AI Use Assessment Template

Version 2.0 · Updated 2026-09-21 · Assessment

Define and evaluate an AI-enabled GxP use, its decision authority, failure scenarios, human review, evidence, monitoring, and revalidation criteria.

Adapt this template to your intended use, applicable requirements, and approved procedures.

When to use it

Before pilot or production use of machine learning, generative AI, retrieval-augmented generation, or agentic functions in a regulated process.

Information needed before starting

• Defined AI task, users, authority and excluded uses
• Source data, reference cases and model/configuration identifiers
• Acceptance basis, human-review design and supplier responsibilities

Field instructions

• Intended use and AI function: Describe the specific task, users, outputs and decisions supported. Identify the assessed environment and limits of reliance.
• Decision authority and prohibited uses: State what is outside the assessed use or evidence. Explain the consequence and any restriction; do not treat missing information as a pass.
• Data, population, and reference dataset: Describe dataset provenance, representativeness, independent expected results and exclusions. Keep evaluation material separate from development where appropriate.
• Failure scenarios and critical misses: Describe a credible incorrect, missing or delayed result and trace it to the affected process, record or decision. Distinguish severity from how often it could occur.
• Human review design: Define the reviewer’s independent checks, source access, competence and escalation route. Reference evidence that the review detects important errors.
• Performance measures and acceptance criteria: Define the measures, denominators and risk-based acceptance criteria before execution. Report critical misses separately and explain dataset limitations.
• Source verification and data integrity: Identify the authoritative source/version for each relied-on output and the checks preserving provenance, completeness and record meaning.
• Access, audit trail, and supplier responsibilities: Identify the account or role, permitted actions and business justification. Check authorization, inappropriate combinations, inactive accounts and evidence of removal or correction.
• Testing and release conditions: Identify the assessed configuration, representative data, selected activities and expected results. Include abnormal and recovery paths and explain remaining coverage gaps.
• Monitoring, stop, and revalidation criteria: Define changes or events that reopen this assessment, the responsible role and the required response or review date.

Define the AI task and prohibited actions at feature level.

Identify decision authority and realistic failures, including critical misses.

Specify reference data, metrics, acceptance criteria, and human-review effectiveness.

Control model, prompt, retrieval, data, tools, access, monitoring, and change.

Completed fictional example

Fictional teaching example; this is not an executed or approved validation record.

Blank template

System / record ID: ____________________

Prepared by / date: ____________________

Required review / approval under local procedure: ____________________