scenarios-product.md

Product AI Integration Scenario

Read this file for customer-facing or partner-facing AI features, embedded AI systems, recommendation engines, copilots, conversational interfaces, or automated decision-support features.

Typical Examples

• AI chat or drafting features in a SaaS product
• Recommendation or ranking systems
• AI-generated summaries, documents, or classifications
• Decision-support tools that influence user or business outcomes

Typical Risk Areas

• Hallucinations or misleading outputs
• User overreliance
• Inadequate disclosure that AI is involved
• Bias, unfairness, or discriminatory impact
• Product liability, consumer protection, or deceptive-practice exposure
• Model drift after deployment
• No continuous improvement

Required Questions

• Who are the intended users and how consequential are the outputs?
• What user decisions or downstream actions may depend on the AI output?
• What data is used for inference, personalization, retrieval, or tuning?
• What user disclosures, labels, or challenge mechanisms exist?
• What human review, escalation, or override controls exist?
• What testing exists for quality, fairness, abuse resistance, and production monitoring?
• Has an AI impact assessment been completed or required?
• What technical documentation, model card, or architecture overview exists?
• Will users clearly know AI is being used?
• What disclosures, instructions for use, or confidence/explanation cues are shown to users?
• What red-team testing, incident response, and post-launch monitoring plan exist?
• What approvals, accountable owners, and escalation paths are already in place?

First Intake Set

Use this grouped intake set first when facts are missing:

• What is the AI product feature and what user problem does it solve?
• Who are the intended users and how much may they rely on the outputs?
• What model, vendor, or AI capability is being used?
• What data types are used for inference, retrieval, tuning, or personalization?
• Will users know AI is being used and what disclosures or instructions will they see?
• What human oversight, testing, red-team, incident response, and monitoring controls exist?
• Do you have an AI impact assessment, technical architecture, disclosure copy, or testing materials?

Review Focus

• Risk classification and prohibited-use screening
• Transparency and user-facing disclosures
• Human oversight and escalation paths
• Testing, staged rollout, monitoring, and change management
• Affected-party analysis and non-AI legal exposure