How does the check decide if a job is worth testing?
By how often the job comes up, since a test needs enough cases to judge it by. With no job named, the check stops and asks for one.
It asks this first because the Office for National Statistics (ONS) lists difficulty finding a use for AI as one of the most common reasons UK businesses hold back.
| How often it comes up | What the brief says |
|---|---|
| Every week or more, or a few times a month | Worth testing. |
| A few times a year | Worth a narrow test. |
| No job picked yet, or not sure | Not yet. |
How does it pick the route to test first?
It starts with the software you already have, because it's the least new work. The check only puts a later route forward when your answers give a reason, such as a gap that needs another system or a rule against outside services.
The four routes, in order: software you already have, an app built on an outside AI service, a dedicated cloud setup, and hardware in your building. These answers change them:
| If you say | What happens |
|---|---|
| It has to work with no internet connection | Rules out the outside AI service and the dedicated cloud setup, and puts hardware in your building forward. |
| Outside AI services aren't allowed | Rules out the outside AI service, and makes a dedicated cloud setup depend on what your rule covers. |
| Your software leaves a gap that needs another system | Puts an app built on an outside AI service forward, if outside services may be used. |
What happens when you answer "Not sure"?
Answer "Not sure" about what goes in, who may see it, whether an outside service is allowed, where it may be processed or whether it must work offline, and the brief marks every route still in play "Answer the unknowns first". It then says what to find out.
When does it say to plan for a DPIA?
When personal data goes in. The ICO, the UK's data protection regulator, says most AI use with personal data is likely to be high risk, which makes a data protection impact assessment (DPIA) a legal requirement. With no personal data, the brief says one may not be needed and to record why.
How does it decide what to settle first?
Each line comes from one of your answers. If staff already use AI with no rules, it adds an AI policy. If each person keeps their own access, it adds a test of permissions. Sensitive or confidential information brings a security review, and if nobody is named to run it or check its work, those jobs go on the list. A UK processing rule adds a check on where the supplier's staff sit.
What does the first test look like?
Four weeks on the one job, with your own recent documents, one person running it and another checking every output. Time the job before and after, and carry on only if it saves time and the work is as good.
What doesn't the check do?
It doesn't rank suppliers, judge anyone's security or promise how much time AI will save. The National Cyber Security Centre (NCSC) treats security as work at every stage of a system's life, wherever it's hosted.
Where do your answers go?
They stay in your browser tab and clear when you close it. Nothing is sent unless you request a review. The privacy page has the details.