AI Use Case Intake and Risk Tiering Template (EU AI Act)

Screen a proposed AI use case: data, affected people, AI Act prohibited/high-risk/transparency questions, tier, reviews

KI & DatenStandardEU AI Act (Regulation (EU) 2024/1689) Articles 5, 6, 50 and Annex III, as amended by Regulation (EU) 2026/1744use case intakeAktualisiert 20.10.2026

Im Editor öffnen.md herunterladen

Anleitung: Use it when someone proposes a new AI use case or a material change. The requester fills the problem, approach, data and affected people; governance answers the screening questions and sets the tier. The main pitfall is answering for the happy path only and ignoring foreseeable misuse.

Vorschau

AI Use Case Intake and Risk Tiering: [Use case name]

Intake form for a proposed AI use case: requester, business problem, proposed approach, data, affected people, screening questions based on the risk categories of the EU AI Act (Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744): prohibited practices (Article 5), high-risk systems (Article 6 and Annex III), transparency obligations (Article 50) and minimal risk. It ends with an internal risk tier, required reviews and a decision. Replace every [bracketed] value and every row marked Example. This is a screening format, not legal advice; legal counsel confirms any classification.

Field	Value
Intake ID	[AI-UC-2026-047]
Submitted	YYYY-MM-DD
Status	[Submitted / In review / Approved / Approved with conditions / Rejected / Withdrawn]
Internal risk tier	[Tier 1 / Tier 2 / Tier 3 / Tier 4] (set in section 7)
AI governance reviewer	[@ai-governance]
Next review	YYYY-MM-DD
Related documents	[AI risk assessment], [AI acceptable use policy], [Data protection impact assessment], [Vendor assessment]

1. Requester

Field	Value
Requester	[@name], [team]
Business owner (accountable)	[@name], [role]
Technical lead	[@name]
Budget and cost centre	[value]
Target go-live	YYYY-MM-DD

2. Business problem

[Problem statement.] Example: "Recruiters spend about 11 hours per vacancy reading 300 to 600 applications for entry-level roles. We want to cut screening time by half while keeping or improving the diversity of shortlists."

Success measure	Current	Target
Example: Screening hours per vacancy	11	≤ 5
Example: Shortlist selection rate ratio across gender	0.88	≥ 0.90

Alternatives considered without AI: [for example, structured screening questions, more recruiters].

3. Proposed AI approach

Field	Value
Description	Example: LLM summarises each CV against job criteria and suggests a ranking
Build or buy	[Build in-house / Vendor product / Vendor API with our prompts]
Model or vendor	[Name, version]
Our role under the AI Act	[Provider / Deployer / Both / Not in EU scope]
Human involvement	[Fully automated / Human reviews every output / Human reviews samples]
Decision made with the output	Example: Recruiter decides who is shortlisted, sees AI summary and rank
Users	Example: 25 recruiters in [countries]
Scale	Example: 40,000 applications per year

4. Data involved and classification

Data	Source	Classification	Personal data	Special category	Leaves our environment
Example: CVs and cover letters	Applicant tracking system	Confidential	Yes	Possibly (health, ethnicity in free text)	Yes, to vendor API (EU region)
Example: Job descriptions	HR	Internal	No	No	Yes
Example: Recruiter decisions (for evaluation)	ATS	Confidential	Yes	No	No
[Data]	[Source]	[Public / Internal / Confidential / Restricted]	[Yes / No]	[Yes / No]	[Yes / No]

5. Affected people

Group	How affected	Approximate number	Vulnerable
Example: Job applicants	Ranking affects shortlisting	40,000 per year	Possibly (young people, people with disabilities)
Example: Recruiters	Work changes; oversight duty	25	No
[Group]	[Effect]	[n]	[Yes / No]

6. EU AI Act screening questions

6.1 Prohibited practices (Article 5)

Q	Does the system...	Answer
P1	Use subliminal, manipulative or deceptive techniques that materially distort behaviour and cause significant harm?	[Y/N/U]
P2	Exploit vulnerabilities due to age, disability or social or economic situation, causing significant harm?	[Y/N/U]
P3	Evaluate or classify people by social behaviour or personal traits leading to detrimental treatment (social scoring)?	[Y/N/U]
P4	Assess the risk that a person commits a crime based solely on profiling or personality traits?	[Y/N/U]
P5	Build or expand facial recognition databases by untargeted scraping of images from the internet or CCTV?	[Y/N/U]
P6	Infer emotions of people in the workplace or in education (outside medical or safety reasons)?	[Y/N/U]
P7	Categorise people by biometric data to infer sensitive characteristics such as race, political opinions or sexual orientation?	[Y/N/U]
P8	Perform real-time remote biometric identification in publicly accessible spaces for law enforcement?	[Y/N/U]
P9	Generate or manipulate realistic intimate or sexually explicit images, video or audio of an identifiable person without consent, or child sexual abuse material (added by Regulation (EU) 2026/1744, applicable from 2 December 2026)?	[Y/N/U]

6.2 High-risk (Article 6 and Annex III)

Is the system intended to be used in one of the Annex III areas, or as a safety component of a product covered by the Union harmonisation legislation listed in Annex I?

Q	Area	Answer	Reason
H1	Biometrics (remote identification, categorisation, emotion recognition, where permitted)	[Y/N/U]
H2	Critical infrastructure (safety components in digital infrastructure, traffic, water, gas, heating, electricity)	[Y/N/U]
H3	Education and vocational training (admission, assessment, monitoring of tests)	[Y/N/U]
H4	Employment, workers' management and access to self-employment (recruitment, promotion, termination, task allocation, monitoring)	[Y/N/U]	Example: Yes, CV ranking for recruitment
H5	Access to essential private and public services and benefits (public benefits, creditworthiness, life and health insurance pricing, emergency call triage)	[Y/N/U]
H6	Law enforcement	[Y/N/U]
H7	Migration, asylum and border control management	[Y/N/U]
H8	Administration of justice and democratic processes	[Y/N/U]
H9	Safety component of an Annex I product (for example machinery, medical devices, toys)	[Y/N/U]

If an Annex III area applies, record whether the Article 6(3) exception may apply (the system performs a narrow procedural task, improves the result of a completed human activity, detects decision patterns without replacing human assessment, or performs a preparatory task) and note that systems that profile natural persons remain high-risk. Any reliance on the exception must be documented and approved by legal. High-risk obligations for Annex III systems apply from 2 December 2027 under the amended timeline; check the current text.

6.3 Transparency obligations (Article 50)

Q	Does the system...	Answer
T1	Interact directly with people who may not realise they are dealing with AI (chatbots, voice agents)?	[Y/N/U]
T2	Generate synthetic audio, image, video or text content?	[Y/N/U]
T3	Perform emotion recognition or biometric categorisation (where lawful)?	[Y/N/U]
T4	Generate or manipulate deep fakes, or text published to inform the public on matters of public interest?	[Y/N/U]

6.4 Result of screening

Category	Outcome
Prohibited	[No / Possible, stop and refer to legal]
High-risk	[No / Yes / Possible]
Transparency obligations	[None / T1 / T2 / T3 / T4]
Minimal risk	[Yes, if none of the above]
General-purpose AI model obligations	[Relevant only if we place a GPAI model on the market; normally No]

7. Internal risk tier

Tier	Criteria	Review depth
Tier 1, Critical	Possible prohibited practice, or high-risk with fully automated decisions	Executive and legal decision; usually rejected
Tier 2, High	High-risk area, or significant effect on people's rights, money or health	Full AI risk assessment, DPIA, red team, validation
Tier 3, Medium	Transparency obligations, personal data, customer-facing content	Light risk assessment, privacy and security review
Tier 4, Low	Internal productivity, no personal data, human checks all outputs	Register and approved tools only

Assigned tier: [Tier 2], because [reasoning]. Example: "Recruitment falls under Annex III employment; outputs influence shortlisting of 40,000 applicants a year."

8. Required reviews

Review	Required	Owner	Status	Reference
AI risk assessment	[Yes / No]	[@ai-governance]	[Not started / In progress / Done]	[link]
Privacy (DPIA)	[Yes / No]	[@dpo]	[Status]	[link]
Security review	[Yes / No]	[@security]	[Status]	[link]
Legal (AI Act classification, employment law)	[Yes / No]	[@legal]	[Status]	[link]
Vendor assessment	[Yes / No]	[@procurement]	[Status]	[link]
Works council or staff consultation	[Yes / No]	[@hr]	[Status]	[link]
Fairness evaluation	[Yes / No]	[@data-science]	[Status]	[link]

9. Decision and conditions

Decision: [Approved / Approved with conditions / Rejected / Deferred].

ID	Condition	Owner	Due
Example: CON-01	AI output shown as summary only; no automatic rejection	[@business-owner]	Before go-live
Example: CON-02	Recruiters complete human oversight training (AI literacy plan module M05)	[@hr-learning]	Before access
Example: CON-03	Quarterly selection-rate ratio report to AI governance	[@data-science]	Quarterly

Role	Name	Decision	Date
AI governance lead	[@name]	[Decision]	YYYY-MM-DD
Business owner	[@name]	[Accepts conditions]	YYYY-MM-DD
Legal (Tier 1 and 2)	[@name]	[Decision]	YYYY-MM-DD

10. Register entry

Field	Value
Inventory ID	[AI-SYS-0112]
Tier	[Tier]
Review frequency	[Annual / Semi-annual]
Monitoring plan	[link]

Standard and licence note

Based on the risk categories of Regulation (EU) 2024/1689 (the Artificial Intelligence Act), Articles 5, 6 and 50 and Annex III, as amended by Regulation (EU) 2026/1744; EU legislative texts are free to reuse. The screening questions are summaries in original wording and do not reproduce or replace the legal text; consult the consolidated text on EUR-Lex and Commission guidelines. This is a screening format, not legal advice. Template licence: MIT.