Document one AI-assisted workflow with controls.

# AI-Assisted Procedure Summary Workflow

## SOP Front Page

| Field | Response |
|---|---|
| Workflow ID | AI-OPS-001 |
| Workflow Name | AI-Assisted Procedure Summary Workflow |
| Department | Operations |
| Named Owner | Department lead |
| Accountable Executive | Chief Operating Officer |
| Tool/Vendor | Approved AI writing assistant |
| Deployment Type | Approved enterprise AI account |
| Data Class | Internal procedure text; no customer NPI |
| Customer Data Involved | No |
| Regulated Process Involved | None unless the source procedure touches a regulated process |
| Risk Tier | Yellow |
| Status | Draft |
| Approval Date | YYYY-MM-DD |
| Next Review Date | YYYY-MM-DD |
| Material Error Threshold | More than 5% of reviewed outputs require material correction in a month. |
| Customer-Impacting Error Threshold | Any customer-impacting error. |
| Pause Trigger | Any prohibited input, data exposure, severe error, vendor model change, or two consecutive months over the material error threshold. |
| Restart Approval | Workflow owner plus Compliance and Risk approval. |
| Fallback Process | Complete the procedure summary manually using the approved source document and review checklist. |
| Records Retained | Final reviewed output, source reference, reviewer note, approval record, and any exception or incident ticket. |
| Last Version Reviewed | Version/date/reviewer |

---

**Department:** Operations
**Workflow owner:** Department lead
**Accountable executive:** Chief Operating Officer
**Risk tier:** Yellow
**Status:** Draft

---

## 1. Business Purpose

Use an approved AI tool to convert internal procedure text into a plain-English draft summary for staff review.

---

## 2. Approved Tool

Approved AI writing assistant

**Deployment type:** Approved enterprise AI account

---

## 3. Allowed Inputs

Approved internal procedure text, role/audience, process owner, known exceptions, review owner.

---

## 4. Prohibited Inputs

Customer names, account numbers, balances, transactions, SSNs, DOBs, confidential records, examiner correspondence, legal advice requests, SAR or AML case details, authentication details, API keys, passwords, or access tokens.

---

## 5. Prompt / Task Instructions

Rewrite the approved procedure text into a plain-English staff summary. Preserve policy meaning. Do not add requirements. Flag unclear or missing information with [VERIFY]. Label output as draft pending review.

---

## 6. Expected Output

Draft staff-facing summary with purpose, key steps, exceptions, escalation triggers, and reviewer checklist.

---

## 7. Human Reviewer

Department lead or process owner

---

## 8. Review Standard

Reviewer confirms the source meaning was preserved, no prohibited data was included, uncertain items are flagged, escalation language is accurate, and the output is labeled draft until approved.

---

## 9. Approval Checkpoint

The output may be distributed only after the human reviewer approves the final version.

---

## 10. Retention Rule

Save only the reviewed final version and source reference in the approved internal repository or toolbox. Do not retain unreviewed drafts as official records.

**Records retained:** Final reviewed output, source reference, reviewer note, approval record, and any exception or incident ticket.

---

## 11. Monitoring Thresholds And Shutoff Triggers

| Field | Response |
|---|---|
| Material error threshold | More than 5% of reviewed outputs require material correction in a month. |
| Customer-impacting error threshold | Any customer-impacting error. |
| Pause trigger | Any prohibited input, data exposure, severe error, vendor model change, or two consecutive months over the material error threshold. |
| Restart approval | Workflow owner plus Compliance and Risk approval. |
| Fallback process | Complete the procedure summary manually using the approved source document and review checklist. |

---

## 12. Escalation Triggers

Escalate to Compliance, Legal, InfoSec, or Risk if the workflow touches customer impact, credit, BSA/AML, fraud, authentication, complaints, examiner-facing material, confidential records, or uncertain regulatory interpretation.

---

## 13. Review Checklist

- [ ] Front-page control fields are complete
- [ ] Business purpose is clear
- [ ] Approved tool is named
- [ ] Allowed inputs are defined
- [ ] Prohibited inputs are explicit
- [ ] Human reviewer is identified
- [ ] Monitoring thresholds are written
- [ ] Pause and restart approvals are defined
- [ ] Approval checkpoint is documented
- [ ] Records retained are defined
- [ ] Escalation triggers are listed

---

## 14. Final Approval

| Field | Response |
|---|---|
| Reviewed by |  |
| Review date |  |
| Approved for use? | Yes / No / Conditional |
| Conditions or notes |  |
| Next review date |  |