1. Does the AI workflow touch customer PII?

Yes No / Not sure

If yes, special care needed.

2. Is all PII masked before LLM calls?

Yes No / Not sure

Replace emails / SSNs with placeholders.

3. Is the LLM vendor contractually blocked from training on your data?

Yes No / Not sure

Check the DPA / enterprise terms.

4. Are AI decisions auditable (inputs logged)?

Yes No / Not sure

Regulators + lawyers will ask.

5. Is there a human in the loop for customer-facing output?

Yes No / Not sure

Never ship hallucinations unreviewed.

6. Are prompt-injection mitigations in place (schema validation)?

Yes No / Not sure

Untrusted content = untrusted input.

7. Is AI spend capped at the account level?

Yes No / Not sure

Circuit breaker against runaway bills.

8. Are model outputs validated against policy before action?

Yes No / Not sure

Guardrails before side-effects.

9. Is data residency (EU / US) explicit in the vendor contract?

Yes No / Not sure

Jurisdiction matters for compliance.

10. Is there a kill switch to disable AI features instantly?

Yes No / Not sure

You want this the day a bug or incident appears.

AI Usage Risk Scanner