Intake Preparation

Use this before you fill in an intake. Work through it, note where each answer came from, and flag anything you could not establish.

One worksheet per deployment. One tool, used one way. If the description contains "and also," you likely have two.

---

The Seven That Matter Most

You will not have every answer. You do not need them to start.

These seven determine whether the analysis is right at all. Get them properly, and the worksheet is usable even if the rest is incomplete.

• The tool
• The use case
• Where the affected people are
• Your industry
• What data it sees
• Who it affects — employees or the public
• Whether it decides about people

Everything else narrows the picture. Without it, more frameworks stay possible and more items sit unresolved. That is a wider result, not a wrong one.

Mark what you cannot establish as unresolved. Do not guess to fill the gap.

---

Before You Start

Check what already exists:

• AI approval or governance request for this tool
• Procurement file
• Security review documentation
• Contract and any processing agreement
• Implementation or kick-off materials

If a governance record exists, note its date: ________________

Under six months — use it as a starting point, verify the regulatory fields. Over six months — re-baseline it.

---

Part 1 — The Deployment

Use case — describe in plain language:

What the team does with it, what data goes in, what the output drives.

---

---

---

Check: does this description contain more than one process?

• Single use — continue
• Multiple uses — stop, split into separate worksheets

---

Part 2 — Where the People Are

Not where your office is. Where the affected people live.

Specific checks:

• Any employee working remotely from another state or country
• Any customer or member outside your main operating states
• Any European resident, even one
• Any UK resident, even one

---

Part 3 — The Data

What the tool sees or uses:

• Names, contact details, identifiers
• Government or tax identifiers
• Health information
• Biometric data used to identify someone
• Financial account or transaction data
• Employment records
• Behavioural signals — usage, patterns, interactions
• Precise location
• Children's data
• Other sensitive categories: ________________
• None of the above

Additional:

---

Part 4 — People and Decisions

Vulnerable populations in scope:

• Patients or healthcare recipients
• Children under 18
• Elderly individuals
• People with disabilities
• People in financial vulnerability
• Employees or workers
• None

---

Part 5 — The Vendor

Check published documentation first. Email the vendor contact if it is not there.

If the vendor's answer conflicts with the contract:

• Conflict noted
• Handed to procurement
• Aligned answer received

---

Part 6 — Controls

For every "yes," ask: show me how you can prove that.

Acceptable evidence — a document, a link, a configured setting, or a named owner.

On human review, be specific:

• Every time, before it affects anyone
• Sometimes — describe: ________________
• After the fact only
• None
• Unresolved

On the last column. A policy existing is not the same as it covering this deployment. Check whether the retention schedule names this system, whether the privacy notice describes this processing, whether the agreement names this service.

---

Part 7 — Before You Submit

Verification pass:

• Every answer has a source noted
• Anything I could not establish is marked unresolved, not "no"
• I spoke to the business lead
• I spoke to IT about connections and hosting
• The use case describes one process, not several
• The footprint reflects where people are, not where we are
• Nothing here is an assumption I have not confirmed

Unresolved items — list them:

---

After You Submit

If any field could not be answered from existing records, fix that going forward:

• Add the missing fields to the AI request form
• Add vendor training and retention questions to the vendor questionnaire
• Record hosting location on the asset record
• Capture the affected population at approval, not afterwards

The next deployment should arrive with these answers already attached.

---

Completed by: ________________

Date: ________________

Deployment reference: ________________

---

Use and reuse

Free to use, share, and adapt within your organization. Attribution appreciated, not required. No warranty of any kind — this is practitioner guidance, not legal advice, and sufficiency is determined by your counsel.

LegisGate · Regulatory Intelligence for AI Deployments · legisgate.com

Written by compliance and audit practitioners who spent decades on the other side of the table.

Version 1.0 · Current as of August 2026 · Verify time-sensitive claims against current sources before relying on them.