AI Use Case Intake and Risk Tiering: [Use case name]
Intake form for a proposed AI use case: requester, business problem,
proposed approach, data, affected people, screening questions based on
the risk categories of the EU AI Act (Regulation (EU) 2024/1689, as
amended by Regulation (EU) 2026/1744): prohibited practices
(Article 5), high-risk systems (Article 6 and Annex III), transparency
obligations (Article 50) and minimal risk. It ends with an internal
risk tier, required reviews and a decision. Replace every [bracketed]
value and every row marked Example. This is a screening format, not
legal advice; legal counsel confirms any classification.
| Field | Value |
|---|
| Intake ID | [AI-UC-2026-047] |
| Submitted | YYYY-MM-DD |
| Status | [Submitted / In review / Approved / Approved with conditions / Rejected / Withdrawn] |
| Internal risk tier | [Tier 1 / Tier 2 / Tier 3 / Tier 4] (set in section 7) |
| AI governance reviewer | [@ai-governance] |
| Next review | YYYY-MM-DD |
| Related documents | [AI risk assessment], [AI acceptable use policy], [Data protection impact assessment], [Vendor assessment] |
1. Requester
| Field | Value |
|---|
| Requester | [@name], [team] |
| Business owner (accountable) | [@name], [role] |
| Technical lead | [@name] |
| Budget and cost centre | [value] |
| Target go-live | YYYY-MM-DD |
2. Business problem
[Problem statement.] Example: "Recruiters spend about 11 hours per
vacancy reading 300 to 600 applications for entry-level roles. We want
to cut screening time by half while keeping or improving the diversity
of shortlists."
| Success measure | Current | Target |
|---|
| Example: Screening hours per vacancy | 11 | ≤ 5 |
| Example: Shortlist selection rate ratio across gender | 0.88 | ≥ 0.90 |
Alternatives considered without AI: [for example, structured screening
questions, more recruiters].
3. Proposed AI approach
| Field | Value |
|---|
| Description | Example: LLM summarises each CV against job criteria and suggests a ranking |
| Build or buy | [Build in-house / Vendor product / Vendor API with our prompts] |
| Model or vendor | [Name, version] |
| Our role under the AI Act | [Provider / Deployer / Both / Not in EU scope] |
| Human involvement | [Fully automated / Human reviews every output / Human reviews samples] |
| Decision made with the output | Example: Recruiter decides who is shortlisted, sees AI summary and rank |
| Users | Example: 25 recruiters in [countries] |
| Scale | Example: 40,000 applications per year |
4. Data involved and classification
| Data | Source | Classification | Personal data | Special category | Leaves our environment |
|---|
| Example: CVs and cover letters | Applicant tracking system | Confidential | Yes | Possibly (health, ethnicity in free text) | Yes, to vendor API (EU region) |
| Example: Job descriptions | HR | Internal | No | No | Yes |
| Example: Recruiter decisions (for evaluation) | ATS | Confidential | Yes | No | No |
| [Data] | [Source] | [Public / Internal / Confidential / Restricted] | [Yes / No] | [Yes / No] | [Yes / No] |
5. Affected people
| Group | How affected | Approximate number | Vulnerable |
|---|
| Example: Job applicants | Ranking affects shortlisting | 40,000 per year | Possibly (young people, people with disabilities) |
| Example: Recruiters | Work changes; oversight duty | 25 | No |
| [Group] | [Effect] | [n] | [Yes / No] |
6. EU AI Act screening questions
6.1 Prohibited practices (Article 5)
| Q | Does the system... | Answer | Reason |
|---|
| P1 | Use subliminal, manipulative or deceptive techniques that materially distort behaviour and cause significant harm? | [Y/N/U] | |
| P2 | Exploit vulnerabilities due to age, disability or social or economic situation, causing significant harm? | [Y/N/U] | |
| P3 | Evaluate or classify people by social behaviour or personal traits leading to detrimental treatment (social scoring)? | [Y/N/U] | |
| P4 | Assess the risk that a person commits a crime based solely on profiling or personality traits? | [Y/N/U] | |
| P5 | Build or expand facial recognition databases by untargeted scraping of images from the internet or CCTV? | [Y/N/U] | |
| P6 | Infer emotions of people in the workplace or in education (outside medical or safety reasons)? | [Y/N/U] | |
| P7 | Categorise people by biometric data to infer sensitive characteristics such as race, political opinions or sexual orientation? | [Y/N/U] | |
| P8 | Perform real-time remote biometric identification in publicly accessible spaces for law enforcement? | [Y/N/U] | |
| P9 | Generate or manipulate realistic intimate or sexually explicit images, video or audio of an identifiable person without consent, or child sexual abuse material (added by Regulation (EU) 2026/1744, applicable from 2 December 2026)? | [Y/N/U] | |
6.2 High-risk (Article 6 and Annex III)
Is the system intended to be used in one of the Annex III areas, or as a
safety component of a product covered by the Union harmonisation
legislation listed in Annex I?
| Q | Area | Answer | Reason |
|---|
| H1 | Biometrics (remote identification, categorisation, emotion recognition, where permitted) | [Y/N/U] | |
| H2 | Critical infrastructure (safety components in digital infrastructure, traffic, water, gas, heating, electricity) | [Y/N/U] | |
| H3 | Education and vocational training (admission, assessment, monitoring of tests) | [Y/N/U] | |
| H4 | Employment, workers' management and access to self-employment (recruitment, promotion, termination, task allocation, monitoring) | [Y/N/U] | Example: Yes, CV ranking for recruitment |
| H5 | Access to essential private and public services and benefits (public benefits, creditworthiness, life and health insurance pricing, emergency call triage) | [Y/N/U] | |
| H6 | Law enforcement | [Y/N/U] | |
| H7 | Migration, asylum and border control management | [Y/N/U] | |
| H8 | Administration of justice and democratic processes | [Y/N/U] | |
| H9 | Safety component of an Annex I product (for example machinery, medical devices, toys) | [Y/N/U] | |
If an Annex III area applies, record whether the Article 6(3) exception
may apply (the system performs a narrow procedural task, improves the
result of a completed human activity, detects decision patterns without
replacing human assessment, or performs a preparatory task) and note
that systems that profile natural persons remain high-risk. Any reliance
on the exception must be documented and approved by legal. High-risk
obligations for Annex III systems apply from 2 December 2027 under the
amended timeline; check the current text.
6.3 Transparency obligations (Article 50)
| Q | Does the system... | Answer |
|---|
| T1 | Interact directly with people who may not realise they are dealing with AI (chatbots, voice agents)? | [Y/N/U] |
| T2 | Generate synthetic audio, image, video or text content? | [Y/N/U] |
| T3 | Perform emotion recognition or biometric categorisation (where lawful)? | [Y/N/U] |
| T4 | Generate or manipulate deep fakes, or text published to inform the public on matters of public interest? | [Y/N/U] |
6.4 Result of screening
| Category | Outcome |
|---|
| Prohibited | [No / Possible, stop and refer to legal] |
| High-risk | [No / Yes / Possible] |
| Transparency obligations | [None / T1 / T2 / T3 / T4] |
| Minimal risk | [Yes, if none of the above] |
| General-purpose AI model obligations | [Relevant only if we place a GPAI model on the market; normally No] |
7. Internal risk tier
| Tier | Criteria | Review depth |
|---|
| Tier 1, Critical | Possible prohibited practice, or high-risk with fully automated decisions | Executive and legal decision; usually rejected |
| Tier 2, High | High-risk area, or significant effect on people's rights, money or health | Full AI risk assessment, DPIA, red team, validation |
| Tier 3, Medium | Transparency obligations, personal data, customer-facing content | Light risk assessment, privacy and security review |
| Tier 4, Low | Internal productivity, no personal data, human checks all outputs | Register and approved tools only |
Assigned tier: [Tier 2], because [reasoning]. Example: "Recruitment
falls under Annex III employment; outputs influence shortlisting of
40,000 applicants a year."
8. Required reviews
| Review | Required | Owner | Status | Reference |
|---|
| AI risk assessment | [Yes / No] | [@ai-governance] | [Not started / In progress / Done] | [link] |
| Privacy (DPIA) | [Yes / No] | [@dpo] | [Status] | [link] |
| Security review | [Yes / No] | [@security] | [Status] | [link] |
| Legal (AI Act classification, employment law) | [Yes / No] | [@legal] | [Status] | [link] |
| Vendor assessment | [Yes / No] | [@procurement] | [Status] | [link] |
| Works council or staff consultation | [Yes / No] | [@hr] | [Status] | [link] |
| Fairness evaluation | [Yes / No] | [@data-science] | [Status] | [link] |
9. Decision and conditions
Decision: [Approved / Approved with conditions / Rejected / Deferred].
| ID | Condition | Owner | Due |
|---|
| Example: CON-01 | AI output shown as summary only; no automatic rejection | [@business-owner] | Before go-live |
| Example: CON-02 | Recruiters complete human oversight training (AI literacy plan module M05) | [@hr-learning] | Before access |
| Example: CON-03 | Quarterly selection-rate ratio report to AI governance | [@data-science] | Quarterly |
| Role | Name | Decision | Date |
|---|
| AI governance lead | [@name] | [Decision] | YYYY-MM-DD |
| Business owner | [@name] | [Accepts conditions] | YYYY-MM-DD |
| Legal (Tier 1 and 2) | [@name] | [Decision] | YYYY-MM-DD |
10. Register entry
| Field | Value |
|---|
| Inventory ID | [AI-SYS-0112] |
| Tier | [Tier] |
| Review frequency | [Annual / Semi-annual] |
| Monitoring plan | [link] |
Standard and licence note
Based on the risk categories of Regulation (EU) 2024/1689 (the
Artificial Intelligence Act), Articles 5, 6 and 50 and Annex III, as
amended by Regulation (EU) 2026/1744; EU legislative texts are free to
reuse. The screening questions are summaries in original wording and do
not reproduce or replace the legal text; consult the consolidated text
on EUR-Lex and Commission guidelines. This is a screening format, not
legal advice. Template licence: MIT.