Using AI to check whether internal AI usage requests follow AI usage guidelines

At one company, the DX Office began receiving dozens of generative AI usage requests from business teams each month. Each form states the purpose, tool, and input data, but reviewers still manually judge each request against internal AI guidelines, APPI, and confidentiality classification policy.

The guideline set spans multiple documents, with prohibited uses, risk classifications, and confidential information handling spread across different pages. Interpretation varies by reviewer, and approval criteria become person-dependent in practice. Reviews concentrated on a few people and became a bottleneck.

First, there is no complex setup."Check whether the request conflicts with guidelines or prohibited uses, with supporting evidence."We entered that in the same language a team member would use with a manager. The AI then built the required review steps automatically.

No programming knowledge or complex rule configuration is required. The generated workflow can be reviewed and edited, then reused across future requests with the same checks.

After saving and running the workflow, AI checks each aspect of the request against the guidelines. The results are consolidated on one screen. The key point isevery decision includes the exact guideline and clause used as evidence so reviewers do not have to take the AI conclusion on trust. Tapping a row opens the source text.

The 4 items AI marked as passing have evidence attached and can be checked quickly. Human judgment is reserved forthe 2 needs-review items and 1 non-compliant item, 3 items in total. The reviewer returned the prohibited-use request to the drafting team, confirmed the revised scenario that removed personal data input, and finally approved and locked the result.

Every action and decision is recorded in a tamper-proof audit log. Teams can later trace who decided what, when, and based on which evidence, and reuse that record for internal audits and governance reporting.

Request reviews that had depended on reviewer experience and memory can now be judged against the same criteria regardless of reviewer. Most importantly, prohibited-use conflicts were reliably detected before approval.

This example focused on AI usage requests, but INDX Compliance works the same way across use cases.Provide the standard documents, such as guidelines, laws, or internal rules, along with the documents to check, such as applications, contracts, or policies, and compare them with evidence attached. The same workflow applies to internal policy consistency checks, contract reviews, ISO audit preparation, and any operation that requires checking documents against rules.