Map: Turning AI Use Cases into Risk-Aware System Profiles

1. What Is the Map Function and Why It Matters

2. From "AI Idea" to Use Case: Clarifying Purpose and Scope

3. Example: Turning a Vague Idea into a Mapped Use Case

4. Designing an AI System Intake Form

5. Template: Simple AI Intake Form in JSON

Here is a minimal, technology-neutral intake template. You could implement this as a web form, spreadsheet, or API. Read through and think about how you might adapt it for a university or small company.

```json

{

"system_name": "Undergraduate application triage model",

"description": "Ranks university applications into priority bands for admissions reviewers.",

"owners": {

"business_owner": "Director of Admissions",

"technical_owner": "Data Science Team Lead"

},

"lifecycle_stage": "pilot",

"purposeandcontext": {

"task_type": ["classification", "ranking"],

"businessprocess": "undergraduateadmissions_screening",

"sector": "education",

"geographic_scope": ["EU", "US"],

"deployment_environment": "internal web portal for admissions staff"

},

"dataandmodel": {

"inputdatatypes": [

"academic_records",

"standardizedtestscores",

"schoolprofiledata",

"essay_features",

"demographic_data (non-protected for reporting only)"

],

"personal_data": true,

"specialcategorydata": false,

"data_sources": [

"applicantportalsubmissions",

"schoolreportingfeeds"

],

"modeltype": "supervisedlearninggradientboosting",

"usesfoundationmodelorLLM": false

},

"stakeholders": {

"directly_affected": ["applicants"],

"internalusers": ["admissionsofficers"],

"oversightroles": ["legalcounsel", "dataprotectionofficer"],

"vulnerablegroups": ["minors", "first-generationstudents"]

},

"decision_role": {

"automationlevel": "humanintheloop",

"description": "Model suggests a band; human reviewers make final decisions.",

"overridemechanism": "admissionsofficercanchangebandandrecordreason"

},

"regulatory_flags": {

"euaiacthighriskdomain": "educationandvocationaltraining",

"usesbiometricidentification": false,

"usesemotionrecognition": false,

"usessocialscoring": false,

"processessensitivepersonal_data": false

}

}

```

6. Initial Risk Tiering: How Risky Is This Use Case?

7. Thought Exercise: Classify Three AI Use Cases

Try this mental exercise to practice mapping and initial risk tiering. For each use case, pause and answer the questions.

Use case A: Retail product recommender

• A clothing website uses an ML model to recommend items based on browsing and purchase history.

Questions:

1. Who are the main stakeholders?
2. What is at stake if the model performs poorly?
3. What risk tier (1–3) would you assign, and why?

Use case B: Hospital sepsis early warning system

• A deep learning model monitors vital signs and lab results to flag possible sepsis cases for clinicians.

Questions:

1. What kinds of harms could false negatives and false positives cause?
2. Which vulnerable groups are affected?
3. What risk tier (1–3) would you assign, and why?

Use case C: University chatbot using a large language model (LLM)

• A university deploys an LLM-based chatbot to answer students’ administrative questions (deadlines, forms, campus services). It is clearly labeled as an AI assistant.

Questions:

1. What happens if the chatbot gives wrong information?
2. How serious are the consequences compared to the sepsis system or admissions triage?
3. What risk tier (1–3) would you assign, and why?

Suggested answers (keep these in mind to self-check):

• Use case A: Typically Tier 1 (low) unless data is very sensitive or profiling is intrusive.
• Use case B: Typically Tier 3 (high) because it directly affects health and life.
• Use case C: Likely Tier 1–2 depending on how critical the information is (e.g., visa issues or financial aid could raise the tier).

8. Quick Check: Map Function Basics

Answer this question to check your understanding of the Map function and intake process.

9. Flashcards: Key Terms for Mapping AI Use Cases

Use these flashcards to reinforce core concepts from the Map function.

10. Mini Design Task: Draft Your Own Intake Fields

To consolidate what you have learned, design a minimal AI intake form for a small organization (e.g., a university department, a startup, or a local government office).

Task:

1. Choose a context (for example, a university IT department or a fintech startup).
2. List 8–12 fields you would include on your intake form to support mapping and initial risk tiering.
3. Mark which fields are mandatory for all AI ideas.

Hints:

• Make sure you cover: purpose, context, data, stakeholders, decision role, and regulatory flags.
• Keep it short enough that people will actually fill it out.

Example (partial list for a university department):

• System name (mandatory)
• Short description (mandatory)
• Business owner (mandatory)
• Purpose / main task (mandatory)
• Affected individuals (mandatory)
• Data types (mandatory)
• Automation level (advisory vs automatic) (mandatory)
• Potential high-risk domain (education, employment, health, etc.) (mandatory)
• Lifecycle stage (optional)

Write your list now. In a real organization, you would test this form with a few teams and refine it based on their feedback and how well it supports risk tiering.