Intake forms

Overview

Intake forms let anyone in your organization request a new AI use case or register a model without needing a VerifyWise account. You publish a public form, share the link and submissions land in your governance queue for review. When you approve a submission, VerifyWise creates the use case or model inventory entry and carries over the risk score from the intake.

Without this, the gap between "someone wants to launch an AI project" and "the governance team finds out" usually gets filled by ad hoc emails or a spreadsheet that nobody updates. Intake forms replace that with a repeatable path: request, score, review, approve or reject.

How it works

1. Build: Create a form in the drag-and-drop builder. Choose field types, set validation rules and map fields to entity properties.
2. Brand: Customize the look with your organization's colors, logo and typography.
3. Publish: One click generates a public URL. Share it internally, embed it in a wiki, or send it via email.
4. Collect: Submissions arrive with automatic risk scoring. If an LLM key is connected, the system also runs an LLM-based risk analysis on top.
5. Review: Approve or reject each submission. Approvals create governed entities instantly. Rejections send the submitter a pre-filled resubmission link.

When to use intake forms

A few scenarios where intake forms tend to pay off:

New AI project requests

A product team wants to build a recommendation engine. Rather than filing a ticket or sending a Slack message that gets lost in a thread, they fill out the intake form: what the system does, what data it uses, who it affects, what it decides. The governance team gets the request with a risk score already attached.

Vendor AI tool registration

Marketing buys a third-party content generation tool. The intake form captures the vendor name, what data the tool touches, whether it makes decisions on its own and how many people are affected. Governance reviews it before the tool goes live across the company.

Model inventory registration

Data science teams ship models regularly. An intake form set up for model inventory collects the model name, version, training data description, intended use and provider. Approved submissions go straight into the model inventory with risk metadata carried over.

Department self-service

HR is piloting AI resume screening. Finance is testing automated fraud detection. Every department fills out the same intake form, so the governance team can compare risk and compliance exposure on equal terms instead of parsing different request formats from each group.

External partner intake

A consulting firm or system integrator is deploying AI on your behalf. Since intake forms require no login, external partners can submit their project details directly without getting access to your internal systems.

Compliance pre-screening

Before a team spends months building an AI system, an intake form can flag whether the project falls into a high-risk category under the EU AI Act or triggers GDPR obligations. The risk scoring gives teams early feedback on what compliance work lies ahead.

Creating a form

Navigate to the Intake forms page from the sidebar and click Create form. You will choose:

• Form name: Descriptive title shown to submitters at the top of the form
• Description: Optional context about what the form is for
• Entity type: Whether approved submissions create a Use case or a Model inventory entry

After creation, the form builder opens with your chosen entity type's default fields pre-loaded.

Default fields

New use case forms start with six fields that are already mapped to entity properties:

1. Use case name (mapped to project title)
2. What does this AI system do? (mapped to description)
3. What business goal does this serve? (mapped to goal)
4. AI risk classification (mapped to risk classification)
5. Does this system make autonomous decisions?
6. What type of personal data does this process?

You can keep all of these, remove the ones you don't need, or add your own. Model inventory forms have their own set of defaults (model name, version, provider, intended use and risk level).

The form builder

The builder has three areas: a field palette on the left, the form canvas in the center and a settings panel on the right.

Field types

Drag any field type from the palette onto the canvas:

Field configuration

Click any field on the canvas to open its configuration in the right panel. Every field supports:

• Label: The question text shown to the submitter
• Placeholder: Hint text inside the input (disappears on focus)
• Help text: Appears below the field label as secondary guidance
• Guidance text: Detailed instructions shown below the input field
• Required: Whether the field must be filled to submit
• Default value: Pre-filled value when the form loads
• Entity field mapping: Which entity property this field populates on approval (e.g., project_title, description, risk_classification)

Text and textarea fields also support min length, max length and regex pattern validation. Number fields support min and max bounds. Select and multi-select fields have an options editor where you add label/value pairs.

Conditional fields

Open "Show this field only if…" in a field's settings to show it only when answers above it match. Add one or more conditions and choose whether all or any must match. A condition can only use fields above the one you are editing. Until the earlier question is answered, the field stays hidden.

Hidden fields are never required and their answers are not saved. Fields mapped to the use case name, the use case goal or the model name cannot have conditions, because those values are needed to create the entity.

Calculated fields

A calculated field shows a read-only result that updates as the submitter types, for example annual cost from a monthly cost. Add one from the Advanced section of the field palette. Formulas use + − × ÷ (typed as + - * /), parentheses and numbers, and refer to number or calculated fields above the field. Type { in the formula box to insert a field.

Set decimals (0 to 6) and an optional prefix or suffix, such as € or people. If an input is empty or hidden, the result shows a dash. The value is recalculated by VerifyWise when the form is submitted and is shown to reviewers.

Risk dimension tags

Under "Risk scoring" in a text, dropdown or checkbox field's settings, choose the risk dimension its answer speaks to. The AI scorer sees the dimension next to each tagged answer, so it knows what the answer was meant to show. Tags don't produce scores of their own. For submissions scored with the earlier keyword method, tags decided which answers fed each dimension.

Entity field mapping

Each field can optionally map to a property on the entity that gets created when the submission is approved. For use case forms, available mappings include:

• project_title, use case name
• description, system description
• goal, business justification
• owner, responsible person
• start_date, planned start date
• ai_risk_classification, risk tier
• type_of_high_risk_role, the use case's high-risk roles (Provider, Deployer or both). Map a select or multi-select question to it. Each selected option whose label or value is Provider or Deployer becomes a role; the review dialog lists any other selected option so you can correct the roles before approving.

For model inventory forms: name, description, modelVersion, provider, owner, modelType, intendedUse and riskLevel.

Fields without a mapping are still captured in the submission data. They just don't auto-populate entity properties. The reviewing admin can always edit entity data before confirming approval.

Field operations

Each field on the canvas has a toolbar with:

• Move up / Move down: Reorder fields in the form
• Duplicate: Copy the field with all its settings (gets a new ID)
• Delete: Remove the field after confirmation

Design settings

Switch to the Design tab in the builder to change how the public form looks.

The form canvas updates in real-time as you change design settings, so you see exactly what submitters will see.

Form settings

The right panel in Edit mode has several settings beyond individual field configuration.

Notification recipients

Select which team members get an email when a new submission arrives. Recipients come from your organization's user list. The email waits for the AI assessment and then shows the EU AI Act level, the risk score and the number of suggested risks. If the assessment takes longer than 2 minutes, the email goes out anyway and says scoring is still running. Each submission sends this email once. If no recipients are configured, submissions still appear in the review queue but no email is sent. Forms opened through the older /{organization}/{form} link email your organization's admins instead.

Risk score bands

Scores run from 0 to 100. Every screen shows the score with its band: Low (0 to 25), Medium (26 to 50), High (51 to 75) or Critical (76 to 100). The band is separate from the EU AI Act level, which comes from the risk questionnaire. Submissions scored with the earlier keyword method keep their old tiers: Minimal, Limited, High and Unacceptable.

LLM key

Connect one of your organization's LLM keys to the form. VerifyWise uses it to score submissions and to suggest risks. Without a key, reviewers get the rule-based EU AI Act classification only. The score is then the rule minimum, shown as "at least 70 (rules only)", and no risks are suggested.

Suggested questions

Toggle on Suggested questions to show a panel of pre-built governance questions in the builder. They are organized by category (risks, compliance, operations, vendors, models) and you can add any of them to your form with one click. Each question comes with the field type, validation rules and guidance text already set up.

Collect contact information

Toggle Collect contact information to control whether submitters are asked for their name and email. When enabled, the public form shows a "Your contact information" section at the top with name (optional) and email (required). When disabled, submissions are anonymous.

Publishing a form

Forms start in Draft status. Click Publish to generate a public URL you can copy and share. The form status changes to Active and submissions start showing up in your review queue.

You can still edit an active form. Changes take effect for new visitors right away. To stop accepting submissions, archive the form. Archived forms can be deleted later if you no longer need them.

The public form experience

When someone opens the public link, they see the form page with your color theme, the form title in a gradient banner and an optional description. No login required.

Submitting a form

The submitter fills out the required fields, optionally enters their contact information, solves a math CAPTCHA (something like "7 + 4 = ?") and clicks Submit. The CAPTCHA blocks automated spam but is simple enough that it won't slow anyone down.

After submission, the submitter sees a success page with their reference number. If contact information was collected, they also receive a confirmation email.

Spam protection

Public forms are protected by two layers:

• Math CAPTCHA: A simple arithmetic question that changes on each page load. The answer is verified server-side using a time-limited cryptographic token that expires after 5 minutes.
• IP-based rate limiting: Limits the number of submissions from a single IP address within a time window. Exceeding the limit returns a "Too many submissions" error.

Reviewing submissions

All submissions appear in the Submissions tab on the intake forms page. Each row shows the submitter's name (if provided), the form name, submission status, risk score and date.

Click Review on any submission to open the review modal, which shows:

• All submitted field values
• The risk score, with a How this score is built breakdown
• The EU AI Act classification, when the form asks the questionnaire
• Suggested risks to accept or dismiss
• An entity data preview built from field mappings
• Approve and Reject action buttons

Risk scoring

VerifyWise scores each submission in the background after it arrives. The review dialog shows Scoring… until the result is in and refreshes on its own.

The score has two parts. The EU AI Act level from the risk questionnaire sets a rule minimum. The form's LLM then scores the answers 5 times, independently, from 0 to 100. Each run explains its score with reasons that quote the submitter's answers. VerifyWise drops any reason whose quote is not in the answer. The median of the runs is the AI score, and at least 3 runs must succeed for it to count.

The final score is the higher of the rule minimum and the AI median. The AI can raise the score but never lower it, so an answer written to talk the score down can't take it below what the rules require.

Without an AI score the dialog shows the rule minimum as "at least 70 (rules only)". This happens when the form has no LLM key or the AI scoring failed. With no AI score and a rule minimum of 0, it shows "No score yet". When a step failed, or has run for more than 10 minutes, the dialog offers Retry. Retry reruns only the steps that did not finish, so your decisions on suggested risks stay as they are.

Model inventory forms have no EU AI Act questionnaire. Their submissions are scored by the AI alone and marked "not rule-checked".

The LLM sees the answers and the questionnaire result. It never sees the submitter's name, their email address or any email field on the form. Answers are passed as data, and the model is told to ignore any instructions written inside them.

Open How this score is built to see each input: the level with its articles, the rule minimum, all 5 AI scores with failed runs marked, the median, the range, the quoted reasons and any band override.

If you pick a different EU AI Act level before approving, the score is recalculated for that level and marked "Minimum based on your level change". If the questionnaire rules changed after the submission was scored, the dialog says "Rules updated since this was scored".

Submissions scored before AI scoring

Submissions scored with the earlier keyword method keep that score. The dialog shows its 6 dimension scores:

The weighted dimension scores produced an overall score mapped to the old tiers.

Overriding the score band

Reviewers can override the score band during approval with a justification. The override changes the band, while the score stays as computed. It is logged with your identity and time. Use it when the scoring misses context you have, like a system that scores Medium but affects a protected population.

The band can go up but not below the band that holds the rule minimum. A High risk submission (minimum 70) can't be set lower than High, and the lower bands are greyed out. To go lower, change the EU AI Act level itself, which needs its own justification.

Suggested risks

With the score, the form's LLM suggests up to 10 risks for each submission, highest rated first. Some come from the MIT and IBM risk catalogs. The rest are written for the submission. Each one names its source, likelihood and severity. It comes with a drafted impact, mitigation plan and implementation strategy. Model submissions also get a model risk category and level.

For each suggestion you can accept, dismiss, edit or undo your choice. Accept all accepts every open suggestion that has a mitigation plan. A risk can't be accepted without a mitigation plan, because the risk register requires one. Your choices save as you make them, so closing the dialog keeps them.

Nothing is added to the register until you approve. On approval each accepted suggestion becomes a risk on the new use case. You own it, and it is due 90 days after approval unless you set a deadline. For model submissions it becomes a model risk with status Open. If adding any risk fails, the whole approval is rolled back. Rejecting a submission adds no risks.

Without an LLM key on the form there are no suggestions. When more than 10 risks fit, the list says how many lower-rated ones are not shown.

EU AI Act risk classification step

Use case forms can ask the EU AI Act risk questionnaire before the form's own questions. Turn on EU AI Act risk classification step in the builder's settings panel and save the form. The toggle only appears on use case forms. Model inventory forms do not have it. New use case forms start with the step on, and their default questions no longer ask for a risk level or a high-risk role, because the step sets both. Forms you saved earlier keep their setting. While the step is on, the builder canvas shows it above the form's questions as a read-only card. Select View questions to open the questionnaire, read-only, in a sidebar. While it is off, the builder shows a notice that submissions won't be rule-checked.

The step sets the new use case's AI risk classification, so a form cannot have both the step and a question mapped to ai_risk_classification. Turning the step on removes that mapping. The question itself stays on the form and its answers are still saved with the submission.

What submitters see

The public form opens on the risk questionnaire. Each answer decides which question comes next, so a system built only for research and development finishes after one question. The follow-up questions for each Annex III area accept several answers, and any listed use makes the system high risk. After the last question the submitter moves on to the form, and can go back with Back to risk classification. Submitters do not see the resulting classification. The browser sends only the answers: VerifyWise checks and scores them on the server when the form is submitted. If the server rejects the answers, the form returns to the risk questionnaire.

What reviewers see

The review dialog adds an EU AI Act classification panel with:

• The computed level: Prohibited, High risk, Limited risk, Minimal risk or Out of scope
• The reasons, each with its article and, where one applies, the date it applies from
• The roles (provider, deployer or both) the submitter chose
• Every question and the answer given

The panel scores the stored answers again when you open it. If that gives a different level from the one at submission, the panel marks it Updated since submission.

You can pick a different level under Classification for the new use case. Only the five levels above are offered, and a change needs a justification of at least 10 characters. On approval the use case gets the chosen level and the roles, the answers are copied to the use case, and its change history records the level together with the computed level and your justification when you changed it. Because the classification comes from the EU AI Act step, the new use case also gets the EU AI Act framework, with its assessment and controls. A submission without a classification from the step, for example from a form that does not use the step, gets no framework on approval. When the selected level is Prohibited, the panel warns that approving creates a use case classified as prohibited.

Approving a submission

When you approve a submission:

1. Review the entity data preview. These are the field values that will populate the new entity, and you can edit them before confirming.
2. Accept or dismiss the suggested risks.
3. Optionally override the score band with a justification.
4. Click Approve. VerifyWise creates the entity (use case or model inventory entry) with the confirmed data and adds the risks you accepted.
5. If the submitter provided an email, they receive an approval notification.

When you approve a submission (which transitions the submission status from PENDING to APPROVED), VerifyWise creates the entity. The new entity then starts in its own default lifecycle state ("Under review" for use cases, "Pending" for models) and shows up in your governance dashboards right away.

Rejecting a submission

When you reject a submission:

1. Enter a rejection reason explaining what needs to change.
2. Click Reject. The submission status changes to "Rejected."
3. If the submitter provided an email, they receive a rejection notification that includes the reason and a resubmission link.

Resubmission

The rejection email includes a link that opens the form with all previous answers pre-filled. The submitter edits what needs changing and resubmits. These links expire after 7 days and are cryptographically signed so they can't be tampered with.

Resubmissions create a new submission record linked to the original. The original submission is preserved for audit purposes.

Email notifications

Emails go out at four points in the workflow. Submitter-facing emails are only sent when an email address was collected.

Managing forms

The intake forms list page shows all your forms with their status, entity type, submission count and creation date.

Form actions

• Edit: Open the form builder to modify fields, settings, or design
• Preview: See how the form looks to submitters without publishing
• Copy link: Copy the public URL to clipboard (active forms only)
• Archive: Stop accepting submissions while preserving the form and its data
• Delete: Permanently remove the form (draft and archived forms only)

Submission statuses

Best practices

Form design

• Keep forms under 15 fields. Longer forms have higher abandonment rates.
• Use guidance text on complex questions. A two-sentence explanation prevents misinterpretation.
• Map fields to entity properties wherever possible. This saves the reviewer from manual data entry on approval.
• Use select and multi-select fields for classification questions (risk level, data categories). Structured answers are easier to score and compare.
• Start with the default fields and remove what you don't need rather than starting blank.

Review workflow

• Configure at least one notification recipient so submissions don't sit unreviewed.
• Connect an LLM key to get an AI score and suggested risks. Without one, reviewers see the rule-based classification only.
• When rejecting, be specific in the rejection reason. The submitter sees your text verbatim.
• Review entity data before confirming approval. The field mapping builds a reasonable starting point, but a quick check prevents errors downstream.

Security

• Archive forms as soon as you stop accepting submissions. This prevents stale links from collecting data.
• Enable contact collection when you need to communicate decisions back to submitters. Disable it when anonymity is more important than follow-up.
• The CAPTCHA and rate limiting run automatically. No configuration needed.