How does the check decide if a job is worth testing?
It looks at how often the job comes up. A job that comes up every week, or a few times a month, gives a test enough cases to judge it by. One that comes up a few times a year gets a narrow test. With no job named, the check stops there and asks you to name one.
The Office for National Statistics (ONS) reports that difficulty identifying business use cases is the most commonly reported reason UK businesses give for not adopting AI, which is why the check asks this first.
| How often it comes up | What the brief says |
|---|---|
| Every week or more, or a few times a month | Worth testing. |
| A few times a year | Worth a narrow test. |
| No job picked yet, or not sure | Not yet. |
How does it pick the route to test first?
It starts every brief with the software you already have, because it's the least new work, and gives each other route a status from your answers. A later route is only put forward when your answers show a reason for it, such as a gap that needs another system or a rule against outside services.
The four routes, in order: software you already have, an app built on an outside AI service, a dedicated cloud setup, and hardware in your building. These answers change them:
| If you say | What happens |
|---|---|
| It has to work with no internet connection | Rules out the outside AI service and the dedicated cloud setup, and puts hardware in your building forward. |
| Outside AI services aren't allowed | Rules out the outside AI service, and makes a dedicated cloud setup depend on what your rule covers. |
| Your software leaves a gap that needs another system | Puts an app built on an outside AI service forward, if outside services may be used. |
Each route gets one of these statuses: check first, if a gap remains, no need shown yet, worth investigating, check it works offline, ruled out by your answers, depends on your rules, answer the unknowns first or not assessed yet.
What happens when you answer "Not sure"?
Unknown answers stay unknown. If you're not sure what information goes in, who may see it, whether an outside service is allowed, where it may be processed or whether it must work offline, every route still in play is marked "Answer the unknowns first", and the brief tells you what to find out.
When does it say to plan for a DPIA?
When personal data goes in. The ICO, the UK's data protection regulator, says that in the vast majority of cases, using AI involves processing likely to be high risk, which makes a data protection impact assessment (DPIA) a legal requirement. With no personal data, the brief says one may not be needed and to record why.
The brief always adds that this isn't legal advice, and that your data protection officer or adviser makes the call.
How does it decide what to settle first?
Each line comes from one of your answers. Staff using AI with no rules adds an AI policy. People keeping their own access adds a test of permissions. Sensitive or confidential information adds a security review, and nobody named to run it or check it adds those jobs. A UK processing rule adds a check on where the supplier's staff sit.
What does the first test look like?
Four weeks on the one job, using your own recent documents, with one person running the test and another checking every output. You time the job before you change anything and again at the end, and carry on only if it saves time and the work is as good.
What doesn't the check do?
It doesn't rank suppliers, judge anyone's security or look at any product. It doesn't promise how much time AI will save. It never asks for company names or documents, and it isn't legal advice. Guidance from the National Cyber Security Centre (NCSC) treats security as work at every stage of a system's life, wherever it's hosted.
Where do your answers go?
Nowhere. They stay in your browser tab and clear when you close it. Nothing is sent unless you choose to request a review, and your brief goes with the request only if you tick the box. The privacy page has the details.