# AI use-case review — starter worksheet

Compliance Toolset · Version 1.0

A starting point for internal review. This is not a legal classification, an automated risk score, or authorization to deploy. Use appropriate legal, privacy, security, and business expertise for your circumstances.

## 1. Describe the use case

- Use-case name:
- Business purpose and expected benefit:
- Accountable business owner:
- Service/provider and model (if known):
- Teams and people affected:
- New use / change to existing use:

## 2. Ask ten practical questions

| Question | Answer and supporting information | Reviewer / next action |
| --- | --- | --- |
| What will the AI do, and what will remain a person's responsibility? | | |
| Is it only suggesting content, or can it change records, execute transactions, or contact people? | | |
| What data enters the system, and is any of it personal, confidential, or regulated? | | |
| Do we have permission to use the data for this purpose? | | |
| Who receives the data, where is it processed, and can the provider use it for training? | | |
| Could an error affect someone's employment, finances, health, access to services, or other important interests? | | |
| What can users check before relying on the output? | | |
| What tests will demonstrate acceptable performance for this specific use? | | |
| What evidence, logs, exceptions, and incidents will we retain? | | |
| Who can stop the use, and when must it be reviewed again? | | |

## 3. Identify mandatory review triggers

Escalate for appropriate review when information is unknown or the use involves sensitive data, consequential decisions, external autonomous actions, unclear data rights, or safeguards that have not been tested. Do not average away a serious issue with an overall score.

## 4. Record required safeguards

| Safeguard / open question | Owner | Evidence needed | Due date | Status |
| --- | --- | --- | --- | --- |
| | | | | |

Possible safeguards to evaluate: restricted data inputs; limited permissions; human review; independent validation; tested fallback; monitoring; incident response; supplier commitments. The appropriate safeguards depend on the use case.

## 5. Record the decision

- Decision: proceed / proceed after conditions are met / further review / do not proceed
- Decision owner and date:
- Rationale:
- Conditions and evidence:
- Next review date and change triggers:

Completing this file on your device does not transmit it to Compliance Toolset. Keep sensitive assessment records in a location approved by your organization.