# AI use-case register template

One row per concrete use, not one row per vendor brand. Keep this register private when it contains internal system information.

| ID | Purpose/task | Business owner | Users/output audience | Data classes/minimization | Product/plan/workspace/features | Sources/tools/access | Proposed route/status | Human reviewer/action authority | Usage/spend limits | Evidence/gaps/next action |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| [ID] | [purpose] | [role] | [scope] | [minimum input] | [exact arrangement] | [bounded scope] | [permitted/restricted/prohibited; approved?] | [who/what] | [limits] | [dated evidence or UNKNOWN] |

## Separate control record per use
Training/feedback use: [policy + verified configuration + exceptions]
Retention: [data category -> duration/condition -> source -> verified?]
Storage location: [data category/region/feature coverage; UNKNOWN if not established]
Processing location: [coverage/route; separate from storage]
Access: [roles, administrators, support, provider/subprocessors and connected systems]
Deletion: [scope, process, UI versus backend evidence, exceptions, backups/third parties if applicable]
Data-flow manifest: [source -> local/export -> prompt/file/retrieval -> processing/tool -> output -> logs/backups/support as applicable]
Applicable obligations and review: [responsible reviewer; do not infer a legal verdict]
Decision/approval evidence: [who/date/scope; UNAPPROVED if absent]
Control checks actually performed: [result/date/evidence; planned checks remain planned]
Open gaps: [owner/required evidence/next action/deadline or UNSET]
Review trigger: [change/incident/date]

Cross-border review: identify storage/processing coverage, relevant entities/subprocessors/support access and applicable disclosure obligations. Contractual/technical controls are not guarantees against all access. Responsible reviewer: [role]; evidence: [source or UNKNOWN].