AI Risk Review Template

Purpose: Provide a reusable intake and risk review template for new AI tools, AI applications, AI vendors and agentic AI workflows.

Audience: AI product owners, solution architects, security reviewers, GRC.

AI Risk Review Intake

Project / Tool Name:
Business Owner:
Technical Owner:
Security Reviewer:
Vendor / Platform:
AI Use Case:
Deployment Model:
Users / Departments:
Data Types Processed:
Data Classification:
External Processing Required: Yes / No
Custom AI Application: Yes / No
RAG / Retrieval Used: Yes / No
Agentic Tool Calling Used: Yes / No
Production Target Date:

Required Review Questions

What data will be submitted to the AI system?
Will users upload documents, code, logs, images or spreadsheets?
Are prompts or uploads retained by the vendor?
Is customer or employee data processed?
Is source code or infrastructure data involved?
Are AI APIs integrated with enterprise applications?
Does the AI system retrieve data from internal repositories?
Can the AI system perform actions, call tools or trigger workflows?
Are prompts, responses, source documents and tool calls logged?
Can audit evidence be exported for investigation?
Where is data processed and stored?
Is customer data excluded from model training?

Approval Decision

Approved / Conditionally Approved / Rejected:
Conditions:
Required Controls:
Residual Risk:
Risk Owner:
Review Date:
Next Review Date: