AI Collaboration Safety & Transparency Checklist

How to use this checklist

This checklist helps teams decide whether to use an AI tool for a given task and to put simple guardrails in place so AI outputs remain trustworthy, private, and clearly attributed. Use it before starting a new AI-assisted task, when onboarding new tools, or as part of regular safety reviews. Mark responsible roles and capture notes for anything you flag.

1) Task suitability

• [ ] Define the task and expected outcome. (Who owns the outcome?)
• [ ] Is the task decision-critical, safety-critical, or high reputational risk? If yes, require human-in-the-loop review before release.
• [ ] Does the task involve advice, policy, legal interpretation, clinical recommendations, or sensitive customer decisions? If yes, escalate to a subject-matter reviewer.
• [ ] Are there existing non-AI processes that are safer or more appropriate? If yes, justify why AI is preferred.

2) Data sensitivity & privacy

• [ ] List data types used (e.g., public web, internal documents, PII, PHI, proprietary designs).
• [ ] For any PII/PHI or regulated data: [ ] Obtain required consent / [ ] Use anonymization / [ ] Use synthetic or redacted data.
• [ ] Are model inputs or outputs stored by the third-party AI service? (Check vendor privacy terms.)
• [ ] If external APIs are involved, [ ] confirm contractual protections and data processing agreements are in place.

3) Attribution conventions

• [ ] Agree on how AI contributions are labeled in deliverables (e.g., "Drafted with assistance from [Model]" or inline tags).
• [ ] Specify who will sign off on AI-generated content before publication.
• [ ] Keep a short rationale for accepting AI output (why it was used and who approved it).

4) Human review & fail-safe handoff

• [ ] Identify reviewers and their responsibilities (content, legal, safety, privacy).
• [ ] Define pass/fail criteria for human review (accuracy threshold, compliance checks, tone).
• [ ] Define a clear handoff: when the system must stop and route to a human (e.g., ambiguous result, flagged risk, model uncertainty above threshold).
• [ ] If a human reviewer rejects AI output, [ ] record reason and [ ] document corrective action.

5) Prompt & output logging

• [ ] Log the prompt/inputs used and the full AI output for reproducibility (store in a team prompt log).
• [ ] Tag entries with date, model/version, tool name, and responsible person.
• [ ] Keep a retention policy for logs that balances investigability with data minimization.

6) Experiment & change tracking

• [ ] Assign a unique experiment ID for each new model, prompt variation, or workflow change.
• [ ] Record hypothesis, success criteria, start/end dates, and key metrics (e.g., accuracy, false positives, time saved).
• [ ] Save representative examples of successes and failures for future tuning and training.

7) Incident-response mini-plan (example)

Use this short plan for suspected misinformation, data exposure, or harmful outputs.

1. Immediate containment: Stop the workflow, unpublish or disable the AI-generated content if live.
2. Notify: Inform the designated incident lead and legal/privacy teams within 1 hour.
3. Assess: Collect logs (prompt, model/version, outputs, recipients) and classify the severity.
4. Mitigate: Correct public-facing errors, notify affected parties if personal data was exposed, and remove or correct content.
5. Remediate: Update prompts, retrain models if needed, and add new guardrails to prevent recurrence.
6. Record: Write a short post-incident note with root cause, decisions made, and action owners for follow-up.

8) Sample team norms for transparent AI use (adapt to your team)

• [ ] We label AI-generated drafts clearly and never present them as final without sign-off.
• [ ] We log prompts and model details for major outputs and experimentation.
• [ ] We do not submit personal or regulated customer data to third-party models unless approved by privacy/legal.
• [ ] We review AI-assisted content before publication. One peer and one subject-matter expert must approve high-risk outputs.
• [ ] We treat AI outputs as suggestions, not authoritative answers; final responsibility rests with the named owner.

9) Quick risk score (useful before you begin)

Rate each from 1 (low) to 5 (high) and add the three numbers to prioritize review rigor.

• Data sensitivity: [ ] 1 2 3 4 5
• Decision impact: [ ] 1 2 3 4 5
• Public visibility/reputational risk: [ ] 1 2 3 4 5

10) Record keeping & next steps

• [ ] Save this checklist result with a reference to the related project or experiment ID.
• [ ] If any item is flagged, schedule a brief follow-up to close outstanding actions before release.
• [ ] Periodically (e.g., monthly) review logged experiments, incidents, and norms to update team practices.

Example completed entry (for teams)

Project: Customer Onboarding Email Drafts | Experiment ID: ONB-2026-01 | Responsible: Product Content Lead

• Task suitability: Low decision impact (automated drafts reviewed by human) — Proceed with human-in-loop.
• Data sensitivity: Internal customer names & emails — Use templates + redacted examples; do not send PII to external model without approval.
• Attribution: Drafts labeled "AI-assisted draft" in the subject line.
• Logging: Prompt and model/version saved to prompt-log with date and reviewer initials.
• Incident plan: Publisher will hold emails for QA if any flagged language appears.

Suggested adaptations

Customize acceptance thresholds, reviewer roles, and logging retention to match your industry, legal needs, and risk tolerance. Use this checklist as a living document and revise after real incidents or near-misses.