Use these worksheets to decide what information may be used, who may receive it, what must be disclosed, and who may approve the proposed work. Connect decisions to Part D’s approved facts, Part F’s evidence and publication records, Part E’s technical checks, and Part C’s monitoring and tool assessments.
These are proposed operating templates. Record the professional rules, jurisdiction, engagement terms, and firm policies applicable to each use. Keep permission to use information, permission to process it through a tool, permission to publish, and disclosure as distinct decisions.
Shared review record
[Review ID; matter/content ID; proposed use; information owner; accountable professional; jurisdiction; applicable rule/contract/policy and version; asset/version; audience; workflow/tool; reviewers; decision/date; reassessment trigger].
Use asset IDs and controlled evidence references. Avoid reproducing confidential material or access credentials in a broadly shared review worksheet.
G.1 Information classification worksheet
Suggested classification scheme
Class | Proposed handling rule |
Approved public | Use the approved version for its permitted purpose. Confirm rights and conditions before reuse, adaptation, or submission to a supplier. |
Internal | Limit access to authorized personnel and approved business workflows. Identify any restrictions on external processing. |
Confidential | Record client, personal, commercial, contractual, or other restrictions. Limit recipients, destinations, and access to the approved purpose. |
Restricted | Refer the proposed use to designated professional and security reviewers. Examples include potentially privileged material, highly sensitive personal information, trade secrets, and access credentials. |
Classification record
[Asset/category; source; owner; class; reason; restrictions; permitted users; permitted destinations; minimum information required; storage/retention; output classification; reviewer/date; review trigger].
Apply the review to source files, prompts, attachments, retrieved content, outputs, logs, exports, and shared links. A service may create additional copies or records; capture the actual workflow in G.5.
For a mixed document, identify the most restrictive material and whether an approved extract can meet the purpose. Give the extract its own version and classification. Do not lower its classification merely because an AI tool summarized it.
Public availability, anonymity, and approval for publication are different judgments. The UK ICO’s anonymisation guidance explains why removing direct identifiers may still leave people identifiable through other details. Check combinations of facts and links to other sources.
Decision: [Permitted as proposed / permitted after specified changes / hold]; [approved destination; controls; owner]. If classification is unresolved, hold the proposed external use of that material until the owner resolves it.
G.2 Permissions worksheet
Questions to resolve separately
Confidentiality and engagement terms. [What information may be used, for which purpose, and with which recipients? What client or contractual restrictions apply?]
Protected material. [Does the proposed use involve privilege, professional secrecy, proceedings, or another protected status? Who is qualified to determine the implications?]
Personal information. [What purpose and legal basis apply? Which notices, consents, restrictions, and sharing arrangements are required in the relevant jurisdiction?]
Intellectual-property and reuse rights. [Who controls the text, data, image, logo, recording, quotation, or other material? Does the permission or licence cover this use and any adaptations?]
Authority to authorize release. [Who can approve on behalf of each relevant client, person, rights holder, and the firm? What is the evidence of that authority?]
An approval from one person may cover only some of these questions. Obtain a determination for each applicable requirement.
Permission record
[Asset/version or exact excerpt; action; purpose; recipient/tool; publication channels; rights or authority relied on; grantor and authority; written evidence; allowed edits/translations; attribution; conditions; effective date/duration; change or withdrawal process; reviewer; status].
Use Confirmed, Pending, Declined, or Not required with a documented basis. Record existing valid authorization when the proposed use falls within its scope. A missing reply remains pending.
Scoped approval wording
Approved for [specified use] of [asset/version or attached excerpt], by [firm], through [named channels/workflow], during [period or until trigger], subject to [conditions]. Permitted edits are [scope]. Required attribution is [wording].
Present the actual excerpt or proposed asset for review. Record approval of quotations, names, logos, figures, and images individually when their permissions differ.
Permission to publish a case-study excerpt does not by itself authorize uploading the underlying engagement file to an AI supplier. Record any separate processing authority and supplier controls.
When permission changes, identify affected pages, files, excerpts, and supplier copies. Determine the required response, stop uses no longer authorized, and record removal or correction actions and any limits on recovering third-party copies.
G.3 Disclosure worksheet
Disclosure record
[Audience; content/service; trigger; applicable requirement or editorial reason; fact to disclose; exact wording; placement/timing; owner; reviewer; approved version; review trigger].
Record Required, Appropriate for clarity, or Not applicable with reason. Disclosure should be understandable to the intended audience and appear where it informs the relevant decision.
Subject | Decision to record |
AI or automated assistance | What task was performed, how materially it affected the work, what human review occurred, and what client or reader communication is required. |
Authorship and professional role | Who produced and reviewed the work, what the review covered, and whether experience belongs to the present firm or an individual’s earlier role. |
Research | Funding, sponsorship, methods, material limitations, and the distinction between observed, reported, modeled, and generated evidence. |
Commercial relationships | Sponsorship, paid placement, referral arrangements, incentives, or affiliations that may affect how a recommendation is understood. |
Examples and claims | Whether a case is actual, anonymized, composite, or hypothetical; relevant scope, assumptions, and limitations on outcomes. |
For U.S. endorsement contexts, FTC guidance calls for clear, conspicuous disclosure of unexpected connections that could affect an endorsement’s credibility. Determine the requirements applicable to the actual audience and arrangement.
Wording patterns
Research support: “This study was funded by [party]. The sponsor’s role was [accurate description].”
AI assistance: “[Tool or system] assisted with [task]. [Responsible reviewer/team] checked [specific aspects].”
Illustrative example: “This hypothetical example uses stated assumptions and does not describe a client engagement.”
Use only statements that accurately describe what happened. Keep necessary disclosures with charts, quotations, summaries, and promotional excerpts when reused.
A disclosure does not supply missing permission, substantiate an unsupported claim, or replace professional review. Check that the disclosure itself does not reveal restricted information.
G.4 Professional approval worksheet
Review assignment
Assign reviewers according to the proposed use and its consequences. One person may perform several roles where appropriate; keep each review scope explicit.
Review role | Scope to document |
Practice expert | Professional accuracy, competence, service scope, evidence, qualifications, and the claims made. |
Engagement or information owner | Client restrictions, permissions, context, and correct attribution of work and results. |
Legal, privacy, or ethics reviewer | Applicable duties, protected material, personal information, reuse rights, conflicts, independence, and disclosures as relevant. |
Technical or supplier owner | Approved tools and settings, data destinations, access controls, and applicable Part E checks. |
Publication owner | Approved wording and version, outstanding conditions, intended channels, release readiness, and correction ownership. |
Sector prompts
- Consulting: Are engagement scope, implementation responsibility, and attribution of results accurate?
- Accounting: Are service type, assurance implications, and any applicable independence requirements addressed?
- Law: Have confidentiality, potential privilege, jurisdiction, and professional communications requirements been reviewed?
- Engineering consulting: Are discipline, competence, design or test basis, and any certification or sign-off authority accurately represented?
Approval record
[Asset/version; proposed audience/use; review scope; evidence checked; reviewer/role; findings; required changes; unresolved matters; conditions; decision/date; release owner; review trigger].
Use Approved, Approved with specified conditions, Revise, Hold, or Not reviewed. State whether a condition must be satisfied before release or is an ongoing obligation. The release owner verifies that every prerequisite is closed and ongoing controls have an owner.
An approval should identify what was actually reviewed. Approval of factual accuracy does not establish publication permission or supplier suitability.
Release and change control
Before release, confirm the final version, permissions, disclosures, required reviews, and relevant technical checks. Retain the evidence of each decision.
Reopen affected approvals when the purpose, audience, jurisdiction, material wording, underlying facts, supplier, or data flow changes. Apply the firm’s authorized process for clerical corrections. Reuse approvals that remain valid within their documented scope.
Record [Change; affected approval IDs; owner; action; revised decision; date]. Escalate unresolved requirements to the accountable professional; an internal exception cannot override an applicable external obligation.
G.5 Supplier-review worksheet
Review the specific service: a content agency, research provider, monitoring platform, AI tool, or integrated workflow. Include subcontractors and embedded services that receive the firm’s information.
NIST’s Generative AI Profile offers voluntary guidance on supplier assessment, contractual terms, monitoring, and incident arrangements. Use the following worksheet to define the evidence needed for the proposed task.
Supplier and use record
[Supplier/legal entity; product/plan/version; account configuration; intended task; permitted information classes; users; integrations; data-flow description; contract/document versions; evidence dates; reviewers; owner; review date].
Assessment worksheet
For every row, record [Supplier response; evidence; finding; required control; owner; verification date]. Use Meets, Partially meets, Fails, Unknown, or Not applicable with reason.
Check | Evidence and questions |
S1 Data and purpose | What inputs, outputs, metadata, logs, and copies are created? What information is necessary? What secondary uses are permitted? |
S2 Training and access | Ask separately about model training, product improvement, retention, human access, support access, and disclosure to others. Record exceptions. |
S3 Supply chain and location | Identify subprocessors, embedded tools, processing/storage locations, onward transfers, and who implements each control. |
S4 Security and configuration | Verify authentication, roles, separation, sharing settings, encryption, audit records, and integration permissions for the actual account. |
S5 Terms and rights | Check confidentiality, permitted use, input/output rights, evaluation rights, responsibility allocation, and relevant data-processing terms. |
S6 Professional and editorial quality | Test representative tasks against known evidence. Check sources, invented claims, disclosure practices, human review, and correction handling. |
S7 Assurance evidence | Examine the scope, date, exclusions, and findings of security reports or certifications. Distinguish supplier statements from independently assessed or tested evidence. |
S8 Incidents and continuity | Identify contacts, notification commitments, response responsibilities, investigation support, service continuity, and fallback arrangements. |
S9 Exit and deletion | Establish export, access revocation, deletion, backup/retention exceptions, subprocessors’ handling, and evidence available when the relationship ends. |
S10 Changes and monitoring | Establish notices and review triggers for changed terms, features, models, integrations, subprocessors, settings, or intended use. |
A “no training” statement does not answer retention, human-access, or onward-sharing questions. NCSC’s supply-chain guidance specifically addresses data and derived metadata available to third parties.
Verify the actual configuration. NCSC’s secure-use guidance emphasizes the customer’s configuration responsibilities and periodic review, including when newer defaults may not have reached existing accounts.
Use approved public or synthetic material for initial testing. Record contractual commitments, configured controls, and observed results separately. Part C supplies relevant performance evidence; a security assessment alone does not establish suitability for a professional task.
Supplier decision
[Approve specified use / approve after conditions / hold / decline; permitted data and tasks; excluded uses; mandatory controls; unresolved items; evidence; accountable owner; expiry/reassessment trigger].
Identify mandatory criteria before assessment. Do not let an aggregate score conceal a failed requirement or an unknown answer essential to the decision. Verify conditions before enabling the use they govern.
Illustrative decision:
Approved to monitor the listed public pages and retain answer captures in [configured account]. Client workspaces are outside scope. The owner must review [specified changes] and reassess on [date].
Maintain the decision with the related classification, permissions, disclosures, and professional approvals. Review only the affected decisions when circumstances change, while preserving the evidence supporting uses that remain authorized.
