AI Use Case Risk & Impact Assessment
Assesses security, privacy, fairness and operational impact of an AI use case before approval.
Available soon
- Format
- Excel
- Size
- 76 KB
- Length
- 12 sheets
- Version
- 1.1
- Updated
What's inside
What changed
- 1.1
Hold H-2 applies to Internal data as well as Confidential: either goes in only under a contract term that bars the supplier from training on it, and a setting verified off does not clear the hold.
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | Do this first: take the proposed use through intake (AI Use Case Intake & Approval Procedure) and keep its answers. Tier 2 and Tier 3 uses need this assessment (IS-3). Tier 1 uses need only the screen. |
| 2 | On the Use sheet, enter the intake answers (IQ-04 to IQ-12) and the supplier terms. Answer IQ-12 Yes when the use is built on a supplier's model API, for staff or for customers; that is a signal for Legal and not a finding. Enter the role Legal records in the role cell, and H-4 clears. The sheet works out the tier from the answers, as the procedure does, and names the holds. A prohibited practice or special category data stops the use here (AG-05, AG-03). |
| 3 | On the Result sheet, enter the date of this assessment, who assessed it and your appetite for AI-use risk (Cautious is the house default). |
| 4 | On the Factors sheet, rate each of the 6 factors twice. First rate the risk as it stands before any control: impact 1 to 4 and likelihood 1 to 4. Read the words for each impact level on the Scales sheet. Then name the controls that lower it, who checks them, and rate the risk again. A control can lower a rating and never raise it. |
| 5 | Apply the safety rule: Where the output or action could physically harm a person, rate the impact 4 (Severe) whatever the other areas say. The use is Tier 3 and Legal is told. |
| 6 | Read the Result sheet: the count of factors in each band after controls, the highest band, the factors outside appetite or tolerance and who may accept them, the lowest tier the assessment allows, and the tier for the decision. If the assessment raises the tier, take the use to the approvers of the higher tier. |
| 7 | On the Decision sheet, record the decision (Approved, Approved with conditions, Held, Declined), who decided, the date and the reason. Clear or keep each hold. Attach the baseline conditions and add any further conditions with a person to check each and a date. |
| 8 | Enter the outcome in the AI System & Use Case Inventory (status, tier, approver, review date) and update the AI Tool Approval & Data Permission Matrix. Keep this workbook with the intake file for the period in AG-12. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
Limitations: This document helps you govern the AI your organisation uses. It is not legal advice, and following it is not a statement that you comply with the EU AI Act, the GDPR or any standard. Whether the Act binds you, in which role, and which of its duties apply to each system depends on the facts and on how your Member State applies the Act: confirm it with counsel.
What this workbook does not do. This worksheet records your own reasoning against the text of the Act. It does not say that any system is or is not prohibited, high-risk or subject to a transparency duty, and it does not say that you are a provider, a deployer or any other operator. Counsel confirms each conclusion.
The idea behind it. Most organisations do not build AI. They use other people's AI: an assistant inside the office suite, a forecasting feature in a system they already run, a chatbot a supplier offers, or a free tool a member of staff finds on their own. Governing that use proportionately starts with knowing what is in use. For each use, the organisation then decides what data it may touch, who answers for it and how much checking it needs. A small use with low-risk data needs a short screen and a named owner. A use that touches Confidential data, faces customers, acts on its own or helps decide something about a person needs an assessment and a senior decision first. A few uses are never allowed. The result is a list the organisation keeps, with counts of what is approved, held, declined and due for review. It is never one score.
Counts, not a score. The result is the number of factors in each band after controls, the highest band and the tier (AG-22). The workbook never adds the factors together.
The rules this workbook applies: AG-03, AG-05, AG-06 ("No AI output decides, alone, a matter that affects a person's job, pay, discipline, credit, access to a service or legal position (GDPR Article 22). A named person makes the decision after reading the evidence. A use that decides or shapes such a decision, or that falls in an area of Annex III of the EU AI Act whatever it does, is Tier 3 and is not started before the Tier 3 decision. A use that only informs such a decision is Tier 2."), AG-09, AG-10, AG-11, AG-12, AG-16 and AG-17. The other rules are in the AI Acceptable Use & Security Policy.
EXAMPLE: A customer-service chatbot, proposed by the outsourced contact centre, that answers order-status questions, proposed by the Chief Operating Officer of the distributor on 9 Sep 2026. The workbook shows its assessment of 23 Sep 2026 and the decision of the Executive Committee on 29 Sep 2026: held. The distributor has about 900 staff and is an important entity under NIS2 in its Member State.
Adapting this template
Small organisation: one person can fill in the Use and Factors sheets in an hour for a Tier 2 use. Keep the evidence short and name one person who checks each control. Tier 3 still goes to the executive decision-maker the procedure names.
Regulated organisation: if a sector regulator or a customer contract sets extra duties for automated decisions or outsourcing, add them as further conditions on the Decision sheet and as questions you ask under RF-6.
Service provider or outsourced IT: rate a factor on what you can show, not on what the provider says. The AI use owner is the person who manages the provider, and the supplier terms ST-1 to ST-8 go into the contract before approval.
Amounts and appetite: replace the amounts in double brackets on the Scales sheet with the ones in your risk assessment methodology (P05), and change the appetite on the Result sheet if your leadership team has set a different one.
This workbook is your own record. Keep it with the evidence it rests on.
Use
The use and the intake answers
Describe the use and give the intake answers (AI Use Case Intake & Approval Procedure, IQ-01 to IQ-12). The tier follows from the answers. Yellow cells are yours; the rest calculates (AG-06, AG-09).
| Field | Your answer | Help | ||
|---|---|---|---|---|
The use
| Use ID (A05) | AI-003 | The ID the use has in the AI System & Use Case Inventory (A05). | ||
| IQ-01 The use | A customer-service chatbot, proposed by the outsourced contact centre, that answers order-status questions | What is the use, in one sentence, and what does the business gain? | ||
| IQ-02 Tool or feature | Customer-service chatbot | Which tool or feature, from which supplier (the P06 reference, or none)? Is it already running? What do the supplier's assessment, contract and processor terms say? | ||
| IQ-02 Supplier (P06 reference, or blank) | SUP-013 | Leave blank if there is no supplier record. A supplier here means the supplier terms below can create a hold. | ||
| IQ-03 AI use owner | Chief Operating Officer | Which manager is the AI use owner, and who reads the output before it is used? | ||
| IQ-03 Who reads the output before it is used | Customer service team leader, who reviews a sample of conversations each week | The person with the authority to reject the output (AG-07). | ||
| Already running? | No | Yes if the use is already running, for example found in the inventory survey. A hold then becomes a condition with a date. | ||
What goes in, who sees it and what it affects
| IQ-04 Highest data level | Confidential | What is the highest level of information that goes in (P15)? | ||
| IQ-05 Special category data | No | Could special category personal data go in (health, trade union membership, biometric data and the others of GDPR Article 9)? | ||
| IQ-06 Personal data | Yes | Could any personal data go in or come out? | ||
| IQ-07 Audience | Customers or the public deal with the system or see its output directly | Do customers or the public deal with the system, or see its output directly, or does a person review anything that leaves the organisation? | ||
| IQ-08 Autonomy | It acts, or sends output, without a person reading it first | Does a person read every output before it is used, or does the system act or send output on its own? | ||
| IQ-09 Effect on people | None | Does the use inform a decision about a person, or decide or shape one (recruitment, pay, performance, discipline, credit, access to a service)? A use that decides or shapes one is Tier 3; a use that only informs one is Tier 2. | ||
| IQ-10 Operational effect | Low | If the output were wrong or the tool stopped, would a core service or a material sum be affected (more than P05's Minor level in any impact area)? | ||
| IQ-11 Possible prohibited practice | No | Yes if any item on the prohibited-practice checklist (A08, PP-01 to PP-10) is Yes or Unsure. | ||
| IQ-11 Annex III area ticked | No | Yes if the use might fall in an area of Annex III (A08, HA-1 to HA-8). Legal confirms; the workbook only routes the request. | ||
| IQ-12 Provider signal | No | Would the organisation build an application or feature on a supplier's model API (prompts, retrieval, tools or code around a model it calls), whether for staff or for customers, fine-tune for others, brand, sell or supply the system, or change what it is meant for? Using a supplier's finished product as supplied is not building. Is it already running? | ||
| IQ-12 Role Legal recorded (A08), or blank | Leave blank until Legal records the role (Deployer, Provider or Other) with its reasoning in the A08 row. A Yes to IQ-12 holds a new use at H-4 and sets Tier 3 until a role is entered. Deployer: the tier is then worked out again from the other answers. Provider or Other: the hold clears but the use stays Tier 3, because it is outside the deployer governance of this pack (a use already running carries H-4 as a condition with a date). | |||
Supplier terms (they decide the holds)
| Supplier's decision under P06 | None yet | The supplier's decision under the third-party pack (P06). Choose None yet if there is none. | ||
| How training on our data is barred | None | Contract term if the contract bars the supplier from training on our data (ST-1). Setting verified off if only a vendor setting does: not enough for Internal or Confidential data, because the supplier can change it (BC-2, H-2). None if neither does. Where there is a contract term, keep any such setting off too. | ||
| Processor terms signed | No | Yes if processor terms are signed (P06 clause CL-06). | ||
| Answers complete (working) | Yes |
| Stop (working) | No |
What sets the tier (A03, IS-2)
| Trigger | What it means | Applies? | Tier | Rule |
|---|---|---|---|---|
| IQ-11 A prohibited practice may match | The use may match a prohibited practice. It is not started, and Legal is told. | No | Stop | AG-05 |
| IQ-05 Special category data could go in | Special category personal data would go into an AI tool. It never does (P15 CL-19). Change the use so that it does not. | No | Stop | AG-03 |
| IQ-11 An Annex III area is ticked | The use falls in an area of Annex III of the EU AI Act. It is Tier 3. | No | 3 | AG-06 |
| IQ-09 Decides or shapes a decision about a person | The use decides or shapes a decision about a person (GDPR Article 22; Annex III). | No | 3 | AG-06 |
| IQ-08 Acts or sends output without a person reading it | The system acts or sends output without a person reading it first. | Yes | 3 | AG-16 |
| IQ-12 A provider signal with no role recorded by Legal, and not yet running | Building on a supplier's model API counts as building. That is a signal, not a classification, and Legal records the role (D-51). A new use is Tier 3 until Legal has recorded it. | No | 3 | AG-17 |
| IQ-12 Legal recorded the Provider or Other role: H-4 clears, the use stays Tier 3 | Legal recorded a role other than deployer (provider or other). The use is outside this pack's deployer governance, so it stays Tier 3: the executive decision-maker decides, with the EU AI Act worksheet (A08) confirmed by Legal. | No | 3 | AG-17 |
| IQ-04 Confidential information goes in | Confidential information would go in. | Yes | 2 | AG-03 |
| IQ-06 Personal data goes in or comes out | Personal data would go in or come out. | Yes | 2 | AG-03 |
| IQ-07 Customers or the public deal with it | Customers or the public deal with the system or see its output. | Yes | 2 | AG-08 |
| IQ-09 Informs a decision about a person | The use informs a decision about a person. | No | 2 | AG-06 |
| IQ-10 A wrong output or a stoppage would be material | A wrong output or a stoppage would affect a core service or a material sum. | No | 2 | AG-10 |
| None of the above | Public or Internal non-personal data, staff only, a person reads every output, no effect on a person, and a low operational effect. | No | 1 | AG-09 |
| Tier from the intake answers | 3 | Tier 3: assessment and executive decision. The assessment may raise it (Result sheet). | ||
| The workbook routes the request as AI Use Case Intake & Approval Procedure does. It does not say that a use is prohibited, high-risk or subject to a transparency duty. This worksheet records your own reasoning against the text of the Act. It does not say that any system is or is not prohibited, high-risk or subject to a transparency duty, and it does not say that you are a provider, a deployer or any other operator. Counsel confirms each conclusion. | ||||
Factors
One row per factor. Rate the risk before controls, name the controls, then rate it again. Yellow columns are yours; the columns to the right of the second likelihood calculate. EXAMPLE: AI-003, a customer-service chatbot, proposed by the outsourced contact centre, that answers order-status questions.
| Example | Factor ID | Factor | What to ask | P05 impact areas | Evidence to look at | Impact before controls (1 to 4) | Likelihood before controls (1 to 4) | Controls that lower it, and who checks them | Impact after controls (1 to 4) | Likelihood after controls (1 to 4) | What the impact after controls means (P05) | Band before controls | Band after controls | Against appetite | Who may accept it | Check | Valid (working) | Band rank (working) | Outside appetite so far (working) | Outside tolerance so far (working) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | RF-1 | Security | Could the use expose the organisation's data or systems, or be turned against them: leaked prompts or files, prompt injection, an insecure plug-in, stolen credentials, malicious output? | Data, Service | The tool's settings, sign-in, logging and data location; the supplier's security assurance; the access the system holds. | 3 | 3 | Read-only lookup of order status; no write access; prompt injection testing before go-live. | 3 | 2 | Data: personal or customer data of [[hundreds]] of people, or commercially sensitive data; Service: a core customer service stopped for up to [[2]] days | High | Medium | Within appetite | Risk owner and Head of Information Security | OK | 1 | 2 | ||
| EXAMPLE | RF-2 | Privacy | Does personal data go in or come out? Is there a lawful basis, a purpose limit, processor terms, and a need for a data protection impact assessment (GDPR Article 35)? | Data, Legal and regulatory | What personal data, whose, how much; the Data Protection Officer's advice; the processor terms; the retention of prompts and outputs. | 3 | 3 | Customer personal data at scale. No reduction until processor terms and the Data Protection Officer's advice are in place (H-3). | 3 | 3 | Data: personal or customer data of [[hundreds]] of people, or commercially sensitive data; Legal and regulatory: a formal enquiry by a regulator or customer, or a contract breach with penalties | High | High | Outside appetite, within tolerance | Accountable executive and Head of Information Security, and executive management as well | OK | 1 | 3 | RF-2 | |
| EXAMPLE | RF-3 | Fairness | Could the output treat people unfairly or unequally, or carry bias into a decision, a message or a published item? | Legal and regulatory, Reputation | Who is affected; what the output is used for; how a person checks it; how a person can challenge it. | 2 | 2 | Same answers to every customer; a person takes over on request; weekly review of a sample. | 2 | 1 | Legal and regulatory: a minor breach of contract or policy, put right without penalty; Reputation: noticed by some customers or suppliers | Medium | Low | Within appetite | Risk owner | OK | 1 | 1 | RF-2 | |
| EXAMPLE | RF-4 | Safety | Could the output or the action physically harm a person or damage property? | Service, Financial | The physical processes the output can reach, and the checks between the output and the action. | 1 | 1 | Order status only. | 1 | 1 | Service: an internal service degraded for hours; Financial: less than [[€50,000]] | Low | Low | Within appetite | Risk owner | OK | 1 | 1 | RF-2 | |
| EXAMPLE | RF-5 | Operational | What happens if the output is wrong, the tool is unavailable or the supplier withdraws it? Can the business carry on, and is there a way back? | Service, Financial | The process it supports, the manual fallback, the exit route (P06 TP-11) and who notices a wrong output. | 2 | 3 | Agents take over; the contact centre can switch it off the same day. | 2 | 2 | Service: a customer service degraded, or an internal service stopped, for up to [[1]] day; Financial: [[€50,000]] to [[€250,000]] | Medium | Medium | Within appetite | Risk owner and Head of Information Security | OK | 1 | 2 | RF-2 | |
| EXAMPLE | RF-6 | Legal and contractual | Does the use fit the law, the organisation's contracts, customers' terms, intellectual property and the worksheet's reading of the EU AI Act (A08)? | Legal and regulatory, Reputation | The contract terms, the confidentiality duties, the A08 reasoning and Legal's confirmation. | 3 | 3 | Article 50(1) notice in the first message; ST-1 to ST-8 in the contract; Legal's reading (A08). | 3 | 2 | Legal and regulatory: a formal enquiry by a regulator or customer, or a contract breach with penalties; Reputation: complaints from several major customers, or regional or trade press | High | Medium | Within appetite | Risk owner and Head of Information Security | OK | 1 | 2 | RF-2 |
The safety rule. Where the output or action could physically harm a person, rate the impact 4 (Severe) whatever the other areas say. The use is Tier 3 and Legal is told.
Judge impact on the scales on the Scales sheet, never on a second scale. A factor can be Low and still carry a condition. Add a factor on a new sheet if the use raises a risk none of these six covers, and say so in the decision reason.
Result
Result
Counts of factors by band after controls, the highest band, the lowest tier the assessment allows and the tier for the decision, calculated from the Factors and Use sheets. Only the yellow settings are yours. Every figure is a count or a tier (AG-22).
EXAMPLE: AI-003, a customer-service chatbot, proposed by the outsourced contact centre, that answers order-status questions. Clear the EXAMPLE column and the yellow answers to use your own.
Settings
| Date of this assessment | 23 Sep 2026 | EXAMPLE: the date the assessment was done. | |
| Assessed by (role) | EXAMPLE: Head of Information Security | The person who rated the factors and checked the evidence (A03, IS-3). | |
| Appetite for AI-use risk | Cautious | Cautious is the house default. Averse, Cautious or Open (P05). Set it with your leadership team. | |
| Appetite and tolerance (working) | Medium | High | Appetite band, then tolerance band. |
Factors by band
| Band | After controls | Before controls | Scores | What the band means for acceptance (P05) | |
|---|---|---|---|---|---|
| Low | 2 | 1 | 1–3 | Risk owner; review every 12 months | |
| Medium | 3 | 2 | 4–6 | Risk owner and Head of Information Security; review every 12 months | |
| High | 1 | 3 | 8–9 | Accountable executive and Head of Information Security; review every 6 months | |
| Critical | 0 | 0 | 12–16 | The board, or a board risk committee it has delegated this to; in a two-tier structure, the management board; where there is no board, such as in an owner-managed company, executive management; review every 3 months | |
| Factors rated | 6 | 6 | 6 of 6 |
The assessment in numbers
| In one line | 6 of 6 factors rated; 2 Low, 3 Medium, 1 High, 0 Critical after controls | ||||
|---|---|---|---|---|---|
| Highest band after controls | High | ||||
| Safety rule applies? | No | Where the output or action could physically harm a person, rate the impact 4 (Severe) whatever the other areas say. The use is Tier 3 and Legal is told. | |||
| Lowest tier the assessment allows | 2 | The lowest tier the assessment allows: Tier 2 when the highest band after controls is High, Tier 3 when it is Critical or the safety rule applies, otherwise Tier 1. The tier for the decision is the higher of the intake tier and this floor. | |||
| Factors outside appetite | RF-2 | These need a higher approver than the band alone sets; see the Factors sheet (P05). | |||
| Factors outside tolerance | None | Only the board or its equivalent may accept a factor outside tolerance (P05). | |||
Tier and who decides
| Tier from the intake answers | 3 | ||||
|---|---|---|---|---|---|
| Lowest tier the assessment allows | 2 | ||||
| Tier for the decision | 3 | ||||
| In one line | Tier 3: assessment and executive decision: the assessment does not raise the tier. | ||||
| Assessment needed at this tier? | Yes | ||||
| Who decides | The executive decision-maker your procedure names (executive management by default; the board or its equivalent where your governance structure puts it), on the AI governance lead's recommendation | ||||
| What the tier needs | Everything in Tier 2, the EU AI Act worksheet (A08) confirmed by Legal, a data protection impact assessment where Article 35 of the GDPR applies, and HR where staff are affected. | ||||
| Working days to decide, from a complete file | 30 | ||||
| Months between reviews of an approval | 6 | ||||
Limitations
This assessment is as good as the evidence behind each rating. Look at the tool's settings, the contract and the records. Do not rely on what a supplier or a colleague says.
The ratings are judgement on a four-point scale. A second person who reads the factors and the controls is the best defence against optimism.
The impact thresholds in the Scales sheet come from your risk assessment methodology (P05). Replace the amounts in double brackets with yours so the two documents agree.
The workbook routes a use to the right tier and decision. It does not say that a system is or is not in a category of the EU AI Act, or that you are a provider or a deployer. Legal confirms those readings (A08).
The result is counts of factors by band and a tier. Never turn the counts into a percentage, a score or a traffic-light total.
Decision
The decision and its conditions
Record the decision, clear or keep each hold, and attach the baseline conditions. The tier decides who may decide (AI Use Case Intake & Approval Procedure, IS-4). Any approver may hold or decline. Only the approvers of the tier may approve, and the executive decision-maker takes the place of an approver who owns the use.
EXAMPLE: AI-003, held on 2026-09-29. Clear the EXAMPLE values and the yellow answers to use your own.
The decision
| Date the file was complete | 23 Sep 2026 | The day the intake answers, the assessment and the supplier decision (if needed) were all in. The tier's days count from it. | ||
| Decision | Held | Choose from the list. This becomes the status in the AI System & Use Case Inventory. | ||
| Decided by (role) | Executive Committee | The approvers of the tier (never the use owner; the executive decision-maker takes the place of an approver who owns the use). The executive decision-maker the procedure names decides Tier 3. | ||
| Decided on | 29 Sep 2026 | The date of the decision. | ||
| Reason | Executive Committee, 29 Sep 2026: held until the contact centre's assessment under P06 (planned 1 Dec 2026), a bar on training on our data and processor terms for the chatbot are in place, and the Data Protection Officer has advised on a data protection impact assessment. | Say why, in a sentence or two. For a hold, say what clears it. | ||
| Hold to be reviewed by (if Held) | 1 Dec 2026 | EXAMPLE: the date of the supplier's assessment under P06. Leave blank for any other decision. | ||
| Decision due by | 4 Nov 2026 | The tier's working days after the file is complete. | ||
| Decided in time? | Yes | |||
|---|---|---|---|---|
| Review the approval by | Only for an approval. Review sooner on a trigger (AG-10, IS-7). | |||
| Holds to clear before it starts | H-1, H-2, H-3 | |||
| Baseline conditions that apply | 5 of 5 | |||
| Check | OK | |||
Holds a new use must clear first (A03)
| Hold | Clears when | Applies? | Status | Rule |
|---|---|---|---|---|
| H-1 The use has a supplier with no documented decision under the third-party pack yet, and either Internal or Confidential data would go in or the use is Tier 2 or 3 even with Public data (P06 TP-01, TP-05; P15 CL-16 asks for it for Confidential data only, and this procedure asks earlier). A use with no supplier raises no H-1: there is nothing to assess. | The supplier's assessment ends in Approve or Approve with conditions. | Yes | Hold | AG-11 |
| H-2 Internal or Confidential data would go in, and the contract does not carry a term barring the supplier from training on it (ST-1; P15 CL-19). A setting verified off does not clear it: the supplier can change a setting, and only the contract binds it. | The contract carries the term barring training on the organisation's data. | Yes | Hold | AG-03 |
| H-3 Personal data would go in, and there are no processor terms (P06 clause CL-06). | Processor terms are signed, and the Data Protection Officer's advice is recorded. | Yes | Hold | AG-03 |
| H-4 A provider signal is present: the organisation would build on a supplier's model API, brand, supply or change the purpose of the system (AG-17). The signal is not a classification. | Legal records which role the organisation holds (deployer, provider or other), with its reasoning in A08. If the role is deployer, the tier is set again from the answers. If it is provider or other, the hold clears but the use stays Tier 3: the executive decision-maker decides, with A08 confirmed by Legal. | No | AG-17 | |
| A use already running does not wait: each hold that applies becomes a condition with a date, and the tool is switched off if it is not met. The supplier's decision comes from the third-party pack (P06). | ||||
Baseline conditions that go with every approval (BC-1 to BC-5)
| Condition | Why | Applies? | From data level | Rule |
|---|---|---|---|---|
| BC-1 Staff sign in with the work account through single sign-on (P13). No personal or free account. A feature built into a service follows that service's own access rules (P07, P13). | Internal or higher goes in. | Yes | Internal | AG-04 |
| BC-2 The contract bars the supplier from training on the organisation's data (ST-1; P15 CL-19). Where the tool also has a setting that stops training, it is kept off and checked at each review as an added technical control; it never replaces the contract term. | Internal or higher goes in. | Yes | Internal | AG-03 |
| BC-3 The tool and its supplier are in the inventory (A05) and, for Internal and Confidential data, in the supplier register (P06). | Internal or higher goes in. | Yes | Internal | AG-10 |
| BC-4 Confidential data and above only after the supplier's documented decision is Approve or Approve with conditions (P06 TP-05; P15 CL-16). | Confidential or higher goes in. | Yes | Confidential | AG-11 |
| BC-5 Personal data only where the tool is approved for it, under processor terms (P06 clause CL-06). | Personal data goes in or comes out. | Yes | Public | AG-03 |
Further conditions of this approval
| Condition | Who checks it | By when |
|---|---|---|
| [[A further condition, if any: what must be true]] | [[Role]] | [[YYYY-MM-DD]] |
A condition with a date is a condition of the approval, and the tool is switched off if it is not met. Record each one in the AI Tool Approval & Data Permission Matrix against the tool.
Scales
The scales behind the ratings
The impact and likelihood scales and the bands are the ones in your risk assessment methodology (P05). The AI factors are rated on them and on no other scale. Replace the amounts in double brackets with yours.
Impact: the words for each level, by area
| Area | 1 Minor | 2 Moderate | 3 Major | 4 Severe |
|---|---|---|---|---|
| Financial | less than [[€50,000]] | [[€50,000]] to [[€250,000]] | [[€250,000]] to [[€1,000,000]] | more than [[€1,000,000]] |
| Service | an internal service degraded for hours | a customer service degraded, or an internal service stopped, for up to [[1]] day | a core customer service stopped for up to [[2]] days | a core customer service stopped for more than [[2]] days |
| Data | internal, non-personal data | internal confidential data, or personal data of a few people | personal or customer data of [[hundreds]] of people, or commercially sensitive data | personal or customer data at scale |
| Legal and regulatory | no notification or breach | a minor breach of contract or policy, put right without penalty | a formal enquiry by a regulator or customer, or a contract breach with penalties | a notifiable breach, enforcement or contract termination |
| Reputation | not noticed outside the team | noticed by some customers or suppliers | complaints from several major customers, or regional or trade press | national press, or loss of a major customer |
Each factor is judged in the areas named for it: RF-1: Data and Service; RF-2: Data and Legal and regulatory; RF-3: Legal and regulatory and Reputation; RF-4: Service and Financial; RF-5: Service and Financial; RF-6: Legal and regulatory and Reputation. Judge the worse of the areas.
Likelihood
| Level | Name | Meaning | ||
|---|---|---|---|---|
| 1 | Unlikely | Not reachable from the internet or by ordinary users; no known exploitation; strong compensating control in place. | ||
| 2 | Possible | Reachable internally; exploitation needs skill or insider access. | ||
| 3 | Likely | Reachable by many users or from partner networks; exploitation techniques are public. | ||
| 4 | Almost certain | Internet-facing or known to be actively exploited, with no effective compensating control. | ||
Impact times likelihood gives the band
| Impact \ Likelihood | 1 Unlikely | 2 Possible | 3 Likely | 4 Almost certain |
|---|---|---|---|---|
| 1 Minor | Low (1) | Low (2) | Low (3) | Medium (4) |
| 2 Moderate | Low (2) | Medium (4) | Medium (6) | High (8) |
| 3 Major | Low (3) | Medium (6) | High (9) | Critical (12) |
| 4 Severe | Medium (4) | High (8) | Critical (12) | Critical (16) |
The product finds the band for one factor. Products are never added across factors.
Appetite and tolerance
| Appetite | Accepted without escalation up to | Tolerated, with a plan, up to | Meaning | |
|---|---|---|---|---|
| Averse | Low | Medium | We avoid this risk and act on anything above Low. | |
| Cautious | Medium | High | We accept some risk for a clear business benefit, with controls. | |
| Open | High | High | We accept higher risk to pursue opportunity; Critical is never within tolerance. | |
The highest band accepted without escalation. Tolerance is the highest band tolerated while a plan brings it back (P05). Critical is never within tolerance.
Lists
| Rating14 | YesNo | RoleChoice | TrainingBar | DataLevel | AudienceChoice | AutonomyChoice | PeopleChoice | OpsChoice | SupplierDecision | OutcomeChoice | AppetiteName | AppetiteBand | ToleranceBand | BandName | BandMin | AuthKey | AuthText | TierName | TierAssess | TierDecide | TierNeeds | TierDays | TierMonths |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | Yes | Deployer | Contract term | Public | Staff only: a person reviews anything that leaves the organisation | A person reads every output before it is used | None | Low | None yet | Approved | Averse | Low | Medium | Low | 1 | Low|Within appetite | Risk owner | Tier 1: screen | No | AI governance lead | A screen against the intake questions. No assessment. | 5 | 12 |
| 2 | No | Provider | Setting verified off | Internal | Customers or the public deal with the system or see its output directly | It acts, or sends output, without a person reading it first | Informs a decision about a person | Material | Approve | Approved with conditions | Cautious | Medium | High | Medium | 4 | Low|Outside appetite, within tolerance | Risk owner, and executive management as well | Tier 2: assessment | Yes | AI governance lead and Head of Information Security, with the use owner consulted (the owner signs the conditions it accepts and does not approve) and the Data Protection Officer's advice recorded where personal data is used | The risk and impact assessment (A06), the supplier decision under P06 where a supplier is involved, and the Data Protection Officer's advice where personal data is used. | 15 | 6 |
| 3 | Other | None | Confidential | Decides or shapes a decision about a person | Approve with conditions | Held | Open | High | High | High | 8 | Low|Outside tolerance | Risk owner recommend; only the board or its equivalent may accept | Tier 3: assessment and executive decision | Yes | The executive decision-maker your procedure names (executive management by default; the board or its equivalent where your governance structure puts it), on the AI governance lead's recommendation | Everything in Tier 2, the EU AI Act worksheet (A08) confirmed by Legal, a data protection impact assessment where Article 35 of the GDPR applies, and HR where staff are affected. | 30 | 6 | ||||
| 4 | Escalate | Declined | Critical | 12 | Medium|Within appetite | Risk owner and Head of Information Security | |||||||||||||||||
| Reject | Medium|Outside appetite, within tolerance | Risk owner and Head of Information Security, and executive management as well | |||||||||||||||||||||
| Medium|Outside tolerance | Risk owner and Head of Information Security recommend; only the board or its equivalent may accept | ||||||||||||||||||||||
| High|Within appetite | Accountable executive and Head of Information Security | ||||||||||||||||||||||
| High|Outside appetite, within tolerance | Accountable executive and Head of Information Security, and executive management as well | ||||||||||||||||||||||
| High|Outside tolerance | Accountable executive and Head of Information Security recommend; only the board or its equivalent may accept | ||||||||||||||||||||||
| Critical|Outside tolerance | The band's approvers recommend; only the board or its equivalent may accept |
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| AI use | One way the organisation uses an AI system, for one purpose, with one owner: summarising meeting notes with the office assistant, or forecasting stock with the warehouse system. One tool can have several uses. The inventory lists uses. |
| Tier | How much checking a proposed use needs before it starts: Tier 1 a screen, Tier 2 an assessment, Tier 3 an assessment and an executive decision. A fourth outcome, Stop, means the use is not allowed. |
| Human oversight | A named person who is competent to judge the output reads it before it is relied on, sent outside the organisation or published, and has the authority to reject it. |
| Training on our data | A supplier using what the organisation puts into a tool, or what the tool returns, to train or improve the supplier's models. The approved list records whether the contract or the tool's settings bar it. |
| Before controls | The rating of a factor before any control: an impact and a likelihood, each from 1 to 4, on the risk assessment scales (P05). Judge it as if nothing you plan were in place. |
| After controls | The rating of a factor after the controls named beside it. A control can lower a rating and never raise it. The band after controls is the one that counts. |
| Band | The band an impact multiplied by a likelihood falls in: Low, Medium, High or Critical (P05). The product only finds the band. It is never added to another factor's product, and the workbook gives no total. |
| Against appetite | Where a factor's band after controls sits against the appetite for AI-use risk: within appetite, outside appetite but within tolerance, or outside tolerance (P05). |
| Appetite and tolerance | The highest band accepted without escalation. Tolerance is the highest band tolerated while a plan brings it back (P05). Critical is never within tolerance. |
| Lowest tier the assessment allows | The lowest tier the assessment allows: Tier 2 when the highest band after controls is High, Tier 3 when it is Critical or the safety rule applies, otherwise Tier 1. The tier for the decision is the higher of the intake tier and this floor. |
| Hold | A condition a new use must clear before it starts (H-1 to H-4). A use already running gets a condition with a date instead. |
| Baseline condition | A condition that goes with every approval, from the data level shown (BC-1 to BC-5). A tool approved with conditions carries them as well. |
| Safety rule | Where the output or action could physically harm a person, rate the impact 4 (Severe) whatever the other areas say. The use is Tier 3 and Legal is told. |
| RF-1 to RF-6, IQ-01 to IQ-12 | The six risk factors of this workbook and the twelve intake questions of the AI Use Case Intake & Approval Procedure. |
| AG-xx, IS-x, H-x, BC-x | A rule of the AI Acceptable Use & Security Policy, a stage of the AI Use Case Intake & Approval Procedure, a hold and a baseline condition. |
| EXAMPLE | A worked example: AI-003, as at 30 Sep 2026. Clear the EXAMPLE values and the yellow answers before use. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Clause 6.1.2 — Information security risk assessment | The workbook as a whole: a risk assessment of one AI use, with its results recorded |
| NIST CSF 2.0 | ID.RA-04 — “Potential impacts and likelihoods of threats exploiting vulnerabilities are identified and recorded” | Factors and Result sheets: the impacts and likelihoods of the use are identified and recorded |
| ISO/IEC 42001:2023 | Clause 6.1.2 — AI risk assessment | Factors and Result sheets: the risk assessment of one use |
| ISO/IEC 42001:2023 | Clause 6.1.3 — AI risk treatment | Decision sheet: the controls and conditions that treat the risk |
| ISO/IEC 42001:2023 | Clause 6.1.4 — AI system impact assessment | Use and Factors sheets: the effect of the use on people and on the organisation |
| ISO/IEC 42001:2023 | Annex A 5.2 — AI system impact assessment process | The workbook as a whole: a set process for assessing the effect of a use |
| ISO/IEC 42001:2023 | Annex A 5.3 — Documentation of AI system impact assessments | The kept workbook: the assessment is documented and retained (AG-12) |
| EU AI Act — Regulation (EU) 2024/1689 | Article 3(12) — “intended purpose” means “the use for which an AI system is intended by the provider, including the specific context and conditions of use, as specified in the information supplied by the provider in the instructions for use, promotional or sales materials and statements, as well as in the technical documentation” | Factors sheet, RF-6: the intended purpose the supplier states is the context in which the use is judged |
| EU AI Act — Regulation (EU) 2024/1689 | Article 5(1), points (a) to (h) — prohibited, from 2 February 2025: AI that deploys subliminal, purposefully manipulative or deceptive techniques that materially distort behaviour and cause significant harm (a); exploits vulnerabilities due to age, disability or a specific social or economic situation (b); evaluates or classifies people by social behaviour or personal characteristics, with detrimental treatment in unrelated contexts or that is unjustified or disproportionate (c); assesses the risk of a person committing a criminal offence based solely on profiling or personality traits (d); creates or expands facial recognition databases by untargeted scraping of facial images from the internet or CCTV (e); infers emotions in the areas of workplace and education institutions, except for medical or safety reasons (f); categorises people by biometric data to infer race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation (g); and, with narrow exceptions, real-time remote biometric identification in publicly accessible spaces for law enforcement (h). Regulation (EU) 2026/1744 adds points (ba) and (bb) (AI that generates or manipulates realistic intimate images of an identifiable person without consent, and AI that generates or manipulates child sexual abuse material), with Article 5(1a) and (1b), from 2 December 2026 | Use sheet: a possible match with a prohibited practice stops the use before any assessment |
| EU AI Act — Regulation (EU) 2024/1689 | Article 6(3) — an Annex III system is not high-risk where it “does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons, including by not materially influencing the outcome of decision making”, which applies where it is intended to perform a narrow procedural task, improve the result of a previously completed human activity, detect decision-making patterns without replacing or influencing the human assessment, or perform a preparatory task; “an AI system referred to in Annex III shall always be considered to be high-risk where the AI system performs profiling of natural persons”. The provider documents the assessment before the system is placed on the market (Article 6(4)) | Use sheet and RF-6: a ticked Annex III area makes the use Tier 3, and Legal reads whether the Article 6(3) exemption could apply |
| EU AI Act — Regulation (EU) 2024/1689 | Article 26(4) — to the extent the deployer exercises control over the input data, it shall ensure that the input data is relevant and sufficiently representative in view of the intended purpose of the high-risk system | RF-1 and RF-3: where we control the input data, it must be relevant and representative of the intended purpose |
| EU AI Act — Regulation (EU) 2024/1689 | Article 26(9) — where applicable, deployers of high-risk systems use the information the provider gives under Article 13 to carry out their data protection impact assessment under Article 35 of Regulation (EU) 2016/679 | RF-2: the supplier's information on the system is used for the data protection impact assessment |
| EU AI Act — Regulation (EU) 2024/1689 | Article 27(1) — a fundamental rights impact assessment before deploying a high-risk system under Article 6(2) is required of deployers that are bodies governed by public law or private entities providing public services, and of deployers of the systems in points 5(b) and (c) of Annex III (creditworthiness, and life and health insurance pricing) | RF-3 and RF-6: some deployers must assess the effect on fundamental rights before using a system in an Annex III area; Legal decides if that is us |
| EU AI Act — Regulation (EU) 2024/1689 | Article 113, as amended — the Regulation applies from 2 August 2026, except that Chapters I and II (including Articles 4 and 5) apply from 2 February 2025, with Article 5(1) points (ba) and (bb) and Article 5(1a) and (1b) applying from 2 December 2026; Chapter III Section 4, Chapter V (general-purpose AI models), Chapter VII and Chapter XII and Article 78 apply from 2 August 2025, except Article 101; and Chapter III Sections 1, 2 and 3, except Article 6(5), apply from 2 December 2027 as regards systems classified as high-risk under Article 6(2) and Annex III, and from 2 August 2028 as regards those under Article 6(1) and Annex I. Article 50 is not listed in an exception and so applies from 2 August 2026 | Use sheet: the dates from which the prohibitions, the transparency duties and the Annex III duties apply, as amended |
| EU AI Act — Regulation (EU) 2026/1744 (Digital Omnibus on AI) | Regulation (EU) 2026/1744 of 8 July 2026 amending Regulations (EU) 2024/1689, (EU) 2018/1139 and (EU) 2023/1230 as regards the simplification of the implementation of harmonised rules on artificial intelligence (Official Journal, 24 July 2026); in force on the third day after publication (its Article 4), 27 July 2026. Its Article 1 amends Regulation (EU) 2024/1689 | Use sheet: the amending Regulation that adds two prohibitions and moves the date for Annex III systems |
| NIST AI RMF 1.0 | GOVERN 1.3 — “Processes, procedures, and practices are in place to determine the needed level of risk management activities based on the organization’s risk tolerance.” | Result sheet: the tier sets how much risk management a use needs, in line with the organisation's risk tolerance |
| NIST AI RMF 1.0 | MAP 4.1 — “Approaches for mapping AI technology and legal risks of its components – including the use of third-party data or software – are in place, followed, and documented, as are risks of infringement of a third party’s intellectual property or other rights.” | RF-6: the legal risks of the system and of its third-party components are mapped |
| NIST AI RMF 1.0 | MEASURE 2.7 — “AI system security and resilience – as identified in the MAP function – are evaluated and documented.” | RF-1: security and resilience of the AI system are evaluated and documented |
| NIST AI RMF 1.0 | MEASURE 2.10 — “Privacy risk of the AI system – as identified in the MAP function – is examined and documented.” | RF-2: privacy risk is examined and documented |
| NIST AI RMF 1.0 | MEASURE 2.11 — “Fairness and bias – as identified in the MAP function – are evaluated and results are documented.” | RF-3: fairness and bias are evaluated and the results documented |
| NIST AI RMF 1.0 | MANAGE 1.1 — “A determination is made as to whether the AI system achieves its intended purposes and stated objectives and whether its development or deployment should proceed.” | RF-5 and the Decision sheet: a determination whether the use should proceed |
| NIST AI RMF 1.0 | MANAGE 4.3 — “Incidents and errors are communicated to relevant AI actors, including affected communities. Processes for tracking, responding to, and recovering from incidents and errors are followed and documented.” | Decision sheet: the review date and the conditions that bring the use back for review after an incident or error |
| GDPR — Regulation (EU) 2016/679 | Article 5(1)(c) — personal data shall be “adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’)” | RF-2: personal data is limited to what the purpose needs |
| GDPR — Regulation (EU) 2016/679 | Article 9(1) — “Processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation shall be prohibited.”, unless one of the conditions of Article 9(2) applies | Use sheet: special category personal data never goes into an AI tool, so the use stops |
| GDPR — Regulation (EU) 2016/679 | Article 22(1) — “The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.” Article 22(3) requires, for the cases in Article 22(2), points (a) and (c), at least the right to obtain human intervention, to express a point of view and to contest the decision | Use sheet: a use that decides or shapes a decision about a person is Tier 3 |
| GDPR — Regulation (EU) 2016/679 | Article 35(1) — where a type of processing, in particular using new technologies, is likely to result in a high risk to the rights and freedoms of natural persons, the controller carries out “prior to the processing” an assessment of the impact on the protection of personal data; a single assessment may address a set of similar processing operations with similar high risks | RF-2 and the Decision sheet: a data protection impact assessment is considered where the processing is likely to be high risk |
| GDPR — Regulation (EU) 2016/679 | Article 35(3) — a data protection impact assessment is required in particular for a systematic and extensive evaluation of personal aspects of natural persons based on automated processing, including profiling, on which decisions with legal or similarly significant effects are based; for processing on a large scale of special categories of data; and for systematic monitoring of a publicly accessible area on a large scale | RF-2: systematic and extensive evaluation of people by automated processing is a case that needs one |
| NIST AI 600-1 | NIST AI 600-1, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, July 2024, cited by number and title | Factors sheet: the generative AI profile is a source of risks to ask about under RF-1 to RF-6 |
Editions referenced: Regulation (EU) 2024/1689 (the EU AI Act) as amended by Regulation (EU) 2026/1744; ISO/IEC 27001:2022 incl. Amd 1:2024; ISO/IEC 42001:2023 (by number and title only); NIST CSF 2.0; NIST AI RMF 1.0; Regulation (EU) 2016/679 (GDPR); as published and read on 8 October 2026
ISO/IEC 27001 and ISO/IEC 42001 references name the clause or control this document relates to, by number and title only. ISO/IEC 42001 is a paid standard whose text was not read for this document. A reference does not say that meeting a clause or control meets any requirement of the EU AI Act.
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.
Regulation (EU) 2024/1689 binds the operators of its Article 2(1): providers, deployers, importers, distributors, product manufacturers and authorised representatives. An organisation that uses another party’s AI system under its own authority for its business is a deployer (Article 3(4)). An organisation that sells goods and is called a distributor in its trade is not an AI Act distributor unless it makes an AI system available on the Union market (Article 3(7)). Which role an organisation holds for each system depends on the facts, and counsel confirms it.
The Commission’s guidelines explain how the Commission reads the Act. They are not binding, and only the Court of Justice of the European Union gives an authoritative interpretation of the Act. Member States lay down the penalties for infringements (Article 99(1)) and designate the authorities that enforce the Act, and no national text was read for these documents.
Dates are those in Article 113 as amended by Regulation (EU) 2026/1744, in force from 27 July 2026: the prohibitions and AI literacy from 2 February 2025; general-purpose AI models from 2 August 2025; the general date and Article 50 from 2 August 2026; Article 5(1) points (ba) and (bb) from 2 December 2026; high-risk systems under Annex III from 2 December 2027 and under Annex I from 2 August 2028.
This pack does not say which ISO/IEC 42001 or ISO/IEC 27001 controls, or which NIST AI RMF outcomes, meet a requirement of the EU AI Act. Each reference says what the source asks for and which CISO Times document helps with that work. Using a document does not by itself show that a requirement is met.