---
title: "Set the high-risk report and the twelve-month review after a decision to deploy"
url: "https://ailawframework.com/obligations/ai-decision-systems/set-the-high-risk-report-and-the-twelve-month-review-after-a-decision-to"
type: "task"
site: "AI Law Framework"
id: "A45-WR20261022-9"
practice_area: "AI decision systems (the firm's and clients')"
tier: "yellow"
lawyer_review: "required"
last_reviewed: "2026-10-22"
---

# Set the high-risk report and the twelve-month review after a decision to deploy

> From the completed impact assessment, copy the inherent risk rating the lawyer has recorded.…

Canonical page: https://ailawframework.com/obligations/ai-decision-systems/set-the-high-risk-report-and-the-twelve-month-review-after-a-decision-to  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [AI decision systems (the firm's and clients')](https://ailawframework.com/obligations/ai-decision-systems.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | From the completed impact assessment, copy the inherent risk rating the lawyer has recorded. If that rating is medium, note that the page says the agency should consider governance through a designated board or a senior executive, appropriate to the agency's size and scope. If the rating is high, list the musts on the page: report the use case to the agency accountable official with the reasons for the inherent high-risk rating, the proposed mitigations and the residual risks; govern it through a designated board or a senior executive; and, once the agency has decided to deploy, report it to the Digital Transformation Agency through the accountable official and set a review at least every 12 months that reports to that board or executive on whether the use case is operating as intended and risks are being managed, and that considers the impact assessment and any revision. Do not assign the rating. |
| What the lawyer must review | The lawyer confirms the inherent rating, what is reported to the accountable official, and whether deployment has been decided so that the twelve-month review and the Digital Transformation Agency report are due. A medium rating is a 'should' on the page, not a must. |
| Written for / versions | 1 jurisdiction versions below |

## Checking plan

**Source-by-source verification**

Trace relied-on content to independent sources and check for relevant material the output has missed.

- What the AI does: From the completed impact assessment, copy the inherent risk rating the lawyer has recorded. If that rating is medium, note that the page says the agency should consider governance through a designated board or a senior executive, appropriate to the agency's size and scope. If the rating is high, list the musts on the page: report the use case to the agency accountable official with the reasons for the inherent high-risk rating, the proposed mitigations and the residual risks; govern it through a designated board or a senior executive; and, once the agency has decided to deploy, report it to the Digital Transformation Agency through the accountable official and set a review at least every 12 months that reports to that board or executive on whether the use case is operating as intended and risks are being managed, and that considers the impact assessment and any revision. Do not assign the rating.
- What the lawyer does: The lawyer confirms the inherent rating, what is reported to the accountable official, and whether deployment has been decided so that the twelve-month review and the Digital Transformation Agency report are due. A medium rating is a 'should' on the page, not a must.
- Who reviews: Responsible lawyer with competence in the matter
- Basis: Practical workflow informed by the linked primary sources; the traffic light and working checks are editorial guidance, not a court classification.
- Why: The level reflects what the work is, the consequence of an error, and how much of the output the lawyer must independently re-derive.

## Checks the lawyer makes

1. Use only the inherent rating written on the completed assessment. Do not calculate a new rating.
2. Keep the medium-risk governance step as a should, and the high-risk report and board or executive governance as musts.
3. Start the twelve-month review and the report to the Digital Transformation Agency only after the lawyer records that deployment has been decided.

## Notes

- These are suggested working checks. Confirm the required checking with the responsible lawyer before work starts; the checking approach does not establish permission to use AI.

## Sources

- [Digital Transformation Agency: AI use case impact assessment](https://www.digital.gov.au/ai/ai-in-government-policy/ai-use-case-impact-assessment) (checked 2026-10-22)

## Jurisdiction versions

| Jurisdiction | Level |
| --- | --- |
| [United States](https://ailawframework.com/obligations/ai-decision-systems/set-the-high-risk-report-and-the-twelve-month-review-after-a-decision-to/united-states.md) | Yellow |

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*