the system:
| Role | Definition | Typical scenario |
|---|---|---|
| AI service provider | An entity that independently develops and provides AI services to the public | Self-developed models/SaaS AI products |
| AI service user | An entity that uses third-party AI services for internal business activities | Procuring third-party AI capabilities and embedding them into its own business processes |
| Dual role | Has both provider and user attributes | Providing services externally after fine-tuning based on a third-party model |
Role determination affects the scope of subsequent obligations:
- Provider: requires algorithm filing, security assessment, content labeling, and bears heavier compliance obligations (Articles 7-17 of the Interim Measures for the Administration of Generative Artificial Intelligence Services
[法条原文]） - User: requires ensuring compliant use and conducting supplier due diligence, but filing obligations are lighter
Step 3: Risk level determination
| Level | Typical system characteristics | Assessment requirements |
|---|---|---|
| High risk | Used for credit review, insurance pricing, recruitment screening, educational assessment; involves sensitive personal information; targeted at minors; safety-critical scenarios | Full track, algorithm security assessment + science and technology ethics review + personal information protection impact assessment (Article 55 of the Personal Information Protection Law [法条原文]） |
| Medium risk | Public-facing content recommendation, customer service AI; involves personal information but not sensitive information | Full track, algorithm filing (if applicable) + personal information protection impact assessment |
| Low risk | Internal productivity tools, only processes non-personal information, not public-facing | Fast track, internal records are sufficient |
Step 4: Fast-track assessment
[工作成果头 — 按照插件配置 ## 输出]
# AI系统快速评估：[系统名称]
**日期：** [日期]
**轨道：** 快速
**监管等级：** 低风险
**适用法规：** [列出]
---
## 系统描述
[一段话：系统做什么、用什么数据、谁使用、部署在哪]
## 非高风险自证
- [勾选快速轨的每项标准，附简要说明]
## 合规检查清单
| 检查项 | 状态 | 说明 |
|--------|------|------|
| 数据合法来源 | ✅/⚠️/❌ | [说明] |
| 不涉及敏感个人信息 | ✅/⚠️/❌ | [说明] |
| 不面向未成年人 | ✅/⚠️/❌ | [说明] |
| 不涉及自动化重大决策 | ✅/⚠️/❌ | [说明] |
| 不使用深度合成/生成式 | ✅/⚠️/❌ | [说明] |
| 有内部使用限制 | ✅/⚠️/❌ | [说明] |
| 科技伦理不触发 | ✅/⚠️/❌ | [说明] |
## 结论
[状态：通过 / 附条件通过（列出条件）]
## 审查者
[评估人] | [日期]
Step 5: Full-track assessment
The full-track assessment includes the following parts:
5A: System profile
- System name, version, deployment date
- Function description and data flow diagram (input data, processing logic, output data)
- Categories of data involved (whether it includes personal information, sensitive personal information, biometric information, etc.)
- Affected population (scale, characteristics, whether minors or vulnerable groups are involved)
- Deployment environment (internal/external, whether opened through API)
- Model type and source (self-developed/third-party fine-tuned/directly procured)
5B: Regulatory obligation mapping
| Regulation | Applicable? | Trigger condition | Core obligation |
|---|---|---|---|
| Measures for the Administration of Generative Artificial Intelligence Services | ✅/❌ | Providing generative AI services to the public | Security assessment, algorithm filing, content labeling, legality of training data, complaint mechanism |
| Provisions on the Administration of Algorithm Recommendations for Internet Information Services | ✅/❌ | Using algorithm recommendation technology | Algorithm filing, security assessment, user tag management, protection of minors |
| Provisions on the Administration of Deep Synthesis of Internet Information Services | ✅/❌ | Providing deep synthesis services | Security assessment, content labeling, log retention |
| Personal Information Protection Law | ✅/❌ | Processing personal information | Personal information protection impact assessment, notice and consent, data minimization, security measures |
| Measures for Ethical Review of Science and Technology (Trial) | ✅/❌ | Involving life and health, public social interests, etc. | Ethical review, informed consent, risk control |
5C: Item-by-item assessment
For each applicable regulation, assess compliance status item by item:
### 《生成式人工智能服务管理办法》合规评估
| 条款 | 要求 | 合规状态 | 证据/差距 | 整改措施 |
|------|------|----------|-----------|----------|
| 第4条 | 遵守法律、尊重社会公德、不得生成违法和不良信息 | ✅/⚠️/❌ | [说明] | [行动] |
| 第7条 | 训练数据合法来源，不侵害知识产权 | ✅/⚠️/❌ | [说明] | [行动] |
| 第9条 | 生成内容标识 | ✅/⚠️/❌ | [说明] | [行动] |
| 第11条 | 用户信息保护义务 | ✅/⚠️/❌ | [说明] | [行动] |
| 第15条 | 投诉举报机制 | ✅/⚠️/❌ | [说明] | [行动] |
5D: Science and technology ethical review
If the Measures for Ethical Review of Science and Technology (Trial) are triggered[法条原文]：
## 科技伦理审查
**是否触发：** ✅/❌
**触发依据：** [所涉及的生命健康/社会公共利益/个人信息等具体情形]
### 伦理风险清单
| 风险类别 | 具体风险 | 严重度 | 缓解措施 |
|----------|----------|--------|----------|
| 算法歧视 | [描述] | 🔴/🟠/🟡 | [措施] |
| 隐私侵害 | [描述] | 🔴/🟠/🟡 | [措施] |
| 信息茧房 | [描述] | 🔴/🟠/🟡 | [措施] |
| 算法滥用 | [描述] | 🔴/🟠/🟡 | [措施] |
### 伦理审查结论
[通过 / 附条件通过 / 不予通过 — 附理由]
5E: Rectification plan
| # | Gap | Legal basis | Rectification measures | Responsible person | Deadline | Status |
|---|---|---|---|---|---|---|
| 1 | [description] | [legal provision citation] | [specific action] | [name] | [date] | [ ] |
Step 6: Output and archiving
Save the assessment document to ~/.claude/plugins/config/claude-for-legal-zh/ai-governance-legal/outputs/aia-[系统简称]-[日期].md. At the same time, update ## AI系统清单 the corresponding entry in - add the assessment date and conclusion.
Reassessment trigger conditions
Assessed systems should be reassessed in the following circumstances:
- Substantial changes in the sources of training data
- Substantial changes in model architecture or algorithms
- Expansion of usage scenarios from internal to public-facing
- Beginning to process sensitive personal information
- Regulatory updates: revisions to relevant regulations or entry into force of new regulations
- More than 12 months since the last assessment (recommended recertification cycle)
Closing
Close with the next-step decision tree specified in CLAUDE.md ## 输出 . Customize options to cover the specific outputs of this assessment - approve/reject gap rectification, set rectification deadlines, escalate to legal counsel.
Source citation hierarchy
Each legal provision cited in the assessment must be attached with a source traceability label:
[法条原文]— direct quotation of the original text of the legal provision[模型知识 — 需验证]— derived from model training data, not independently verified[yuandian检索]— obtained through yuandian MCP[联网检索 — 需复核]— obtained through online search, without secondary verification
What this skill does not do
- It does not replace a formal science and technology ethical review committee resolution. If the Measures for Ethical Review of Science and Technology (Trial) are triggered, this assessment is internal preparatory material, and the formal review opinion shall be based on the resolution of the ethical review committee.
- It does not perform technical testing - it does not assess technical metrics of model accuracy, robustness, or bias.
- It does not complete algorithm filing submissions - this skill identifies filing obligations, but does not fill out filing forms.
- Does not replace the official review by the Cyberspace Administration of China/National Data Administration—this is an internal assessment, not regulatory approval.