Turn the discovery results into a manageable worklist. The objective is not to label everything immediately; it is to identify what needs attention first and who should investigate it.
Purpose
Agree a proportionate priority order, assign owners and identify issues that need specialist review.
Recommended timing
Weeks 4–5 · Indicative timing. Adjust to the organisation’s size, complexity and available capacity.
What to do
- Check inventory entries for a clear purpose, business owner, supplier/tool, affected people and information used.
- Group duplicate entries where teams use the same tool for the same purpose, but preserve differences in purpose, data or context.
- Use the screening prompts to identify possible legal, safety, privacy, security, discrimination, employment or consumer-impact concerns.
- Flag uncertainty. Do not treat a questionnaire answer or automated score as a legal classification.
- Prioritise uses with potential impact on people’s rights or opportunities, sensitive data, consequential decisions, limited human oversight, unclear supplier terms or safety implications.
- Assign an owner and next action to every priority item. Escalate urgent concerns promptly.
Meetings to arrange
Use these default meeting formats. Combine meetings or shorten them where the same people are involved and the decisions can be made together.
Inventory and triage review
Duration: 60 minutes
Attendees: Programme lead, IT, security, privacy, risk/compliance and relevant business owners.
Agenda: Review coverage, resolve duplicates, identify missing facts and agree which uses need deeper assessment.
Expected output: Reviewed inventory, gaps list and proposed priority categories.
Prioritisation workshop
Duration: 75–90 minutes
Attendees: Programme lead, risk/compliance, privacy, legal, security and owners of priority use cases.
Agenda: Discuss significant or uncertain uses, agree escalation, assign specialist reviewers and set deadlines.
Expected output: Approved follow-up worklist with owners, due dates and escalation decisions.
Decisions to make
- Which use cases require immediate escalation?
- Which require a more detailed assessment before continued use or expansion?
- Which can proceed under ordinary internal controls while further information is collected?
- Which supplier contracts, product settings or data practices need review?
Definition of done
- Prioritised AI use-case list.
- Named owners and due dates for follow-up.
- Specialist review requests where needed.
- Documented rationale and unresolved questions.
Keep it proportionate
Use existing roles, committees and processes wherever they work. Do not create a new approval layer or collect more information than is needed to make a sound decision.
Resources to use
Use the relevant Lucentreg resources at this point in the programme: the communications templates, simplified AI usage questionnaire, integrated governance workbook, assessment guidance, policy template, committee terms of reference and worked examples. Download blank resources, then maintain completed records in your organisation’s own approved environment; Lucentreg does not need to receive your operational data.
Important: Lucentreg provides educational and operational guidance, not legal advice or a determination of compliance. Screening prompts and suggested actions are starting points. Your organisation remains responsible for its decisions and should obtain qualified legal or technical advice where appropriate.