How to choose

Which tier does a use case need? Five questions

1. About a person? Credit, hiring, insurance, housing and health care are where almost every rule and lawsuit sits. A tool drafting marketing copy and a tool ranking applicants can run on the same model and need very different treatment.
2. On a list? Check the EU's prohibited practices and high-risk categories, the state laws on hiring and insurance, and your sector's rules. A prohibited use stops at assessment; a listed one goes to the top tier.
3. Your role? Under the EU AI Act, putting your name on a system, changing it substantially or using a general-purpose model for a high-risk purpose makes you its provider, with every provider duty. In the US a vendor whose tool screens or ranks people can be sued as its customer's agent.
4. How exposed? Banks score materiality from exposure and purpose, and that works anywhere. Re-tier when volume grows.
5. Can you show it? If you can't produce the inputs, outputs and approval for one applicant two years later, or re-run your tests on a new model version within the vendor's notice period, the use case needs more control before launch.

My defaults: three tiers. The top tier is anything that makes or shapes a decision about a person or sits on a regulator's list: independent testing and bias testing before launch, a named reviewer with authority to override, logs kept as long as the longest rule that applies, re-testing on every model change and a yearly review. The middle tier covers customer-facing tools that decide nothing: team testing, a governance review, an AI disclosure and monitoring. The low tier is internal productivity on approved vendors: a register entry, an acceptable-use policy and a self-serve intake that takes a day, because a slow lane sends people to personal accounts. I'd record the vendor and model version on each use case, so a retirement notice tells me which ones to re-test.