LLM Risk Governance & Audit

1. Governance Frameworks Comparison

2. Model Inventory and Risk Classification

from dataclasses import dataclass
from enum import Enum
from datetime import datetime

class RiskTier(Enum):
    LOW = "low"
    MEDIUM = "medium"
    HIGH = "high"
    CRITICAL = "critical"

@dataclass
class ModelInventoryEntry:
    """Enterprise model inventory record for governance tracking."""
    model_id: str
    model_name: str
    use_case: str
    owner: str
    risk_tier: RiskTier
    deployment_date: str
    last_validation: str
    next_review: str
    data_sources: list[str]
    regulations: list[str]

    def needs_review(self) -> bool:
        return datetime.fromisoformat(self.next_review) <= datetime.now()

    def to_dict(self):
        return {
            "model_id": self.model_id,
            "model_name": self.model_name,
            "use_case": self.use_case,
            "owner": self.owner,
            "risk_tier": self.risk_tier.value,
            "overdue": self.needs_review(),
        }

entry = ModelInventoryEntry(
    model_id="LLM-CS-001", model_name="Customer Support Bot v2",
    use_case="Customer service automation", owner="ML Platform Team",
    risk_tier=RiskTier.MEDIUM, deployment_date="2025-01-15",
    last_validation="2025-01-10", next_review="2025-07-10",
    data_sources=["support_tickets", "knowledge_base"],
    regulations=["GDPR", "EU AI Act (limited risk)"],
)
print(entry.to_dict())

Audit Trail Implementation

import json, hashlib
from datetime import datetime

class AuditTrail:
    """Immutable audit log for LLM interactions."""

    def __init__(self):
        self.entries = []

    def log(self, request_id: str, model: str, input_text: str,
           output_text: str, user_id: str, metadata: dict = None):
        entry = {
            "request_id": request_id,
            "timestamp": datetime.utcnow().isoformat(),
            "model": model,
            "user_id": user_id,
            "input_hash": hashlib.sha256(input_text.encode()).hexdigest()[:16],
            "output_hash": hashlib.sha256(output_text.encode()).hexdigest()[:16],
            "metadata": metadata or {},
        }
        # Chain entries for tamper detection
        if self.entries:
            prev_hash = hashlib.sha256(
                json.dumps(self.entries[-1]).encode()
            ).hexdigest()[:16]
            entry["prev_hash"] = prev_hash
        self.entries.append(entry)
        return entry

    def verify_chain(self) -> bool:
        for i in range(1, len(self.entries)):
            expected = hashlib.sha256(
                json.dumps(self.entries[i-1]).encode()
            ).hexdigest()[:16]
            if self.entries[i].get("prev_hash") != expected:
                return False
        return True