Category 1
Workflow Scope & AI Use
What AI workflow is in scope, and how is AI used within it?
2 evidence items
No unresolved reviewer questionsThis is a demo Evidence Room for a fictional company called Acme AI. It shows what an AI Evidence Review intake looks like across the five governance categories.
Acme AI
enterprise customer AI readiness review
Checklist overview
Category 1
What AI workflow is in scope, and how is AI used within it?
2 evidence items
No unresolved reviewer questionsCategory 2
What is it authorized to do, and what limits apply?
1 evidence item
No unresolved reviewer questionsCategory 3
What evidence shows it is fit for that authorized use?
1 evidence item
Category 4
How do we know it stays within its limits over time?
1 evidence item
No unresolved reviewer questionsCategory 5
What happens when it fails, causes harm, or exceeds its limits?
1 evidence item
No unresolved reviewer questionsKeep the workflow context accurate so contributors and reviewers are working from the same scope.
Category 1
What AI workflow is in scope, and how is AI used within it?
Helpful evidence may include workflow description, process map, system diagram, data-flow note, AI tool/vendor/model list, product screenshots, prompt or instruction summary, retrieval/source description, user roles, customer-facing description, architecture notes, dependency list, launch or rollout notes.
Category 3
What evidence shows it is fit for that authorized use?
Helpful evidence may include evaluation plan, test plan, test results, red-team or adversarial testing summary, prompt/output samples, representative case set, issue log, acceptance criteria, launch checklist, release gate, readiness memo, subject-matter expert review notes, known limitations, residual risk note, sign-off record, remediation record.
Category 4
How do we know it stays within its limits over time?
Helpful evidence may include monitoring plan, logs or log summaries, dashboard screenshots, review cadence, alert rules, issue/ticket process, human review queue, feedback process, override records, complaint records, change log, release notes, prompt/version history, model/vendor update review, periodic review notes, owner responsibilities.
Category 5
What happens when it fails, causes harm, or exceeds its limits?
Helpful evidence may include AI-specific incident procedure, general incident process with AI addendum, escalation matrix, severity criteria, pause/rollback procedure, customer communication process, support ticket workflow, issue intake process, remediation tracker, incident review notes, postmortem template, prior incident or near-miss records, root-cause analysis, retesting record, workflow change record.
The red-team and eval summary is useful, but does not show who accepted the result as ready for the authorized use. Is there a separate release gate, approval note, readiness memo, or decision record?