Intake
The sponsor submits the intended task, tool, data types, users, source material, recipient of the output and proposed human review. “Everyone who wants to be more productive” is an audience, not a use case. A demonstration using invented data may proceed only under the applicable demonstration rules.
Security and legal review
IT Security reviews identity, data movement, access, logs and integration. Legal reviews rights, disclosures, privilege and the proposed reliance on the output. Records determines what must be kept. Internal Audit considers whether the process can be reconstructed after the project team moves on.
Pilot and operation
The business tests sample inputs, including a case the model should refuse or flag. The pilot records incorrect outputs and the time required to catch them. Approval for wider use names the person who owns the ongoing checks, the conditions for pausing use and the date for reassessment.
Change control
A new model, external connector, document source or audience can change the approved risk. The owner submits a change before expanding use. Renaming the use case in the register does not preserve an approval that no longer describes what colleagues are doing.
