Guides

Start with a complete list

Ask everyone what they use, then look further. Transcription and meeting-notes tools, search assistants and AI features inside software you already license all count. The tool nobody thinks of as AI is the one most likely to be missing.

What to record for each tool

• its name, supplier and type
• its purpose: how your firm actually uses it, in your own words
• its known limitations, and what you don’t use it for
• a named owner who is responsible for it
• its status: approved, restricted to certain uses, or banned
• whether it handles private or confidential data, which brings in the limits in clause 3.1
• whether it produces outputs automatically or in volume, which means sampling under clause 4.2
• when you started using it, and when you’ll next review it

Assess each one

For each tool, record whether it’s appropriate for what you use it for (3.2): why this tool, what it can and can’t do, what else you considered, the risks of error and bias, and what happens to the data you put in. A named person should stand behind that judgement.

Keep it current

Review an entry when the tool changes, when the way you use it changes, and on the review date you set. A list of names with no purpose, owner or assessment tells a reviewer very little.

Ask in writing

Send your questions in writing and follow up in writing where you need to (4.1). As a minimum, ask about:

• the system’s environmental impact
• who was involved in developing it
• how it meets data protection and confidentiality law
• what permissions were obtained where data about individuals was used
• the accuracy, relevance and diversity of its training data, including known gaps and bias risks
• the type and extent of the supplier’s liability

Keep the questions and the replies together, so you can show what you asked, and when.

Record what you’re told, and what you’re not

Keep the supplier’s answers and your assessment of them. Expect gaps: suppliers often answer some questions vaguely and some not at all. Where information is missing or limited, the standard asks you to identify the risks that creates and add them to your risk register (4.1). Record a gap as a gap. It’s an honest answer, and the standard expects it.

Test it, and mind the timing

Keep a record of how far you’ve tested the system for fitness for purpose at your firm (4.1). If you haven’t tested it, write that down too. The clause says before you buy. If a tool is already in use without these checks, do them now, and expect an assessor to notice the date.

What the decision covers

The standard lists five things (4.2):

1. 1.the assumptions you made
2. 2.your key concerns about reliability, including the data behind the output
3. 3.why each concern matters
4. 4.whether anything could reduce each concern
5. 5.a conclusion on whether the output can reasonably be used for its purpose

The conclusion carries the most weight, so make it a clear answer with any conditions, for example “I’m satisfied this can be used for the draft yield analysis, subject to checking the comparables.” Write it at the time. A decision pieced together weeks later is hard to stand behind.

When the answer is no

If you conclude an output can’t reasonably be used, tell the client in writing, with your reasoning or a summary of it (4.2). Recording it internally doesn’t discharge that duty, so keep a copy of what you sent against the job. It can feel like admitting a problem, but it shows exactly the professional judgement the standard asks for.

Automated and high-volume tools

Where AI produces outputs automatically or in volume, a written decision on every one is generally neither necessary nor proportionate. Check randomised samples at regular intervals instead (4.2). The standard doesn’t set the interval, so choose one and record it.