| Owner | Evidence to assemble | Hold condition |
|---|---|---|
| Commercial | Use-specific term sheet, identified contracting party, product description | “Any AI purpose” remains undefined |
| Legal | Cohort permissions, territorial analysis, claims and liability schedule | Unresolved ownership or unlawful disclosure risk |
| Data | Versioned sample, excluded fields, recipient list, access and deletion design | Recipient or sensitive content cannot be identified |
| Finance | Cash timing and deductions separated from settlement receipts | Revenue depends on unverified legal or market assumptions |
| Executive sponsor | Accepted residual risks and one accountable release approver | No owner can explain the remaining uncertainty |
Use a dated change log for each legal development: source, proposition, affected clause, owner, next review trigger and decision. Reopen the pack after a relevant ruling, new recipient, new use or material dataset change. These are recommended controls rather than statutory review intervals.