Who signed off on that AI tool?

Before an AI system goes live, a board, an auditor or a regulator will ask who approved it, what it may do with company data, and who can switch it off. This page produces those answers for one system and records them for the file.

What you leave with

  • A risk tier for the system, with the answer that set it.
  • The conditions the approval must carry, each with its reason.
  • One named owner for every decision about the system.
  • A signed record, printed or saved as a PDF.

Free, with no sign-up. Nothing typed on this page leaves your browser.

Rate an AI tool Print or save as PDF Clear every field

These instruments describe operational governance practice. They are RBD Co. methods built on the governance model in The Intelligence Organization. They are not legal standards or legal advice, and legal counsel determines which laws apply to a given system.

Why these questions

Most companies have an AI policy. Few can state who approved a given AI system, how far it acts on its own, what it may do with which data, or who can switch it off. Only 7.2% of 750 senior technology leaders report that a named individual holds formal accountability for AI agent behavior (Gravitee, June 2026).

The consequences follow from that gap. Attackers used access tokens held by one AI chat integration to reach data at more than 700 organizations (Salesloft Drift, per a FINRA alert). In a simulation before deployment, an AI agent read a $2 account fee as theft and drafted a report to the FBI, which was never sent (CBS News, Nov. 16, 2025).

The questions on this page address that gap one system at a time. The rating applies written rules rather than a weighted score, so every result states the answer that produced it. Review conducted this way is also faster. At one insurer, approval for low-risk tools fell from 5 to 6 months to 2 days once a 48-hour lane was established.

1. Decision Rights Map

Each decision about an AI system requires one named owner. A committee may advise, but an individual decides. Authority follows competence and risk rather than title, and legal and security reviews proceed in parallel.

DecisionNamed personRoleBackupDate

    The risk rating in Tool 2 sets the approval lane. The fast lane takes about 48 hours and serves reversible, low-risk changes. The medium lane takes about 2 weeks and serves decisions that cross departments. The slow lane takes 1 month or longer and serves new risk classes and major regulatory implications.

    2. Risk Rating

    The rating attaches to the decision the system affects, not to the technology. The highest single answer sets the tier. Each result states the answer that produced it, and each condition states its reason, so the rating can be audited.

    Begin with an example and adjust any answer. Résumé screener Company assistant such as Copilot Coding agent Customer support agent

    1. How far does the system act on its own?
    2. Can the system start other agents?
    3. What is the most sensitive data the system touches?
    4. What does the output decide? Select every answer that applies.
    5. How far does a failure reach?
    6. Which actions can the system take? Select every answer that applies.
    7. Regulation screen. Select every category that the data or the decision touches. Each selected category requires review by legal counsel.
    8. Has this model or vendor had a published incident, such as a data exposure, harmful output or an action no one approved?

    Search the AI Incident Database, the OECD AI Incidents Monitor, and the vendor's own model documentation and status page.

    Answer questions 1, 3 and 5 to see the tier.

    3. Pre-Deployment Review Checklist

    Each owner answers, attaches the evidence and signs. The review repeats whenever the system, its data, its vendor or its model changes. The checklist is a set of questions that owners answer, not a form completed once at the end of a project.

    Ten core questions

    Questions by type of system

    Check every type that applies. A system of more than one type answers each matching set.

    Permission grid

    The approval states which actions the tool may take with which data. Each cell is permitted, permitted with review, or blocked. Fill the coding agent example

    Decision

    The approver named in Tool 1 records one decision.

      Review again when

      • The tool, its data, its vendor or its model changes.
      • A published incident involves the model or the vendor.
      • Anyone proposes a lower tier, which requires 90 days of clean operation.

      Sources and method

      These instruments review one AI system at a time. The AI Agent Security Diagnostic assesses the organization as a whole, and its fifteen questions share a source with the agent questions on this page.

      The governance model, the approval lanes and the agent approval gate come from The Intelligence Organization (RBD. Press, 2026), pp. 162-163, 186-187, 194-202 and 289. The statutes and regulations in question 7 are quoted, with their effective dates, in the author's written materials for Session 302 of Minnesota CLE's 2026 AI and the Law Conference.