# AI use-case risk triage · [Product] · [Use case] · [Date] **Owner:** [PM] **Reviewed by:** [legal / privacy / security] **Next review:** [Date or trigger] ## The use case - What it does, in one sentence: - Who uses it, and who is affected by its output: - Model(s) and provider(s): - Data it reads (including any personal data): - What it can change (none / suggests only / acts with approval / acts autonomously): ## Role - Our EU AI Act role: provider / deployer / both - Could a customer or partner become a provider (own branding, substantial modification, new high-risk purpose)? [yes/no, how] ## Screens | Screen | Answer | Reasoning | |---|---|---| | Any prohibited practice (Art. 5)? | | | | In an Annex III area? Which one? | | | | Profiles people? (if yes and Annex III: high-risk) | | | | Article 6(3) conditions claimed, if any | | | | Annex I regulated product? | | | | Interacts with people or generates content (Art. 50)? | | | | Personal data: DPIA trigger likely? | | | | Other jurisdictions in scope (US states, Korea, China, others) | | | ## Internal tier Low / Medium / High, because [reason]. Review track: light / standard / full board. ## Open questions for counsel 1. ## Decision [Proceed / proceed with conditions / stop], decided by [name] on [date].