How do we perform an AI risk assessment?

AI risk is multidimensional. A system that processes highly sensitive data but only makes suggestions to expert users is different from one that processes minimal data but makes automated decisions at scale. Effective risk assessment evaluates five dimensions: the sensitivity of the data processed; the impact and reversibility of the decisions influenced; the scale of deployment (how many people are affected); the degree of human oversight in the workflow; and the regulatory context (which laws apply).

Most organizations simplify to three primary dimensions: data sensitivity, decision impact, and regulatory exposure. This is a reasonable simplification that produces consistent, actionable results. The scoring should be calibrated to your specific context: what counts as "high" data sensitivity at a healthcare company differs from a marketing analytics firm.

Data sensitivity assessment asks: what data does this system process? Assign a score of 1 if the system only processes aggregate or clearly non-personal data; 2 if it processes personal data without special categories; 3 if it processes special categories (health, biometric, financial, children's data, or other regulated categories).

Decision impact assessment asks: how consequential are the outputs? Assign 1 if the system only informs a human decision with no direct consequence; 2 if it significantly influences decisions that can affect individuals; 3 if it makes or effectively determines consequential decisions (hiring, credit, medical, legal, access to services). Irreversibility raises the score.

Regulatory exposure asks: which regulations specifically address this use case? Assign 1 if minimal regulatory attention applies; 2 if general privacy or sector regulations apply; 3 if specific AI regulations or high-risk classifications under major frameworks apply. The EU AI Act Annex III is a useful reference list for the highest regulatory exposures.

High-risk systems (aggregate score 7-9) require the full governance treatment: technical documentation, bias assessment, human oversight arrangements, logging and audit trails, and a pre-deployment sign-off from risk and legal. They should be reviewed annually at minimum, and after any material change.

Medium-risk systems (score 4-6) require a documented risk assessment, basic testing records, a named owner, and a review schedule. They do not require the full documentation burden of high-risk systems, but they are not ungoverned. Low-risk systems (score 3) should appear in the model registry with basic metadata and a risk tier assignment, but do not require extensive supporting documentation.

Completing a risk tier assignment is not the end of the process. High- and medium-risk systems require documented records that can withstand external scrutiny, and NIST's draft AI documentation guidance provides a structured template for exactly this. The template covers system purpose, intended use, performance characteristics, known limitations, and the risk controls in place. Aligning your post-assessment documentation to that structure makes records reusable across governance approvals, audits, and regulatory inquiries.

External-facing disclosures are a separate requirement from internal governance records. Affected parties need a plain description of how the system behaves and what safeguards apply, not just a risk score. Retaining both the internal assessment record and any public-facing disclosure together creates a defensible audit trail if a third party or regulator asks you to substantiate your pre-deployment review.