Question 1

What makes an AI use case high-risk?

Accepted Answer

An AI use case is high-risk when it directly affects individuals (hiring, credit, healthcare, legal decisions), involves personal data processed at scale, or operates without human review. The EU AI Act specifically designates certain categories as high-risk requiring conformity assessment.

Question 2

What does a Critical risk rating mean?

Accepted Answer

Critical means AI is making decisions that affect individuals with no human review in the loop. GDPR Article 22 restricts decisions based solely on automated processing that significantly affect people, and Article 14 of the EU AI Act requires high-risk systems to be designed for effective human oversight. Add a human review step before scaling this use case.

Question 3

How do I use this assessment for compliance?

Accepted Answer

Download the CSV to create an AI register — a record of your AI use cases, their risk levels, and mitigations. Use it as evidence of due diligence. Then use the Policy Generator to create an AI acceptable use policy covering your specific use cases.

Question 4

What is an AI register?

Accepted Answer

An AI register is a log of every AI system your organization uses, documenting what it does, what data it processes, who is responsible, and what controls are in place. The NIST AI RMF calls for mechanisms to inventory AI systems (GOVERN 1.6), and the EU AI Act separately requires providers to register Annex III high-risk systems in an EU database. The CSV download from this tool gives you a starting point.

Rate your AI use cases

What does your team use AI for?