Meet everyone in Cardiff for Socitm Cymru on Tuesday 3 November
New in Digital Trends 2026: Data is the foundation for better decisions
Use your at-a-glance guide to Socitm membership
Previous
Next

Guide |

Generative AI assessment checklists

Part of the Public Sector Digital Trends 2026 collection: Risk, ethics, procurement and post-deployment assurance

Authors and contributors: Yasmine Hajji, Diana Rebaza, Matthew Fraser, Anna Officer, Mike Manson
These assessment checklists provide help to local government and wider public sector organisations use generative artificial intelligence (GenAI) safely, responsibly and effectively, by considering key governance, ethical, operational, security, commercial and accountability questions when exploring, procuring, deploying or reviewing GenAI tools and services.

Jump to section

1. About

This resource provides practical checklists to support the safe, responsible and effective use of generative artificial intelligence (GenAI) across local government and the wider public sector.

The checklists help organisations consider governance, ethical, operational, security, commercial and accountability questions when exploring, procuring, deploying or reviewing GenAI tools and services.

  • The ‘Initial risk and ethical impact assessment checklist’ helps teams decide whether a proposed GenAI use case should proceed, what level of scrutiny it needs and which risks must be addressed before approval.
  • The ‘Supplier procurement assessment checklist’ helps procurement, digital, legal and information governance teams test supplier claims, identify gaps and gather evidence before a product, platform or service is purchased or deployed.
  • The ‘Post-deployment assurance checklist’ helps organisations confirm that safeguards are working, benefits are being realised and emerging risks are identified before go-live and at agreed review points after implementation.

Together, they support a lifecycle approach, from initial exploration and supplier assessment through to implementation, monitoring and ongoing assurance.

The checklists have been developed to align with and help organisations apply Socitm’s Policy for the Use of Generative AI. As well as in response to a gap identified across local government guidance and practice. While many organisations have adopted policies, ethical principles or standalone assessment processes, fewer have established a practical end-to-end approach covering assessment, procurement, deployment, monitoring and assurance. These checklists are intended to provide a practical framework that organisations can adapt to support responsible AI governance throughout the AI lifecycle.

They are also informed by recognised UK and international guidance, standards and good practice on responsible AI, including the Information Commissioner’s Office (ICO), UNESCO, OECD, Digital Public Services Wales, the Scottish AI Alliance, the Government of New Zealand and other public sector organisations (see ‘References & useful links’).

The resource was also developed collaboratively by Socitm and the Association of Local Government Information Management (ALGIM) in New Zealand, bringing together practical experience from local government and the wider public sector.

This resource is primarily intended for UK public sector organisations. Organisations should adapt it to their local legal, regulatory, policy and governance context.

2. Before you begin

Use these checklists to support clear, evidence-based decisions about proposed GenAI use cases. They should be used alongside existing legal, data protection, equality, security, procurement and risk processes, and adapted to your organisation’s governance arrangements and risk appetite.

The process at a glance

  1. Record the use case, owner and approval route.
  2. Classify the risk.
  3. Complete the initial assessment.
  4. Complete the supplier assessment if a third-party product or service is involved.
  5. Record the decision, conditions and actions.
  6. Complete assurance before go-live and repeat reviews during live use.
Illustration showing processes and assessments for AI

What to complete

  • Governance overview and assessment record: complete for every proposed use case.
  • Initial risk and ethical impact assessment checklist: complete before approval or implementation.
  • Supplier procurement assessment checklist: complete when buying, licensing or using a third-party product or service.
  • Post-deployment assurance checklist: complete before go-live and repeat while the system remains in use.
  • Other assessments: complete any additional assessment required by your organisation, such as a Data Protection Impact Assessment, Equality Impact Assessment or security assessment.

Not every use case needs the same level of scrutiny. If a checklist, row or assessment does not apply, record the reason.

Who does what

Please see Socitm’s Policy for the Use of Generative AI for an overview of the roles and responsibilities.

How to complete each row

Use the same outcome options across all three checklists:

  • Met: sufficient evidence shows that the requirement has been satisfied.
  • Partly met: some evidence or controls are in place, but further action is needed.
  • Not met: the requirement has not been satisfied.
  • Unable to verify: there is not enough evidence to reach a conclusion.
  • Not applicable: the requirement genuinely does not apply. Record why.

For each row, record the finding, evidence, any gap or action, owner, due date and remaining risk. Do not mark a requirement as ‘met’ without supporting evidence.

How findings affect the decision

A ‘Partly met’, ‘Not met’ or ‘Unable to verify outcome’ does not automatically decide the final position. The approval authority should judge the seriousness of each finding and decide whether the use can proceed, proceed with conditions, pause for further evidence or mitigation, or should not proceed.

Legal non-compliance, unacceptable risk of harm, or an inability to provide adequate oversight, human review, transparency or control should normally result in a pause or do not proceed decision.

Risk classification and approval

Apply scrutiny in proportion to the risk, considering the sensitivity of the data, the possible impact on people and services, and the level of reliance on AI-generated outputs.

Where indicators fall into different categories, organisations should normally apply the higher classification until a documented review supports a different decision.

Use the guide below to support an initial risk classification. Where indicators fall into different categories, apply the higher classification unless a documented review supports a different decision.

  • Low risk: internal productivity or administrative use, limited impact on services or decisions, and no sensitive or special category data.
  • Medium risk: use involving personal data, outputs that influence operational decisions, or potential service-user impact if outputs are inaccurate.
  • High risk: use affecting access to services, eligibility, safeguarding, welfare, employment or statutory decisions, involving sensitive data or vulnerable groups, or relying on AI outputs in ways that could cause significant legal, financial, operational, reputational or service harm.
  • Do not proceed or unsuitable use: proposed use that conflicts with law, regulation, policy, professional standards or public sector values, cannot be appropriately overseen or controlled, or presents unacceptable harm even with mitigation.
⚠️ Please note:

These checklists are not universal or stand-alone assessments. Organisations should adapt them to their local governance arrangements and use them as part of a wider responsible AI governance framework.

ALGIM and Socitm accept no responsibility for any loss or detriment arising from use of this document.

The content should be appropriately attributed and must not be used for commercial purposes.

3. Governance overview & assessment record

Before completing the assessment checklists, organisations should record key information about the proposed GenAI use case, including ownership, lifecycle stage, risk classification, approval arrangements and review dates.

This provides the governance context for the assessment, supports accountability and oversight, and helps ensure that the right approval and assurance processes are followed throughout the AI lifecycle.

4. Checklists

Templates can be downloaded at the end of this section.

🛡️ Initial risk and ethical impact assessment checklist

This assessment checklist is intended to support organisations in evaluating whether a proposed GenAI use case is appropriate, proportionate and aligned with organisational objectives, governance requirements and public sector values. It provides a structured framework for identifying potential risks, opportunities and mitigations across areas including governance, security, transparency, equality, ethics, legal compliance and operational delivery.

The checklist should be completed before implementation and used to inform approval, procurement and deployment decisions.

On completion, the assessment should result in one of four recorded decisions: proceed, proceed with conditions, pause pending further evidence or mitigation, or do not proceed. The decision should identify the approval authority, outstanding actions, responsible owners and review date.

Complete each row with the outcome, evidence, action status, owner and any required mitigation. Resolve or formally accept significant gaps before approval.

🛡️ Supplier procurement assessment checklist

This assessment checklist is designed to support organisations when evaluating third-party AI suppliers and solutions. It helps ensure that suppliers can demonstrate appropriate standards of governance, security, privacy, transparency, accessibility, performance and legal compliance before a solution is procured or deployed. The checklist should be used alongside existing procurement, commissioning and contract management processes to support informed purchasing decisions and responsible AI adoption.

Supplier evidence should inform, but does not replace, the organisation’s own legal, information governance, equality, security, procurement and risk assessments. The purchasing organisation remains responsible for the final decision. This checklist should be reviewed after significant changes to the GenAI use case, including changes to the model, supplier, data sources etc.

When working with suppliers, organisations should follow their established procurement and commissioning guidance and procedures, alongside the Local Government Association’s Responsibly Buying AI guidance.

Ask the supplier for documents or records that support each response. Record gaps, actions, an owner and a due date. Reassess the checklist after a significant change to the supplier, model, data or intended use.

🛡️ Post-deployment assurance checklist

This assurance checklist should be completed before go-live and repeated at regular intervals following implementation.

Before go-live: Complete the checklist review to confirm that required approvals, safeguards, mitigations, monitoring arrangements, training, escalation routes and fallback procedures are in place.

After initial live use: Conduct an early review at a point proportionate to the risk, novelty and scale of the system. This should identify issues that may not have been visible during testing, including unexpected outputs, user behaviour, access problems, complaints, poor practice or early indications of unfairness or inaccuracy.

Periodic review: Set review dates before approval, proportionate to the level of risk and potential impact. Organisations may find a review within the first six months useful once sufficient operational evidence is available. Systems remaining in use should normally be reviewed at least annually, with higher-risk uses subject to more frequent or continuous monitoring where appropriate. Agree the next review date before approval and record it in the governance record. Also record event-based review triggers.

After material changes or incidents: Repeat the relevant assessment and assurance activities following a material change to the model, supplier, intended purpose, user group, data, integrations, level of automation, hosting arrangements or contractual terms, or following a significant incident or emerging risk. Record the reason for determining whether a change is material.

Please complete the checklist with Met / Partly met / Not met / Not applicable / Unable to verify.

📁 Download the Generative AI checklists [Excel]

5. Worked example

This short example shows the expected level of detail. It is illustrative and should be adapted to the circumstances of each use case.

Example use case: internal drafting assistant

The worked example does not replace a full assessment. The amount of evidence and level of review should reflect the nature and risk of the proposed use.

6. Authors & acknowledgements

This resource has been authored and developed by:

  • Yasmine Hajji (Senior research analyst, Socitm)
  • Diana Rebaza (Senior research analyst, Socitm)
  • Matthew Fraser (Technical consultant, Socitm)
  • Anna Officer (Information governance manager, ALGIM New Zealand)
  • Mike Manson (Chief executive, ALGIM New Zealand)
ALGIM logo

ALGIM (Association of Local Government Information Management) is Socitm’s partner organisation in New Zealand, with a shared mission to bring people and technology together to improve local government services.

Socitm and ALGIM have a longstanding relationship, including collaboration through LOLA (Linked Organisation of Local Authority ICT Societies), which supports the exchange of international perspectives on local government practice.

These assessment checklists have been reviewed and approved by Socitm’s policy and research team and ALGIM’s information management team.

For questions, feedback, or suggestions regarding this template, please email us at hello@socitm.net.

Please note: This document contains content generated by Microsoft 365 Copilot, which is a type of AI. The AI generated content has been reviewed by Socitm’s policy and research team for accuracy and edited where necessary.

Acknowledgements

With thanks to the following individuals who have peer reviewed this resource at different stages of production:

  • Cath Ritchie (North Yorkshire Council)
  • Chris Baker (Norfolk County Council)
  • Dr. Kristina Khutsishvili (University of Cambridge)
  • Dr. Mark Brett (Socitm)
  • Kevin Taylor (Suffolk County Council and Socitm)
  • Kevin Woodcock (East Riding of Yorkshire Council)
  • Kurt Frary (Norfolk County Council and Socitm)
  • Martin Ferguson (Socitm)
  • Sarbjit Bakhshi (London Office of Technology & Innovation)
  • Trish Etheridge (Central Bedfordshire Council)

7. Related content

Blog posts

Case studies

Guides

Infographic

Templates

Topic hub

Whitepaper