AI Legal Readiness Checklist

List every AI tool you use, including AI features inside software you already have (meeting notetakers, chatbots, email and document tools).

For each tool, note what it's used for and who uses it.

Note what information goes in and where the results go.

Note whether it only suggests (a person decides) or acts on its own (an “agent”).

Note whether it's used in decisions about people, such as hiring, pay or credit.

Name one person in charge of AI.

Set up one simple way to request a new AI tool.

Rate each tool as low, medium or high risk.

Approve low-risk tools quickly and save the closer look for high-risk ones.

Name who controls access to each tool and who keeps its contract.

Find out whether the vendor can use your data to train its AI.

Confirm who owns what the AI produces.

Require the vendor to tell you about breaches and major changes.

Check who pays if the AI causes a problem.

Ask your insurance broker whether your policies cover AI.

Write down what information can and can't go into each tool.

Decide which problems must be reported right away.

Limit what agents can do on their own, and make sure each has an off switch.

Train people on the rules that apply to their role.

Review your AI list on a set schedule, such as quarterly.

Re-check a tool when it changes or gets a new use.

Check that the results are still accurate.

Keep up with new AI laws where you operate.

Decide who gets the first call when AI goes wrong.

Write down the first steps for the most likely problems.

Practice once.