Review an AI use case before relying on it

Start with one concrete use

Describe the task and affected people. Identify the actual service, provider, version and intended users. Use a separate intake when the purpose or data boundary changes materially; an approved provider is not permission for every use.

Define boundaries before a decision

Record permitted and prohibited information, output review, restrictions, provider terms, policy and recordkeeping references. Use categories and references instead of client records or sample prompts containing confidential information.

Keep unknowns visible

Use the focused questions to record evidence and limitations. Do not treat a vendor statement as proof that your configuration matches it. A decision not to permit use can be recorded without pretending every question is resolved.

Review permission deliberately

A downloaded or imported decision is a proposal. In an enabled firm program, assign an active owner and request review. A designated reviewer approves the preserved version. Conditional use needs specific limits, tracked follow-up and a bounded expiry.

Maintain the register

The firm register shows approved versions separately from drafts, expired conditions and superseded cycles. Reassess changed models, terms, data or integrations. Link the same firm inventory and findings used in vendor, policy and risk reviews; their approvals remain separate. The register neither discovers shadow AI nor blocks a service.

Source & applicability

NIST-AI — AI Risk Management Framework 1.0

Govern, Map, Measure and Manage inform AI policy and use-case review prompts. Voluntary framework. This release uses version 1.0; NIST indicates revision work is underway. The policy builder is not a complete AI governance system.

SEC-registered and state-registered firms may have different obligations. Have the appropriate professionals review what applies to your firm. No regulatory determination is made here.