AI scoping records
How does your institution separate uses by risk?
Explain why different AI uses receive different review, rather than assigning every tool the same label.
What examiners look for
The Work Program looks for a reasoned difference in review based on risk, impact or use. Relevant records include ratings, tiers, intake forms, approvals and governance decisions. A Yes, No or unclear answer can inform the review. A label by itself says little unless the file explains the reason and the review that follows.
CSBS Examiner Work Program, initial scoping 7. Checked October 16, 2026.
Which records answer the question
- Keep the assessment or tier record beside the AI use.
- Retain the business purpose, owner and expected outputs.
- Link governance decisions to the reasoning reviewed.
- Use testing, monitoring and change records when they affect the assessment.
Where the answer directs review
The guide connects this question to Governance and Oversight, AI Inventory and Use Cases, and existing supervisory resources. Generative AI and Emerging Use applies when those capabilities are involved. Select the relevant review from the facts of the use. Do not assume that a tier replaces the institution's other risk processes or approval rules.
Core Examiner Guide, page 3. Checked October 16, 2026.
Two gaps to check
The register shows a tier without the reasoning or source version. Ask which impacts, oversight arrangements, possible harms and data facts informed the assessment. Unknown information belongs in the file. A neat rating should not conceal an unanswered question about the use.
A pilot becomes customer-facing, but its earlier review label remains unchanged. Identify what changed about the audience, decisions or human checks. Return the affected assessment to review. The earlier decision should remain in history without silently carrying forward to the expanded use.
How to prepare the record
Describe one use before proposing its level of review. Identify the evidence behind the description and the facts that remain uncertain. Record a proposed assessment with reasons and a reviewer role. The institution assigns its final tier under its own process. Keep any decision conditions linked to the assessment and the source versions considered.
A row behind the question
Illustrative inputs, not a client.
| Use | Where it runs | Data it can touch | Owner | Evidence on hand | Question still open |
|---|---|---|---|---|---|
| Assistant draft used in operations | Enterprise service | Input categories partly described | Business owner role | Use description and proposed assessment | What evidence supports the level of human review before action? |
What the reviewer should retain
The useful output explains what receives extra attention and why. It can support a review discussion without pretending to be a regulator-issued rating. A new data category, decision role or permission may alter the picture. Keep those change triggers explicit so an owner knows when to request another assessment.
Prepare the next step
Check sensitive data next, including information the AI can access through connected services.