Inventory use cases, not just products
Record each AI use case with its purpose, business owner, users, affected people, data sources and operating context. Distinguish experimentation from live deployment. The same assistant used to summarise public material and assess job applicants represents different activities, even with the same supplier and product.
Include embedded SaaS features, employee-selected tools and externally supplied AI services. Note whether your organisation develops, provides or uses the system and where responsibilities overlap. Ask teams what decisions the output influences; a tool list alone will not reveal consequential uses.
Assign authority at meaningful approval points
Define who approves exploration, data access, pilot operation and deployment. Identify when security, privacy, legal, procurement or specialist review is needed. Business owners should explain the intended benefit and operating limits rather than handing every question to an AI governance lead.
ISO/IEC 42001:2023 addresses AI policy, roles, responsibilities and authorities within an AI management system. Translate these arrangements into recorded decisions, including who can refuse a use or require safeguards. Record a decision before allowing a pilot to become an operational dependency.
Set conditions that can be checked
An approval should state permitted data, users, tasks and integrations, together with required oversight. Specify prohibited uses and escalation triggers. For a drafting assistant, that could mean excluding confidential client material, requiring factual verification and prohibiting direct publication without an accountable reviewer.
Assess supplier evidence against the actual service and configuration. A model card or assurance report may describe a different version, deployment option or testing population. Record missing evidence and its implications; a broad claim of responsible AI does not establish suitability for your use case.
Keep approvals current as systems change
Define reassessment triggers such as a new model, broader data access, changed purpose, autonomous action or a different affected population. Establish reporting routes for unexpected outputs and policy breaches. Review whether safeguards still work rather than treating initial approval as permanent permission.
Connect these arrangements to the existing ISO 42001 consultancy and AI risk management below. Horizon organises risks, controls, owners, evidence and reviews. It does not approve AI uses, decide acceptable risk or certify an AI management system.