Choose an architecture for each AI use case, not a model ranking
The choice: make the use case the starting point
Do not start by choosing the most highly regarded model; start with the clearly defined workflow the model is intended to serve. Then document which provider, data, costs, rights, tooling, human oversight and fallback belong to that workflow. This makes the choice open to discussion when an integration, terms of use or cost pattern changes. NIST organizes AI risk work around govern, map, measure and manage, with governance as a cross-cutting function. This supports an approach in which model selection is one decision within a continuous risk cycle, rather than a one-off ranking. This source provides a general framework for risk management; it does not prescribe a specific provider or model choice.
Assess whether the chosen provider fits within the chain
Assess a provider based on the information you need to integrate the use case responsibly: intended tasks and acceptable use, technical specifications, inputs and outputs, plus the arrangements concerning data, rights and costs that apply to your application. The European Commission describes documentation obligations for providers of general-purpose AI models toward downstream providers. This is relevant when you build on such a model, but the cited passage does not cover all types of AI services and is not a complete legal assessment. Therefore, also make explicit where a human reviews the output, which error triggers escalation and which alternative route remains available.
Use a register and schedule reassessment
Make the decision actionable with one entry per use case, a designated owner and a fixed reassessment after a relevant change or at a cadence you choose. For each entry, also note why a fallback is acceptable: for example, stopping, routing to a human or switching to another pre-assessed route. Practical tool: Create a decision register for each AI use case with the task, owner, provider, data flow, cost ceiling, rights and documentation check, tooling and permissions, human oversight, fallback, measurement point and next review date. The register does not replace testing or legal advice; it makes visible which assumptions still need to be tested. Limitation: the supplied passages provide a general NIST risk framework and partial information on documentation for general-purpose AI providers. They do not support a claim about the best provider, current prices, applicable contractual terms or the suitability of a specific use case.
