@diottodev/runic 1.0.0 → 1.1.0

package/commercial/rfp-responder/SKILL.md

@@ -0,0 +1,154 @@
+---
+name: rfp-responder
+description: "Use when an RFP, RFI, RFQ, security questionnaire, vendor questionnaire, or proposal request arrives and the team needs a structured response — parsing multi-section buyer-dictated requirements (MANDATORY vs WEIGHTED vs NICE-TO-HAVE), building a Shipley-method proof-point matrix mapping each requirement to a verifiable proof point, articulating 3-5 win-themes that ladder up across requirements, and producing a Shipley-derived winrate estimate that informs a bid / no-bid / partner-bid recommendation. For Bid Managers, Proposal Leads, Directors of Sales, and Sales Engineers at the response-strategy moment. Surfaces GAP requirements explicitly — never invents claims. NOT free-form proposal narrative authoring, NOT contract redline, NOT marketing collateral."
+context: fork
+version: 2.8.0
+author: claude-code-skills
+license: MIT
+tags: [commercial, rfp, rfi, rfq, shipley, win-theme, proof-points, structured-response, bid-management]
+compatible_tools: [claude-code, codex-cli, cursor, antigravity, opencode, gemini-cli]
+---
+
+# rfp-responder
+
+## Purpose
+
+Help Bid Managers, Proposal Leads, and Directors of Sales answer five questions at the response-strategy moment:
+
+1. **What is this RFP actually asking?** (parse sections, tag every requirement MANDATORY / WEIGHTED / NICE-TO-HAVE, extract scoring criteria, surface deadlines and format constraints)
+2. **What is our true fit?** (proof-point matrix per requirement: STRONG / PARTIAL / GAP, each backed by a verifiable source — case study, certification, customer quote, technical attestation, benchmark)
+3. **What is our win-theme strategy?** (Shipley method: 3-5 themes that ladder up across requirements, not generic value-prop bullets)
+4. **What is our realistic winrate?** (Shipley-derived factor model: fit, incumbent, relationship strength, decision-criteria alignment, late-entry, competitor count, deal size — produces estimate + confidence band)
+5. **Should we bid?** (deterministic verdict: BID / PARTNER-BID / NO-BID with named factors driving the call)
+
+The skill surfaces GAPs explicitly. Leadership decides whether to close them, partner around them, or no-bid. **It never invents claims.**
+
+## When to use
+
+- A 30+ page RFP / RFI / RFQ has landed with a 7-14 day response deadline
+- A security questionnaire (SIG, CAIQ, custom-buyer) needs structured Q&A — not prose
+- The team is preparing a bid / no-bid review and needs a defensible winrate estimate
+- Sales Engineering has a proof-point library but no system to map proofs to requirements
+- Leadership wants to see fit % (STRONG / PARTIAL / GAP) before committing pursuit budget
+- A late-entry opportunity needs honest assessment of the relationship deficit
+
+**Do not use for:**
+- Free-form proposal narrative authoring → `business-growth/contract-and-proposal-writer`
+- Contract redline AFTER award → `c-level-advisor/general-counsel-advisor`
+- Marketing collateral / category content → `marketing-skill/*`
+- Discount approval on the awarded deal → `commercial/deal-desk`
+- Pricing-model design for a new product → `commercial/pricing-strategist`
+
+## Workflow
+
+### Step 1 — Parse the RFP
+
+Drop the RFP markdown / text into `scripts/rfp_parser.py`. Output: structured JSON listing every requirement, tagged MANDATORY / WEIGHTED / NICE-TO-HAVE based on cue words (must / shall = MANDATORY; should / weighted scoring numbers = WEIGHTED; may / preferred / desired = NICE-TO-HAVE). Captures section structure, scoring criteria if disclosed, deadline, submission format constraints.
+
+```bash
+python scripts/rfp_parser.py --input rfp.md --output json > parsed.json
+```
+
+### Step 2 — Score fit per requirement
+
+Fill `assets/rfp_intake_template.md` with your proof-point library (each proof tagged with type + verifiable source + which requirement-tags it covers) and proposed win-themes. Feed parsed RFP + intake into `scripts/response_drafter.py`. Output: proof-point matrix per requirement with STRONG / PARTIAL / GAP, win-theme injection, GAP audit.
+
+```bash
+python scripts/response_drafter.py --input draft_input.json --output markdown > matrix.md
+```
+
+**Hard rule:** GAP requirements are surfaced, never invented around. Leadership reads the GAP audit and decides: close the gap, partner-bid, or no-bid.
+
+### Step 3 — Apply win-theme strategy
+
+Shipley method: 3-5 themes that span requirements. Each theme answers "why us over the incumbent / competitor on the criteria the buyer named." `response_drafter.py` shows which themes thread through which requirements — a theme appearing in <2 requirements is decorative, not strategic, and gets flagged.
+
+### Step 4 — Estimate winrate
+
+Feed deal context (fit %, incumbent strength, relationship, decision-criteria alignment, late-entry, competitor count, deal size vs. average) into `scripts/winrate_predictor.py`. Output: Shipley-derived estimate 0-100% + confidence band + factor breakdown + BID / PARTNER-BID / NO-BID verdict.
+
+```bash
+python scripts/winrate_predictor.py --input deal_context.json --profile enterprise-software --output markdown
+```
+
+**No-bid threshold:** estimate < 20% triggers automatic no-bid recommendation.
+
+### Step 5 — Decide
+
+Take parsed RFP + proof-point matrix + GAP audit + winrate estimate into the go / no-go review. Skill does not commit pursuit budget — leadership does.
+
+## Scripts
+
+- `scripts/rfp_parser.py` — section + requirement extractor (regex + cue-word heuristics, stdlib only)
+- `scripts/response_drafter.py` — proof-point matrix + win-theme injection + GAP audit
+- `scripts/winrate_predictor.py` — Shipley-derived factor model + bid/no-bid verdict, industry-profile-tuned
+
+All scripts: stdlib only (argparse, json, sys, pathlib, re, collections, statistics). `--help` and `--sample` work on all three.
+
+## References
+
+- `references/shipley_method_canon.md` — Shipley Proposal Guide v6, Shipley Capture Guide, APMP BoK, Tom Sant, Tom Searcy + Henry DeVries, Strategic Proposals research, Larry Newman
+- `references/rfp_strategy_canon.md` — FAR, GSA, Forrester, Gartner, Bain, McKinsey, B2B International on RFP win-rates and buyer behavior
+- `references/rfp_anti_patterns.md` — Shipley failure modes, APMP cases, Strategic Proposals research, federal loss reviews, MIT Sloan, Bain commercial-discipline, Gartner
+
+## Assumptions
+
+- **The RFP is the ground truth.** If the buyer asked it, answer it — in the order they asked, in the format they specified. Re-organizing for narrative flow is for proposals, not RFPs.
+- **Proof points must be verifiable.** A claim is only as strong as the case study, certification, customer reference, or technical attestation backing it. Unsourced claims become GAPs.
+- **Win-themes are buyer-side, not seller-side.** "We're the leader in X" is a marketing claim; "Your operations team reduces incident MTTR by 60% with the same headcount" is a win-theme. Shipley canon, not optional.
+- **Winrate estimates are directional.** The model is a discipline tool to force honest pursuit-qualification — not an oracle. Confidence band always wider than the point estimate suggests.
+- **Industry profiles tune base rates** — government RFPs reward compliance discipline; enterprise SaaS rewards reference accounts; healthcare rewards regulatory + security depth.
+- **Late entry is a structural disadvantage.** Entering after the RFP issued, with no relationship history, drops base rate ~15%. The skill names this, doesn't hide it.
+
+## Anti-patterns
+
+- **Inventing a proof point to fill a GAP.** Hard rule violation. GAPs surface for leadership decision, not for prose-laundering. See `references/rfp_anti_patterns.md`.
+- **Responding to every RFP.** Without a qualified bid / no-bid gate, the team burns capacity on <20% winrate pursuits and loses the 50%+ pursuits to lack of focus. Bain commercial-discipline research.
+- **Generic response with no win-theme.** A proposal that could be sent verbatim by any competitor is decorative. Shipley failure mode #1.
+- **Missing a mandatory disqualifier late.** FedRAMP / HIPAA / ISO 27001 / SOC 2 / on-shore data residency caught on Day 12 of a 14-day response = wasted pursuit. Parser surfaces these on Day 1.
+- **Answering the question YOU wanted asked.** RFP responder discipline: answer what they asked, in their words, in their order. Re-framing belongs in cover letters, not in the compliance matrix.
+- **No compliance matrix.** Every requirement should map to a response section + page number. Evaluators score on a matrix; respondents who don't provide one self-disqualify on traceability.
+- **Late-entry without acknowledging the relationship deficit.** Entering cold against an incumbent with a 3-year relationship and no champion = sub-20% winrate. Pretending otherwise wastes Sales Engineering capacity.
+- **Treating WEIGHTED requirements like MANDATORY.** Score-weighted requirements reward depth on the high-weight items, not uniform mediocrity across all. Shipley capture method.
+
+## Distinct from
+
+- **`business-growth/contract-and-proposal-writer`** — free-form narrative proposals where YOU set the structure (executive briefs, capability statements, unsolicited proposals). RFP-responder handles **buyer-dictated structured Q&A** where the buyer set the questions, sections, scoring criteria, and format. Different artifact, different decision logic.
+- **`c-level-advisor/general-counsel-advisor`** — contract redline and IP/risk review AFTER award. RFP-responder operates BEFORE award, on the response strategy.
+- **`marketing-skill/*`** — external marketing assets (web copy, content, ASO, SEO, brand voice) for many-to-many audiences. RFP-responder produces a **single-buyer artifact** with deterministic compliance requirements.
+- **`commercial/deal-desk`** — per-deal discount routing on a closing opportunity. RFP-responder is pursuit-stage; deal-desk is close-stage.
+- **`commercial/pricing-strategist`** — pricing-model design for a new product. RFP-responder consumes existing pricing as input to the commercial-terms section.
+
+## Forcing-question library (Matt Pocock grill discipline)
+
+Walked one at a time before any script runs. Recommended answer + canon citation per question. Never bundled.
+
+1. **"What's your STRONG / PARTIAL / GAP split on the MANDATORY requirements?"**
+   Recommended: STRONG ≥ 70% on MANDATORY before bidding. PARTIAL/GAP on any MANDATORY = either close the gap pre-submission or no-bid.
+   Canon: Shipley *Proposal Guide v6* — capture-management discipline, "Pgw (probability of win) is bounded by your weakest MANDATORY."
+
+2. **"Is there an incumbent, and how strong is their position?"**
+   Recommended: strong incumbent (3+ years, no displacement event) drops base winrate ~30%. Don't bid without a named displacement trigger.
+   Canon: Forrester B2B-RFP research — incumbents win 70-80% of renewal RFPs absent a named failure event.
+
+3. **"Did you enter the conversation before or after the RFP issued?"**
+   Recommended: late-entry (after RFP issued, no prior engagement) drops winrate ~15% and signals the RFP was scoped to someone else's strengths.
+   Canon: Tom Searcy + Henry DeVries *How to Win Big Business* — "If you didn't help write the RFP, you're column fodder."
+
+4. **"What are your 3-5 win-themes, and does each thread through ≥2 requirements?"**
+   Recommended: themes that appear in only one requirement are decorative. Themes must ladder up across MANDATORY + WEIGHTED sections.
+   Canon: Shipley *Capture Guide* — win-themes are the buyer-side answer to "why us" across the evaluation criteria, not seller-side feature lists.
+
+5. **"For every claim in the response, can you name the verifiable source?"**
+   Recommended: every claim → case study / certification / customer reference / technical attestation / benchmark. Unsourced claims = GAPs.
+   Canon: APMP BoK — "Substantiation: every assertion in a proposal must be backed by evidence the evaluator can independently verify."
+
+6. **"What's the bid / no-bid threshold you committed to BEFORE seeing this RFP?"**
+   Recommended: pre-committed threshold (e.g., winrate ≥ 25%, STRONG ≥ 70% on MANDATORY, named champion). Post-hoc rationalization is how teams end up bidding 5% pursuits.
+   Canon: Bain RFP-win-rate studies — disciplined bid/no-bid gates lift win-rate from ~15% to ~35%.
+
+7. **"What does the buyer's evaluation team actually score on?"**
+   Recommended: if the RFP discloses scoring criteria, weight your response effort proportionally. If undisclosed, ask. If you can't ask, that itself is a relationship-deficit signal.
+   Canon: Strategic Proposals proposal-management research — evaluators score on the rubric they were given, not on your narrative.
+
+Walk depth-first. Lock 1-3 before opening 4-7. After all 7 are answered, invoke `rfp_parser.py` → `response_drafter.py` → `winrate_predictor.py` in sequence. If question 6 lands on "we don't have a threshold," set one now or no-bid.

package/compliance/ai-act-readiness/SKILL.md

@@ -0,0 +1,149 @@
+---
+name: "ai-act-readiness"
+description: "/cs:ai-act-readiness <system> — EU AI Act 6-question forcing interrogation. Use during AI-system intake, before EU deployment, or during annual compliance refresh as Article 113 obligations phase in (2025-02-02 / 2025-08-02 / 2026-08-02 / 2027-08-02)."
+---
+
+# /cs:ai-act-readiness — EU AI Act Forcing Questions
+
+**Command:** `/cs:ai-act-readiness <system>`
+
+The EU AI Act compliance operator pressure-tests any AI system before EU deployment. Six Article-cited questions before any EU placement, conformity assessment, or annual compliance refresh.
+
+## When to Run
+
+- During AI-system intake review (per new system or material change)
+- Before placing an AI system on the EU market
+- Before signing the EU declaration of conformity (Article 47)
+- During annual compliance refresh (Article 113 phasing brings new obligations)
+- When the organization's role changes (deployer becomes provider via Article 25(1) substantial modification)
+- When training compute approaches 10^25 FLOPs (Article 51 systemic-risk threshold)
+
+## The Six EU AI Act Questions
+
+### 1. Article 5: Is this a prohibited AI practice?
+**Penalty: up to 35M EUR or 7% worldwide turnover.**
+- 8 categories: subliminal manipulation, exploitation of vulnerabilities, social scoring, predictive policing, untargeted facial scraping, emotion recognition in workplace/education, biometric categorisation by sensitive attributes, real-time public biometric ID by law enforcement
+- Run `ai_system_risk_classifier.py`
+- If yes → STOP. Cannot place on EU market. No exceptions outside Article 5(2) carve-outs.
+
+### 2. Article 6 + Annex III: Is this high-risk?
+**Annex III triggers high-risk; Article 6(3) carve-out conditional.**
+- 8 categories: biometrics, critical infrastructure, education, employment, essential services, law enforcement, migration, justice
+- Carve-out applies only if Article 6(3)(a)-(d) AND no profiling of natural persons
+- Profiling overrides carve-out (Article 6(3) last sentence)
+- Run `ai_system_risk_classifier.py`
+
+### 3. Article 43: For high-risk, Module A or Module H?
+**Biometrics → Module H (notified body) by default; others → Module A if harmonised standards applied.**
+- Run `conformity_assessment_planner.py`
+- Module A (Annex VI): internal control with presumption of conformity if Article 40 harmonised standards applied
+- Module H (Annex VII): full QMS + notified body for biometrics or where standards lacking
+- Annex IV technical documentation: 8 items required before placing on market
+
+### 4. Article 25: What role does the company play?
+**Provider obligations are heaviest; substantial modification turns deployer into provider.**
+- Provider (Article 3(3)): placed on market; full Title III + Article 73 reporting
+- Deployer (Article 3(4)): Article 26 obligations + Article 27 FRIA if public sector
+- Importer (Article 3(6)): Article 23 verification of conformity
+- Distributor (Article 3(7)): Article 24 CE marking verification
+- Authorized representative (Article 22): non-EU providers must appoint
+- Run `ai_act_obligation_tracker.py`
+
+### 5. Article 50: Are transparency obligations satisfied?
+**In force 2 Aug 2025.**
+- Article 50(1): disclose AI interaction to natural persons (chatbots, virtual agents)
+- Article 50(2): mark synthetic content as AI-generated
+- Article 50(3): disclose emotion recognition / biometric categorisation (outside Article 5 prohibitions)
+- Article 50(4): disclose deepfakes (image, audio, video) as AI-generated
+
+### 6. Articles 51-55: Is this a GPAI? Does it have systemic risk?
+**GPAI has parallel track; systemic risk above 10^25 FLOPs.**
+- Article 3(63): general-purpose AI model definition
+- Article 51: systemic-risk presumption (≥ 10^25 FLOPs training compute) or Commission designation
+- Article 53: all GPAI providers — Annex XI technical docs, Annex XII downstream info, copyright policy, training-data summary
+- Article 55: systemic-risk GPAI additional obligations — model evaluations, adversarial testing, incident reporting, cybersecurity
+- Article 54: non-EU GPAI providers must appoint authorized representative
+
+## Workflow
+
+```bash
+# 1. Risk classification
+python ../../ra-qm-team/skills/eu-ai-act-specialist/scripts/ai_system_risk_classifier.py systems.json
+
+# 2. If high-risk: conformity assessment
+python ../../ra-qm-team/skills/eu-ai-act-specialist/scripts/conformity_assessment_planner.py system.json
+
+# 3. Per-role obligation matrix
+python ../../ra-qm-team/skills/eu-ai-act-specialist/scripts/ai_act_obligation_tracker.py roles.json
+
+# 4. Cross-framework reuse (ISO 42001 etc.)
+python ../../skills/compliance-os/scripts/cross_framework_mapper.py program.json
+```
+
+## Output Format
+
+```markdown
+# EU AI Act Readiness: <system>
+**Date:** YYYY-MM-DD
+**Article Citations:** Every verdict below cites the specific Article.
+
+## The Decision Being Made
+[classify | conformity-route | obligation-scope | annual-refresh]
+
+## Risk Classification
+- Tier: prohibited | high_risk | limited_risk | minimal_risk
+- Citation: Article X(Y) + Annex Z if applicable
+- Rationale: <Article-cited rationale>
+- GPAI: yes/no
+- Systemic-risk GPAI: yes/no (per Article 51 10^25 FLOPs threshold)
+
+## Conformity Assessment (if high-risk)
+- Module: A | A_with_caveats | H | sectoral
+- Citation: Article 43 + Annex VI/VII
+- Notified body required: yes | no | optional
+- Annex IV pack status: complete | in-progress | not-started
+
+## Obligation Matrix
+- Total obligations: N
+- By deadline phase: 2025-02-02=A, 2025-08-02=B, 2026-08-02=C, 2027-08-02=D
+- Highest-priority unmet obligation: <Article + description>
+
+## Transparency (Article 50)
+- 50(1) interaction disclosure: yes | no
+- 50(2) synthetic content marking: yes | no | NA
+- 50(3) emotion recognition disclosure: yes | no | NA
+- 50(4) deepfake disclosure: yes | no | NA
+
+## Cross-Framework Reuse
+- ISO 42001 evidence applicable to Article 17 QMS: yes/no
+- ISO 27001 evidence applicable to Article 15 cybersecurity: yes/no
+- GDPR DPIA usable for Article 27 FRIA: yes/no
+
+## Verdict
+🟢 READY-FOR-EU | 🟡 GAPS-IDENTIFIED | 🔴 NOT-READY | 🚫 PROHIBITED
+
+## Top 3 Actions
+[3 concrete next steps with owner + Article-tied deadline]
+
+## Legal Review Required
+[Article-level ambiguities flagged for outside counsel: novel cases, GPAI threshold disputes, Article 5 boundary cases, Article 25 substantial-modification questions]
+```
+
+## Routing
+
+- `/cs:compliance-readiness` — for multi-framework view (combine with ISO 42001 + GDPR)
+- `/cs:aims-audit` — for ISO 42001 deep-dive
+- `/cs:caio-review` — for executive AI strategy decisions
+- `/cs:gc-review` — for novel-case legal review (GPAI threshold, Article 5 boundary, substantial-modification)
+- `/cs:decide` — to log the verdict
+- `/cs:freeze 30` — on EU launch commitments (regulatory exposure)
+
+## Related
+
+- Agent: [`cs-ai-act-compliance`](../../agents/cs-ai-act-compliance.md)
+- Skill: [`eu-ai-act-specialist`](../../../ra-qm-team/skills/eu-ai-act-specialist/SKILL.md)
+- Adjacent: `../../skills/compliance-os/`, `../aims-audit/`, `../compliance-readiness/`, `../../../ra-qm-team/skills/gdpr-dsgvo-expert/`
+
+---
+
+**Version:** 1.0.0

package/compliance/aims-audit/SKILL.md

@@ -0,0 +1,132 @@
+---
+name: "aims-audit"
+description: "/cs:aims-audit <scope> — ISO/IEC 42001 AIMS internal-audit 6-question forcing interrogation. Use before certification stage 1, before annual internal audit cycles, or when onboarding a new AI system into an existing AIMS."
+---
+
+# /cs:aims-audit — AIMS ISO 42001 Forcing Questions
+
+**Command:** `/cs:aims-audit <scope>`
+
+The ISO 42001 AIMS specialist pressure-tests any AI Management System work. Six questions before any certification commitment, internal audit cycle, or new-system onboarding.
+
+## When to Run
+
+- Before stage 1 ISO 42001 certification audit
+- Before annual internal audit cycle (Clause 9.2)
+- When onboarding a new AI system into existing AIMS scope
+- When AI risk register hasn't been refreshed in > 6 months
+- After material model change (re-evaluate risks per Clause 6.1.2)
+- When audit findings hint at AIMS / ISMS / QMS duplication
+
+## The Six AIMS Questions
+
+### 1. Does the AIMS scope statement name every AI system?
+**Scope omission = certification finding.**
+- Including: embedded models, third-party AI services, "experimental" production systems
+- Run `aims_gap_analyzer.py` to verify Clause 4.3 evidence
+- "AI features added by SaaS vendors we use" = in scope if they affect the company's services
+
+### 2. Does the AI policy commit to lawful use AND beneficial purpose AND human oversight AND continual improvement?
+**Missing any of the four = critical nonconformity at stage 1.**
+- AI policy is NOT info-sec policy — it has separate substantive content
+- Reference ISO 42001 Annex A.2.2 + Clause 5.2
+- Marketing-copy "AI ethics" doesn't pass
+
+### 3. What's the risk register coverage, and which Annex A controls treat each risk?
+**Risk identification without control mapping = Clause 6.1.3 fails.**
+- Run `ai_risk_register_builder.py` per ISO 23894 methodology
+- Every high/critical risk must link to ≥ 1 Annex A control
+- "Residual verdict: additional_treatment_required" must be closed before stage 1
+
+### 4. Has the AI risk assessment been re-run since the last material model change?
+**Concept drift is not a one-time event.**
+- Article 9 EU AI Act + ISO 42001 Clause 6.1.2 both require iterative risk assessment
+- Material change = retraining on new data, fine-tuning, architecture change, deployment context change
+- If "we did it 18 months ago and haven't touched it," the AIMS is broken
+
+### 5. What's the Clause 9.2 internal audit plan, and is auditor independence respected?
+**Without 9.2 plan, the AIMS is incomplete.**
+- Run `aims_audit_scheduler.py` with scope + auditors + prior findings
+- Audit every clause + applicable Annex A control over rolling 3-year cycle
+- Same auditor cannot audit own work
+- Cross-check with cs-quality-regulatory if integrated with 13485 audit programme
+
+### 6. Has the AIMS been integrated with existing ISMS / QMS, or built in parallel?
+**Parallel systems = 5x ongoing maintenance cost.**
+- 60% of Clauses 4-10 evidence reuses ISO 27001 / 13485 with AI scope appended
+- CAPA loop should be ONE loop with AI-tagged nonconformities, not separate
+- Reference `cross_framework_mapping_ai.md` for the reuse map
+- Cross-check with cs-ciso-advisor on ISO 27001 alignment
+
+## Workflow
+
+```bash
+# 1. AIMS gap analysis
+python ../../ra-qm-team/skills/iso42001-specialist/scripts/aims_gap_analyzer.py evidence.json
+
+# 2. AI risk register
+python ../../ra-qm-team/skills/iso42001-specialist/scripts/ai_risk_register_builder.py risks.json
+
+# 3. Internal audit plan
+python ../../ra-qm-team/skills/iso42001-specialist/scripts/aims_audit_scheduler.py audit_scope.json
+
+# 4. Cross-framework reuse map (via compliance-os)
+python ../../skills/compliance-os/scripts/cross_framework_mapper.py program.json
+```
+
+## Output Format
+
+```markdown
+# AIMS Audit: <scope>
+**Date:** YYYY-MM-DD
+
+## The Decision Being Made
+[gap-closure | risk-treatment | audit-scope | new-system-onboarding]
+
+## Gap Analysis (Clauses 4-10)
+- Weighted coverage: X%
+- Critical gaps: N
+- Major gaps: M
+- Certification readiness: ready | stage_2_candidate | not_ready
+
+## AI Risk Register
+- Total risks: N
+- By severity: critical=X, high=Y, medium=Z, low=W
+- Requires additional treatment: K
+- Top risk requiring action: <description>
+
+## Clause 9.2 Audit Plan
+- 12-month coverage: clauses=X, controls=Y
+- Auditor independence: clean | issues
+- Prior-year follow-up: scheduled in Q1
+
+## Cross-Framework Reuse
+- ISO 27001 evidence reused: % of AIMS Clauses 4-10
+- 13485 evidence reused: % (if applicable)
+- Net-new for AIMS: % (mostly Annex A)
+
+## Verdict
+🟢 STAGE-1-READY | 🟡 CLOSE-CRITICALS-FIRST | 🔴 NOT-READY
+
+## Top 3 Actions
+[3 concrete next steps with owner + date]
+```
+
+## Routing
+
+- `/cs:compliance-readiness` — for multi-framework view
+- `/cs:ai-act-readiness` — if EU AI Act also applies
+- `/cs:caio-review` — for executive AI strategy decisions
+- `/cs:ciso-review` — for ISO 27001 cross-framework alignment
+- `/cs:decide` — to log the verdict
+- `/cs:freeze 30` — on certification commitments
+
+## Related
+
+- Agent: [`cs-aims-iso42001`](../../agents/cs-aims-iso42001.md)
+- Skill: [`iso42001-specialist`](../../../ra-qm-team/skills/iso42001-specialist/SKILL.md)
+- Adjacent: `../../skills/compliance-os/`, `../ai-act-readiness/`, `../compliance-readiness/`
+
+---
+
+**Version:** 1.0.0