# AI use case intake checklist

Use this when a new AI system, feature or vendor model lands on your desk. Article numbers are from the
EU AI Act, Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744, and from the GDPR,
Regulation (EU) 2016/679. It is a starting list, not legal advice.

## The system

- [ ] What it does and its intended purpose, in one paragraph
- [ ] Who built it: in house, a vendor, or a general-purpose model you adapt
- [ ] Who owns it inside the organization, by name

## EU AI Act

- [ ] Your operator role under Article 3: provider, deployer, authorised representative, importer or
      distributor (one organization can hold several at once)
- [ ] Is it a prohibited practice under Article 5? (applied from 2 February 2025; two more from 2 December 2026)
- [ ] Is it high-risk under Article 6(2) and Annex III (from 2 December 2027) or Article 6(1) and Annex I
      (from 2 August 2028)?
- [ ] Do the Article 50 transparency duties apply (from 2 August 2026)?
- [ ] If you are the deployer of a high-risk system: does a fundamental rights impact assessment apply?
- [ ] If you are the provider: who owns the technical documentation and the instructions for use?

## Data protection

- [ ] Personal data in training, testing or use, and the lawful basis for each
- [ ] Automated decision-making under GDPR Article 22, and the Article 13(2)(f) disclosure
- [ ] Data protection by design and by default under Article 25
- [ ] A data protection impact assessment under Article 35, if the processing is likely to be high risk

## Risk and standards

- [ ] NIST AI RMF: which of Govern, Map, Measure and Manage you have done for this system
- [ ] An impact assessment of benefits and harms before deployment (ISO/IEC 42005:2025 covers this)
- [ ] Where the system sits in your AI management system, if you run one to ISO/IEC 42001:2023

## Third parties

- [ ] License terms for the model, the data and the outputs, read by someone who can say yes or no
- [ ] The provider's instructions for use and known limitations, received in writing

## After go-live

- [ ] Monitoring owner and the metrics they watch
- [ ] How an incident is reported, and to whom
- [ ] The date of the next reassessment, and what would make you switch the system off