How to build an AI governance register that tracks AI system risk assessments and human-review sign-off in Formaloo

An intake form where anyone in your org registers an AI system before it goes live: what it does, what data it touches, how autonomous it is, and who owns it. The moment someone submits, Formaloo does two things automatically: calculates a numeric risk score from the answers, and generates a private, AI-written risk explanation that only your team sees. A compliance or AI governance reviewer then reads both, makes a real decision, and signs off, before the system is ever marked approved for use. Every registration, score, AI read, and decision lives in one auditable record.

This is where every AI system enters the register. The fastest way to build it is Magic Create, since most of these fields are standard intake questions.

1. Open Magic Create: From your Formaloo homepage, click Magic Create. Describe the form in plain text.

2. Paste this prompt: "Create an AI system registration form. Public fields: name of the AI system or tool (short text), department that owns it (short text), business owner name (short text), business owner email (email), what the system does (long text), vendor or model powering it (short text), types of data it processes (multi-select dropdown: Public/non-sensitive, Internal business data, Personal data (PII), Special category data), how sensitive the most sensitive data is (dropdown: Public/non-sensitive, Internal business data, Personal data (PII), Special category data — health, biometric, etc.), whether it makes or influences a decision about an individual (yes/no), a description of that decision (long text), how much human oversight happens before its output is acted on (dropdown: Suggests only, Human approves each action, Acts automatically within limits, Fully autonomous), who or what it reaches (dropdown: Single team, Multiple departments, All employees, External customers/public), deployment stage (dropdown: Planned, Pilot, Production), and a confirmation checkbox that the information is accurate. Admin-only fields: risk tier (dropdown: Low, Medium, High), review status (dropdown: Pending review, Under review, Changes requested, Approved for use, Rejected), reviewer (assignee field), reviewer decision notes (long text), review sign-off date (date), internal notes (long text)."

3. Click Create: Magic Create builds the form and generates field IDs for you.

4. Verify your form: Your form should look like this. Magic Create will have generated most of it, so verify each field and field ID matches exactly.

Four hidden variables turn the submitter's choices into numbers, and a formula adds them up into a single risk score. None of this shows up on the form itself.

1. Open Advanced logic: In the form settings panel on the right side of the form editor, click Advanced logic.

2. Add four numeric variables: In the Variables tab, create four Formula-type variables: data_sensitivity_score, decision_impact_score, autonomy_score, and scale_score. Leave their default values at 0 for now, they'll be set by logic below.

3. Add the risk score variable: Create a fifth Formula variable, risk_score, with the default formula data_sensitivity_score + decision_impact_score + autonomy_score + scale_score. This recalculates automatically every time the four inputs change.

4. Open Magic Logic: Navigate to the Logic tab and click Magic Logic in the top right corner.

5. Paste this prompt: "When Data sensitivity equals Public/non-sensitive, set Data sensitivity score to 0. When it equals Internal business data, set it to 1. When it equals Personal data (PII), set it to 2. When it equals Special category data, set it to 3. When Does this system make or influence a decision about an individual equals Yes, show Describe the decision and set Decision impact score to 2. When it equals No, keep Describe the decision hidden and set Decision impact score to 0. When How much human oversight happens equals Suggests only, set Autonomy score to 0. When it equals Human approves each action, set it to 1. When it equals Acts automatically within limits, set it to 2. When it equals Fully autonomous, set it to 3. When Who or what does this system reach equals Single team, set Scale score to 0. When it equals Multiple departments, set it to 1. When it equals All employees, set it to 2. When it equals External customers/public, set it to 3. When Risk score is between 0 and 3, set Risk tier to Low. When Risk score is between 4 and 7, set Risk tier to Medium. When Risk score is between 8 and 12, set Risk tier to High. When I confirm this information is accurate equals No, show a warning message."

6. Review the generated rules: Approve each rule, or redo any that don't match. Once approved, Formaloo applies them for a final review.

7. Save your logic: Click Save in the top right corner of the Logic panel.

This is what makes the risk assessment genuinely AI-based rather than just a weighted score. Formaloo's AI Analysis field reads the submission the moment it comes in and writes a private risk explanation, stored as real row data, that the submitter never sees.

1. Open the Add field panel: In your form editor, click Add field and find AI Analysis.

2. Add it to your form: Click AI Analysis to drop it onto the canvas. It arrives admin-only by default, and that can't be turned off, there's no setting anywhere that exposes it to the person filling out the form.

3. Write the prompt: Open the field's prompt box and use the @ menu to pipe in the risk-relevant answers: "Based on @data_sensitivity, @impacts_individuals, @decision_description, @autonomy_level, @scale_reach, and @vendor_model, write a short risk assessment of this AI system. Note any specific concerns a compliance reviewer should look into before approving it. Keep it to one short paragraph."

4. Set a clear field ID: Name it ai_risk_analysis so you can reference it in emails and the PDF later. Give it a title like "AI risk analysis" so it's a clear column header in your Responses table.

5. Publish your form: Click Publish in the island bar at the top of the editor to make the field live.

Four templates keep everyone informed without anyone having to check the register manually.

1. Open Custom Email Templates: Click your profile icon, go to Apps and Integrations, and open Custom Email Templates. Click Add New Template.

2. Build the registration confirmation: Clear the body, add an AI block, and enter this prompt: "Write a short, calm confirmation to the business owner who just registered an AI system. Confirm you've received the registration for @ai_system_name in @department. State plainly that it is now pending risk review and cannot go into production until a reviewer approves it. Mention the reference number AIGR-@rowid. Keep it factual, 3-4 sentences." Set the subject to Your AI system "@ai_system_name" has been registered for review, name the template, and save.

3. Build the reviewer notification: Add a second template. Prompt: "Write a brief internal notification to the AI governance team. Open with @ai_system_name, @department, and @risk_tier. Include the AI-generated risk read from @ai_risk_analysis as its own block. State the numeric risk score. End with a direct call to review and set a decision." Subject: New AI system to review: @ai_system_name (@risk_tier risk).

4. Build the decision update: Add a third template. Prompt: "Write a clear status update to the business owner. State the new review status, @review_status, plainly and early. If approved, confirm the system is cleared for use and note the sign-off date, @signoff_date. If changes are requested or it's rejected, reference @reviewer_notes so they know what to address." Subject: Update on your AI system registration: @ai_system_name.

5. Build the high-risk escalation: Add a fourth template. Prompt: "Write a short, direct escalation to leadership. State that @ai_system_name in @department has been scored High risk. Summarize the reason using @ai_risk_analysis. Make clear this requires senior review before approval. Under 100 words." Subject: High-risk AI system flagged: @ai_system_name.

6. Connect the triggers: In Advanced logic, add rules so the registration confirmation and reviewer notification both fire on submit, the decision update fires when Review status changes, and the high-risk escalation fires when Risk tier is set to High.

Every reviewed system gets a self-contained record: the submitted details, the numeric risk score, the AI risk read, and the reviewer's decision, in one document.

1. Open Custom PDF Template: Click your profile icon, go to Apps and Integrations, and open Custom PDF Template. Click Add New Template.

2. Switch to HTML view: In the template editor, switch to the HTML view.

3. Paste the template code: Paste the following code in full. It uses @field_id piping to pull in the system details, the calculated risk tier, the AI risk read, and the reviewer's sign-off, plus @rowid for a unique reference number instead of a separate tracking field.

4. Name and save: Give the template a name like "AI system risk review record" and click Save.

5. Attach it to the reviewer notification email: Open the reviewer notification template from Part 4, attach this PDF template to it, so the reviewer gets the full record alongside the email.

This is a fully internal workflow. Business owners registering systems and the AI governance team reviewing them are both workspace members, so every page here uses internal access, not external portal roles.

1. Start from Dashboard: Create a new project and start from Dashboard so you have an empty canvas to build these pages on, then connect your registration form to it.

2. Build "Register an AI system": Add your form as a page. Access: internal users, all workspace members.

3. Build "My registered systems": Add a Table data block filtered to business_owner_email equal to the logged-in user, sorted newest first. In Edit Mode, click Options, scroll to Manage Access, and turn on Allow users to view only their data on the business_owner_email field.

4. Build "All AI systems": Add a Kanban board grouped by Review status. Access: internal users, AI Governance team only.

5. Build "My assigned reviews": Add a Table filtered to reviewer equal to the logged-in user, newest first. Access: internal users, AI Governance team.

6. Build the status queues: Add four more Tables for the AI Governance team: "High risk queue" (Risk tier = High, oldest first), "Pending review" (Review status = Pending review, oldest first), "Approved systems" (Review status = Approved for use, newest first), and "Changes requested & rejected" (Review status = Changes requested or Rejected, newest first).

7. Restrict the AI Governance team's pages: For each page in steps 4-6, click the three-dot menu next to the page name, select Access, and under internal users, restrict access to the AI Governance team specifically, rather than leaving it open to every workspace member.

8. Add a Reports group: Add two Chart pages, "Risk distribution" (bar chart grouped by Risk tier) and "Systems by department" (bar chart grouped by Department). Access: internal users, AI Governance team.

9. Share your portal: Once every page and access level is set, share the portal link with your workspace so business owners and the AI Governance team can start using it.

A single register where every AI system in your org gets recorded, scored, and reviewed the same way, instead of living in scattered spreadsheets or Slack threads. Every submission gets an automatic numeric risk score and an independent AI-written risk read, so reviewers start with two informed opinions instead of a blank page. Nothing gets marked approved for use until a named human reviewer actually makes that call, and every registration, score, AI read, and decision is captured in one auditable PDF record. When someone eventually asks what AI you're running and who signed off on it, you have a real answer.

Don't build this from scratch, we've already put it together for you.

AI lead qualification & scoring form — Scores incoming leads with AI and routes hot and cold leads differently. The same scoring-plus-AI-read pattern used here for lead quality maps directly onto scoring AI system risk.

Scholarship & grant application with scoring and approval — A multi-reviewer scoring workflow with auto-calculated scores and approval/rejection emails. Swap grant criteria for risk criteria and the approval gate works the same way.

Employee request workflow — Internal request routing with status tracking and reviewer assignment. A close structural match for any internal registration-and-approval process like this one.