Research · AI Governance, Risk & Compliance

AI Risk Assessment

An AI risk assessment identifies what could go wrong with a specific AI system, how likely and severe it would be, and what controls reduce it. It turns governance principles into decisions about a real system.

What to assess

• Purpose and context: what decisions the system supports and who is affected.
• Performance: accuracy, robustness and failure modes.
• Fairness: whether outcomes differ unjustifiably across groups.
• Privacy and data: what data is used and whether that use is lawful.
• Security: exposure to prompt injection, data poisoning and misuse.
• Transparency and oversight: whether people understand and can challenge outcomes.
• Legal and regulatory: which laws apply and what they require.

Risk tiering

Not every AI use needs the same review. A tiering model assigns lighter review to low-impact uses, such as drafting internal text, and deeper review to high-impact uses, such as decisions about credit, employment or health. Tiers should consider both the potential harm and the degree of human oversight.

When to assess

Assessments should happen before deployment, when a system or its use changes significantly, and periodically in production. AI features added to purchased software also need assessment, since they can change risk without any internal project.

Common pitfalls

• Long questionnaires completed once and never revisited.
• Assessing the model but not the business process around it.
• No clear owner for accepting residual risk.
• Skipping assessment for vendor AI.

How to get started

• Define three or four risk tiers with clear criteria.
• Create a short intake form that routes each AI use to the right tier.
• Assign a risk owner who formally accepts residual risk.
• Reassess on material change and on a set schedule.