# AI Use Case Intake and Risk Tiering: [Use case name]

> Intake form for a proposed AI use case: requester, business problem,
> proposed approach, data, affected people, screening questions based on
> the risk categories of the EU AI Act (Regulation (EU) 2024/1689, as
> amended by Regulation (EU) 2026/1744): prohibited practices
> (Article 5), high-risk systems (Article 6 and Annex III), transparency
> obligations (Article 50) and minimal risk. It ends with an internal
> risk tier, required reviews and a decision. Replace every `[bracketed]`
> value and every row marked *Example*. This is a screening format, not
> legal advice; legal counsel confirms any classification.

<!--
Guidance: How to use this template
- The requester fills sections 1 to 5; the AI governance team fills
  sections 6 to 10. Expect 30 to 60 minutes for the requester.
- Answer the screening questions for the intended purpose and for
  reasonably foreseeable misuse, not only for the happy path.
- Any "Yes" or "Unsure" in section 6.1 stops the intake until legal
  review. Any "Yes" in section 6.2 means a full AI risk assessment.
- Re-run the intake when the purpose, data, users or model change.
-->

| Field | Value |
|---|---|
| Intake ID | [AI-UC-2026-047] |
| Submitted | YYYY-MM-DD |
| Status | [Submitted / In review / Approved / Approved with conditions / Rejected / Withdrawn] |
| Internal risk tier | [Tier 1 / Tier 2 / Tier 3 / Tier 4] (set in section 7) |
| AI governance reviewer | [@ai-governance] |
| Next review | YYYY-MM-DD |
| Related documents | [AI risk assessment], [AI acceptable use policy], [Data protection impact assessment], [Vendor assessment] |

## 1. Requester

<!-- Guidance: Identify the accountable business owner, not only the person filling the form. -->

| Field | Value |
|---|---|
| Requester | [@name], [team] |
| Business owner (accountable) | [@name], [role] |
| Technical lead | [@name] |
| Budget and cost centre | [value] |
| Target go-live | YYYY-MM-DD |

## 2. Business problem

<!-- Guidance: Describe the problem and the measure of success without mentioning AI. If the problem can be solved without AI, say so. -->

[Problem statement.] *Example:* "Recruiters spend about 11 hours per
vacancy reading 300 to 600 applications for entry-level roles. We want
to cut screening time by half while keeping or improving the diversity
of shortlists."

| Success measure | Current | Target |
|---|---|---|
| *Example:* Screening hours per vacancy | 11 | ≤ 5 |
| *Example:* Shortlist selection rate ratio across gender | 0.88 | ≥ 0.90 |

Alternatives considered without AI: [for example, structured screening
questions, more recruiters].

## 3. Proposed AI approach

<!-- Guidance: Describe what the system does, who builds or supplies it, and the level of human involvement. -->

| Field | Value |
|---|---|
| Description | *Example:* LLM summarises each CV against job criteria and suggests a ranking |
| Build or buy | [Build in-house / Vendor product / Vendor API with our prompts] |
| Model or vendor | [Name, version] |
| Our role under the AI Act | [Provider / Deployer / Both / Not in EU scope] |
| Human involvement | [Fully automated / Human reviews every output / Human reviews samples] |
| Decision made with the output | *Example:* Recruiter decides who is shortlisted, sees AI summary and rank |
| Users | *Example:* 25 recruiters in [countries] |
| Scale | *Example:* 40,000 applications per year |

## 4. Data involved and classification

<!-- Guidance: List all data used for inputs, prompts, fine-tuning and logs, with your classification scheme. Flag special categories of personal data. -->

| Data | Source | Classification | Personal data | Special category | Leaves our environment |
|---|---|---|---|---|---|
| *Example:* CVs and cover letters | Applicant tracking system | Confidential | Yes | Possibly (health, ethnicity in free text) | Yes, to vendor API (EU region) |
| *Example:* Job descriptions | HR | Internal | No | No | Yes |
| *Example:* Recruiter decisions (for evaluation) | ATS | Confidential | Yes | No | No |
| [Data] | [Source] | [Public / Internal / Confidential / Restricted] | [Yes / No] | [Yes / No] | [Yes / No] |

## 5. Affected people

<!-- Guidance: Name everyone affected by the outputs, including people who never use the system. Note vulnerable groups. -->

| Group | How affected | Approximate number | Vulnerable |
|---|---|---|---|
| *Example:* Job applicants | Ranking affects shortlisting | 40,000 per year | Possibly (young people, people with disabilities) |
| *Example:* Recruiters | Work changes; oversight duty | 25 | No |
| [Group] | [Effect] | [n] | [Yes / No] |

## 6. EU AI Act screening questions

<!-- Guidance: Answer Yes, No or Unsure with a short reason. These questions screen; they do not classify. Check the current consolidated text on EUR-Lex and Commission guidelines. -->

### 6.1 Prohibited practices (Article 5)

| Q | Does the system... | Answer | Reason |
|---|---|---|---|
| P1 | Use subliminal, manipulative or deceptive techniques that materially distort behaviour and cause significant harm? | [Y/N/U] | |
| P2 | Exploit vulnerabilities due to age, disability or social or economic situation, causing significant harm? | [Y/N/U] | |
| P3 | Evaluate or classify people by social behaviour or personal traits leading to detrimental treatment (social scoring)? | [Y/N/U] | |
| P4 | Assess the risk that a person commits a crime based solely on profiling or personality traits? | [Y/N/U] | |
| P5 | Build or expand facial recognition databases by untargeted scraping of images from the internet or CCTV? | [Y/N/U] | |
| P6 | Infer emotions of people in the workplace or in education (outside medical or safety reasons)? | [Y/N/U] | |
| P7 | Categorise people by biometric data to infer sensitive characteristics such as race, political opinions or sexual orientation? | [Y/N/U] | |
| P8 | Perform real-time remote biometric identification in publicly accessible spaces for law enforcement? | [Y/N/U] | |
| P9 | Generate or manipulate realistic intimate or sexually explicit images, video or audio of an identifiable person without consent, or child sexual abuse material (added by Regulation (EU) 2026/1744, applicable from 2 December 2026)? | [Y/N/U] | |

### 6.2 High-risk (Article 6 and Annex III)

Is the system intended to be used in one of the Annex III areas, or as a
safety component of a product covered by the Union harmonisation
legislation listed in Annex I?

| Q | Area | Answer | Reason |
|---|---|---|---|
| H1 | Biometrics (remote identification, categorisation, emotion recognition, where permitted) | [Y/N/U] | |
| H2 | Critical infrastructure (safety components in digital infrastructure, traffic, water, gas, heating, electricity) | [Y/N/U] | |
| H3 | Education and vocational training (admission, assessment, monitoring of tests) | [Y/N/U] | |
| H4 | Employment, workers' management and access to self-employment (recruitment, promotion, termination, task allocation, monitoring) | [Y/N/U] | *Example:* Yes, CV ranking for recruitment |
| H5 | Access to essential private and public services and benefits (public benefits, creditworthiness, life and health insurance pricing, emergency call triage) | [Y/N/U] | |
| H6 | Law enforcement | [Y/N/U] | |
| H7 | Migration, asylum and border control management | [Y/N/U] | |
| H8 | Administration of justice and democratic processes | [Y/N/U] | |
| H9 | Safety component of an Annex I product (for example machinery, medical devices, toys) | [Y/N/U] | |

If an Annex III area applies, record whether the Article 6(3) exception
may apply (the system performs a narrow procedural task, improves the
result of a completed human activity, detects decision patterns without
replacing human assessment, or performs a preparatory task) and note
that systems that profile natural persons remain high-risk. Any reliance
on the exception must be documented and approved by legal. High-risk
obligations for Annex III systems apply from 2 December 2027 under the
amended timeline; check the current text.

### 6.3 Transparency obligations (Article 50)

| Q | Does the system... | Answer |
|---|---|---|
| T1 | Interact directly with people who may not realise they are dealing with AI (chatbots, voice agents)? | [Y/N/U] |
| T2 | Generate synthetic audio, image, video or text content? | [Y/N/U] |
| T3 | Perform emotion recognition or biometric categorisation (where lawful)? | [Y/N/U] |
| T4 | Generate or manipulate deep fakes, or text published to inform the public on matters of public interest? | [Y/N/U] |

### 6.4 Result of screening

| Category | Outcome |
|---|---|
| Prohibited | [No / Possible, stop and refer to legal] |
| High-risk | [No / Yes / Possible] |
| Transparency obligations | [None / T1 / T2 / T3 / T4] |
| Minimal risk | [Yes, if none of the above] |
| General-purpose AI model obligations | [Relevant only if we place a GPAI model on the market; normally No] |

## 7. Internal risk tier

<!-- Guidance: Combine the AI Act screening with internal factors: impact on people, autonomy, data sensitivity and scale. The tier sets the review depth. -->

| Tier | Criteria | Review depth |
|---|---|---|
| Tier 1, Critical | Possible prohibited practice, or high-risk with fully automated decisions | Executive and legal decision; usually rejected |
| Tier 2, High | High-risk area, or significant effect on people's rights, money or health | Full AI risk assessment, DPIA, red team, validation |
| Tier 3, Medium | Transparency obligations, personal data, customer-facing content | Light risk assessment, privacy and security review |
| Tier 4, Low | Internal productivity, no personal data, human checks all outputs | Register and approved tools only |

Assigned tier: **[Tier 2]**, because [reasoning]. *Example:* "Recruitment
falls under Annex III employment; outputs influence shortlisting of
40,000 applicants a year."

## 8. Required reviews

<!-- Guidance: Mark each review as required or not, with owner and status. -->

| Review | Required | Owner | Status | Reference |
|---|---|---|---|---|
| AI risk assessment | [Yes / No] | [@ai-governance] | [Not started / In progress / Done] | [link] |
| Privacy (DPIA) | [Yes / No] | [@dpo] | [Status] | [link] |
| Security review | [Yes / No] | [@security] | [Status] | [link] |
| Legal (AI Act classification, employment law) | [Yes / No] | [@legal] | [Status] | [link] |
| Vendor assessment | [Yes / No] | [@procurement] | [Status] | [link] |
| Works council or staff consultation | [Yes / No] | [@hr] | [Status] | [link] |
| Fairness evaluation | [Yes / No] | [@data-science] | [Status] | [link] |

## 9. Decision and conditions

<!-- Guidance: Record the decision and any conditions with owners and dates. Conditions should be testable. -->

Decision: **[Approved / Approved with conditions / Rejected / Deferred]**.

| ID | Condition | Owner | Due |
|---|---|---|---|
| *Example:* CON-01 | AI output shown as summary only; no automatic rejection | [@business-owner] | Before go-live |
| *Example:* CON-02 | Recruiters complete human oversight training (AI literacy plan module M05) | [@hr-learning] | Before access |
| *Example:* CON-03 | Quarterly selection-rate ratio report to AI governance | [@data-science] | Quarterly |

| Role | Name | Decision | Date |
|---|---|---|---|
| AI governance lead | [@name] | [Decision] | YYYY-MM-DD |
| Business owner | [@name] | [Accepts conditions] | YYYY-MM-DD |
| Legal (Tier 1 and 2) | [@name] | [Decision] | YYYY-MM-DD |

## 10. Register entry

<!-- Guidance: Add the approved use case to the AI system inventory with its tier and review date. -->

| Field | Value |
|---|---|
| Inventory ID | [AI-SYS-0112] |
| Tier | [Tier] |
| Review frequency | [Annual / Semi-annual] |
| Monitoring plan | [link] |

## Standard and licence note

Based on the risk categories of Regulation (EU) 2024/1689 (the
Artificial Intelligence Act), Articles 5, 6 and 50 and Annex III, as
amended by Regulation (EU) 2026/1744; EU legislative texts are free to
reuse. The screening questions are summaries in original wording and do
not reproduce or replace the legal text; consult the consolidated text
on EUR-Lex and Commission guidelines. This is a screening format, not
legal advice. Template licence: MIT.