# AI-use review checklist

PrivacyBuilt Editorial

A working starting point for global organisations. Adapt to the processing, role and relevant law; this is educational guidance, not legal advice or a compliance determination.

- [ ] Describe the use case, intended users and accountable owner.
- [ ] List inputs, outputs and any personal, confidential or sensitive data.
- [ ] Confirm purpose, relevant legal basis and applicable restrictions.
- [ ] Review provider terms, training use, retention and deletion.
- [ ] Map access, integrations, recipients and international transfers.
- [ ] Evaluate necessity, alternatives and data minimisation.
- [ ] Assess errors, bias, individual impacts and human oversight.
- [ ] Screen whether a DPIA or other impact assessment is required.
- [ ] Record controls, unresolved questions and escalation owners.
- [ ] Document the review decision, conditions and review date.

## Review record

Owner:
Scope:
Evidence references:
Open questions:
Decision and conditions:
Next review:

Avoid entering personal data, credentials or confidential source material in public tools.