/ai-regulatory-audit

⚠️ Not legal advice. This skill produces a drafting and triage aid generated by a product-organization compliance skill. Its output is NOT a regulatory posture attestation, NOT a certification, NOT a legal opinion, and NOT a substitute for licensed counsel. No attorney-client relationship is created by its production or use. Jurisdiction-specific questions, contested enforcement positions, and any decision with material legal or regulatory consequence require review by a licensed attorney in each relevant jurisdiction. Do not rely on this output as the sole basis for any AI governance, regulatory, or market-access decision.

Jurisdiction Assumed: declared in every audit output (Section: Applicability Determination). If your jurisdiction differs from the assumed list, every finding below must be re-verified with local counsel.

Purpose

/ai-regulatory-audit produces an organizational regulatory posture assessment for an AI system, business unit, or organization across multiple applicable AI governance frameworks simultaneously. For each framework that the input triggers (by jurisdiction or system-characteristic), the skill identifies the in-scope obligations, looks up the technical controls that satisfy each obligation via the shared control-to-obligation mapping table in the compliance-frameworks knowledge pack, and produces a gap register, an overlap register, and a prioritized mitigation plan. The output is a drafting and triage aid for human review — the Compliance Officer plus licensed counsel in each jurisdiction.

The skill answers one question and one question only:

"Does this organization / AI system demonstrate responsible AI governance across the multiple frameworks that apply to it, regardless of whether any single framework is fully compliant?"

That is the posture question. It is not "are we compliant with GDPR?" (that is /compliance-audit A4). It is not "are our technical controls working?" (that is /ai-control-audit C1.2a). It is not "does our privacy policy disclose enough?" (that is /privacy-policy-audit A3). It is not "what could hurt this deal?" (that is /risk-analysis A5). Posture is the cross-framework, organization-level view: can we credibly say our AI governance program addresses what the frameworks that apply to us demand, and where are the material gaps?

What the skill IS: an analytical cross-framework pass that (a) determines which frameworks apply, (b) derives the in-scope obligations inside each, (c) maps those obligations to the organization's technical controls via the shared mapping table, (d) identifies gaps, overlaps, and remediation priority.