Why Your Organization Needs a Comprehensive AI Use Case Tracker
And What to Track: The 40-Field Guide for Complete AI Visibility
40Fields
5Categories
8Frameworks
You know what’s funny about AI governance? Everyone talks about it, but most organizations are flying blind. They’ve got AI systems scattered across departments, no one knows who owns what, and when regulators come knocking, it’s a scramble to find documentation.
An AI Use Case Tracker fixes this mess. Think of it as a master spreadsheet that answers the question: “What AI are we actually using, and should we be worried about any of it?”
Regulations
EU AI Act, NIST, industry rules — documentation required when auditors show up
Risk
AI can discriminate, leak data, or make decisions nobody can explain
Operations
Know who to call at 2 AM when something breaks
ROI
Track whether your AI investments actually work
The 40-Field Guide
What You Should Track (And Why Each Matters)
Not every field applies to every AI system. Start with Identification & Ownership for all systems, then add fields based on risk level. Low-risk internal tools may only need 10–15 fields. High-risk customer-facing systems need all 40.
Select a category to explore fields
Use Case ID
Unique identifier like UC-2024-001 for every AI system
NIST AI RMFAll AI Systems
Use Case Name
“Customer Churn Prediction” beats “ML Model v2” every time
OECD AI Principles
Business Function
Which department uses this? Context determines risk classification
EU AI Act Title III
Owner(s) and Email
A person with a name and email — not a team, not a committee
ISO 42001 §6
Objective
“Reduce churn by 10%” is measurable. “Improve experience” is fluff.
ISO 42001 §5
AI Type
NLP, Computer Vision, Recommender, Time Series — different types carry different risks
OECD Classification
Model Type
Decision Tree, CNN, Transformer, XGBoost — impacts explainability
NIST SP 1270
Model Version
Semantic versioning (major.minor.patch) with changelog
ISO 42001
Data Source
Every source explicitly — “Customer database” isn’t enough
NIST SP 1271High-Risk Required
Data Sensitivity
Public / Internal / Confidential / Restricted — includes PII, PHI, financial, biometric
GDPRNIST 800-53ISO 27001High-Risk Required
Data Governance / Lineage
Document the full data journey — approvals, flows, transformations
NIST AI RMF Map
Retention Period
Exact timeframes with justification — not “just in case”
GDPR Art. 5(1)(e)ISO 27701
Bias & Fairness Concerns
Specific, measurable disparities — not vague statements
NIST SP 1270High-Risk Required
AI Inherent Risk
Rate by autonomy and impact: Low / Medium / High / Critical
EU AI Act Tiers
Data Sensitivity Risk
Combine classification with volume and retention
NIST 800-53
Combined Risk
Simple matrix: autonomy × data sensitivity = risk level
ISO 23894:2023
Training Data Provenance
Where the model was trained — distinct from operational data
EU AI Act Art. 10NIST MAP
Data Residency
Physical location of data + transfer mechanisms
GDPR Ch. VEU AI Act
Regulatory Impact
Every applicable regulation — EU AI Act, GDPR, HIPAA, industry-specific
EU AI ActGDPR
Security Requirements
TLS, access controls, audit logging, adversarial defenses
NIST 800-53
Explainability Level
Can you explain why the model made a specific decision? High/Medium/Low.
EU AI ActHigh-Risk Required
Impact Assessment Completed?
DPIA, AI Impact Assessment — many regulations require these
GDPREU AI Act
Ethical Considerations
Beyond legal — does this system respect user autonomy?
OECDISO 42001
User / Stakeholder Impact
Who does this affect? Employees? Customers? Job applicants?
EU AI Act
KPIs & Metrics
Precision, recall, customer satisfaction, processing time
ISO 42001
Expected Benefits / ROI
“Reduce manual review by 50%” or “Save $2M annually”
ISO 42001 §5
Human-in-the-Loop
Required oversight level per use case
EU AI Act Art. 14NIST GOVERNHigh-Risk Required
Deployment Environment
Cloud, on-prem, hybrid, edge — affects security posture
NIST 800-53
Approval Status
Approved / In Review / Rejected — deploying unapproved AI makes headlines
ISO 42001
Development Status
Planning / Testing / Production / Decommissioned
NIST AI RMF
Tool or Vendor Name
OpenAI API? AWS SageMaker? Vendor dependencies create risks.
NIST AI RMF
Audit History
When last reviewed, by whom, what they found
ISO 42001NIST
License
MIT? Apache? Proprietary? GPL in proprietary = problem.
ISO 42001
Contracting
MSA with cloud provider? SOW with consultants?
ISO 42001
Last Updated
When was this record last verified as accurate?
NIST AI RMF
Governance Contacts
Primary, backup, and escalation — with names, not committees
ISO 42001
Incident History
Past incidents with root cause and remediation
EU AI Act Art. 73NIST MANAGE
Insurance / Liability
AI-specific coverage and vendor indemnification
ISO 42001
Decommissioning Plan
What happens when you sunset this system?
NIST GOVERN 1.7ISO 42001
Cross-border Transfers
International data flow mechanisms
GDPR Ch. VEU AI Act
Ready to start tracking?
Download the pre-built template with all 40 fields, dropdowns, and risk scoring.
Get the 40-Field Tracker Template → Download the Checklist →
Risk Classification
AI Inherent Risk Tiers
Rate each AI system based on its autonomy level and potential impact on people. The EU AI Act defines four risk tiers with different requirements for each.
Low
Makes suggestions humans review
e.g., spell checker, content recommendations
Minimal governance required. Basic documentation and periodic review. No mandatory EU AI Act obligations beyond transparency for certain systems.
Medium
Automates decisions with human oversight
e.g., fraud alerts, customer segmentation
Moderate governance. Documented risk assessment, defined oversight procedures, regular review cycles. May trigger specific transparency requirements.
High
Autonomous decisions affecting people
e.g., loan approvals, hiring, insurance
Full governance required. Mandatory risk management system, data governance, technical documentation, human oversight, accuracy/robustness testing, conformity assessment. EU AI Act Title III, Chapter 2 obligations apply.
Critical
Safety-critical or legally-binding decisions
e.g., medical diagnosis, autonomous vehicles
Maximum governance + external oversight. Third-party conformity assessment, continuous post-market monitoring, serious incident reporting. Some uses prohibited outright under EU AI Act Article 5.
Combined Risk
AI Autonomy × Data Sensitivity
Don’t overcomplicate this. High autonomy + sensitive data = High risk. Low autonomy + public data = Low risk.
AI Autonomy ↑
Medium
High
Critical
High
Low
Medium
High
Low
Low
Low
Medium
Public
Internal
Sensitive
Data Sensitivity →
Need the full regulatory mapping?
See exactly which NIST, ISO, EU AI Act, and GDPR clauses apply to each of the 40 fields.
Grab the Cheat Sheet → Free Download →
Example
What a Completed Tracker Entry Looks Like
Here’s what a fully documented AI Use Case Tracker entry looks like for a real system — Anthropic’s Claude, used as an internal productivity assistant. The heat indicators show where risk concentrates.
UC-2026-017
Claude — Internal AI Assistant
COMBINED: HIGH
Low Risk
Medium Risk
High Risk
Critical
Identification & Ownership
Use Case NameClaude AI — Internal Productivity Assistant
Business FunctionEngineering, Legal Review, Content, Customer Support
OwnerMarcus Webb, VP of Engineering — m.webb@acme.com
ObjectiveReduce internal documentation time by 40%, accelerate code review by 30%
Technical Metadata
AI TypeLarge Language Model (LLM) — Generative AI
Model TypeTransformer (proprietary) — Black box, limited explainability
Model VersionClaude Opus 4 (via API, version pinned to 2026-03)
Data & Risk Attributes
Data SourceInternal codebase, Confluence docs, Slack history, customer tickets (Zendesk), legal contracts
Data SensitivityCONFIDENTIAL — Contains PII (customer names, emails), proprietary source code, legal documents, financial data in contracts
RetentionAPI: zero retention (Anthropic policy). Internal logs: 90 days. Prompt cache: session-only.
Bias ConcernsCode review may favor patterns from dominant language in training data. Legal summaries may reflect US-centric legal reasoning. Customer response tone may vary across cultural contexts.
AI Inherent RiskHIGH — Autonomous text generation used in customer-facing responses and legal review drafts without mandatory human review gate
Combined RiskHIGH — High autonomy × Confidential data = High risk. Legal and customer support use cases elevate to near-critical.
Business & Compliance
RegulatoryGDPR (customer PII in prompts), SOC 2 (code access), CCPA, potential EU AI Act Art. 52 transparency obligations
SecurityTLS 1.3, API key rotation (90-day), SSO via Okta, DLP scanning on prompts, no data used for training (contractual)
ExplainabilityLOW — Transformer architecture, no feature attribution. Outputs are plausible but not traceable to specific training data.
Impact AssessmentDPIA completed 2026-01-15. AI Impact Assessment: PENDING (due before legal use case goes live)
KPIsDoc time: -38% (target -40%). Code review: -27% (target -30%). Hallucination rate: 4.2% (target <3%). CSAT: +8%.
Oversight & Audit
ApprovalCONDITIONAL — Approved for engineering & content. Legal use case: pending AI Impact Assessment completion.
StatusProduction (engineering, content). Pilot (customer support). Blocked (legal review).
VendorAnthropic PBC — API access via Enterprise agreement (signed 2025-11, annual renewal)
Last Audit2026-02-20 — Internal security review. Finding: prompt injection risk in customer support workflow. Remediation: input sanitization layer deployed 2026-03-01.
GovernancePrimary: Marcus Webb (VP Eng). Backup: Mike Torres (CISO). Escalation: AI Governance Committee (quarterly review).
Want a blank version of this?
The fillable tracker template includes all 40 fields with the same structure as this example.
Download Fillable Tracker →
Implementation
Making This Actually Work
An AI Use Case Tracker is only useful if it’s accurate and current.
01
Start Small
Don’t try to document 200 systems on day one. Pick your highest-risk systems and work down.
02
Use What You Have
Got ServiceNow? SharePoint? Even Excel works. Fancy tools can come later.
03
Make It Mandatory
No production deployment without tracker documentation. Period.
04
Review Regularly
Quarterly reviews catch drift before it becomes a problem. Keep it readable.
Template
Interactive Tracker Template
Explore our pre-built tracker template below. Copy it to your own Airtable workspace or use it as a reference for building your own.
