AI Tool Approval / Risk Matrix

AI tool approval and risk matrix

A short triage framework for purpose, data, affected people, provider controls, verification and impact.

Educational resource

Template fields

  1. Purpose and benefit
  2. Public / internal / confidential / personal data
  3. Affected person or decision
  4. Provider, account and retention
  5. Human verification
  6. Consequence of error
  7. Owner and deadline
  8. Decision and conditions

Three triage levels

  • Low: public content, limited impact and straightforward review.
  • Medium: internal data or externally used output; conditions and ownership are mandatory.
  • High: sensitive data, HR, significant decisions or hard-to-reverse effects; specialised review before use.

Permitted outcomes

  • Approved
  • Conditionally approved
  • More information required
  • Not approved

Next step

This matrix supports internal triage; it does not certify a tool or replace legal, DPO, HR or security analysis.

General working material. It is not certification, legal advice or a substitute for legal, DPO, HR or security review appropriate to the organisation.