AI use-case triage form

What this is#

The artefact of the decision test in EU AI Act for security governance: one row per AI use case, one decision per row. Twenty-two columns carry the reasoning; column S carries the answer: proceed, proceed with conditions, or stop. Two columns do most of the work. Role decides whose duties apply, and class decides how heavy they are ¹. An inventory without those two answers settles nothing.

How to use it#

1. Delete the three example rows on the Triage sheet before the first entry.
2. Fill columns A to E from the business. The use case is what the system is used for, not what it is called. See the briefing, questions 1 and 2.
3. Run the Article 5 screen in column F. Every generative use is checked against the two points added to Article 5(1), which apply from 2 December 2026 ². A stop here ends the row.
4. Work columns G to J in order. The Annex I product path and the Annex III area path are separate tests, and a carve-out under Article 6(3) is documented before the system is placed on the market ³. See the briefing, question 4.
5. Record transparency and model facts in columns K to M. Article 50 duties reach systems that are not high-risk ⁴.
6. Fill the security columns O to Q. The threat baseline column tracks the five threats named in Article 15(5); the logging column tracks the six-month floor a deployer keeps ⁵.
7. Set the applicable date in column R, then the decision, conditions, owning role and review date. A condition without an owner and a date is a wish.

What good looks like#

Six of the twenty-two columns, from the workbook.

ID	Use case	Our role	High-risk	Art. 5 screen	Decision
T-001	Screening and ranking of job applications	Deployer	Yes	Pass	Proceed with conditions
T-002	Support assistant drafting replies for agents	Deployer	No	Pass	Proceed with conditions
T-003	Marketing tool generating pictures of people	Deployer	No	Stop, pending safeguards	Stop

Fields#

Field	Required	Meaning	Common mistake
Our role	yes	Provider, deployer, importer, distributor or product manufacturer	Reading provider duties onto a deployer
Art. 5 screen	yes	Pass or stop, against the prohibited practices	Screening the product, not each generative use
Annex I path, Annex III area	yes	The two high-risk routes, tested separately	Testing one and calling the row done
Art. 6(3) carve-out	if claimed	The documented reason a listed system is not high-risk	Claiming it without writing the assessment
Art. 15 threat baseline	yes	Yes, partial or no, against the five named threats	Recording a generic security review
Applicable date	yes	When the duties in this row start	Using the general date for an Article 6(2) system
Decision, Conditions, Owner, Review	yes	The answer, its conditions, who holds it, when it is reread	A decision with no owner or date

Download#

• File: ai-use-case-triage.xlsx (xlsx, 10 KB) — sheets Triage and Read first.
• Markdown variant: the same two sheets in plain markdown, at content/templates/assets/_ai-use-case-triage.md.
• Licence: CC BY 4.0 — reuse and adapt with attribution to GRCIDE.
• Version: 1.0, 2026-09-05. No personal data and no organisation names; the example rows are invented.

Related#

• Briefing: EU AI Act for security governance
• Engagement pattern: AI governance stand-up under the EU AI Act
• Radar: High-risk dates deferred, two prohibitions added

References#

1. European Parliament and Council. Regulation (EU) 2024/1689 (AI Act), consolidated text of 27 July 2026. CELEX 02024R1689-20260727. OJ L, 2024/1689, 12.7.2024. Read at the Publications Office Cellar, 2026-09-05. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:02024R1689-20260727
2. European Parliament and Council. Regulation (EU) 2026/1744 (Digital Omnibus on AI). OJ L, 2026/1744, 24.7.2026. https://eur-lex.europa.eu/eli/reg/2026/1744/oj/eng

Standards and certification names are the property of their respective owners. GRCIDE is an independent publication, not affiliated with, authorized, sponsored or endorsed by ISO, IEC, NIST or any other standards body.