diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json
index 053a1c0..896b4d8 100644
--- a/.claude-plugin/marketplace.json
+++ b/.claude-plugin/marketplace.json
@@ -50,6 +50,15 @@
       "strict": false,
       "description": "Use this skill when creating, reviewing, or editing Agent Skills-format skills, or when implementing skill discovery and loading in an agent client. It covers directory structure, SKILL.md metadata, progressive disclosure, evals, and repository conventions. Do not use this skill for general software work that does not involve the Agent Skills format or lifecycle."
     },
+    {
+      "name": "ai-governance",
+      "source": "./",
+      "skills": [
+        "./ai-governance"
+      ],
+      "strict": false,
+      "description": "Design and operate an organization's AI governance system: define governance principles, operating models and decision rights, risk frameworks, lifecycle gates, and fairness, transparency, privacy, security, regulatory, and board-oversight controls. Use when standing up a governance program, tiering AI use-case risk, reviewing an LLM or agent system for governance and safety gaps, mapping a regulation to a compliance plan, scoring governance maturity, or preparing board reporting. Do not use for interpreting regulations as legal advice (route to legal-strategy), data-governance mechanics (data-architect/data-engineering), or implementing application security (secure-software-engineering)."
+    },
     {
       "name": "anydoc",
       "source": "./",
diff --git a/.codex-plugin/plugin.json b/.codex-plugin/plugin.json
index 97a85c8..2ac07be 100644
--- a/.codex-plugin/plugin.json
+++ b/.codex-plugin/plugin.json
@@ -23,6 +23,7 @@
     "./agent-evals-and-observability",
     "./agent-production-operations",
     "./agent-skills",
+    "./ai-governance",
     "./anydoc",
     "./api-design-and-evolution",
     "./artifact-pyramids",
diff --git a/README.md b/README.md
index c273887..7401cd2 100644
--- a/README.md
+++ b/README.md
@@ -28,6 +28,10 @@ Operate an evaluated agent with tools and authority in production through a runt
 
 Reference for the Agent Skills open format itself — directory structure, frontmatter schema, naming conventions, and progressive disclosure model. Use this meta-skill when creating or reviewing any other skill in this repository.
 
+### [ai-governance](ai-governance/SKILL.md)
+
+Design and operate an organization's AI governance system: governance principles, operating models and decision rights, risk frameworks, lifecycle gates, and fairness, transparency, privacy, security, regulatory, and board-oversight controls. Use when standing up or maturing a governance program, tiering AI use-case risk, reviewing an LLM/agent system for governance and safety gaps, mapping a regulation to a compliance plan, or preparing board reporting. Do not use for legal interpretation (route to legal-strategy), data-governance mechanics (data-architect/data-engineering), or implementing application security (secure-software-engineering).
+
 ### [anydoc](anydoc/SKILL.md)
 
 Convert Word, PowerPoint, Excel, OpenDocument, RTF, EPUB, CSV, and text-based PDF documents to GitHub-Flavored Markdown locally with the Any Doc CLI. Use when a task needs the contents of an office document, spreadsheet, presentation, ebook, or PDF you cannot read directly. Do not use for generating, editing, or validating documents, for ebook packaging, or for OCR of scanned or image-only PDFs.
diff --git a/ai-governance/README.md b/ai-governance/README.md
new file mode 100644
index 0000000..3f15fcf
--- /dev/null
+++ b/ai-governance/README.md
@@ -0,0 +1,71 @@
+# ai-governance
+
+Design and run an organization's AI governance system: principles, operating models and decision
+rights, risk frameworks, lifecycle gates, and the fairness, transparency, privacy, security,
+regulatory, and board-oversight controls that make AI accountable.
+
+## Why Install This Skill
+
+AI systems get deployed faster than the organizations that build them can decide who is
+accountable for them, what risk they are allowed to carry, and what evidence should gate each
+stage of their life. Without a working governance system, launches are rubber-stamped, risks are
+surfaced too late, and "someone approved it" is rarely traceable to a named, evidence-backed
+decision. This skill gives your agent a complete, field-tested framework for standing up and
+operating AI governance — not a compliance checklist you copy, but a method you run.
+
+After installing, your agent can stand up a governance program from scratch, tier AI use cases by
+risk and prescribe the controls each one requires, review an LLM or agent system for governance
+and safety gaps, map a regulation to a concrete compliance and control plan, score organizational
+governance maturity and get a prioritized gap list, and prepare board-level reporting. It ships
+dense references for each governance domain, six fillable templates, and two executable scripts,
+so the method turns into working artifacts instead of advice.
+
+## What You Get
+
+| Path | What it provides |
+|---|---|
+| `SKILL.md` | The router: triggers, what the skill owns vs. doesn't, and when to load each file |
+| `references/` (11 files) | Dense, scannable guides: principles, operating model, risk frameworks, lifecycle, fairness, transparency, privacy, LLM/agent security, regulation, procurement/board oversight, and a source index |
+| `templates/` (6 files) | Fillable artifacts: governance charter, use-case intake, model risk assessment, model card, third-party due diligence, board report |
+| `scripts/governance-maturity.py` | CLI that scores an organization's governance maturity from JSON answers and lists gaps |
+| `scripts/use-case-risk-tier.py` | CLI that classifies an AI use case into a risk tier and its required controls |
+| `evals/evals.json` | Output-quality cases used to grade the skill |
+| `README.md` | This human-facing overview |
+
+## Quick Start
+
+The skill is pure methodology plus two stdlib-only Python CLIs — there is nothing to install or
+configure.
+
+Score governance maturity from an answers file:
+
+```sh
+python3 ai-governance/scripts/governance-maturity.py path/to/answers.json --json
+```
+
+Classify a use case's risk tier:
+
+```sh
+python3 ai-governance/scripts/use-case-risk-tier.py path/to/use_case.json --json
+```
+
+Both scripts print a single JSON object; add `--dry-run` to preview without writing anything.
+Example input shapes are documented in each script's `--help`.
+
+## Triggers
+
+Load this skill when you or your agent need to:
+
+- Stand up or mature an AI governance program, or design the operating model and decision rights.
+- Tier an AI use case by risk and decide which controls it needs before it ships.
+- Review an LLM or agent system (e.g., an internal RAG copilot) for governance and safety gaps.
+- Map a current regulation to a compliance and control plan.
+- Score organizational governance maturity and prioritize gaps.
+- Prepare board-level AI governance reporting or run third-party/model due diligence.
+
+## Requirements
+
+- Nothing to install for the methodology or the templates.
+- The two scripts need Python 3 (standard library only; no third-party packages).
+- No API keys, accounts, or external services.
+- Note: this skill provides governance guidance, not legal, financial, or security advice.
diff --git a/ai-governance/SKILL.md b/ai-governance/SKILL.md
new file mode 100644
index 0000000..755b4ec
--- /dev/null
+++ b/ai-governance/SKILL.md
@@ -0,0 +1,145 @@
+---
+name: ai-governance
+description: >-
+  Design and operate an organization's AI governance system: define governance
+  principles, operating models and decision rights, risk frameworks, lifecycle
+  gates, and fairness, transparency, privacy, security, regulatory, and
+  board-oversight controls. Use when standing up a governance program, tiering
+  AI use-case risk, reviewing an LLM or agent system for governance and safety
+  gaps, mapping a regulation to a compliance plan, scoring governance maturity,
+  or preparing board reporting. Do not use for interpreting regulations as legal
+  advice (route to legal-strategy), data-governance mechanics
+  (data-architect/data-engineering), or implementing application security
+  (secure-software-engineering).
+license: MIT
+compatibility: Agent-agnostic methodology; no external services, APIs, or runtime dependencies. The two scripts are Python 3 standard-library only.
+metadata:
+  tags: ai-governance, responsible-ai, model-risk, ai-risk-management, governance-operating-model,
+    ai-governance-principles, lifecycle-gates, fairness, transparency, privacy,
+    llm-security, ai-regulation, ai-compliance, board-oversight, third-party-risk,
+    governance-maturity, use-case-risk-tiering, model-cards, ai-audit, ai-oversight
+---
+
+# AI Governance
+
+AI governance is the system an organization uses to decide, before a model is built and while it
+runs, who is accountable for an AI system, what risk it is allowed to carry, what evidence must
+gate each lifecycle stage, and how the organization reports and audits that posture. This skill
+teaches an agent to reason about and operate that system: it is a methodology skill, not a tool
+manual and not legal or security advice.
+
+## Scope: What This Skill Owns
+
+| You own | You don't own |
+|---------|---------------|
+| Governance principles and how they translate into policy and controls | Drafting or opining on legal interpretation of a regulation |
+| The governance operating model: councils, stewards, decision rights, RACI, federated vs. centralized | Data-platform mechanics, pipelines, and lineage tooling internals |
+| Risk frameworks: NIST AI RMF, ISO/IEC 42001 & 23894, model-risk tiering, risk registers | Implementing authentication, authorization, or vulnerability fixes |
+| Lifecycle stage gates across ideation, build, evaluate, deploy, monitor, retire | CI/CD pipeline and deployment-gate configuration |
+| Fairness, bias, transparency, explainability, and accountability controls | Product portfolio/roadmap governance cadences |
+| Privacy and data governance for training and operational data | Capital allocation, org structure, or M&A governance |
+| LLM/agent safety: prompt injection, excessive agency, red-teaming, supply chain | Host-level or application-level security scanning |
+| Regulatory landscape and compliance mapping (as guidance, not advice) | Legal drafting, regulatory filings, or attorney-client work product |
+| Third-party and model due diligence, board reporting, audit | Any authoritative statement of "your system is compliant" |
+
+This is a **prevention-and-operations** methodology: it gives the agent frameworks, decision
+models, and controls to design and run governance, not a claim that a system is compliant or
+safe. For every engagement, record the operating model, the risk tier, the evidence that gated
+each stage, and the accountable owner of each accepted exception.
+
+## When To Use
+
+Load this skill to answer "how should we govern this AI system?" — standing up or maturing a
+governance program, tiering use-case risk, designing the operating model and decision rights,
+reviewing an LLM/agent system for governance and safety gaps, mapping a regulation to a
+compliance/control plan, scoring governance maturity, or preparing board-level reporting.
+
+## Reference Files (load on demand, one per task)
+
+Progressive disclosure: load only the reference relevant to the current question.
+
+| Load when | Reference |
+|---|---|
+| Framing what AI governance is and its principles; governance vs. compliance vs. risk | [references/foundations-and-principles.md](references/foundations-and-principles.md) |
+| Designing the operating model, councils, stewards, decision rights, RACI, maturity, culture | [references/governance-operating-model.md](references/governance-operating-model.md) |
+| Applying NIST AI RMF, ISO/IEC 42001 & 23894, model-risk tiering, inherent vs. residual risk | [references/risk-management-and-frameworks.md](references/risk-management-and-frameworks.md) |
+| Placing stage gates across ideation, data, build, evaluate, deploy, monitor, retire | [references/ai-lifecycle-governance.md](references/ai-lifecycle-governance.md) |
+| Fairness metrics and their limits, bias sources, trade-offs, algorithmic justice | [references/fairness-bias-accountability.md](references/fairness-bias-accountability.md) |
+| Explainability (XAI) methods, when explanation is required, disclosure, auditability | [references/transparency-and-explainability.md](references/transparency-and-explainability.md) |
+| Training/operational data governance, ownership, lineage, quality, consent, PETs | [references/privacy-and-data-governance.md](references/privacy-and-data-governance.md) |
+| Trust boundaries, prompt injection, excessive agency, hallucination, supply chain, red-teaming | [references/llm-and-agent-security.md](references/llm-and-agent-security.md) |
+| Current law by jurisdiction, compliance mapping, enforcement, horizon scanning | [references/regulatory-landscape.md](references/regulatory-landscape.md) |
+| Vendor/model due diligence, supply chain, board reporting, metrics, audit | [references/procurement-third-party-and-board-oversight.md](references/procurement-third-party-and-board-oversight.md) |
+| Tracing any idea to its informing books and research notes; bibliography | [references/source-index.md](references/source-index.md) |
+
+## Templates (fillable)
+
+Use these to turn the methodology into working artifacts.
+
+| Use when | Template |
+|---|---|
+| Standing up the governance council and its terms of reference | [templates/governance-charter.md](templates/governance-charter.md) |
+| Registering a use case and classifying it at intake | [templates/use-case-intake-form.md](templates/use-case-intake-form.md) |
+| Running a NIST-aligned risk assessment and tiering worksheet | [templates/model-risk-assessment.md](templates/model-risk-assessment.md) |
+| Documenting a released model: intended use, data, performance, fairness, limitations | [templates/model-card.md](templates/model-card.md) |
+| Conducting vendor/model supply-chain due diligence | [templates/third-party-due-diligence.md](templates/third-party-due-diligence.md) |
+| Preparing executive/board AI-governance reporting | [templates/board-ai-governance-report.md](templates/board-ai-governance-report.md) |
+
+## Scripts
+
+Executable, flag-driven, stdlib-only Python CLIs with tests. Both accept a JSON input path and emit
+deterministic output; `--json` prints one JSON object on stdout; `--dry-run` previews without
+changing anything. Exit 0 on success, 1 on findings or input errors.
+
+| Use when | Script |
+|---|---|
+| Scoring an organization's governance maturity from dimension scores (1-5); emits maturity level + gaps | [scripts/governance-maturity.py](scripts/governance-maturity.py) |
+| Classifying an AI use case into a risk tier and its required controls | [scripts/use-case-risk-tier.py](scripts/use-case-risk-tier.py) |
+| Verifying the maturity scorer (unit + behavior tests) | [scripts/test_governance_maturity.py](scripts/test_governance_maturity.py) |
+| Verifying the risk-tier classifier (unit + behavior tests) | [scripts/test_use_case_risk_tier.py](scripts/test_use_case_risk_tier.py) |
+
+## Evaluation and Configuration
+
+- **Eval manifest:** [evals/evals.json](evals/evals.json) holds the output-quality cases (operating
+  model design, use-case risk tiering, LLM-app governance review, fairness/accountability review,
+  regulatory compliance mapping, board governance reporting) used to grade this skill.
+- **Configuration:** [pytest.ini](pytest.ini) overrides the repository's root coverage settings so
+  the subprocess-based skill tests run cleanly; do not add a second override.
+- **Entry points:** this [SKILL.md](SKILL.md) is the router; [README.md](README.md) is the
+  human-facing overview for people evaluating whether to install the skill.
+
+## When Not To Use
+
+Do not load this skill for work that belongs to a neighbor methodology or to execution:
+
+- **Regulatory/legal strategy.** Interpreting what a law or regulation *means*, structuring
+  compliance legal risk, or preparing legal positions is `legal-strategy` work. This skill maps
+  obligations to controls and records a defensible governance posture; it does not opine on the
+  law. Prefer `legal-strategy` when the ask is legal interpretation, and return here to turn the
+  resulting obligations into a control plan.
+- **Product operations and governance.** Recurring product decision cadences (intake, portfolio,
+  roadmap, experiment, launch, lifecycle reviews) with evidence standards belong to
+  `product-operations-and-governance`, not to this skill. This skill governs the *AI system's risk
+  and accountability*, not the product portfolio cadence.
+- **Data-governance mechanics.** Building data catalogs, lineage pipelines, or platform storage
+  internals is `data-architect` / `data-engineering` work. This skill consumes data governance as
+  a control input but does not operate the data platform.
+- **Implementation-time security.** Writing authentication, authorization, input validation, or
+  dependency hardening for an application is `secure-software-engineering` work. This skill sets
+  the AI governance and safety controls and the risk tier; it does not implement the security
+  mechanisms.
+- **Legal, financial, or security advice.** Nothing in this skill is legal, financial, or security
+  advice. Regulatory and standards material must be re-verified against primary sources at the
+  time of use.
+- **Single one-off decisions.** If you only need to make one decision (not design the recurring
+  governance system), use `adr-authoring` or `product-methodology` for a decision record instead.
+
+## Related Skills (routing)
+
+| When you need... | Route to |
+|---|---|
+| Regulatory and board-legal strategy, legal interpretation | [legal-strategy](../legal-strategy/SKILL.md) |
+| Data-governance mechanics: catalogs, lineage, platform internals | [data-architect](../data-architect/SKILL.md) or [data-engineering](../data-engineering/SKILL.md) |
+| Implementing application and system security controls | [secure-software-engineering](../secure-software-engineering/SKILL.md) |
+| Recurring product decision cadences and evidence standards | [product-operations-and-governance](../product-operations-and-governance/SKILL.md) |
+| A single durable architectural decision record | [adr-authoring](../adr-authoring/SKILL.md) |
diff --git a/ai-governance/evals/evals.json b/ai-governance/evals/evals.json
new file mode 100644
index 0000000..54af79e
--- /dev/null
+++ b/ai-governance/evals/evals.json
@@ -0,0 +1,74 @@
+{
+  "schema_version": 1,
+  "skill_name": "ai-governance",
+  "evals": [
+    {
+      "id": "operating-model-design",
+      "prompt": "A 120-engineer company is scaling its use of AI and has no standing governance. Design a governance operating model for them: the decision-rights map, the review council, named stewards and accountable owners, RACI for intake and launch decisions, and whether to run federated or centralized. State when the lightweight vs. high-assurance mode applies.",
+      "expected_output": "A concrete governance operating model: a named council with charter, a decision-rights map assigning who decides/consults/informs per decision type with evidence standards, stewards and accountable owners, a federated-vs-centralized recommendation with rationale, and an explicit operating-mode choice (lightweight or high-assurance) with the trigger condition for switching.",
+      "assertions": [
+        "names a review council and a governance charter as the accountability home",
+        "assigns decision rights (who decides, consults, informs) and evidence standards per decision type",
+        "recommends a federated or centralized model and justifies it for the scale given",
+        "selects lightweight or high-assurance mode with an explicit trigger condition",
+        "assigns named stewards and an accountable owner for AI governance"
+      ]
+    },
+    {
+      "id": "use-case-risk-tiering",
+      "prompt": "Tier these three AI use cases by governance risk and prescribe the required controls for each: (1) a customer-support email summarizer with no autonomous action, (2) a loan-approval model that makes a consequential decision about an individual, and (3) an internal agent that executes code changes automatically.",
+      "expected_output": "Each use case is assigned a risk tier (low, medium, high, or critical) based on data sensitivity, autonomy, exposure, and decision impact, with the controls that tier requires (e.g., human-in-the-loop, model card, bias review, red-teaming, access restrictions) stated explicitly rather than as generic recommendations.",
+      "assertions": [
+        "assigns each of the three use cases to an explicit risk tier",
+        "derives the tier from autonomy, exposure, decision impact, and data sensitivity",
+        "prescribes tier-appropriate controls for every use case, including elevated controls for the autonomous agent",
+        "does not reduce all three to the same tier and control set"
+      ]
+    },
+    {
+      "id": "llm-app-governance-review",
+      "prompt": "Review an internal RAG copilot that retrieves company documents and answers employee questions. Identify the governance and security gaps across trust boundaries, prompt injection, data exposure, excessive agency, and system-prompt control, then recommend the controls and evidence gates needed before deployment.",
+      "expected_output": "A governance and security gap review that walks the RAG copilot through trust boundaries and threat surfaces (prompt injection, data exposure, excessive agency, system-prompt integrity), maps each gap to a concrete control, and defines the lifecycle evidence gates the system must pass before it can be deployed.",
+      "assertions": [
+        "identifies prompt injection and data-exposure risks specific to a RAG retrieval flow",
+        "addresses excessive agency and system-prompt control for the assistant",
+        "maps each gap to a concrete control and an accountable owner",
+        "defines the evidence gates that must pass before deployment"
+      ]
+    },
+    {
+      "id": "fairness-accountability-review",
+      "prompt": "Review a hiring model for fairness without reducing fairness to a single metric. Lay out the fairness metrics you would compute and their limits, the trade-offs between accuracy and parity, the bias sources to probe, and how accountability and auditability should be established in the model's documentation.",
+      "expected_output": "A fairness and accountability review that computes multiple fairness metrics (e.g., demographic parity, equalized odds, calibration), explains the limits and trade-offs of each rather than picking one number, enumerates the bias sources to probe in data and labels, and ties fairness decisions to model-card documentation and a named accountable owner.",
+      "assertions": [
+        "proposes more than one fairness metric and explains the limits of each",
+        "surfaces accuracy-vs-parity trade-offs rather than an absolute fairness override",
+        "names specific bias sources in data, labels, and evaluation to probe",
+        "connects the fairness decisions to auditable model-card documentation and an accountable owner"
+      ]
+    },
+    {
+      "id": "regulatory-compliance-mapping",
+      "prompt": "Map the EU AI Act's requirements for high-risk AI systems to a concrete compliance and control plan for a company building an AI system, covering risk management, data governance, technical documentation, transparency, human oversight, and registration. Keep it as guidance, not legal advice.",
+      "expected_output": "A compliance and control plan that maps each high-risk obligation of the EU AI Act to a specific control and evidence artifact (risk management system, data governance, technical documentation, transparency and human-oversight measures, registration), with an accountable owner per control, and a clear statement that it is guidance to be re-verified against the primary source.",
+      "assertions": [
+        "maps EU AI Act high-risk obligations to named controls and evidence artifacts",
+        "covers data governance, technical documentation, and transparency obligations",
+        "assigns an accountable owner to each control",
+        "includes human-oversight measures and the registration obligation",
+        "states the output is guidance, not legal advice, to be re-verified"
+      ]
+    },
+    {
+      "id": "board-governance-reporting",
+      "prompt": "Design the board-level AI governance reporting for a company: the metrics to report, the cadence, the risk register and exceptions to surface, the escalation path, and how to structure a board AI-governance report so directors can exercise oversight.",
+      "expected_output": "A board reporting design with a defined metric set (adoption, incidents, open high-risk use cases, material exceptions, compliance posture), a cadence, the risk-register and exception content to surface, a documented escalation path, and a report structure that lets directors exercise oversight rather than drown in detail.",
+      "assertions": [
+        "defines a concrete metric set for board reporting on AI",
+        "specifies a cadence and which risks, exceptions, and incidents get surfaced",
+        "documents the escalation path to the board or risk committee",
+        "structures the report so directors can exercise oversight and ask pointed questions"
+      ]
+    }
+  ]
+}
diff --git a/llms.txt b/llms.txt
index 6553505..1e2e49d 100644
--- a/llms.txt
+++ b/llms.txt
@@ -7,6 +7,7 @@
 - [agent-evals-and-observability](agent-evals-and-observability/SKILL.md): Design, run, review, or release framework- and vendor-neutral evaluations and observability for AI agents. Use when defining agent evals, datasets, graders, trajectory review, regression analysis, release gates, production traces, or privacy-aware telemetry. Covers task and trajectory contracts, statistical comparisons, and incident-to-case learning; route framework implementation to pydanticai or langgraph when needed.
 - [agent-production-operations](agent-production-operations/SKILL.md): Operate an evaluated agent with tools and authority in production through a runtime control plane covering versioning, staged rollout, fallback, cost and latency budgets, tool health, human escalation, disablement, and trace-to-eval feedback. Do not use for building agents, designing evals, or general release, SRE, security, or platform engineering — those methods stay with their specialist skills.
 - [agent-skills](agent-skills/SKILL.md): Use this skill when creating, reviewing, or editing Agent Skills-format skills, or when implementing skill discovery and loading in an agent client. It covers directory structure, SKILL.md metadata, progressive disclosure, evals, and repository conventions. Do not use this skill for general software work that does not involve the Agent Skills format or lifecycle.
+- [ai-governance](ai-governance/SKILL.md): Design and operate an organization's AI governance system: define governance principles, operating models and decision rights, risk frameworks, lifecycle gates, and fairness, transparency, privacy, security, regulatory, and board-oversight controls. Use when standing up a governance program, tiering AI use-case risk, reviewing an LLM or agent system for governance and safety gaps, mapping a regulation to a compliance plan, scoring governance maturity, or preparing board reporting. Do not use for interpreting regulations as legal advice (route to legal-strategy), data-governance mechanics (data-architect/data-engineering), or implementing application security (secure-software-engineering).
 - [anydoc](anydoc/SKILL.md): Convert Word (.doc/.docx/.docm), PowerPoint (.ppt/.pps/.pot/.pptx/.pptm/.ppsx/.ppsm), Excel (.xls/.xlsx/.xlsm/.xlsb), OpenDocument (.odt/.ods/.odp), RTF, EPUB, CSV, and PDF documents to clean GitHub-Flavored Markdown locally with the Any Doc CLI (npx -y @firecrawl/anydoc@0.1.6): headings, GFM tables, slide structure, and footnotes in one pass. Use when a task needs the contents of an office document, spreadsheet, presentation, ebook, or PDF you cannot read directly. Do not use for generating, editing, or validating documents (use documents), for ebook packaging (use epub), or for OCR of scanned or image-only PDFs (anydoc does not OCR; route to OCR tooling).
 - [api-design-and-evolution](api-design-and-evolution/SKILL.md): Design, document, review, and evolve consumer-facing APIs and event interfaces. Use when choosing REST/HTTP, GraphQL, RPC, events, webhooks, or streaming; writing OpenAPI or AsyncAPI contracts; defining schemas, pagination, mutations, errors, idempotency, or API compatibility; or planning API versioning, deprecation, and migration. Use secure-software-engineering for a full security lifecycle, ADR authoring for durable architecture decisions, and spec-driven-development for a delivery specification and implementation gates.
 - [artifact-pyramids](artifact-pyramids/SKILL.md): Organize durable agent research outputs as summaries, analysis, and evidence dossiers. Use when producing multi-layer research artifacts or coordinating research handoffs.
diff --git a/references/skill-triggers.md b/references/skill-triggers.md
index 25eec78..1e79b3e 100644
--- a/references/skill-triggers.md
+++ b/references/skill-triggers.md
@@ -23,6 +23,7 @@ Each skill's `description` field is the canonical routing contract. This conveni
 | "traefik", "reverse proxy", "load balancer", "API gateway", "Let's Encrypt", "ACME", "Docker routing", "traefik.yml", "entry point", "middleware", "TLS termination", "forward auth", "rate limit" | [traefik](../traefik/SKILL.md) |
 | "reverse-engineer", "understand this codebase", "PRD from code", "architecture document" | [software-architecture-analysis](../software-architecture-analysis/SKILL.md) |
 | "data architecture", "data platform", "data strategy", "data mesh", "governance" | [data-architect](../data-architect/SKILL.md) |
+| "AI governance", "AI governance program", "responsible AI", "model risk", "AI risk tier", "AI risk tiering", "use-case risk tier", "governance operating model", "AI decision rights", "AI governance council", "AI risk framework", "NIST AI RMF", "ISO 42001", "AI lifecycle gate", "AI fairness review", "AI transparency", "explainability review", "LLM governance review", "agent safety review", "prompt injection governance", "AI regulatory compliance", "EU AI Act", "AI compliance plan", "governance maturity assessment", "AI board reporting", "board AI governance", "third-party AI due diligence", "model card" | [ai-governance](../ai-governance/SKILL.md) |
 | "de-spin", "is this spin", "propaganda", "misdirection", "true lies", "what is this leaving out", "misleading claim", "selective framing", "evidence theater", "separate what is true false complicated" | [de-spin](../de-spin/SKILL.md) |
 | "daily check-in", "day debrief", "conversational journaling", "grill me", "interview me about my life", "learn how I work", "what could an AI help me with", "personal AI boundaries", "proactive check-in", "daily life" | [daily-life-discovery](../daily-life-discovery/SKILL.md) |
 | "life coaching", "life coach", "coach me", "coach me through", "reflective challenge", "help me clarify what I want", "values conflict", "ambivalence", "user-led goal", "accountability without shame", "coaching progress review", "end coaching" | [life-coach](../life-coach/SKILL.md) |