# A worked AI decision file for a small EU firm

> Explore a synthetic AI decision file for a small EU regulated firm, with scoped questions, evidence references, responsible people and open decisions.

Canonical: https://synainesi.com/resources/worked-ai-decision-file/

**Category: Evidence.** A decision file should let another person understand what was considered, what was actually decided and what remains unresolved. A folder full of supplier documents rarely does that on its own. This worked example follows one deliberately modest workflow through a small firm’s decision process. Use the structure to organise your own discussion, including a decision to refuse or defer a proposed use.

**General information, not legal advice.** This is an original editorial example, not a prescribed regulatory file or evidence of an actual approval. **Everything in the example is fully synthetic:** the firm, people, service, documents, observations and decisions. Cedar Quay Advisory is an invented small EU investment firm. No national authorisation, supervisory finding or legal classification is asserted. Local requirements and the firm’s actual activities would need separate qualified assessment.

## The decision in one paragraph

**Synthetic file CQ-DF-04, revision 2.** The operations team proposes using an AI service to prepare draft summaries of approved public regulatory publications for internal review. It requests permission for research staff to submit public text through a named service route. It does not request permission to analyse client files, change policy, send communications externally or make individual decisions. The fictional decision is **defer use until two evidence gaps close**. Existing manual research continues. No employee is authorised to treat this file as permission for a broader workflow.

## 1. Define the need and the alternatives

The problem statement is specific: research staff need a consistent draft structure for public-source briefings. The request does not assume that AI is necessary. Alternatives recorded in the file are a shared manual briefing template, improved source alerts and a narrower AI drafting step. The business owner, the operations lead, must explain why the proposed route is worth its additional review and oversight. No time-saving estimate or improved-quality claim is inserted without supporting evidence.

The acceptance question is also bounded: can a trained reviewer identify unsupported statements and confirm each material point against the source before circulation? “Produces good summaries” is too vague. The file asks what counts as a material omission, who checks changes in legal meaning and what happens when source text is ambiguous. The reviewer may reject the draft and use the manual process. That outcome is part of the workflow, not a failure to adopt AI enthusiastically enough.

## 2. Draw the proposed information path

```
SYNTHETIC PROPOSED FLOW
Approved public publication
  → research analyst selects public passages
  → designated service endpoint receives those passages
  → draft returns to internal research folder
  → assigned reviewer checks against original sources
  → authorised person circulates approved internal briefing

Excluded: client files, staff records, account credentials,
restricted annotations, external recipients, automatic policy changes.

Unresolved: service-side content retention and endpoint-change authority.
Stop condition: any input outside the approved public-source class.
```

The data-flow owner checks each arrow rather than accepting a diagram as evidence. Public source text can acquire restricted context when someone adds a note about an individual or an internal concern. The synthetic file therefore excludes internal annotations from submissions. It also distinguishes the service operator from the model label. A named endpoint in a proposal is not proof of its processing destination or settings; those statements need supporting evidence for the actual route.

## 3. Give every question an owner and an evidence test

| Decision question | Responsible role and synthetic evidence | Recorded position |
| --- | --- | --- |
| What exact purpose is requested? | Operations lead; E01 workflow statement and excluded-use list. | Public-source internal briefing drafts only. Scope is sufficiently clear for assessment. |
| Which service route and settings apply? | Security lead; E02 endpoint configuration record. | Route identified. Authority to alter settings remains unresolved. |
| What does the service retain? | Procurement lead, with data protection reviewer; E03 unanswered evidence request. | Unresolved. No assumption is made from general marketing material. |
| Can staff review the draft meaningfully? | Research lead; E04 synthetic exercise pack and reviewer comments. | Exercise includes missing context and invented citations. Reviewer guidance needs revision before use. |
| Which legal and regulatory questions apply? | Compliance lead with qualified counsel; E05 applicability questions. | Assessment pending. No AI Act classification, supervisory position or legal conclusion is recorded. |
| Who can stop and restore the workflow? | IT service owner; E06 suspension procedure. | Draft procedure exists. Demonstration and deputy contact still required. |

The evidence labels are deliberately not hyperlinks: there are no real supplier records behind this fictional file. In a real file, each reference should identify a retrievable item, its revision, owner, access location and the question it answers. Keep “requested”, “received” and “reviewed” separate. A received document may not answer the question. A reviewer should record the gap rather than mark a whole supplier folder as checked.

## 4. Record the hard questions without manufacturing certainty

The synthetic compliance lead opens an applicability sheet instead of copying a generic list of obligations. It asks: what is the actual AI use, what role does the firm have, which people may be affected, could the output enter an individual decision, and which existing sector, information-handling and recordkeeping requirements need consideration? Each question has a named reviewer. This resource supplies no answer about the law applicable to a real investment firm. The useful discipline is to keep that assessment visible and separate from technical suitability.

The team also asks what it cannot know from the proposed records. A request log might show that a draft was generated, but not whether the reviewer understood a subtle omission. A signed decision file might show who accepted a restriction, but not whether staff followed it. These limits become verification questions: inspect the actual route, exercise the review process and check what evidence the target system leaves. Do not treat documentation as a substitute for observation.

## 5. State the decision, conditions and reopening triggers

```
SYNTHETIC DECISION RECORD
Decision: DEFER. No permission to start the proposed AI workflow.
Decision owner: accountable operations director (fictional role).
Reason: route-change authority and content-retention evidence unresolved.
Additional preparation: revise reviewer guidance; demonstrate suspension.
Alternative while deferred: existing manual public-source briefing process.
Closure owners: security lead (route); procurement lead (retention).
Closure evidence: assessed configuration and contract/service evidence,
with each unresolved question answered or a restriction proposed.
Reconsideration: named decision owner reviews a new revision of this file.
No automatic approval: closing a task does not itself change the decision.
Reopen after approval if: purpose, data class, service route, model,
connected tools, material terms or reviewer responsibilities change.
Record access owner: compliance lead.
Retention and disposal decision: to be assessed for the actual file.
Approval signatures: none; this is a synthetic teaching example.
```

The wording makes the next move clear. The security lead cannot approve the whole workflow merely by closing the route question. The procurement lead cannot decide that an unknown retention setting is acceptable for everyone. The accountable decision owner considers the updated evidence and records a fresh decision. If the proposal becomes a different workflow during that process, the scope statement changes visibly; it does not drift through an informal email chain.

## Reuse the structure in your own firm

Create a cover sheet with the request, purpose, excluded uses and decision state. Add a data-flow sketch, an owner-and-evidence table, an applicability-question sheet and a decision record. Keep sensitive evidence in its controlled location and reference it instead of duplicating it. Ask someone outside the proposing team to read the file: can they tell whether use is allowed, what remains unanswered and who may decide next? If they cannot, improve the file before adding more documents.

Related: build the permitted-use detail with the [model approval register](https://synainesi.com/resources/model-approval-register/) and the [agent approval matrix](https://synainesi.com/resources/agent-approval-matrix/); examine [what an AI decision record can and cannot prove](https://synainesi.com/resources/ai-decision-record-limits/). Continue with [Evidence without surveillance](https://synainesi.com/insights/evidence-without-surveillance/), [governance principles](https://synainesi.com/trust/), [workflow questions](https://synainesi.com/solutions/) or [all resources](https://synainesi.com/resources/).

---

Synainesi: AI within your rules.

Source: https://synainesi.com/resources/worked-ai-decision-file/. The HTML page is canonical; this Markdown version is provided as a convenience.