AI use-case intake and approval

Supporting mappings

AI capacity and cost overrun Medium

Tests the cost case before approval. Usage, latency or spend exceeds what was planned, degrading the service or the budget, without any attacker being involved.

AI-driven social scoring Critical

Ensures every proposed use reaches the screening. An AI system evaluates or classifies people over time on their social behaviour or personal characteristics, and the score leads to detrimental treatment that is out of context or disproportionate.

Biometric categorisation of sensitive attributes Critical

Ensures every proposed use reaches the screening. A biometric categorisation system categorises individuals from their biometric data to deduce or infer race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation.

Exploitation of vulnerable groups by AI Critical

Ensures every proposed use reaches the screening. An AI system exploits vulnerabilities arising from a person's age, disability or social or economic situation to distort their behaviour in a way that causes, or is likely to cause, significant harm.

Incomplete AI inventory High

Every approved use enters the record at source. The organisation cannot list the AI systems and models it builds, buys or uses, so risk assessment, oversight and regulatory duties are applied to only part of what it has.

Individual criminal risk profiling Critical

Ensures every proposed use reaches the screening. An AI system assesses or predicts the risk that an individual will commit a criminal offence, based solely on profiling them or on their personality traits and characteristics.

Missing AI impact assessment process High

Triggers the assessment when a use is proposed. AI systems are deployed without a structured assessment of who they affect, how, and what could go wrong for those people.

Missing DPIA for high-risk AI processing High

Screening at intake identifies processing that needs one. AI processing that is likely to result in a high risk to individuals goes ahead without a data protection impact assessment, or with one that was never updated.

Purpose creep in AI data use Medium

New uses of existing data pass through approval. Data collected for one purpose is used to train or run AI for another purpose that the people concerned would not expect.

Real-time public biometric identification Critical

Ensures every proposed use reaches the screening. Real-time remote biometric identification is used in publicly accessible spaces for law enforcement, outside the three narrow objectives and the authorisation the law requires.

Shadow AI use High

An accessible approval route reduces the incentive to go around it. Staff use AI tools that have not been approved, placing organisational data and decisions outside any control.

Subliminal or manipulative AI techniques Critical

Ensures every proposed use reaches the screening. An AI system uses subliminal, purposefully manipulative or deceptive techniques that materially distort a person's behaviour and cause, or are likely to cause, significant harm.

Untargeted facial recognition scraping Critical

Ensures every proposed use reaches the screening. An AI system creates or expands a facial recognition database through the untargeted scraping of facial images from the internet or from CCTV footage.

Use beyond validated scope High

A new use of an existing model goes through approval. A model approved for one purpose is reused for another, or for a new population, without reassessment.

Workplace and education emotion recognition High

Ensures every proposed use reaches the screening. An AI system infers the emotions of people at work or in education, for a purpose other than medical or safety reasons.