Category: Controls and Evidence. Practical tools. Hard questions. Better decisions.
Our vision is a bigger future for AI in regulated work. That future needs people who can make clear decisions about authority, information and responsibility. These resources are a contribution to that work: original worksheets, synthetic examples and questions you can use without buying anything. No registration is needed. Copy the tables into your own documents or use each page’s Markdown alternate. There is no requirement to adopt Synainesi, choose a particular supplier or follow a prescribed technology architecture.
Start with the decision in front of you
Do not begin by filling every register. Start with one actual task and the decision that is holding it up. Who wants to use AI? Which information would enter the request? What could the result cause someone to do? Which person has the authority to allow that use? Write the unanswered question in a sentence before collecting evidence. A folder full of supplier material is less useful than a precise question linked to the document that answers it.
For a small team, one working session can establish the boundaries of a proposed use without pretending to settle every issue. Invite the person doing the work, the person accountable for its outcome and someone able to challenge the data and access assumptions. Keep a list of unknowns. Assign each unknown to a role and specify what evidence would close it. A missing answer should remain visible rather than becoming an implied acceptance through silence.
Choose a tool by the question it answers
- Agent approval matrix — Who may authorise an action, and what happens when its destination or payload changes? Start here when an agent could send, update or submit something. Use the blank fields and completed synthetic rows to separate permission to propose from permission to act.
- Model approval register — Which model, deployment and task have actually been considered? Use it when “we approved the provider” is doing too much work. Record the permitted data, evidence, restrictions and withdrawal triggers alongside the model identity.
- Worked AI decision file — What does a small firm’s unresolved decision look like on paper? Follow a fully synthetic case connecting questions, evidence, accountable roles and open decisions. Use the structure to keep a narrow permission from becoming permission for an entire business process.
- AI acceptable-use policy starter — What should a colleague do before using a new tool or sharing unfamiliar data? Adapt the policy clauses, exception route and escalation path to your organisation. Connect the policy to actual owners and registers so it can guide a decision during the working day.
- AI literacy under Article 4 — What could a deployer show about its literacy measures? Use the role-and-task worksheet to connect learning activity with the context of use. The resource distinguishes the primary-source wording from suggested evidence and avoids treating attendance as proof of judgement.
- Article 26 deployer checklist — Which high-risk deployer questions need an owner and evidence? Start with applicability, then work through the relevant obligations. Do not use the checklist as a blanket classification of everyday AI or as a substitute for checking the system’s role and use.
- DORA and AI services — Which supplier is doing what, and what would happen if that service changed or failed? Map the workspace, model access, inference hosting and other dependencies separately. Use the questions to request evidence about oversight, service boundaries and an exit that somebody could actually execute.
- Shadow AI response plan — How can a team respond to an unapproved use without driving the work further out of sight? Follow an intake, containment and decision process. Record what is known, preserve appropriate evidence and give the person doing the work a clear route to a safer alternative.
- Prompt pseudonymisation — What could a recipient still learn after names are replaced? Work through synthetic prompt transformations, contextual identification and mapping access. Use the checklist before sending, including the possibility that the right decision is to remove more context or withhold the request.
- AI decision records and their limits — What can a record support, and what remains unknown? Examine a synthetic schema and reconstruction questions. Separate a recorded policy outcome from proof of the underlying content, the user’s understanding or the correctness of a later business decision.
Use the tools together without duplicating the work
A model approval and an agent permission answer different questions. A model can be considered suitable for drafting an internal note while an agent using that model remains forbidden from sending the note outside the organisation. Link the model row to the agent row using stable identifiers. Keep the task’s decision in one place and reference it elsewhere. Repeating the same wording across several documents creates competing versions that drift as soon as someone changes one of them.
The acceptable-use policy gives people a route into those decisions. The literacy worksheet helps a manager explain that route through realistic tasks. The decision file keeps the evidence and unresolved questions together. A decision record can later support a reconstruction of a particular event, but it cannot repair a missing approval or establish that the policy was sensible. These are complementary ways of asking better questions, rather than interchangeable badges of assurance.
Agree what would change the answer
Before closing a decision, name the changes that would require another look. A new model identity, a different processing destination, expanded agent permissions, new data types or removal of a human review step can each change the question you thought you had answered. Assign responsibility for noticing those changes. Include a route to suspend the permission while the new facts are checked. A review date alone is weak protection against a material change that happens immediately after the review.
Make the final check practical: ask a colleague who was not in the meeting to describe what is allowed, what is excluded, where to find the supporting evidence and whom to contact if the conditions fail. If they cannot tell, simplify the decision. The useful outcome is a boundary people can understand and operate, with the unanswered questions still attached. It is not the number of completed cells.
Read the foundations and check the source
For the arguments behind these tools, read A setting is not a control, Agents have permissions, not trust and Evidence without surveillance. The Trust hub connects those ideas with our principles, the Solutions hub starts from workflow needs, and our AI workspace vision explains the future we want to help build.
Qualification: These resources provide general information, not legal advice. Templates are editorial tools, not prescribed regulatory forms. All worked examples and example organisations are fully synthetic. Check the primary sources linked in the individual regulatory resources, their current wording and the rules applicable to your own organisation before relying on a conclusion.