An AI risk assessment answers four questions about a specific AI use: what could go wrong, how likely is it, how serious would it be, and what will we do about it? It does not need to be complicated. A clear, repeatable method applied to each significant AI use is far more valuable than a perfect framework nobody uses.
Step 1: Describe the use case
Write down what the AI does, who uses it, what data it uses, who is affected by its outputs and what decisions it influences. Vague descriptions produce vague assessments.
Step 2: Classify the impact
Is the AI used internally with human review, or does it affect customers, employees or regulated decisions? Higher-impact uses need deeper assessment. If you operate in the EU, consider where the use sits under the EU AI Act's risk categories.
Step 3: Identify risks
Work through common AI risk categories:
| Category | Example questions |
|---|---|
| Accuracy | Could it produce wrong or invented information? |
| Bias and fairness | Could it treat some groups unfairly? |
| Data protection | Does it process personal or confidential data appropriately? |
| Security | Could it leak data, be manipulated or be misused? |
| Transparency | Can we explain how outputs are produced and used? |
| Reliability | What happens if it fails or behaves unexpectedly? |
| Legal and regulatory | Does it meet applicable law and sector rules? |
| Reputation | How would customers or staff react if they knew how we use it? |
Step 4: Rate likelihood and impact
Score each risk, for example from 1 to 5 for likelihood and impact. Multiply for a simple priority score. Be aware of the limits of scoring; see the limitations of risk assessment matrices.
Step 5: Decide controls
For each significant risk, choose proportionate controls:
- Human review before outputs are used.
- Restricting data that can be entered.
- Approved tools with suitable contracts.
- Testing for accuracy and bias.
- Access controls and logging.
- Clear user guidance and training.
Step 6: Record it in a risk register
| Use case | Risk | Likelihood | Impact | Control | Owner | Review date |
|---|---|---|---|---|---|---|
Step 7: Monitor and review
AI systems and their use change. Review assessments when the use case changes, after incidents and at regular intervals.
Common mistakes
- Assessing the tool rather than the specific use of it.
- Ignoring informal AI use by staff.
- Treating the assessment as a one-off.
- No named owner for each risk.
Frameworks that can help
The NIST AI Risk Management Framework and ISO/IEC 23894 provide structure for AI risk management, and our guide to the biggest risks of AI transformation covers organisation-wide risks.
Learn AI risk assessment properly
Our AI Risk Management & Security course teaches AI risk categories, model and data risks, building a risk register, policy and security controls, incident response and regulatory alignment, without technical jargon.
Frequently asked questions
Who should carry out an AI risk assessment?
The business owner of the use case, with input from IT, data protection, legal and the people affected. Risk teams can provide the method.
How long does an AI risk assessment take?
A simple internal use can be assessed in an hour or two. High-impact uses need more time and specialist input.
Do we need to assess every AI tool?
Assess each significant use. Low-risk internal uses can follow a lighter, standard assessment.