Source Map
Where each answer lives, organized by who holds it.
Use this to plan your conversations. Take the relevant section to each person rather than asking everyone everything.
Start Here — Your Own Files
Check these before you ask anyone anything.
- AI approval or governance request for this tool
- Procurement file
- Security review documentation
- Contract and any processing agreement
- Implementation or kick-off materials
- Prior assessments for similar processing
- The published privacy notice
- The retention schedule
- Asset or system inventory
A surprising amount is already in the building. Asking people for information you already hold costs you credibility the second time you do it.
The Business Lead
What they hold:
| Question | Notes |
|---|---|
| What the tool does for the team | |
| What data it works with | |
| What the output drives, and who acts on it | |
| Who is affected — employees, customers, patients | |
| Whether it runs without being triggered | Often in the business case |
| Whether other teams use the same tool | Catches parallel deployments |
Also worth asking: who in IT supports you on this? That gets you the next conversation without hunting.
IT and Information Security
What they hold:
| Question | Notes |
|---|---|
| What systems the tool connects to | |
| What it can access beyond what was described | Ask specifically |
| Where it is hosted | Region matters, not just provider |
| Whether it operates on a schedule | |
| What integrations were configured | |
| Existing security measures | |
| Whether data leaves the region |
The gap this closes: the business lead describes what they put in. IT tells you what the tool can reach.
Human Resources
Often overlooked, and holds the answer to the question people get wrong most.
| Question | Notes |
|---|---|
| Where employees are located | By state and country |
| Remote workers outside the main locations | One is enough to change the analysis |
| Whether the tool touches employee data | |
| Employee representative arrangements | Needed for some assessments |
| Training records for this tool |
Sales, Service, and Marketing
Where the customer footprint actually lives.
| Question | Notes |
|---|---|
| Where customers or members are located | |
| Where support requests originate | |
| Where applicants come from | Talent or recruiting |
| Whether targeted advertising is involved | Marketing or ad operations |
| What data flows to advertising platforms |
Procurement and Legal
| Question | Notes |
|---|---|
| Is there a signed data processing agreement | |
| Does it name this service | Not just this vendor |
| Transfer safeguards for EU or UK data | |
| Contract renewal date | Triggers a review |
| Whether a "sale" or "share" is occurring | Legal call |
| Any exclusions being relied on | Document the basis |
The Privacy Function
If that is not you, it is whoever owns the program.
| Question | Notes |
|---|---|
| Lawful basis for this processing | |
| Condition for sensitive categories | |
| Privacy notice coverage for this use | |
| Prior impact assessments | Reuse the factual sections |
| Documented risk classification | |
| How rights requests are handled |
Records Management
| Question | Notes |
|---|---|
| Retention rules for this data | |
| Whether the schedule names this system | Existence is not coverage |
| Deletion process |
The Vendor
Check published documentation first. See Worksheet 3 for how to ask.
| Question | Notes |
|---|---|
| Model training on your data | |
| Retention of prompts, inputs, outputs | |
| Whether prompts are logged | |
| Sub-processors | Usually a linked page, not the contract |
| Hosting region | |
| Security certifications |
Finance
Only needed for threshold questions.
| Question | Notes |
|---|---|
| Annual gross revenue | Some state laws turn on this |
| Number of consumers whose data is processed | |
| Revenue from selling personal information |
When Nobody Has It
Record it as unresolved, not as a no. Then fix the process that should have captured it.
| Missing field | Which process should capture it | Owner |
|---|---|---|
Common fixes:
- Add data categories to the AI request form
- Add training and retention questions to the vendor questionnaire
- Record hosting region on the asset record
- Capture affected population at approval
- Ask where users are located at onboarding
The next deployment should arrive with these answers attached.
Use and reuse
Free to use, share, and adapt within your organization. Attribution appreciated, not required. No warranty of any kind — this is practitioner guidance, not legal advice, and sufficiency is determined by your counsel.
LegisGate · Regulatory Intelligence for AI Deployments · legisgate.com
Written by compliance and audit practitioners who spent decades on the other side of the table.
Version 1.0 · Current as of August 2026 · Verify time-sensitive claims against current sources before relying on them.