REASON

acf.identify-governance-gaps

Governance gap analysis tied to the 4 ACF® principles: an inventory and a process list in; out, a coverage score per principle, a list of gaps prioritised by severity, quick wins and remediation actions out.

!Warning

Preliminary analysis. The maturity score rests on a baseline that is not weighted by sector: an asset manager and a municipality get the same calibration. requires_human_review is always true. Gaps not explicitly declared by the inventory are inferred, confirm the inferred / declared distinction before acting.

When to use

Use this tool when you must answer the board-level question: “what does ACF® say we should have that we don’t?”. It takes an AI inventory (count of systems, high-risk, GPAI, known shadow AI) and a list of governance processes with their status (exists / documented), returns a coverage score for each of the 4 principles (P1 Decision Sovereignty, P2 Governance by Design, P3 Ultimate Human Control, P4 Traceable Accountability) and the prioritised list of gaps to close.

It is the audit tool. It serves to scope a roadmap, prioritise an AI governance budget, or prepare an AI committee review. First results are designed to land in an ACF-10 (Action Plan & Improvement) card.

Input parameters

Two required blocks (inventory + processes), two optional context fields.

current_inventory{ ai_systems_count, high_risk_count?, gpai_used?, shadow_ai_known? }required

Snapshot of the AI inventory: total system count, high-risk count, GPAI presence, known shadow AI presence. Everything except ai_systems_count is optional, the tool distinguishes absent vs declared.

current_processes{ process: string, exists: boolean, documented?: boolean }[]required

List of evaluated governance processes. Recognised processes: ai_committee, executive_sponsor, ai_inventory, doctrine_published, kill_switch_drill, observability, ddao_appointed, raci, dpia, article_49_register, ai_act_qualification, annual_audit, incident_review.

sectorstring (≤80)

Organisation’s sector. Stored for traceability, not yet used to weight the score (cf. assumptions).

locale"en" | "fr"default: "en"

Language of the textual output.

Output schema

Coverage score (overall and per principle), gap list, priority order, quick wins, signed footer.

maturity_score{ overall: number, by_principle: Record<"P1" | "P2" | "P3" | "P4", number> }

Overall 0-100 score and per-principle score (P1 to P4). Each expected process is tied to the principle it serves: P1 inventory, AI committee, sponsor; P2 published doctrine, AI Act qualification, DPIA; P3 appointed DDAO, kill switch drill; P4 RACI, observability, Art. 49 register, annual audit, incident review.

gaps{ principle, severity: "low"|"medium"|"high"|"critical", description, remediation, fiches, estimated_effort_days }[]

Detailed list of identified gaps, each with its principle, severity, remediation, related fiches and effort estimate in days.

priority_orderstring[]

Gap descriptions sorted by severity (critical → low), directly usable as a committee agenda.

quick_winsstring[]

Gaps remediable in ≤ 3 effort-days, useful to kick off a governance sprint.

confidence"low" | "medium" | "high"

Global confidence of the analysis.

assumptionsstring[]

Explicit assumptions, notably the lack of sector weighting.

gaps_to_validatestring[]

Points to confirm in human review, including the inferred / declared distinction and the high-risk subset.

rationale_per_rule{ rule_id, rule_version, fired, evidence }[]

Trace of the fired rule with the number of processes evaluated.

requires_human_reviewtrue

Constant. No call returns false.

Example call

A bank with 14 AI systems including 2 high-risk, GPAI used, known shadow AI:

identify-governance-gaps.tstypescript

import { Client } from "@modelcontextprotocol/sdk/client/index.js";
import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";

const transport = new StdioClientTransport({
  command: "npx",
  args: ["-y", "acf-mcp"],
});
const client = new Client({ name: "demo", version: "1.0" }, {});
await client.connect(transport);

const result = await client.callTool({
  name: "acf.identify-governance-gaps",
  arguments: {
    current_inventory: {
      ai_systems_count: 14,
      high_risk_count: 2,
      gpai_used: true,
      shadow_ai_known: true,
    },
    current_processes: [
      { process: "ai_committee", exists: true, documented: true },
      { process: "executive_sponsor", exists: true, documented: true },
      { process: "ai_inventory", exists: true, documented: false },
      { process: "doctrine_published", exists: false },
      { process: "kill_switch_drill", exists: false },
      { process: "observability", exists: true, documented: false },
      { process: "ddao_appointed", exists: false },
      { process: "raci", exists: false },
      { process: "dpia", exists: false },
      { process: "article_49_register", exists: false },
      { process: "ai_act_qualification", exists: false },
      { process: "annual_audit", exists: true, documented: true },
      { process: "incident_review", exists: false },
    ],
    sector: "banking",
    locale: "en",
  },
});

console.log(JSON.stringify(result.content, null, 2));

Response

response.jsonjson

{
  "maturity_score": {
    "overall": 29,
    "by_principle": {
      "P1": 84,
      "P2": 1,
      "P3": 0,
      "P4": 30
    }
  },
  "gaps": [
    {
      "principle": "P1",
      "severity": "medium",
      "description": "Process 'ai_inventory' exists but is undocumented.",
      "remediation": "Document 'ai_inventory' with the relevant ACF® card.",
      "fiches": [
        "ACF-02"
      ],
      "estimated_effort_days": 2
    },
    {
      "principle": "P2",
      "severity": "medium",
      "description": "Process 'doctrine_published' is missing for P2.",
      "remediation": "Publish a doctrine note grounded in ACF® v1.0 to the relevant teams.",
      "fiches": [],
      "estimated_effort_days": 5
    },
    {
      "principle": "P2",
      "severity": "critical",
      "description": "Process 'ai_act_qualification' is missing for P2.",
      "remediation": "Run acf.classify-agent on each system to qualify under the AI Act.",
      "fiches": [],
      "estimated_effort_days": 5
    },
    {
      "principle": "P2",
      "severity": "critical",
      "description": "Process 'dpia' is missing for P2.",
      "remediation": "Stand up the DPIA workflow with ACF-12 as the template.",
      "fiches": [
        "ACF-12"
      ],
      "estimated_effort_days": 10
    },
    {
      "principle": "P3",
      "severity": "high",
      "description": "Process 'ddao_appointed' is missing for P3.",
      "remediation": "Appoint a DDAO per agent that decides on its own, with a documented mandate.",
      "fiches": [
        "ACF-13"
      ],
      "estimated_effort_days": 5
    },
    {
      "principle": "P3",
      "severity": "high",
      "description": "Process 'kill_switch_drill' is missing for P3.",
      "remediation": "Run a quarterly kill-switch drill per ACF-P7.",
      "fiches": [
        "ACF-07",
        "ACF-P7"
      ],
      "estimated_effort_days": 3
    },
    {
      "principle": "P4",
      "severity": "high",
      "description": "Process 'raci' is missing for P4.",
      "remediation": "Publish a RACI for agentic decisions including DDAO + DPO + CISO + sponsor.",
      "fiches": [],
      "estimated_effort_days": 5
    },
    {
      "principle": "P4",
      "severity": "medium",
      "description": "Process 'observability' exists but is undocumented.",
      "remediation": "Document 'observability' with the relevant ACF® card.",
      "fiches": [
        "ACF-06"
      ],
      "estimated_effort_days": 2
    },
    {
      "principle": "P4",
      "severity": "critical",
      "description": "Process 'article_49_register' is missing for P4.",
      "remediation": "Prepare the Article 49 register for any high-risk system before go-live.",
      "fiches": [
        "ACF-09",
        "ACF-12"
      ],
      "estimated_effort_days": 5
    },
    {
      "principle": "P4",
      "severity": "medium",
      "description": "Process 'incident_review' is missing for P4.",
      "remediation": "Open a quarterly incident review forum with the AI committee.",
      "fiches": [],
      "estimated_effort_days": 5
    },
    {
      "principle": "P1",
      "severity": "high",
      "description": "Shadow AI exists in the organisation.",
      "remediation": "Run a discovery campaign + classify each shadow agent via acf.classify-agent.",
      "fiches": [
        "ACF-02"
      ],
      "estimated_effort_days": 10
    },
    {
      "principle": "P2",
      "severity": "critical",
      "description": "High-risk systems present but no DPIA process.",
      "remediation": "Stand up the DPIA workflow before any new high-risk go-live.",
      "fiches": [
        "ACF-12"
      ],
      "estimated_effort_days": 5
    }
  ],
  "priority_order": [
    "P2: Process 'ai_act_qualification' is missing for P2.",
    "P2: Process 'dpia' is missing for P2.",
    "P4: Process 'article_49_register' is missing for P4.",
    "P2: High-risk systems present but no DPIA process.",
    "P3: Process 'ddao_appointed' is missing for P3.",
    "P3: Process 'kill_switch_drill' is missing for P3.",
    "P4: Process 'raci' is missing for P4.",
    "P1: Shadow AI exists in the organisation.",
    "P1: Process 'ai_inventory' exists but is undocumented.",
    "P2: Process 'doctrine_published' is missing for P2.",
    "P4: Process 'observability' exists but is undocumented.",
    "P4: Process 'incident_review' is missing for P4."
  ],
  "quick_wins": [
    "Process 'ai_inventory' exists but is undocumented.",
    "Process 'kill_switch_drill' is missing for P3.",
    "Process 'observability' exists but is undocumented."
  ],
  "confidence": "low",
  "assumptions": [
    "Coverage is unweighted across the 4 principles; sector-specific weights not yet calibrated."
  ],
  "gaps_to_validate": [
    "Confirm which gaps were inferred vs explicitly declared by your inventory.",
    "Run acf.classify-agent on the high-risk subset to consolidate the qualification."
  ],
  "requires_human_review": true,
  "rationale_per_rule": [
    {
      "rule_id": "identify-gaps.principle-checklist",
      "rule_version": "2026-06",
      "fired": true,
      "evidence": "13 processes evaluated"
    }
  ],
  "doctrine_version": "ACF framework v1.0 / rules 2026-06",
  "doctrine_hash": "sha256:119819463363cde0649504ab8ed5a96982fdb8506441f2c5e76e7e3c3feb77f1",
  "doctrine_signature": "ed25519:3R0oIiqL3Kgd…",
  "doctrine_archive_url": "https://acfstandard.io/archive/doctrine/v1.0/doctrine-v1.0.json",
  "regulatory_snapshot": "EU AI Act (Reg. 2024/1689, incl. Digital Omnibus deferral) + GDPR (Reg. 2016/679) + DORA (Reg. 2022/2554) + NIS2 (Dir. 2022/2555) + ISO 42001:2023: as of 2026-06-07",
  "generated_at": "2026-11-01T12:06:31.065Z",
  "disclaimer": "Preliminary qualification produced by the ACF® deterministic engine. Not legal advice. Human review required. Do not use for autonomous regulatory decision-making. See doctrine_archive_url for the version of the doctrine used."
}

Common errors

Invalid parameters: negative or non-integer ai_systems_count, or a current_processes item without process or exists. The call fails with a JSON-RPC error whose message lists the offending fields.
Low confidence: when few context fields are provided, confidence is low and assumptions states what was assumed. Complete the input before relying on the result.

acf.classify-agent: qualify each system identified as high-risk to consolidate the governance landscape.
acf.advisor: drop from the organisational maturity score back to a single case when a gap deserves focus.
acf.map-ai-act-obligations: get the exhaustive obligations to inscribe in the remediation plan for high-risk systems.