Checklist

AI Ethics, Privacy & Risk Management Checklist

An actionable, fillable pre-deployment and periodic review checklist to evaluate data provenance, privacy, model risk, explainability, human oversight, monitoring, vendor risk, retention, and incident readiness. Includes a simple risk-tier rubric, owner and review fields, and a notes section so teams can save a documented decision and follow up on mitigations.

Interactive Tool

AI Ethics, Privacy & Risk Management Checklist

This interactive checklist helps teams quickly evaluate the ethical, privacy and operational risks of an AI model or automation before deployment and during scheduled reviews. Answer each question, add concise comments where needed, assign an owner, and capture overall risk and readiness. Use the risk-tier rubric below to prioritize follow-up actions.

Risk-tier rubric

Low: Minimal privacy or safety exposure; mitigations trivial to implement.
Moderate: Some potential for user impact, privacy exposure, or bias; monitoring and mitigations required.
High: Significant potential for safety, privacy, legal, or reputational harm; deployment should be restricted until mitigations are in place.
Critical: Likely to produce high-impact harms (safety, legal, privacy, discrimination); do not deploy without major redesign.

Model or Automation Name

Clear name so records and owners can be matched to deployments.

Checklist Owner (person/team)

Who is accountable for completing mitigations and tracking progress.

Review Date

Planned review date (ISO format recommended, e.g., 2026-09-30).

Is source data provenance documented and accessible?

Includes origin, collection method, preprocessing steps, and any sampling or labeling processes.

Notes — data provenance

Describe missing items or links to documentation (if any).

Is personal or sensitive data (PII/PHI) identified and classified?

Identify whether data contains personal identifiers, health, financial, or other sensitive attributes.

Notes — PII handling

Anonymization, pseudonymization, or minimization steps required.

Is there a lawful basis and documented consent (or other legal basis) for the intended use of the data?

Cite consent scope, contracts, or legal assessments. If not applicable, explain why.

Notes — consent/legal basis

Link to consent records, DPA, or legal memo.

Are access controls and encryption applied for training and inference data?

Include storage and transit protections and role-based access limits.

Notes — security

List gaps or remediation steps.

Has a data minimization and retention review been completed?

Confirm only required attributes are retained and retention/deletion rules exist.

Notes — retention/deletion

Describe retention periods and deletion procedures.

Has model performance been validated on representative, held-out test sets?

Include metrics, acceptance criteria, and if datasets reflect production populations.

Have fairness and subgroup performance checks been performed?

List protected attributes considered and mitigation steps (if any).

Notes — validation & fairness

Include links to experiment notebooks or validation reports.

Are explainability and observability requirements documented (for users, auditors, regulators)?

Describe explanation type (global, local), intended audience, and evidence of interpretability.

Notes — explainability

Provide links to explainability artifacts or UI designs.

Has the model been tested for adversarial inputs, extreme cases, or safety failure modes?

Include test coverage and outcomes.

Notes — robustness

List remaining test gaps and scheduled tests.

Are human-in-the-loop decision points and rollback controls identified?

Specify where humans review, override, or validate outputs and how they are trained.

Notes — human oversight

List roles and escalation paths.

Are role-based responsibilities (product, legal, security, ops) assigned and documented?

Who signs off on deployment and who monitors post-deploy?

Notes — roles & sign-offs

Include names, teams, or job titles.

Is a monitoring plan defined for drift, performance degradation, and harms?

Define metrics, alert thresholds, and owners for continuous monitoring.

Notes — monitoring plan

Link to dashboards, metrics, or scheduled reports.

Is an incident response playbook available and tested for model failures or harmful outputs?

Includes detection, containment, rollback, communication, and remediation steps.

Notes — incident response

Indicate last test date and lessons learned.

If using third-party models or services, have they been assessed for transparency, data handling, and contractual obligations?

Include vendor questionnaires, SOC reports, or contractual clauses.

Notes — vendor risk

List unresolved vendor risks and mitigation commitments.

Are logs and audit trails enabled for training, changes, and decision outputs?

Record model versions, training data snapshots, and inference logs where appropriate.

Notes — logging & audit

Where logs are stored and retention policies.

Overall Risk Tier

Select the team's assessed risk tier to prioritize follow-up.

Estimated Risk Score (1 = low, 5 = critical)

Quick numeric summary to support sorting and dashboards.

1.0 10.0

Deployment Readiness

Select the team's recommended readiness status.

Ready

Ready with mitigations

Not ready

Next steps / Action items

List prioritized mitigation actions, owners, and target dates.

Additional notes

Freeform space for context, links, or reviewer comments.

Approver / Sign-off (name/title)

Who approves deployment given current mitigations.

You can explore this tool now. Sign in or create an account to save your responses and return to them later.

Make this tool part of your work

Save a personal copy, bring it to your team, or tailor the questions and workflow to fit what you are hungry to improve.

Member customization and team collaboration are coming soon.

Discuss Ask the Librarian

Discussion

Comments and conversation will live here.

AI Ethics, Privacy & Risk Management Checklist