REASON

acf.identify-governance-gaps

Analyse d’écarts de gouvernance rattachée aux 4 principes ACF® : un inventaire et une liste de processus en entrée ; en sortie, un score de couverture par principe, une liste de gaps priorisés par sévérité, des quick wins et des actions de remédiation en sortie.

!Attention

Analyse préliminaire. Le score de maturité repose sur une baseline non pondérée par secteur: un cabinet de gestion d’actifs et une mairie obtiennent la même calibration. requires_human_review vaut toujours true. Les gaps non déclarés explicitement par l’inventaire sont inférés, confirmez la distinction inféré / déclaré avant d’agir.

Quand l’utiliser

Utilisez cet outil quand vous devez répondre à la question board-level : « qu’est-ce qu’ACF® dit qu’on devrait avoir, et qu’on n’a pas ? ». Il prend un inventaire IA (nombre de systèmes, high-risk, GPAI, shadow AI connue) et une liste de processus de gouvernance avec leur statut (existe / documenté), il rend un score de couverture pour chacun des 4 principes (P1 Souveraineté décisionnelle, P2 Gouvernance par conception, P3 Contrôle humain ultime, P4 Responsabilité traçable) et la liste priorisée des trous à combler.

C’est l’outil d’audit. Il sert à cadrer une feuille de route, à prioriser un budget de gouvernance IA, ou à préparer une revue de comité IA. Les premiers résultats sont conçus pour entrer dans une fiche ACF-10 (Plan d’action & Amélioration).

Paramètres d’entrée

Deux blocs obligatoires (inventaire + processus), deux champs contextuels optionnels.

current_inventory{ ai_systems_count, high_risk_count?, gpai_used?, shadow_ai_known? }required

Photo de l’inventaire IA : nombre total de systèmes, nombre marqué high-risk, présence de GPAI, présence connue de shadow AI. Tout sauf ai_systems_count est optionnel, l’outil distingue absent vs déclaré.

current_processes{ process: string, exists: boolean, documented?: boolean }[]required

Liste des processus de gouvernance évalués. Processus reconnus : ai_committee, executive_sponsor, ai_inventory, doctrine_published, kill_switch_drill, observability, ddao_appointed, raci, dpia, article_49_register, ai_act_qualification, annual_audit, incident_review.

sectorstring (≤80)

Secteur de l’organisation. Stocké pour traçabilité, pas encore utilisé pour pondérer le score (cf. assumptions).

locale"en" | "fr"default: "en"

Langue de la sortie textuelle.

Schéma de sortie

Score de couverture (global et par principe), liste des gaps, ordre de priorité, quick wins, pied-de-page signé.

maturity_score{ overall: number, by_principle: Record<"P1" | "P2" | "P3" | "P4", number> }

Score global 0-100 et score par principe (P1 à P4). Chaque processus attendu est rattaché au principe qu’il sert : P1 inventaire, comité IA, sponsor ; P2 doctrine publiée, qualification AI Act, AIPD ; P3 DDAO nommé, test du kill switch ; P4 RACI, observabilité, registre art. 49, audit annuel, revue d’incidents.

gaps{ principle, severity: "low"|"medium"|"high"|"critical", description, remediation, fiches, estimated_effort_days }[]

Liste détaillée des écarts identifiés, chacun avec son principe, sa sévérité, sa remédiation, les fiches associées et l’effort estimé en jours.

priority_orderstring[]

Description des gaps triée par sévérité (critical → low), directement utilisable comme ordre du jour de comité.

quick_winsstring[]

Gaps remédiables en ≤ 3 jours d’effort, utiles pour démarrer un sprint de gouvernance.

confidence"low" | "medium" | "high"

Confiance globale de l’analyse.

assumptionsstring[]

Hypothèses explicites, notamment la non-pondération sectorielle.

gaps_to_validatestring[]

Points à confirmer en revue humaine, dont la distinction inféré / déclaré et le sous-ensemble high-risk.

rationale_per_rule{ rule_id, rule_version, fired, evidence }[]

Trace de la règle déclenchée avec le nombre de processus évalués.

requires_human_reviewtrue

Constant. Aucun appel ne le retourne false.

Exemple d’appel

Une banque avec 14 systèmes IA dont 2 high-risk, GPAI utilisé, shadow AI connue :

identify-governance-gaps.tstypescript

import { Client } from "@modelcontextprotocol/sdk/client/index.js";
import { StdioClientTransport } from "@modelcontextprotocol/sdk/client/stdio.js";

const transport = new StdioClientTransport({
  command: "npx",
  args: ["-y", "acf-mcp"],
});
const client = new Client({ name: "demo", version: "1.0" }, {});
await client.connect(transport);

const result = await client.callTool({
  name: "acf.identify-governance-gaps",
  arguments: {
    current_inventory: {
      ai_systems_count: 14,
      high_risk_count: 2,
      gpai_used: true,
      shadow_ai_known: true,
    },
    current_processes: [
      { process: "ai_committee", exists: true, documented: true },
      { process: "executive_sponsor", exists: true, documented: true },
      { process: "ai_inventory", exists: true, documented: false },
      { process: "doctrine_published", exists: false },
      { process: "kill_switch_drill", exists: false },
      { process: "observability", exists: true, documented: false },
      { process: "ddao_appointed", exists: false },
      { process: "raci", exists: false },
      { process: "dpia", exists: false },
      { process: "article_49_register", exists: false },
      { process: "ai_act_qualification", exists: false },
      { process: "annual_audit", exists: true, documented: true },
      { process: "incident_review", exists: false },
    ],
    sector: "banking",
    locale: "en",
  },
});

console.log(JSON.stringify(result.content, null, 2));

Réponse

response.jsonjson

{
  "maturity_score": {
    "overall": 29,
    "by_principle": {
      "P1": 84,
      "P2": 1,
      "P3": 0,
      "P4": 30
    }
  },
  "gaps": [
    {
      "principle": "P1",
      "severity": "medium",
      "description": "Process 'ai_inventory' exists but is undocumented.",
      "remediation": "Document 'ai_inventory' with the relevant ACF® card.",
      "fiches": [
        "ACF-02"
      ],
      "estimated_effort_days": 2
    },
    {
      "principle": "P2",
      "severity": "medium",
      "description": "Process 'doctrine_published' is missing for P2.",
      "remediation": "Publish a doctrine note grounded in ACF® v1.0 to the relevant teams.",
      "fiches": [],
      "estimated_effort_days": 5
    },
    {
      "principle": "P2",
      "severity": "critical",
      "description": "Process 'ai_act_qualification' is missing for P2.",
      "remediation": "Run acf.classify-agent on each system to qualify under the AI Act.",
      "fiches": [],
      "estimated_effort_days": 5
    },
    {
      "principle": "P2",
      "severity": "critical",
      "description": "Process 'dpia' is missing for P2.",
      "remediation": "Stand up the DPIA workflow with ACF-12 as the template.",
      "fiches": [
        "ACF-12"
      ],
      "estimated_effort_days": 10
    },
    {
      "principle": "P3",
      "severity": "high",
      "description": "Process 'ddao_appointed' is missing for P3.",
      "remediation": "Appoint a DDAO per agent that decides on its own, with a documented mandate.",
      "fiches": [
        "ACF-13"
      ],
      "estimated_effort_days": 5
    },
    {
      "principle": "P3",
      "severity": "high",
      "description": "Process 'kill_switch_drill' is missing for P3.",
      "remediation": "Run a quarterly kill-switch drill per ACF-P7.",
      "fiches": [
        "ACF-07",
        "ACF-P7"
      ],
      "estimated_effort_days": 3
    },
    {
      "principle": "P4",
      "severity": "high",
      "description": "Process 'raci' is missing for P4.",
      "remediation": "Publish a RACI for agentic decisions including DDAO + DPO + CISO + sponsor.",
      "fiches": [],
      "estimated_effort_days": 5
    },
    {
      "principle": "P4",
      "severity": "medium",
      "description": "Process 'observability' exists but is undocumented.",
      "remediation": "Document 'observability' with the relevant ACF® card.",
      "fiches": [
        "ACF-06"
      ],
      "estimated_effort_days": 2
    },
    {
      "principle": "P4",
      "severity": "critical",
      "description": "Process 'article_49_register' is missing for P4.",
      "remediation": "Prepare the Article 49 register for any high-risk system before go-live.",
      "fiches": [
        "ACF-09",
        "ACF-12"
      ],
      "estimated_effort_days": 5
    },
    {
      "principle": "P4",
      "severity": "medium",
      "description": "Process 'incident_review' is missing for P4.",
      "remediation": "Open a quarterly incident review forum with the AI committee.",
      "fiches": [],
      "estimated_effort_days": 5
    },
    {
      "principle": "P1",
      "severity": "high",
      "description": "Shadow AI exists in the organisation.",
      "remediation": "Run a discovery campaign + classify each shadow agent via acf.classify-agent.",
      "fiches": [
        "ACF-02"
      ],
      "estimated_effort_days": 10
    },
    {
      "principle": "P2",
      "severity": "critical",
      "description": "High-risk systems present but no DPIA process.",
      "remediation": "Stand up the DPIA workflow before any new high-risk go-live.",
      "fiches": [
        "ACF-12"
      ],
      "estimated_effort_days": 5
    }
  ],
  "priority_order": [
    "P2: Process 'ai_act_qualification' is missing for P2.",
    "P2: Process 'dpia' is missing for P2.",
    "P4: Process 'article_49_register' is missing for P4.",
    "P2: High-risk systems present but no DPIA process.",
    "P3: Process 'ddao_appointed' is missing for P3.",
    "P3: Process 'kill_switch_drill' is missing for P3.",
    "P4: Process 'raci' is missing for P4.",
    "P1: Shadow AI exists in the organisation.",
    "P1: Process 'ai_inventory' exists but is undocumented.",
    "P2: Process 'doctrine_published' is missing for P2.",
    "P4: Process 'observability' exists but is undocumented.",
    "P4: Process 'incident_review' is missing for P4."
  ],
  "quick_wins": [
    "Process 'ai_inventory' exists but is undocumented.",
    "Process 'kill_switch_drill' is missing for P3.",
    "Process 'observability' exists but is undocumented."
  ],
  "confidence": "low",
  "assumptions": [
    "Coverage is unweighted across the 4 principles; sector-specific weights not yet calibrated."
  ],
  "gaps_to_validate": [
    "Confirm which gaps were inferred vs explicitly declared by your inventory.",
    "Run acf.classify-agent on the high-risk subset to consolidate the qualification."
  ],
  "requires_human_review": true,
  "rationale_per_rule": [
    {
      "rule_id": "identify-gaps.principle-checklist",
      "rule_version": "2026-06",
      "fired": true,
      "evidence": "13 processes evaluated"
    }
  ],
  "doctrine_version": "ACF framework v1.0 / rules 2026-06",
  "doctrine_hash": "sha256:119819463363cde0649504ab8ed5a96982fdb8506441f2c5e76e7e3c3feb77f1",
  "doctrine_signature": "ed25519:3R0oIiqL3Kgd…",
  "doctrine_archive_url": "https://acfstandard.io/archive/doctrine/v1.0/doctrine-v1.0.json",
  "regulatory_snapshot": "EU AI Act (Reg. 2024/1689, incl. Digital Omnibus deferral) + GDPR (Reg. 2016/679) + DORA (Reg. 2022/2554) + NIS2 (Dir. 2022/2555) + ISO 42001:2023: as of 2026-06-07",
  "generated_at": "2026-11-01T12:06:31.065Z",
  "disclaimer": "Preliminary qualification produced by the ACF® deterministic engine. Not legal advice. Human review required. Do not use for autonomous regulatory decision-making. See doctrine_archive_url for the version of the doctrine used."
}

Erreurs courantes

Paramètres invalides : ai_systems_count négatif ou non entier, ou élément de current_processes sans process ou sans exists. L’appel échoue avec une erreur JSON-RPC dont le message liste les champs en cause.
Confiance basse : quand peu de champs de contexte sont fournis, confidence vaut low et assumptions dit ce qui a été supposé. Complétez l’entrée avant de vous appuyer sur le résultat.