AI system inventory and preliminary risk classification (ENG-D004, artifact 2)

The client, its people and its town are fictional. This is a sample, not a case study.

Prepared for Bizet & Brahms Home Goods by Joshua Garza, Touchstone Data. Approved by the owner, 2026-11-02.

This document is a professional opinion based on the evidence cited with each row. It is not legal advice and carries no warranty of regulatory compliance. The ratings are Touchstone's preliminary operational risk view, not legal categories. Every regulatory mapping is possible only, for Bizet & Brahms Home Goods' counsel to confirm.

How to read this

• One row per system: one use of a model for one purpose. Two systems are in the evidence: the proposed support assistant (AI-001, not built) and the help-desk "suggested replies" feature (AI-002, live since spring 2026).
• Evidence: every field names the file in evidence/index.md it rests on. Requirement IDs (FR, G, DH, TR, NFR, Q-C) refer to deliverables/01-requirements.md, Touchstone's draft; that draft is not a control Bizet & Brahms Home Goods has adopted.
• "unknown (to ask <who>)": the evidence does not say. The question is listed on 2026-11-02 in section 6 for the named person. Nothing has been sent, so none is answered. No question has been put to anyone yet, so this draft does not say "asked".
• Rating: high, medium or low under Touchstone's rating rules (reach of the data, autonomy, effect on people, untrusted input); when two rules apply, the higher one is taken. The reason is given with each rating.
• Findings: the gaps this inventory shows are written up as F-001 to F-012 in findings.yaml; section 5 lists them.

1. Sources and their limits

Touchstone's method draws an inventory from four sources. Only two were available.

Read the full sectionShow less›

Source	What was available	Effect on this inventory
What Bizet & Brahms Home Goods says it uses	The assistant plan (evidence/agent-proposal.md), support process notes (evidence/process-notes.md), policy sources, vendor-terms position, transcript fields	AI-001 and AI-002
Bills and contracts	The procurement file holds the URL of Anthropic's Commercial Terms of Service and the acceptance date (October 2026) and nothing else (evidence/vendor-terms.md). No invoices, SaaS admin consoles, expense reports or subprocessor list are in evidence.	Confirms the Anthropic API account behind AI-001. Other paid AI tools: unknown (to ask Mendelssohn).
Network and identity data	None. No access to client systems was granted (scope.md).	Staff use of AI tools outside the two systems: unknown (to ask Mendelssohn).
Interviews	Four interviews (COO, VP of Customer Service, Data and AI Governance Lead, support team lead)	Confirm AI-001 and AI-002. No interviewee mentioned another AI tool; nobody was asked about one, so this is not evidence that none is used.

Mendelssohn: "The risk register has no AI entries. Not the assistant, not the help-desk suggestions." (interviews/2026-10-16-mendelssohn-governance-lead.md). This inventory is the first list of AI systems in evidence. It is Touchstone's draft and reduces no risk until Bizet & Brahms Home Goods adopts and maintains it.

2. Summary

3. Inventory

Read the full sectionShow less›

Field	AI-001: proposed support assistant	AI-002: help-desk "suggested replies"
id	AI-001	AI-002
name	The assistant. Marketing has proposed "Rosie"; adopted name unknown (to ask Schumann). (evidence/agent-proposal.md)	"suggested replies" (vendor feature name as the process notes give it). (evidence/process-notes.md)
kind	agent (proposed, not built)	staff tool built into the help-desk tool. Approval: "No one recorded who turned it on." Whether any approval route exists for vendor AI features: unknown (to ask Mendelssohn). (evidence/process-notes.md)
owner	Clara Schumann, VP of Customer Service. Georges Bizet, COO, sponsors it and owns the budget: "Clara owns it; I own the budget." (interviews/2026-10-14-bizet-coo.md, stakeholders.md)	none recorded. Not in the risk register (interviews/2026-10-16-mendelssohn-governance-lead.md).
purpose	First-line assistant for website chat in six steps: disclose, verify, answer, act, flag, log (evidence/agent-proposal.md). Schumann: "The point is that it just sorts the refund out." Bizet: "Handle time is the number I care about."	"It drafts replies from past tickets; agents can send them with one click." (evidence/process-notes.md)
users and affected people	Used by: customers on website chat, with no agent in the loop for answers or actions under the plan. Output is about: customers (their orders, returns, refunds, addresses). Support agents and team leads receive handoffs. (evidence/agent-proposal.md)	Used by: about 40 support agents in two shifts. Output is about and goes to: customers who contact support by chat or email (both land in the shared inbox). Whether suggested replies run on chat, email or both: unknown (to ask Schumann). (evidence/process-notes.md)
decisions about people	Yes. The plan has it decide and carry out returns, refunds ("refund whatever the customer is entitled to under policy") and address changes, and decide which chats are "abusive or suspicious" and handed off. It decides from policy text whose three sources disagree (evidence/policy-sources.md). (evidence/agent-proposal.md)	Not directly: an agent sends or does not send each draft. A draft that states a policy term (for example a return window) shapes what the customer is told. Whether drafts state policy terms: unknown (to ask Schumann). (evidence/process-notes.md)
model and vendor	Claude, through Anthropic's API; account created by IT in October 2026. Model version: unknown (to ask Schumann). (evidence/vendor-terms.md)	The help-desk tool's vendor. Vendor name, and which model or model provider sits behind the feature: unknown (to ask Mendelssohn). (evidence/process-notes.md)
data received	Customer data, each chat turn: "the customer's name, email, shipping address, order history and order status" (evidence/vendor-terms.md); the customer's message text; policy text from the help-center page and the wiki page (evidence/agent-proposal.md). Card data: agents never see it and refunds go through the payment provider by order ID (evidence/process-notes.md); keeping it out of the assistant is DH-2. Client classification of each item: unknown (to ask Mendelssohn); no classification scheme is in evidence.	Customer data: past tickets. The help-desk export fields include customer_email, order_number and messages[] text (evidence/transcript-schema.md). Exactly which ticket fields the feature reads, and whether it reads the current incoming message: unknown (to ask Mendelssohn).
vendor terms	Anthropic's Commercial Terms of Service, accepted online in October 2026. "There is no record that anyone has read the terms' provisions on customer data, retention or training, no data processing addendum on file, and no decision on retention settings." Training on inputs, retention, data location: unknown (to ask Mendelssohn; legal reading is Q-C2 for counsel). DPA in force: none on file. On a subprocessor list: no subprocessor list in evidence. Mendelssohn: "I haven't seen the vendor terms." (evidence/vendor-terms.md, interviews/2026-10-16-mendelssohn-governance-lead.md)	unknown (to ask Mendelssohn): the help-desk contract's terms for AI features, training on ticket data, retention, data location, DPA, and whether a model provider behind the feature is a subprocessor. No help-desk contract is in evidence.
contract and policy limits	No customer contract or written client policy restricting this data or this vendor is in evidence. Whether one exists: unknown (to ask Mendelssohn). The three policy sources the assistant would answer from have no owner, version, approval or effective date, and "Nothing in any of them says which one governs." (evidence/policy-sources.md)	As for AI-001: none in evidence; unknown (to ask Mendelssohn).
autonomy	Acts alone under the plan. Actions: lookup_order (read), create_return (write), issue_refund (pay), update_address (write), handoff_to_human. "The plan states no amount limit on issue_refund and no approval step for any action." (evidence/agent-proposal.md)	Drafts for a person. The send is the agent's one click. Whether the feature can take any other action in the help-desk tool: unknown (to ask Mendelssohn). (evidence/process-notes.md)
untrusted input	Yes. Customers type into the chat, and the model reads it. Dvořák: "Customers already try 'your colleague already approved my refund' or paste in text that looks like one of our emails." Today "My people check the order notes before acting"; the plan describes no equivalent check. The only flagging mechanism is the model's own recognition: "No other mechanism is described." (interviews/2026-10-19-dvorak-support-team-lead.md, evidence/agent-proposal.md)	Yes, through past tickets, which hold customers' messages (evidence/transcript-schema.md). It holds no write permission in evidence; the send is a person's click.
human review	None before a customer sees an answer or before an action, under the plan; handoff after three failed verification tries or a flag. Refunds above $100 go to a team lead today, but Dvořák: "Nobody has asked me how that works with the bot." (evidence/agent-proposal.md, evidence/process-notes.md, interviews/2026-10-19-dvorak-support-team-lead.md)	An agent clicks send. No record on file of whether agents read or edit drafts before sending. (evidence/process-notes.md)
testing	None planned: "The plan has no test step, no pilot". Schumann: "We'll test it in production; that's where the real questions are." Dvořák: "Nobody has asked my team for example chats to test it with." Results on file: no. Testing across groups: not applicable on the evidence; no decision in the plan turns on who the customer is. (evidence/agent-proposal.md, interviews/2026-10-15-schumann-vp-customer-service.md, interviews/2026-10-19-dvorak-support-team-lead.md)	No test results on file. Whether anyone checked the drafts before or after the feature was switched on: unknown (to ask Schumann).
logging	"Chats are saved in the help-desk tool like today." The export has "no field for the policy text quoted, the tools called, or approval decisions." "Transcripts are kept until someone deletes them; nobody does." Reason for the period: none stated. Schumann: "Keep every transcript forever; it's training data for next year." Mendelssohn: "There is no retention schedule for chats. I'd propose 90 days, but it isn't adopted." Vendor-side retention: no decision on retention settings. (evidence/agent-proposal.md, evidence/transcript-schema.md, interviews/2026-10-15-schumann-vp-customer-service.md, interviews/2026-10-16-mendelssohn-governance-lead.md, evidence/vendor-terms.md)	Whether the help-desk tool records which replies were AI-drafted, and whether they were edited: unknown (to ask Mendelssohn). Tickets themselves follow the transcript position: kept until deleted; nobody deletes them. (evidence/transcript-schema.md)
off switch	None. The plan has "no named person or mechanism to switch the assistant off." Schumann: "If it misbehaves we'd raise a ticket with IT, I suppose." (evidence/agent-proposal.md, interviews/2026-10-15-schumann-vp-customer-service.md)	It was "switched on", so presumably a setting can switch it off; this is an inference. Who may decide to switch it off, and who has access: unknown (to ask Mendelssohn). (evidence/process-notes.md)
EU exposure	Yes, under the plan: Bizet & Brahms Home Goods ships to customers in the EU, and the release plan switches the assistant "on for all website chats". (evidence/process-notes.md, evidence/agent-proposal.md)	unknown (to ask Schumann). Bizet & Brahms Home Goods has customers in the EU; whether their tickets receive suggested replies is not shown. (evidence/process-notes.md)
preliminary rating	high. Four high rules apply: it acts alone with actions beyond drafting (refund, return, address change); it receives customer data each turn; untrusted chat text reaches a model holding write and pay permissions; and its output decides refunds and returns for customers.	high. It reads customer data (past tickets). On its own its other traits would rate medium (customer-facing drafts sent by a person; untrusted input with no write permission). Re-rate when the vendor terms and data flow are known. The finding about it (F-006) is rated medium because no harm is shown; the inventory rating is the rule-based view of the system.
mapping	See section 4, AI-001.	See section 4, AI-002.
open questions	Section 6: Schumann, Mendelssohn, Bizet, Dvořák, counsel.	Section 6: Schumann, Mendelssohn, counsel.

Strength recorded. Refunds are issued through the payment provider by order ID and agents never see card data (evidence/process-notes.md). If the assistant keeps that pattern (DH-2), card data stays out of the model.

4. Regulatory mapping (preliminary; for review by Bizet & Brahms Home Goods' counsel)

Every entry below is possible only, for the client's counsel to confirm. Touchstone does not decide a role, a category, or whether a law applies. Only references confirmed against their primary sources are used, and only as questions for counsel: EU AI Act (Regulation (EU) 2024/1689) Article 50(1) and 50(5) and Article 113, Maine 10 M.R.S. § 1500-DD, Utah Code §§ 13-77-103 and 13-77-104, and Moffatt v. Air Canada, 2024 BCCRT 149 as an illustration. Counsel should work from the primary texts.

Read the full sectionShow less›

AI-001: proposed support assistant

• EU AI Act, role. Possible; for the client's counsel to confirm. Bizet & Brahms Home Goods would build the assistant itself on Anthropic's model, may put it into service under its own name ("Rosie" is proposed), and would use it in its own support work. Question: is Bizet & Brahms Home Goods the provider, the deployer, or both, for this system, given that it is offered to customers in the EU through website chat? Article 50(1) places its transparency duty on providers.
• EU AI Act, transparency (Article 50(1) and 50(5)). Possible; for the client's counsel to confirm. Question: does Article 50(1) (people told they are interacting with an AI system, unless that is obvious) apply to the planned assistant for EU customers, and does the proposed first-message wording satisfy it, including the Article 50(5) requirement that the information be given clearly at the latest at the first interaction? Wording, placement and frequency are "to be decided", and Schumann does not want "'I am a bot' on every message". Under Article 113 the original text applies Article 50 from 2 August 2026; counsel to confirm the date for this client.
• U.S. state rules. Possible; for the client's counsel to confirm. Bizet & Brahms Home Goods ships across the U.S., and the evidence names Maine and Utah (evidence/process-notes.md). Question: what do Maine 10 M.R.S. § 1500-DD and Utah Code §§ 13-77-103 and 13-77-104 require of disclosure that a customer is talking to an automated assistant? Other states where customers are: to check.
• Other frameworks. No other legal or framework reference is used here; none is confirmed for this inventory. For counsel.

AI-002: help-desk "suggested replies"

• Mapping. None confirmed; for the client's counsel. Question: do the Maine and Utah rules above reach replies the feature drafts and an agent sends? The EU role question is as for AI-001 only if counsel finds the feature offered to EU customers as an AI system.

5. Findings this inventory shows

Full text, evidence excerpts and recommendations are in findings.yaml. Severity is the consequence for Bizet & Brahms Home Goods now. The launch date is not in the evidence ("before the holiday peak"); no severity was raised or lowered for a date, and each launch-dependent finding should be re-rated when the date is known.

Read the full sectionShow less›

ID	Severity	System	Title
F-001	high	AI-001	The assistant could issue refunds with no amount limit and no approval step
F-002	high	AI-001	Release plan has no test step, no pilot and no test material
F-003	high	AI-001	No named person or mechanism to switch the assistant off
F-004	high	AI-001	Customer data would go to the API each turn; the terms' customer-data provisions are unread and no DPA is on file
F-005	high	AI-001	The assistant would answer and act from three policy sources that disagree and have no owner
F-006	medium	AI-002	A live AI feature drafts customer replies with no owner, no approval record and no risk-register entry
F-007	medium	AI-001, AI-002	No AI system has been recorded or classified in the risk register
F-008	medium	AI-001	Disclosure that customers are talking to an assistant is undecided, and the owner prefers it not repeat
F-009	medium	AI-001, AI-002	Chat transcripts are kept indefinitely with no stated reason, and the owner plans to use them as training data
F-010	medium	AI-001	No decision on the API account's retention settings
F-011	medium	AI-001	The chat log would not record tools called, policy quoted or approvals
F-012	high	AI-001	Untrusted chat text reaches a model that can act, with no check other than the model's own judgement

6. Open questions by person

None has been sent. All are listed 2026-11-02.

Read the full sectionShow less›

Person	Questions
Clara Schumann, VP of Customer Service	Adopted name; model version; whether suggested replies run on chat, email or both; whether drafts state policy terms; whether drafts were checked before or after the feature was switched on; whether EU customers' tickets get suggested replies; the refund amount limit for the assistant (a parameter Bizet & Brahms Home Goods sets); the remaining AI-001 questions in deliverables/01-requirements.md section 10.
Fanny Mendelssohn, Data and AI Governance Lead	Whether an approval route exists for vendor AI features; owner for AI-002; help-desk vendor name and the model behind suggested replies; the help-desk contract's terms for AI features (training, retention, location, DPA, subprocessors); which ticket fields the feature reads; whether the help-desk tool records AI-drafted replies; who can switch AI-002 off; client data classification scheme; whether any customer contract or written policy restricts this data or these vendors; Anthropic training, retention and location settings; other paid AI tools (invoices, SaaS consoles, expense reports) and staff AI use (SSO or browser extension lists, as counts only).
Georges Bizet, COO	Launch date (needed to re-rate F-001 to F-005 and F-012).
Antonín Dvořák, Support team lead	How team-lead refund approval works with the assistant; masked example chats for testing.
Counsel (not named)	The section 4 mapping questions, and Q-C1 to Q-C4 in deliverables/01-requirements.md.

The client, its people and its town are fictional. This is a sample, not a case study.