Deploy Enterprise Ai Governance Hub Frootai

---
name: deploy-enterprise-ai-governance-hub-frootai
title: Deploy Enterprise AI Governance Hub
description: Deploy Enterprise AI Governance Hub — AI system registry, EU AI Act risk classification, model lifecycle management, policy enforcement, compliance dashboard.
author: frootai
author_url: https://github.com/frootai/frootai/tree/main/solution-plays/99-enterprise-ai-governance-hub/.github/skills/deploy-enterprise-ai-governance-hub
license: MIT
version: 0.1.0
execution_mode: open
jurisdiction: eu
practice: regulatory
language: en
---

# Deploy Enterprise AI Governance Hub

## Prerequisites

- Azure CLI authenticated (`az account show`)
- Contributor + User Access Administrator on target subscription
- Organization AI system inventory (existing models, data sources)
- Python 3.11+ with `azure-openai`, `azure-identity`

## Step 1: Deploy Infrastructure

```bash
az deployment group create \
  --resource-group rg-frootai-ai-governance \
  --template-file infra/main.bicep \
  --parameters infra/parameters.json \
  --parameters environment=dev
```

Infrastructure components:
| Resource | Purpose | SKU |
|----------|---------|-----|
| Azure OpenAI | Risk classification + compliance report generation | S0 |
| Cosmos DB | AI system registry, assessments, policies, audit log | Serverless |
| Azure AD / Entra ID | RBAC for governance roles (admin, assessor, viewer) | Included |
| Azure Functions | Policy enforcement gates + scheduled reviews | Consumption |
| Container Apps | Governance dashboard API | Consumption |
| Azure Key Vault | Secrets + governance config | Standard |
| App Insights | Governance telemetry + audit trail | Pay-as-you-go |

## Step 2: Deploy AI System Registry

```python
# AI System registration schema
AI_SYSTEM_SCHEMA = {
    "id": str,
    "name": str,
    "description": str,
    "owner": {"team": str, "responsible_person": str, "email": str},
    "risk_level": str,  # Auto-classified: "unacceptable", "high", "limited", "minimal"
    "status": str,      # "development", "staging", "production", "deprecated", "retired"
    "model_info": {
        "model_name": str,
        "version": str,
        "provider": str,  # "azure_openai", "custom", "third_party"
        "model_type": str  # "generative", "classification", "regression", "vision"
    },
    "data_sources": [str],
    "use_case": str,
    "affected_population": str,
    "compliance": {
        "eu_ai_act": {"status": str, "assessment_date": str},
        "gdpr": {"status": str, "dpia_completed": bool},
        "nist_ai_rmf": {"status": str},
        "iso_42001": {"status": str}
    },
    "oversight": {
        "human_in_the_loop": bool,
        "override_mechanism": bool,
        "monitoring_active": bool,
        "escalation_path": str
    },
    "last_assessment": str,
    "next_review": str,
    "incidents": [{"date": str, "severity": str, "description": str}]
}
```

## Step 3: Deploy EU AI Act Risk Classification

```python
EU_AI_ACT_RISK_LEVELS = {
    "unacceptable": {
        "description": "Banned AI applications",
        "examples": ["social_scoring", "real_time_biometric_mass_surveillance", "subliminal_manipulation"],
        "action": "block_registration",
        "allowed_exceptions": ["law_enforcement_with_judicial_authorization"]
    },
    "high": {
        "description": "AI systems with significant impact on health, safety, fundamental rights",
        "categories": [
            "biometric_identification", "critical_infrastructure", "education_access",
            "employment_decisions", "essential_services_access", "law_enforcement",
            "migration_border", "justice_democratic"
        ],
        "requirements": [
            "risk_management_system", "data_governance", "technical_documentation",
            "record_keeping", "transparency_to_users", "human_oversight",
            "accuracy_robustness_cybersecurity", "conformity_assessment"
        ],
        "review_frequency": "quarterly"
    },
    "limited": {
        "description": "AI with transparency obligations",
        "examples": ["chatbots", "emotion_recognition", "deepfake_generation"],
        "requirements": ["transparency_notice", "user_informed_ai_interaction"],
        "review_frequency": "annually"
    },
    "minimal": {
        "description": "Low-risk AI with no specific obligations",
        "examples": ["spam_filters", "game_ai", "inventory_optimization"],
        "requirements": ["voluntary_code_of_conduct"],
        "review_frequency": "biannually"
    }
}

async def classify_risk(system: AISystem) -> str:
    """Auto-classify EU AI Act risk level based on use case and affected population."""
    # Rule-based classification first
    for category in EU_AI_ACT_RISK_LEVELS["unacceptable"]["examples"]:
        if category in system.use_case.lower():
            return "unacceptable"
    
    for category in EU_AI_ACT_RISK_LEVELS["high"]["categories"]:
        if category in system.use_case.lower() or system.affected_population in ["vulnerable", "children"]:
            return "high"
    
    # LLM-assisted for ambiguous cases
    if not clear_classification:
        result = await openai.chat.completions.create(
            model="gpt-4o", temperature=0,
            messages=[{"role": "system", "content": f"""Classify this AI system's risk level under EU AI Act.
System: {system.description}
Use case: {system.use_case}
Affected population: {system.affected_population}
Respond with: unacceptable, high, limited, or minimal."""}]
        )
        return parse_risk_level(result)
    
    return "minimal"
```

## Step 4: Deploy Policy Enforcement Gates

```python
GOVERNANCE_POLICIES = {
    "registration_required": {
        "rule": "All AI systems must be registered before staging/production",
        "enforcement": "block_deployment_if_unregistered",
        "exceptions": None
    },
    "high_risk_oversight": {
        "rule": "High-risk AI must have human oversight plan",
        "enforcement": "block_if_no_oversight_plan",
        "required_fields": ["human_in_the_loop", "override_mechanism", "escalation_path"]
    },
    "review_compliance": {
        "rule": "Systems must be reviewed per schedule",
        "enforcement": "alert_owner_if_overdue",
        "escalation": "block_after_30_days_overdue"
    },
    "incident_reporting": {
        "rule": "Serious incidents must be reported within 72 hours",
        "enforcement": "auto_create_incident_report",
        "notify": ["governance_team", "system_owner", "ciso"]
    },
    "model_deprecation": {
        "rule": "Deprecated models must be retired within 90 days",
        "enforcement": "warn_at_60_days_block_at_90",
        "migration_plan_required": True
    }
}

async def enforce_policy(system: AISystem, action: str) -> PolicyResult:
    """Check if an action (deploy, update, deprecate) is allowed by policies."""
    violations = []
    for policy_name, policy in GOVERNANCE_POLICIES.items():
        if not check_policy_compliance(system, policy, action):
            violations.append(PolicyViolation(policy=policy_name, rule=policy["rule"]))
    
    if violations:
        return PolicyResult(allowed=False, violations=violations,
            recommended_actions=[v.remediation for v in violations])
    return PolicyResult(allowed=True)
```

## Step 5: Deploy Compliance Dashboard

```python
DASHBOARD_METRICS = {
    "organization_overview": {
        "total_ai_systems": "count(registry)",
        "by_risk_level": "group_by(risk_level).count()",
        "by_status": "group_by(status).count()",
        "compliance_rate": "compliant_systems / total_systems * 100",
        "overdue_reviews": "count(next_review < today)"
    },
    "risk_heatmap": {
        "dimensions": ["department", "risk_level"],
        "values": "system_count",
        "highlight": "overdue_or_non_compliant"
    },
    "incident_tracker": {
        "metrics": ["incident_count_30d", "severity_distribution", "mean_time_to_resolve"],
        "trend": "month_over_month"
    },
    "regulation_coverage": {
        "regulations": ["eu_ai_act", "gdpr", "nist_ai_rmf", "iso_42001"],
        "per_system": "compliance_status_per_regulation"
    }
}
```

## Step 6: Deploy Scheduled Review Engine

```bash
# Azure Functions timer trigger for scheduled reviews
# High-risk: quarterly
# Limited: annually
# Minimal: biannually

# Reviews check: model drift, data quality, incident history, policy changes
# Auto-generate review report with current compliance status
```

## Step 7: Smoke Test

```bash
# Register an AI system
curl -s https://api-governance.azurewebsites.net/api/register \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"name": "Customer Support Bot", "use_case": "chatbot", "affected_population": "general_public"}' | jq '.risk_level, .next_review'

# Check policy for deployment
curl -s https://api-governance.azurewebsites.net/api/policy-check \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"system_id": "sys-001", "action": "deploy_to_production"}' | jq '.allowed, .violations'

# Get compliance dashboard
curl -s https://api-governance.azurewebsites.net/api/dashboard \
  -H "Authorization: Bearer $TOKEN" | jq '.compliance_rate, .overdue_reviews'
```

## Troubleshooting

| Symptom | Cause | Fix |
|---------|-------|-----|
| Risk classification too conservative | LLM classifies everything as high | Add rule-based fast path for common minimal-risk cases |
| Shadow AI not captured | Teams deploy without registering | Integrate with CI/CD gates to enforce registration |
| Reviews always overdue | Review schedule too aggressive | Adjust: minimal → biannual, limited → annual |
| Policy violations not enforced | Gates not integrated with deployment | Add pre-deployment webhook to CI/CD pipeline |
| Dashboard data stale | Registry not updated | Require status update on every model version change |