Most businesses already have a template for technology investment: a description, strategic fit, a value tree, a cost breakdown, an evaluation framework and a prioritisation matrix. It was written before AI, and it has no place to record the things that decide whether an AI system is safe to run. Rather than inventing a parallel process, add four fields. They take a paragraph each, they map onto the EU AI Act’s structure, and they turn governance from a gate at the end into part of the decision.
1. Risk category
Minimal, limited or high, using the EU AI Act’s classification whether or not the Act applies to you, because it is the clearest vocabulary available. Most everyday business uses are minimal. Customer-facing assistants are limited, with a transparency duty. Anything that is a safety component, or that affects a person’s access to credit, employment, education or essential services, is high, with documentation, risk management and human-oversight obligations.
Filling it in forces the question early. A use case that turns out to be high risk is not a reason to stop; it is a reason to budget for the obligations and to design the oversight in from the start.
2. Data protection
What data the system uses, where it lives, who can see it, and under what terms it leaves the business. For an enterprise assistant: the no-training commitment in the licence, the data classification that applies, the DLP controls. For a built system: the data flows, the retention, the access filtering on retrieval. For anything touching personal data: the lawful basis and the data-protection assessment.
This field is where most blanket blocks on AI tools quietly dissolve, because written down, the enterprise terms answer the concern that drove the block.
3. Human oversight
Who decides, what the system may do alone, and what happens when it is unsure. For a copilot: the person decides everything. For an agent: the confidence threshold, the escalation path, and who reviews the escalations. For anything high risk: the documented oversight the Act requires. If this field cannot be filled in, the use case is not ready to build, whatever its priority score.
4. Transparency
Who is told that AI is involved, and how. Customers interacting with an assistant must know it is AI and how to reach a person. Staff using AI output need to know its provenance and its confidence. Generated content needs labelling where the audience would expect it. Transparency is the cheapest control on the list and the one most often forgotten.
How they fit the rest of the template
| Existing section | What the four fields add |
|---|---|
| Evaluation framework | Risk classification and mitigation plan |
| Value tree | Workforce impact and compliance value |
| Total cost of ownership | Compliance, audit and oversight cost |
| Strategic fit | A responsible-AI check against the business’s stated principles |
Why four and not forty
Because they get filled in. A governance questionnaire of forty items is skipped or delegated; four paragraphs are written by the person who owns the use case and read by the people who approve it. In discovery programmes we fill them in for every consolidated use case as standard, and the finding in most businesses is reassuring: the existing governance structure is already well aligned, and AI can be adopted without reinventing decision-making. The four fields are what make that true in practice.
They are part of the convergence scorecard, and the governance service that supports them is under AI governance and the EU AI Act.