A — 0: Data sensitivity, affected people and intended actions are unknown. B — 1: Risks are listed, but approvals, controls or escalation remain unresolved. C — 2: The appropriate reviewers have approved the pilot’s scope and handling, with restrictions and required human checks documented.
Evidence to attach: use-case/data-flow review and control owners. If weak: pause the affected activity. Consequential-decision requirements and health-data processing rules illustrate why this must be specific to the use, not a generic AI checklist.