Updated 17 October 2026. A light-touch process can be appropriate for a limited use. An undefined boundary cannot. The useful question is whether the process matches the consequences of the system’s actions.
Make proportionality concrete
Begin with the intended use and the actions available to the system. A tool that summarises public text presents a different operational situation from one that can change records or initiate payments. Treating both identically can waste effort in one place and miss risk in another.
An illustrative proportional review can reduce unnecessary process while keeping a clear permission boundary and a route to handle mistakes. The aim is not maximum paperwork. It is enough evidence to support the decision being made.
Keep legal scope separate from product judgement. A team can decide a control is useful without claiming the law mandates it. It cannot decide an applicable obligation is optional simply because it prefers a lighter process.
Revisit the assessment when the system changes. A low-consequence prototype can acquire tools, users and dependencies that make the original process inadequate. The review should follow the actual capability rather than the name the project started with.
| Question | Evidence or action |
|---|---|
| Scope | Purpose and permitted actions |
| Proportionality | Process matched to consequences |
| Change | Reassessment when capability expands |
The practical next step
Ask which evidence justifies the lighter process and which change would require a stronger one. If neither answer exists, the process may simply be light on thought.
Keep the resulting decision, its owner and unresolved questions in a short decision record. For claims about agent behaviour, connect the decision to evaluation evidence rather than relying on a successful demonstration alone.
Further primary reading: NIST AI Risk Management Framework. The review map and product recommendations above are my analysis, not a certification or a legal assessment of a particular deployment.
