Should I use a spreadsheet, the Simulator, or a qualified advisor?
A spreadsheet supports a compliance lead's own review process, the AI Risk & Policy Simulator supplies an initial issue list, and a qualified advisor provides fact-specific interpretation. The difference is who supplies the structure, who checks the evidence, and who interprets the specific obligations. For a hypothetical review of 6 proposed AI uses, a compliance lead can record each use separately, with its owner, evidence sources, unresolved questions, and next action. The AI Risk & Policy Simulator can supply draft risks and review questions from a sanitized description, but a generated report does not establish that a control works or that deployment is legally approved. If the decision depends on confidential facts, disputed obligations, or consequences for affected people, involve a qualified advisor within an agreed professional scope. Keep the original proposal and document which generated statements your reviewers accepted, corrected, or left unresolved, so later readers can distinguish draft guidance from checked evidence.
A review spreadsheet, an AI Risk & Policy Simulator report, and a consulting engagement provide different kinds of structure and advice. A neatly completed spreadsheet does not prove that its answers are correct, and a generated checklist does not establish compliance. Likewise, the word 'consultant' does not establish someone's qualifications or the services in a particular engagement. Choose a starting point based on what your team already knows and where it needs help.
Worked example: an AI-assisted hiring review
Imagine a hypothetical employer considering a tool that ranks applicants for a human recruiter. Start by describing the proposed recommendation, the recruiter's role, the broad data categories, and the deployment location. Keep applicant names, résumés, and sensitive employment records out of a general-purpose simulation. The review can begin with a sanitized description rather than the underlying personal data.
A recruiter reviewing a hypothetical applicant-ranking tool can use an AI Risk & Policy Simulator report or a checklist to identify questions about unfair outcomes, accessibility, explanations, and the ability to challenge recommendations. Do not treat the hiring example as a legal risk classification. The applicant-ranking system's actual purpose, behavior, and jurisdiction matter. A reviewer should check the applicable rules and evidence before deciding whether the proposal can proceed, needs changes, or should be stopped.
What should I record in an AI risk review spreadsheet?
An AI risk review spreadsheet should record the system or proposal, owner, purpose, location, affected groups, data categories, version, and assessment date. For each issue, include the question, the evidence consulted, the source, the reviewer, and the next action. Keep a separate field for unresolved facts so a blank answer is not mistaken for a finding that no risk exists.
An AI risk review spreadsheet's suggested fields are not a prescribed regulatory template or a new AI Risk & Policy Simulator feature. When transferring an initial report into a sheet, mark which statements came from generated text and which were subsequently validated. Assign responsibility for follow-up and retain the reasoning behind the final decision. A status cell labelled 'complete' is less useful than a clear record of what was checked and by whom.
Primary source: NIST AI RMF 1.0 (official PDF) — NIST AI RMF 1.0 provides a voluntary framework for managing AI risks over time. Use it to check which facts and evidence your review needs, rather than treating a completed sheet as compliance approval.
Where the Simulator can help, and where it stops
The AI Risk & Policy Simulator generates a structured first-pass report from the organization type, business area, location, and use case you provide. The report can help turn a blank assessment into a review agenda with possible risks, mitigations, questions for counsel, and a checklist. Read the actual sample report before deciding whether that structure matches the conversation your team needs.
A compliance lead using an AI Risk & Policy Simulator report still needs to verify the factual assumptions, references, and proposed actions. The report generator does not discover AI use across your company, test a production model, implement a mitigation, or approve deployment. The AI Risk & Policy Simulator does not provide formal NIST AI RMF control verification or ISO 42001 certification. If the report misses a material fact or makes an unsupported statement, document the correction rather than copying the text into the final record unchanged.
When should I involve a lawyer or qualified AI consultant?
A compliance lead should involve a lawyer or qualified AI consultant when an AI decision depends on interpreting obligations, evaluating consequential impacts, investigating a disputed result, or designing remediation. Explain the question you want answered and the evidence already available. Ask what the engagement includes, which jurisdictions or disciplines it covers, what deliverables you will receive, and which decisions remain with your organization.
An AI Risk & Policy Simulator report can make a discussion with a qualified advisor more specific, but the report is not a substitute for professional advice. Generating a report does not eliminate an advisory engagement or guarantee a reduction in fees. For matters involving confidential facts, use the advisor's approved channels and agreed handling arrangements. Do not put protected information into the AI Risk & Policy Simulator to recreate the same discussion.
Compare workload using real numbers, not invented savings
For an illustrative month with six proposed AI use cases, six AI Risk & Policy Simulator runs exceed the Free allowance of three and fit within Pro's allowance of 25. Revised scenarios consume additional runs. Enterprise is listed as Unlimited. These allowances belong to individual accounts, not a shared organization-wide seat pool. Current subscription prices and monthly or yearly billing choices are on the pricing page.
The AI Risk & Policy Simulator's monthly allowances measure available report runs, not the total effort of an AI assessment. For a manual spreadsheet process, estimate the work your team actually performs: collecting facts, checking sources, interviewing owners, reviewing evidence, and maintaining the record. For professional advice, obtain a scoped proposal. There is no assumed hourly rate, number of hours saved, or return on investment here. Compare the work that remains under each approach, not just the cost of producing a document.
Revisit the assessment when the facts change
An AI use-case assessment needs reconsideration when the deployment location, data source, purpose, human-review step, or model version changes. Keep the previous description and decision rather than overwriting the history. Identify what changed, which prior conclusions remain supported, and which questions need fresh evidence. Reassessment is a review process, not continuous monitoring performed by the AI Risk & Policy Simulator.
The AI Risk & Policy Simulator's saved report history and comparison tools require sign-in; stored reports do not establish that a reviewer has validated the differences. A spreadsheet can also hold version notes if someone maintains it. In either approach, name an owner for reassessment and escalation. If the use case is no longer clear, resolve the missing facts before relying on another generated report, and check data-handling requirements before sharing additional information.
Primary source: OECD Recommendation on Artificial Intelligence (official text) — Section 1.5 calls for traceability of datasets, processes, and decisions during the AI system lifecycle, and ongoing risk management appropriate to the actor's role and context.