AI use-case risk triage — suggest a risk tier in 3 minutes

Go to the tool

Describe one AI system or use case and get a suggested VERITRAIL risk tier — Prohibited-review, High, Medium or Low — with the reasoning behind it. Use it at intake to decide how much assessment a use case needs and who should approve it.

The intake

Question	Options
Domain	customer service, internal productivity, credit, employment, healthcare, biometric, education, critical infrastructure, law enforcement, migration, justice, essential services, other
Decision impact	none, advisory, material, automated decision
Affected parties	internal, customers, public, vulnerable groups
Data sensitivity	public, internal, confidential, personal, special-category
Autonomy	none, suggests, acts with approval, acts autonomously
External actions	Can it send messages, update records or move money?
Other factors	Generative AI, vendor model, EU exposure, tools it can access, environment, number of users

Fields you leave blank are listed in the result as missing, so you can see how confident the suggestion is.

The result

Suggested tier and score, labelled Inferred and marked as requiring human confirmation.
Factors that contributed, each with a control citation.
Triggers — for example, a domain that warrants legal review.
Required assessment modules, such as data and privacy, agentic AI or fairness and safety — see Assessment modules.
Suggested approval authority and review cadence.

VERITRAIL controls cited

EI-02 AI risk classification and tieringEnterprise AI Inventory · priority: criticalNIST AI RMF: MAP 1.1, MAP 1.5, GOVERN 1.3ISO/IEC 42001: 6.1.2, A.5.2EU AI Act: Art. 6
EI-12 Use-case intake registerEnterprise AI Inventory · priority: highNIST AI RMF: MAP 1.1ISO/IEC 42001: A.5.2, A.6.1.3EU AI Act: Art. 6
GL-01 Intake triage workflowGovernance & Lifecycle Control · priority: highNIST AI RMF: MAP 1.1, MAP 1.6ISO/IEC 42001: 8.1, A.6.1.3EU AI Act: Art. 9
AO-10 Prohibited and restricted AI use policyAccountability & Operating Model · priority: criticalNIST AI RMF: GOVERN 1.1, MAP 1.1ISO/IEC 42001: A.9.4, A.2.2EU AI Act: Art. 5

Framework mappings are indicative VERITRAIL interpretations (Control Library v1.0.0); they are not legal advice and do not establish conformity or compliance.

Limitations

The triage is a rules-based starting point, not a risk assessment. It cannot see context you do not provide, and it does not determine legal classification. A Prohibited-review result means "stop and get legal review", not that the use case is prohibited.

Next steps

Use the result to route the use case through intake and assessment. If the system is an LLM app or agent, draft its runtime controls with the guardrail generator.

Describe the AI system

Your answers produce a preliminary risk tier labelled Inferred. A tier only becomes authoritative when an accountable approver confirms it.

AI system or use-case name (required)

Use an internal project name. Do not enter personal data.

Intended purpose

One or two sentences about what the system does and for whom.

Does its output inform or make decisions about people?

Who is affected by its outputs?

Most sensitive data it processes

How autonomous is it?

Domain

Tools, APIs or databases it can use

Comma-separated, e.g. crm_read, send_email, issue_refund. Leave blank if none.

Can it act outside your organization (send emails, payments, posts)?

Is it placed on the EU market or does it affect people in the EU?

Does it use a third-party model or vendor AI product?

Is it a generative AI / LLM-based system?

Environment

Loading the tool…

Frequently asked questions

Is the suggested tier the same as EU AI Act high-risk classification?

No. VERITRAIL tiers are an internal governance classification. The triage flags regulatory relevance — for example, domains such as credit, employment or essential services — so that your legal team can assess classification under the EU AI Act or other law.

Why does the result say it requires human confirmation?

Because changing or confirming a risk tier is a governance decision. The triage result is labelled Inferred; an accountable approver must confirm or change it (EI-02).

Last reviewed: 21 October 2026