06  Build your shortlist

You have read about the categories, the failure modes, and three different teams. Now you build your own shortlist. Three practices to go.

Practice 3 · Write your risk profile10 minutes

You have just read three risk profiles. One is closer to yours than the others. Use it as a scaffold: adapt its structure, not its content. Write three to five sentences answering these for your own context.

  • Public visibility. Could a misstep make the news? Internal news? A complaint to a regulator?
  • Data sensitivity. What data are you handling? Personal, financial, clinical, regulatory, commercially sensitive?
  • Regulatory exposure. What specific rules apply to your sector? Privacy law, sector codes, advertising standards, professional standards?
  • Audience vulnerability. Is anyone in your audience reasonably foreseeably going to be harmed if you get this wrong?
  • Sector trust expectations. What do your audiences, peers, and regulators assume about how you operate?

Three to five sentences. Do not write a memo. Capture what is true about your context. This is the foundation everything else rests on.

Worked example, Team A. We produce communication for a federal regulator in a high-scrutiny consumer-protection space. Our outputs reach the public, the regulated sector, the press, and parliamentary committees. Recent policy changes have made the topic politically sensitive. We handle commercially sensitive information from regulated entities and draft material that may be cited in parliamentary proceedings. Our regulatory exposure includes the Australian Privacy Principles and APS communication standards. A misstep would make sector news within hours and national news within a day. Our audiences expect technical accuracy, evidence-led framing, and political neutrality.
Practice 4 · Pick your tools15 minutes

For each category where you marked AI as helping or could-help (from Practice 2), pick the specific tool you will use. Then write a one-line rationale connecting the tool to your risk profile. Aim for three to five tools: more than five is too many for a one-page artefact; fewer than three usually means you are under-counting what AI is doing in your work.

The criteria

  • Pick the tool that fits your risk profile, not the highest-performing tool.
  • Where two tools are close, pick the one you can explain in one sentence.
  • If a category needs a tool but you do not know which one yet, name the category and write "tool to be selected, criteria: [your one-line criteria]." That is an honest position. An undecided category that has not been thought about is not.

What goes in each row

  • Tool. The specific tool, including account type or version (Claude Enterprise, not just Claude).
  • Category. One of the five categories.
  • What you will use it for. One short phrase: the specific kind of work.
  • Risk-profile match. One line connecting the tool to a specific element of your risk profile.
Worked example, Team A, one row. Tool: Claude Enterprise. Category: Conversational AI. Use: sensitive drafting and summarising of public-facing material. Risk-profile match: configured to retain no inputs, appropriate for a high-scrutiny sector.
Practice 5 · Exclusions and review10 minutes

First, exclusions. Name at least one tool, feature, or use case you have decided not to adopt. Write one sentence: the reason, and what would make you reconsider. This is the half of the shortlist practitioners most often skip, and the half that makes the document useful. Without naming what you will not use, you leave the question open every time you face it. Naming the exclusion closes it.

Then, review cadence. One sentence: when will you come back to this shortlist, and what would make you look again earlier than planned? One or two exclusions is enough for Week 1. Do not over-engineer.

Excluded: AI-generated images of identifiable people. Reason: brand and disclosure risk. Would reconsider when sector disclosure standards mature.  |  Review: at the start of each quarter, and earlier if a tool changes its data-handling terms or I take on a project that materially changes my risk profile.

When the three practices are done, capture the shortlist in the AI Tools Shortlist builder on the next page. It saves as you type and exports to Word, and Week 6 pulls it into your Playbook.