Project Intake#

The more vulnerable your audience, the more safeguards you need. An internal dashboard for your team is very different from a tool used by students.

Think about who will actually interact with the finished tool — not who requested it. If a manager asks you to build something that students will use, the answer is "Students or anyone under 18."

Data that identifies real people requires more protection than internal metrics. Protected data (like student records) has legal requirements.

List every piece of information your tool will store, display, or send somewhere. If any of it could identify a real person, select "Personal data." If it includes student records, health information, or financial details, select "Protected data."

A broken prototype is a minor annoyance. A broken tool that gives parents wrong information about their child's progress is a serious problem. The potential damage determines how much testing and review you need.

Imagine the worst realistic thing that could happen if this tool showed wrong data or stopped working for a day. Pick the option that matches that scenario.

A throwaway prototype needs less documentation and review than something your team will rely on every day. Long-lived tools also need maintenance plans.

If you would need more than a day to replace this tool with something else, it is not throwaway. If people would change their daily workflow because it was gone, it is core to operations.

When AI generates content or makes decisions that affect real people, you need extra checks for accuracy, bias, and safety. The more influence AI has on what users experience, the higher the stakes.

If your tool has a chatbot, summariser, or any feature where AI writes text that users read — that is "generates content." If AI scores applicants, filters results, or recommends actions — that is "makes decisions."