AI Intake, Approval and Use Case Review Processes

Introduction

Within the ISACA Advanced in AI Risk (AAIR) domain on AI Risk Governance and Framework Integration, one of the most practical and frequently tested concepts is how an organization controls the entry point for AI into the enterprise. AI intake, approval and use case review processes are the structured gateways through which proposed AI systems, models, tools and use cases are identified, documented, assessed for risk, approved (or rejected), and tracked throughout their lifecycle. Think of this as the front door of AI governance: if the front door is unlocked or missing, every downstream control such as monitoring, testing, bias evaluation and incident response is undermined because the organization does not even know what AI it is running.

Why It Is Important

1. Visibility and inventory. You cannot govern what you cannot see. Intake is the primary mechanism that feeds the enterprise AI inventory (sometimes called an AI register or model inventory). Without a formal intake step, shadow AI proliferates as business units adopt generative AI tools, embedded vendor AI features and self-built models without any risk review.

2. Proportionate, risk-based control. Not every AI use case deserves the same scrutiny. A spam filter and an automated credit-decisioning model carry very different risk profiles. Intake and triage allow the organization to classify use cases into risk tiers and apply controls proportionate to potential harm, which is a core principle in ISO/IEC 42001, the NIST AI Risk Management Framework (Govern and Map functions) and the EU AI Act risk-tier approach.

3. Regulatory and legal exposure. Many regulations now require organizations to identify high-risk AI, perform impact assessments, maintain documentation and demonstrate human oversight. A documented intake and approval trail is often the primary evidence that these obligations were met before deployment.

4. Alignment with strategy and ethics. Use case review ensures that AI initiatives align with organizational values, acceptable use policies, risk appetite and business objectives. It prevents technically feasible but ethically or reputationally damaging deployments.

5. Accountability. Approval processes assign clear ownership. Every approved AI system should have a named business owner, a technical owner and an approving authority, creating a chain of accountability that auditors and regulators expect.

6. Cost and resource discipline. Intake screens out duplicative or low-value projects and ensures data, infrastructure and compliance resources are directed toward use cases with a sound business case.

What It Is

The process is typically broken into three interlocking components:

AI Intake is the identification and registration stage. Any individual or team proposing to build, buy, integrate or materially change an AI capability submits a standardized intake request. The intake form captures essential information such as business purpose, intended users, affected stakeholders, data sources (including personal or sensitive data), model type (predictive, generative, agentic, third-party API), degree of autonomy, whether decisions affect individuals, and the vendor or build approach.

Use Case Review is the assessment stage. Reviewers evaluate the proposed use case against defined criteria including legal and regulatory requirements, privacy, security, fairness and bias, explainability needs, safety, intellectual property, data provenance, third-party risk, and alignment with the organization's AI principles and acceptable use policy. The output is a risk classification and a set of findings or required conditions.

Approval is the decision stage. An authority appropriate to the risk tier makes a go, no-go, or conditional-go decision. Low-risk uses may be approved by a delegated manager or automatically via pre-approved patterns; high-risk uses escalate to an AI governance committee, ethics board, or executive risk committee. Approval is documented, time-bound and subject to re-review when triggers occur.

How It Works: The End-to-End Flow

Step 1: Policy foundation. The organization defines an AI policy and acceptable use policy that mandate intake for all AI use, define what counts as AI, define risk tiers and state who may approve at each tier. Clear scoping prevents arguments about whether a spreadsheet macro or a vendor's embedded recommendation engine is in scope.

Step 2: Submission and registration. The requester completes the intake form, often in a GRC tool, ticketing system or dedicated AI governance platform. The request is logged in the AI inventory with a unique identifier and status of proposed.

Step 3: Triage and initial risk screening. A governance function (often the AI risk office, second line, or a designated AI governance lead) performs a rapid screen using a questionnaire. Key triage questions include: Does the system make or materially influence decisions about people (employment, credit, healthcare, access to services)? Does it process personal, sensitive or regulated data? Is it customer-facing? Is it generative or agentic with autonomous action capability? Is it subject to sector regulation? Does it involve a third party? Answers map to a preliminary risk tier such as minimal, limited, high or prohibited.

Step 4: Tier-based review path.
- Minimal or low risk: lightweight review, often a checklist and manager sign-off; may use pre-approved patterns (for example, an enterprise-approved generative AI assistant used with non-confidential data).
- Moderate or limited risk: review by AI governance analysts plus relevant specialists (privacy, security, legal), with documented controls.
- High risk: full assessment including an AI impact assessment or algorithmic impact assessment, data protection impact assessment, bias and fairness evaluation plan, explainability requirements, human oversight design, security threat modeling and third-party due diligence; approval by the AI governance committee or equivalent senior body.
- Prohibited: uses that conflict with law or the organization's AI principles (for example, covert social scoring or manipulative techniques) are rejected at triage.

Step 5: Multidisciplinary review. Reviewers typically include legal and compliance, privacy, information security, data governance, model risk management, ethics or responsible AI specialists, procurement for third-party components, and the business sponsor. Each reviewer records findings, required mitigations and residual risk.

Step 6: Decision and conditions. The approving authority issues one of: approved, approved with conditions (for example, pilot only, restricted data, mandatory human-in-the-loop, monitoring thresholds, re-review date), deferred pending more information, or rejected. Decisions, rationale and dissent are recorded to create a defensible audit trail.

Step 7: Handoff to lifecycle controls. Approval conditions become requirements for development, validation, deployment and monitoring. The AI inventory status moves to approved and later in production, and the record links to model documentation such as model cards, data sheets and test results.

Step 8: Change-triggered re-review and periodic recertification. Material changes such as a new data source, new user population, expanded decision scope, model retraining with different behavior, vendor model version changes, or new regulation trigger a return to intake or a focused re-review. Periodic recertification (for example annually for high-risk systems) confirms the use case remains appropriate and controls remain effective. Decommissioning is also recorded.

Key Design Elements Examiners Expect You to Know

- Single mandatory entry point: all AI, whether built, bought, open-source, or embedded in SaaS, must pass through intake.
- Risk-based tiering: proportionality is the guiding principle; a one-size-fits-all heavy process creates bottlenecks and drives shadow AI.
- Defined approval authorities: a matrix mapping risk tier to approver, aligned with risk appetite and delegation of authority.
- Integration with existing processes: intake should plug into procurement, third-party risk management, privacy impact assessment, security architecture review, change management and project portfolio management rather than operate as a silo.
- Documentation and traceability: every decision is evidenced; the inventory is the system of record.
- Stakeholder and impact focus: review considers affected individuals, groups and society, not only the enterprise.
- Metrics: cycle time, percentage of AI in inventory that went through intake, number of shadow AI discoveries, proportion of use cases by tier, conditions overdue, and recertification completion rates.
- Three lines alignment: first line (business) owns and submits; second line (AI risk, compliance) designs the process and reviews; third line (internal audit) independently assesses the effectiveness of intake and approval.

Common Weaknesses and Red Flags

- Intake is voluntary or only covers in-house development, missing vendor AI features.
- Approvers lack independence or expertise (for example, the business sponsor approves their own use case).
- No re-review trigger, so models drift in scope without governance.
- Approval conditions are recorded but never verified before go-live.
- Process is so slow that teams bypass it, creating shadow AI.
- Intake form asks technical questions only and ignores impact on individuals, fairness and explainability.
- Inventory and intake records are disconnected, so the organization cannot reconcile what was approved with what is running.

How to Answer Exam Questions on This Topic

The AAIR exam favors scenario-based questions asking for the best, most important, first, or primary action or control. Apply the following reasoning pattern:

1. Identify the lifecycle stage. If the scenario is about a proposed or newly discovered AI use, the answer almost always involves intake, registration in the inventory, or a risk classification step before anything else.

2. Apply proportionality. If the question describes a low-risk internal tool and offers a full ethics board review as an option, that is usually a distractor; choose the risk-based, tiered response. Conversely, if the use case affects individuals' rights or is high-risk, choose the option involving comprehensive impact assessment and senior committee approval.

3. Favor governance over technology. When asked how to address shadow AI, the best answer is typically establishing a mandatory intake process, acceptable use policy and inventory, supported by discovery tooling, rather than simply blocking tools or buying software.

4. Look for the root cause. If approved conditions were not implemented, the weakness is the lack of a verification gate before deployment, not the design of the conditions.

5. Think in terms of the three lines. The business submits and owns; the AI governance or risk function reviews and tracks; internal audit provides assurance. Questions asking who should approve a high-risk use case point to an independent governance committee, not the project sponsor.

6. Remember triggers. Questions about a model being repurposed, retrained with new data, or expanded to a new population signal that a re-review through intake is required.

7. Documentation is evidence. When asked what best demonstrates compliance or supports an audit, choose the documented intake record, risk classification and approval rationale.

Exam Tips: Answering Questions on AI Intake, Approval and Use Case Review Processes

- Tip 1: First means inventory and classification. If asked what should happen first when a new AI use case is proposed or discovered, the answer is to register it and assess its risk tier, not to test, deploy, or buy tooling.
- Tip 2: Scope includes bought and embedded AI. Any answer that limits intake to internally developed models is incomplete. Vendor, SaaS-embedded, open-source and generative AI tools are all in scope.
- Tip 3: Match the approver to the risk. High-risk and high-impact use cases require an independent, cross-functional, senior approving body. Low-risk cases should be streamlined.
- Tip 4: Conditional approval is a legitimate outcome. Options that allow a pilot with restrictions, human oversight and a re-review date are often the best balanced answer when risk is moderate and benefits are clear.
- Tip 5: Integration beats duplication. Prefer answers that embed AI intake into existing procurement, privacy, security and change management workflows over creating isolated parallel processes.
- Tip 6: Shadow AI is a governance failure first. The primary remedy is policy, mandatory intake and awareness; technical discovery supports but does not replace governance.
- Tip 7: Material change equals re-intake. Watch for words such as repurposed, expanded, retrained, new vendor version, or new jurisdiction; these indicate the need to revisit approval.
- Tip 8: Impact on people is central. Review criteria should include fairness, explainability, safety and rights of affected individuals, not only technical and financial factors. Answers that omit stakeholder impact are weaker.
- Tip 9: Independence matters. A business owner approving their own high-risk use case is a segregation of duties failure. Choose options that provide independent review.
- Tip 10: Evidence and traceability. When a question asks about audit readiness, regulatory demonstration, or accountability, the answer involves documented intake records, decision rationale and linkage to the AI inventory.
- Tip 11: Avoid absolutes. Options that say block all AI, approve everything automatically, or require board approval for every use case are rarely correct; the exam rewards risk-based, proportionate, repeatable processes.
- Tip 12: Connect to frameworks. Recognize that intake and use case review operationalize the NIST AI RMF Govern and Map functions, ISO/IEC 42001 planning and impact assessment requirements, and EU AI Act risk classification. Answers aligned to these framework concepts are generally the intended correct choices.

Summary

AI intake, approval and use case review processes form the gateway of AI governance. They create visibility through a mandatory single entry point and inventory, apply proportionate scrutiny through risk tiering, assign accountability through defined approval authorities, and preserve control over time through conditions, change triggers and recertification. On the AAIR exam, success depends on recognizing that the best answers emphasize registering and classifying first, scaling review to risk, ensuring independent and multidisciplinary approval for high-impact uses, integrating with existing enterprise processes, and maintaining documented, traceable evidence from proposal through decommissioning.