|
| 1 | +# AI Model Governance & Compliance Hub |
| 2 | + |
| 3 | +[](LICENSE) |
| 4 | +[](https://github.com/TamTunnel/AI-Governance-Hub/actions) |
| 5 | + |
| 6 | +## What Is This? |
| 7 | + |
| 8 | +A **centralized platform** for managing your organization's AI models—supporting both **EU AI Act** and **US AI governance** (NIST AI RMF) requirements. |
| 9 | + |
| 10 | +--- |
| 11 | + |
| 12 | +## Executive Summary: The Problem & How This Helps |
| 13 | + |
| 14 | +**The Problem:** |
| 15 | +Organizations, especially government agencies and regulated enterprises, are deploying AI systems at a rapid pace. However, they often lack visibility into what models exist, where they are running, what data they use, and whether they pose unacceptable risks. This "shadow AI" problem leads to **regulatory non-compliance**, duplicated efforts, and an inability to answer basic oversight questions from auditors or leadership. |
| 16 | + |
| 17 | +**The Consequences:** |
| 18 | +Without a central registry, organizations face reputational damage, legal penalties (e.g., EU AI Act fines), and security vulnerabilities. Fragmented spreadsheets and ad-hoc documentation are insufficient for modern compliance frameworks like the NIST AI RMF. |
| 19 | + |
| 20 | +**The Solution:** |
| 21 | +**AI Governance Hub** is a centralized, open-source cockpit that brings order to this chaos. It allows you to: |
| 22 | + |
| 23 | +- **Register & Track:** Maintain a real-time inventory of all AI models and their lineage (datasets, dependencies). |
| 24 | +- **Assess Risk:** Automatically classify systems based on sensitivity (PII/PHI) and regulatory risk levels. |
| 25 | +- **Enforce Policy:** Block non-compliant actions (e.g., deploying high-risk models without approval) using a built-in policy engine. |
| 26 | +- **Prove Compliance:** Generate immutable audit trails and ready-to-file compliance reports. |
| 27 | + |
| 28 | +Crucially, it is **self-hosted and open-source**, giving security-sensitive organizations full control over their governance data without relying on third-party SaaS vendors. |
| 29 | + |
| 30 | +--- |
| 31 | + |
| 32 | +## How This Compares to Other Options |
| 33 | + |
| 34 | +There are three main categories of tools in this space. Here is how AI Governance Hub fits in: |
| 35 | + |
| 36 | +| Feature | **AI Governance Hub** (This Project) | **Enterprise Governance Platforms** (e.g., Credo AI, watsonx) | **MLOps / Model Registries** (e.g., MLflow, Neptune) | |
| 37 | +| :----------------- | :-------------------------------------- | :------------------------------------------------------------ | :--------------------------------------------------- | |
| 38 | +| **Primary Focus** | **Governance & Compliance Scaffolding** | Full-suite GRC & Vendor Risk | Experiment Tracking & Engineering | |
| 39 | +| **Cost / License** | **Open Source (Apache 2.0)** | High (Commercial SaaS) | Open Core or Commercial | |
| 40 | +| **Deployment** | **Self-Hosted (Air-gapped ready)** | SaaS / Hybrid | SaaS / Self-Hosted | |
| 41 | +| **Policy Engine** | **Built-in (Code/Config based)** | Drag-and-drop / Proprietary | Minimal / Custom Scripts | |
| 42 | +| **Target User** | **Gov/Enterprise Architects** | Risk Officers / Legal | Data Scientists | |
| 43 | + |
| 44 | +**Why choose this?** |
| 45 | + |
| 46 | +- Choose **AI Governance Hub** if you need a flexible, self-hosted governance layer that integrates with your existing tools but puts compliance first. |
| 47 | +- Choose **Enterprise Platforms** if you want a fully managed service and have a large budget for GRC tools. |
| 48 | +- Choose **MLOps Tools** for engineering workflows, but pair them with a governance layer (like this one) for oversight. |
| 49 | + |
| 50 | +--- |
| 51 | + |
| 52 | +## Key Features |
| 53 | + |
| 54 | +| Feature | Description | |
| 55 | +| ----------------------- | --------------------------------------------------- | |
| 56 | +| **Model Registry** | Central catalog of AI models | |
| 57 | +| **Risk Profiles** | EU AI Act & NIST AI RMF classification | |
| 58 | +| **Data Classification** | Sensitivity (PII/PHI/PCI) and classification levels | |
| 59 | +| **Lineage Tracking** | Datasets and model dependencies | |
| 60 | +| **Human Approval** | Capture approver, approval notes, timestamps | |
| 61 | +| **Policy Engine** | Define and enforce governance rules | |
| 62 | +| **Multi-Tenancy** | Organization + environment scoping | |
| 63 | +| **SSO Ready** | Designed for IdP integration | |
| 64 | + |
| 65 | +--- |
| 66 | + |
| 67 | +## US AI Governance & NIST AI RMF Alignment |
| 68 | + |
| 69 | +This platform supports alignment with the **NIST AI Risk Management Framework (AI RMF)**. |
| 70 | + |
| 71 | +### NIST AI RMF Function Mapping |
| 72 | + |
| 73 | +| NIST Function | Platform Capability | |
| 74 | +| ------------- | ----------------------------------------------------------- | |
| 75 | +| **GOVERN** | RBAC, policies, organization scoping, audit logs | |
| 76 | +| **MAP** | Model registry, risk profiles, data classification, lineage | |
| 77 | +| **MEASURE** | Evaluation metrics, version tracking, performance history | |
| 78 | +| **MANAGE** | Compliance lifecycle, policy enforcement, human approvals | |
| 79 | + |
| 80 | +### Sectoral Applicability |
| 81 | + |
| 82 | +| Regulation | Relevant Features | |
| 83 | +| -------------- | ------------------------------------------------------ | |
| 84 | +| **HIPAA** | `data_sensitivity: phi`, audit logging | |
| 85 | +| **GLBA/FFIEC** | Risk profiles, data classification, approval workflows | |
| 86 | +| **CCPA/CPRA** | PII tracking, data sources documentation | |
| 87 | +| **FedRAMP** | Organization scoping, audit trails, security controls | |
| 88 | + |
| 89 | +--- |
| 90 | + |
| 91 | +## Data Classification & Sensitivity |
| 92 | + |
| 93 | +### Sensitivity Levels |
| 94 | + |
| 95 | +| Level | Description | Example Use Case | |
| 96 | +| ---------- | ------------------------------------ | ---------------------- | |
| 97 | +| `public` | Non-sensitive data | Public datasets | |
| 98 | +| `internal` | Internal business data | Operational metrics | |
| 99 | +| `pii` | Personally Identifiable Information | Customer names, emails | |
| 100 | +| `phi` | Protected Health Information (HIPAA) | Medical records | |
| 101 | +| `pci` | Payment Card Industry data | Credit card numbers | |
| 102 | + |
| 103 | +### Classification Levels |
| 104 | + |
| 105 | +| Level | Description | |
| 106 | +| -------------- | -------------------------------- | |
| 107 | +| `public` | Open to external parties | |
| 108 | +| `internal` | Internal use only | |
| 109 | +| `confidential` | Restricted access | |
| 110 | +| `restricted` | Highly restricted (need-to-know) | |
| 111 | + |
| 112 | +### Jurisdiction |
| 113 | + |
| 114 | +Track data residency requirements with the `jurisdiction` field (e.g., "US", "EU", "Global"). |
| 115 | + |
| 116 | +--- |
| 117 | + |
| 118 | +## Lineage & Traceability |
| 119 | + |
| 120 | +### Why Lineage Matters |
| 121 | + |
| 122 | +- **Audit compliance**: Know exactly what data trained your models |
| 123 | +- **Incident response**: Quickly identify affected models when data issues arise |
| 124 | +- **Reproducibility**: Track model dependencies for retraining |
| 125 | + |
| 126 | +### Data Model |
| 127 | + |
| 128 | +``` |
| 129 | +Dataset (training data, validation data, etc.) |
| 130 | + ↓ linked via ModelDatasetLink |
| 131 | +ModelRegistry (your AI model) |
| 132 | + ↓ linked via ModelDependency |
| 133 | +ModelRegistry (parent models, fine-tuning sources) |
| 134 | +``` |
| 135 | + |
| 136 | +--- |
| 137 | + |
| 138 | +## Human-in-the-Loop Approvals |
| 139 | + |
| 140 | +When a model is approved, the system captures: |
| 141 | + |
| 142 | +| Field | Description | |
| 143 | +| --------------------- | ---------------------- | |
| 144 | +| `approved_by_user_id` | Who approved the model | |
| 145 | +| `approved_at` | Timestamp of approval | |
| 146 | +| `approval_notes` | Required justification | |
| 147 | + |
| 148 | +**Approval notes are mandatory** when changing status to `approved`. |
| 149 | + |
| 150 | +--- |
| 151 | + |
| 152 | +## Limitations & Non-Goals |
| 153 | + |
| 154 | +While concise and powerful, this platform has specific boundaries: |
| 155 | + |
| 156 | +- **Not Legal Advice:** Using this tool does not guarantee compliance with laws. It provides the _record-keeping_ to support compliance. |
| 157 | +- **Evaluation & Testing:** The hub does not run advanced technical evaluations (bias, robustness, red-teaming) itself. It stores and surfaces results produced by your external ML pipelines and tools. |
| 158 | +- **Discovery & Inventory:** The hub does not automatically scan your network to discover "Shadow AI" systems. It governs models that are registered into it, relying on organizational policy and CI/CD integration to be comprehensive. |
| 159 | +- **Certification Status:** The hub provides documentation support but does not grant formal certification (e.g., FedRAMP authorization, ISO/IEC 42001, or official EU AI Act conformity). It is a tool for internal control and audit readiness, not a substitute for external accreditation. |
| 160 | +- **Not a GRC Platform:** It is not designed to manage broader enterprise risks (cybersecurity, physical, financial) outside of AI. |
| 161 | +- **Not an Observability Solution:** It tracks _metadata_ and _metrics_, but does not replace real-time monitoring tools like Datadog, Prometheus, or Grafana for live inference capability. |
| 162 | +- **Not a Human Replacement:** The tool facilitates governance but does not replace the need for human review boards or legal counsel. |
| 163 | +- **SSO Integration:** Currently designed for SSO patterns (headers/OIDC) but requires proper upstream configuration (Nginx/Okta) to function securely in enterprise environments. |
| 164 | + |
| 165 | +--- |
| 166 | + |
| 167 | +## Security & Deployment |
| 168 | + |
| 169 | +### Network Placement |
| 170 | + |
| 171 | +> [!IMPORTANT] |
| 172 | +> Deploy behind a reverse proxy with TLS termination. |
| 173 | +
|
| 174 | +### High Availability & Scaling (Guidance) |
| 175 | + |
| 176 | +- **Application Layer:** The FastAPI backend is stateless. You can run multiple replicas (containers) behind a load balancer (Nginx, AWS ALB) for high availability. |
| 177 | +- **Database Layer:** Use a managed PostgreSQL service (AWS RDS, Azure Database for PostgreSQL) or a clustered setup (Patroni) for storage reliability. |
| 178 | +- **Secrets:** Inject configuration via environment variables. |
| 179 | + |
| 180 | +### Backup & Restore |
| 181 | + |
| 182 | +Governance data is critical. |
| 183 | + |
| 184 | +- **Strategy:** Integrate the PostgreSQL database into your standard organizational backup policy (e.g., daily snapshots, Point-in-Time Recovery). |
| 185 | +- **Logical Backup:** |
| 186 | + |
| 187 | + ```bash |
| 188 | + # Backup |
| 189 | + pg_dump -h db_host -U user ai_governance > backup_$(date +%F).sql |
| 190 | + |
| 191 | + # Restore |
| 192 | + psql -h db_host -U user ai_governance < backup_2024-01-01.sql |
| 193 | + ``` |
| 194 | + |
| 195 | +--- |
| 196 | + |
| 197 | +## Example 90-Day Rollout (Optional) |
| 198 | + |
| 199 | +For organizations getting started, here is a recommended path: |
| 200 | + |
| 201 | +- **Week 1-2: Pilot Deployment** |
| 202 | + - Deploy the Hub in a staging environment. |
| 203 | + - Connect SSO (simulated or real). |
| 204 | + - Onboard the core AI/ML lead and Compliance lead. |
| 205 | +- **Week 3-6: Inventory & Calibration** |
| 206 | + - Register the top 5 critical AI models ("Golden Record"). |
| 207 | + - Define initial Risk Profiles and Policies (e.g., "High Risk requires 2 reviewers"). |
| 208 | +- **Week 7-10: Process Integration** |
| 209 | + - Make registration mandatory for new models via CI/CD pipelines. |
| 210 | + - Train data scientists on the "Model Registry" workflow. |
| 211 | +- **Week 11-12: Full Governance** |
| 212 | + - Enforce "Block High Risk" policies. |
| 213 | + - Generate the first quarterly Compliance Report for the CISO/Board. |
| 214 | + |
| 215 | +--- |
| 216 | + |
| 217 | +## Quick Start |
| 218 | + |
| 219 | +```bash |
| 220 | +git clone https://github.com/TamTunnel/AI-Governance-Hub.git |
| 221 | +cd AI-Governance-Hub |
| 222 | +cp .env.example .env |
| 223 | +docker compose up --build |
| 224 | +``` |
| 225 | + |
| 226 | +| Service | URL | |
| 227 | +| -------- | ------------------------------------ | |
| 228 | +| Frontend | http://localhost:3000 | |
| 229 | +| API Docs | http://localhost:8000/docs | |
| 230 | +| Metrics | http://localhost:8000/api/v1/metrics | |
| 231 | + |
| 232 | +--- |
| 233 | + |
| 234 | +## Technology Stack |
| 235 | + |
| 236 | +| Layer | Technology | |
| 237 | +| -------------- | ------------------------------ | |
| 238 | +| Frontend | React, TypeScript, Mantine | |
| 239 | +| Backend | Python 3.11, FastAPI, SQLModel | |
| 240 | +| Database | PostgreSQL 15 | |
| 241 | +| Auth | OAuth2, JWT, RBAC | |
| 242 | +| Infrastructure | Docker, Nginx | |
| 243 | + |
| 244 | +--- |
| 245 | + |
| 246 | +## License |
| 247 | + |
| 248 | +Apache License 2.0 — See [LICENSE](LICENSE). |
0 commit comments