AI Governance - Use Cases Page

This guide shows how to review, create, and manage AI use cases end-to-end in the governance tool, from filtering and exporting lists to a five-step intake form that captures identification, purpose, risk factors, controls, and approvals. It explains risk calculation (inherent and residual), how to override with justification, and required controls based on risk.

[CLICK HERE to watch a video for this page!](https://academy.finosec.com/hubfs/Demo%20Videos/AI%20Governance/AI%20Governance%20-%20Use%20Cases%20Page.mp4)

From the AI Governance module, click the Use Cases page.

Overview

The top cards display the residual risk breakdown and counts for use cases waiting for approval, overdue, or approved.

Review the details provided in each use case row. Each record lists the AI system, use case type, data involved, harm potential, residual risk, next review date, and approval status.

Filter by system, type, data, or risk to quickly find target use cases.

Click the Export CSV button to generate a downloadable CSV file containing the list of use cases.

Add a Use Case

Click the Add Use Case button to add a Use Case.

Select an AI system and confirming opens the multi-step creation form.

The form guides you through the 5-step process: Identification, Purpose, Risk factors, Controls, and Approval.

Step 1 - Identification

Enter deployment date.

This section gathers metadata including use case name, business unit, owner, regulatory implications, and AI technology type.

Click the Next button to proceed to Step 2.

Step 2 - Purpose

This section details what the AI system does, the generated output, how that output is used, and the affected parties.

If you select the Decisioning option under Use case type, it will reveal an additional setting to define the AI's decision authority.

Click the Next button to move to Step 3.

Step 3 - Risk Factors

Select the appropriate card for Consumer Impact, Human Oversight, and Harm Potential.

Review Factor 4 for data sensitivity in the Risk factor assessment. Selecting the data types processed determines the sensitivity level, with the most sensitive data type dictating the final classification.

Review the calculated Inherent Risk indicator in the top right corner. The highest-rated factor across all categories determines the overall inherent risk level.

Click the Next button to advance to Step 4.

Step 4 - Controls

If needed, click the override icon next to Inherent Risk. Overriding allows you to manually adjust the calculated risk level if it does not accurately reflect the assessment.

Select a new level from the Select new risk level dropdown. Enter a justification in the Reason for override field. A clear explanation is required to help the team understand why the manual override was applied.

The Governance and System controls are answered in Governance Controls or on the specific system.

Click to answer each on of the Use Case Controls.

Step 5 - Approval

Review the Residual Risk summary in Step 5. Residual risk calculates the remaining risk after all controls are applied to the initial inherent risk. You can override the score if needed.

Enter optional notes in the Notes field. Adding comments provides helpful context for future reviews or audit tracking.

Click the Submit/Submit and Approve button. **IMPORTANT:** - AI governance admins can submit and approve a use case in a single action. - AI governance users submit and then an administrator must approve.

The header displays the approval status alongside inherent and residual risk badges.

The navigation tabs store all submitted data sections including risk factors, controls, and approvals.

Use Case Reviews

Click the Approval tab. Review information about who approved the use case, when it was approved, the next review date, and approval notes.

Click the History tab. The history log maintains a complete audit trail of prior approval actions.

If needed, click the Edit use case button. Editing an approved use case moves it back to draft status so it can be updated and re-approved.

Click the Approve again button. When no changes are needed at review time, re-approving resets the next review cycle without changing the record.

Use the Archive use case button to hide the use case from active lists and reports while preserving all underlying history.

Use the Delete use case button to permanently remove the use case record from the application.

[Click here for information on Use Case scoring methodology.](https://scribehow.com/o/r51ExDipRwSDgjjMi6O7uw/page/AI_Governance__Use_Case_Scoring__SEZ66AjrS2CvxxL-DcP53A)

[Click here to return to AI Governance Overview Guide.](https://scribehow.com/o/r51ExDipRwSDgjjMi6O7uw/page/AI_Governance__Overview_Guide__Vx_h5G80SPeaI2ogbAJv1A)