Prohibited AI Practices Checklist

How to use this document

• Use it to review every AI system in the inventory, before buying, building or deploying it, and rule out that it comes close to a prohibited practice or misuse.
• Suggested owner: the [AI COMMITTEE], with legal as reviewer; each use-case owner completes the questionnaire for their system.
• Before adopting it, decide who can close an assessment as "no indication" and who decides when there is doubt; the rule in this document is that any "Yes" or "Not sure" goes to legal.
• Complete the system profile (section 3), the questionnaire (section 4) and the decision record (section 6) for each system, including those already in use.
• If you operate in the European Union, apply the checklist to the whole inventory before the date on which the practices added by Regulation (EU) 2026/1744 start to apply (see Related regulatory references).
• Keep in "Country variants" only the jurisdictions where you operate.
• The checklist helps spot risks; it does not replace legal analysis of a specific case. Doubtful cases are reviewed by internal legal or an outside advisor.
• Approve the checklist in the [AI COMMITTEE] and add the prohibitions to the AI use policy that staff know.

Prohibited AI Practices Checklist

1. Purpose and scope

[ORGANIZATION NAME] uses this checklist to confirm that no AI system it develops, buys or uses carries out practices prohibited by applicable law or by its own red lines, and to keep a record of each decision.

It applies to all AI systems in the inventory, in-house or third-party, including generative AI models used by staff and AI features embedded in vendor products.

2. When it applies

• Before buying, contracting, developing or deploying an AI system.
• Before turning on a new AI feature in a tool already under contract.
• When the system's purpose, data, affected people or vendor changes.
• When the law changes (for example, when new prohibited practices are added).
• Once a year for the whole inventory.
• Retroactively for systems already in use that have no recorded assessment.