AI Risk Assessment Template: Worked Example and Checklist

A standard assessment you can run on any AI system: a worksheet that covers every dimension, a scoring rubric that produces a tier, a matrix of what each tier requires, and a sign-off page. The output is one signed assessment per system with a rationale and a review date.

Who this is for: The risk owner or governance analyst assessing a specific AI system before deployment, and the approver who signs the residual risk.

Download the kit (Markdown) ↓4 artifacts. Every table also copies as CSV.

1. AI risk assessment worksheet

Spreadsheet

The questionnaire. One per system. Covers purpose, data, model, human oversight, failure modes, and third-party dependencies so nothing gets skipped.

Template

Section	Question	Response	Evidence / notes
System	What does the system do, and what decision or output does it produce?
System	Who are the affected people, and how many?
Data	What data is used for inference, and what are its sensitivity categories?
Data	What is the provenance and lawful basis for that data?
Model	Built in-house, fine-tuned, or a third-party model or API?
Model	What is known about training data, evaluations, and known limitations?
Oversight	Where is the human in the loop, and can they realistically override?
Failure	What are the top three failure modes, and what is the impact of each?
Failure	How would a failure be detected, and how fast?
Third party	Which vendors or upstream models is this system dependent on?
Legal	Which regulatory obligations apply, and is a specific assessment (for example an EU AI Act FRIA) required?

Worked example

Section	Question	Response	Evidence / notes
System	What does it do?	Ranks inbound job applicants 1-5 for recruiter triage	Product spec v3
System	Affected people, how many?	External applicants, roughly 40,000 per year	ATS export
Data	Inference data and sensitivity	CV text, work history, education; special-category data likely present	Data map row 12
Data	Provenance and lawful basis	Submitted by applicants; basis is legitimate interest with notice	Privacy notice section 4
Model	Build type	Third-party base model, fine-tuned in-house on 5 years of hiring outcomes	MLOps ticket 812
Model	Training data, evals, limitations	Historical hiring data carries known demographic skew; adverse-impact eval run quarterly	Fairness report Q2 2026
Oversight	Human in the loop	Recruiter sees the score and can ignore it; no gate forces a second look at low scores	Workflow diagram
Failure	Top failure modes	1: systematic under-scoring of a protected group. 2: score treated as decisive despite guidance. 3: model stale after role mix changes	Risk workshop notes
Failure	Detection speed	Adverse-impact eval is quarterly, so bias could run for up to a quarter undetected
Third party	Dependencies	Base model vendor; ATS platform	Vendor register PRC rows 4, 9
Legal	Obligations	EU AI Act Annex III high-risk; FRIA required; NYC Local Law 144 bias audit required	Legal memo 2026-03

Acceptance criteria

✓Every section has a response, and "not applicable" is justified rather than left blank.
✓Claims in the responses point to evidence (a document, a ticket, a dataset), not memory.
✓Failure modes are specific to this system and each has a stated impact and a detection method.
✓Where a regulation requires a named assessment, the worksheet records whether it has been done and where it lives.

2. Risk scoring rubric

Spreadsheet

Turns the worksheet into a tier. The same three-axis rubric as the inventory kit, kept identical on purpose so inventory and assessment never disagree.

Template

Dimension	Score 1	Score 2	Score 3
Data sensitivity	<no personal or confidential data>	<personal data, no special categories>	<special-category, health, financial, or children's data>
Decision impact	<informational only>	<influences a consequential decision>	<drives or makes a consequential decision about a person>
Regulatory exposure	<no sector AI rule>	<general rules apply>	<named high-risk use or sector AI regime>

Tier: any 3 gives at least High. All 1s is Minimal. Otherwise the highest score sets the tier (2 is Limited). Article 5 prohibited practice is Unacceptable.

Worked example

Dimension	Score	Rationale
Data sensitivity	3	Special-category data present in CVs
Decision impact	3	Score shapes recruiter triage order
Regulatory exposure	3	EU AI Act Annex III plus NYC LL144
Tier	High

Acceptance criteria

✓The rubric wording matches the inventory kit rubric exactly, so a system gets the same tier in both places.
✓The score for each dimension cites the worksheet response it came from.

3. Risk tier control requirements matrix

Spreadsheet

What each tier obliges you to have in place. Use it as the checklist between "assessed" and "approved to deploy".

Template

Requirement	Minimal	Limited	High	Unacceptable
Entry in AI inventory register	Yes	Yes	Yes	Do not deploy
Named accountable owner	Yes	Yes	Yes
This risk assessment, signed	Optional	Yes	Yes
Human oversight design documented	No	Recommended	Yes
Pre-deployment evaluation (performance, and bias where people are affected)	No	Recommended	Yes
Ongoing monitoring with thresholds	No	Basic	Yes, with alerting
Regulator-specific assessment (for example EU AI Act FRIA)	No	If triggered	If triggered
Board or committee visibility	No	No	Yes

Worked example

Requirement	Status for Resume Screener (High)	Gap?
Inventory register entry	Present	No
Named owner	Dana Portillo	No
Signed risk assessment	This document, pending sign-off	Closing
Human oversight design	Recruiters can override, but no gate on low scores	Yes: add a review step for bottom-quartile scores
Pre-deployment evaluation	Quarterly adverse-impact eval exists	Partial: move first eval before each model update, not only quarterly
Ongoing monitoring	Quarterly only	Yes: add monthly adverse-impact check with an alert threshold
EU AI Act FRIA	Not started	Yes: Legal to schedule
Committee visibility	Not on the agenda	Yes: add to next AI governance committee pack

Acceptance criteria

✓The matrix is tailored to your control set, with each requirement pointing at the internal control or standard that satisfies it.
✓The assessment records the status of every requirement for the system's tier, and every gap has an owner and a date.
✓A system is not approved for deployment while any High-tier requirement is an open gap without a documented, time-boxed exception.

4. Risk assessment sign-off

Document

The page that makes the assessment a record. Names the residual risk, who accepted it, and when it gets looked at again.

Template

One page. Attach to the completed worksheet.

System: <name, inventory ID>
Assessment date: <YYYY-MM-DD>
Assessed by: <name, role>
Risk tier: <tier>: <one-line rationale>
Key residual risks after controls: <bullet list, each with likelihood and impact>
Required controls confirmed in place: <list, or reference the tier matrix>
Open gaps and exceptions: <list with owner and target date, or "none">
Decision: Approved to deploy / Approved with conditions / Not approved
Conditions: <if any>
Accepted by: <name, role; must have authority to accept risk at this tier>
Next review date: <YYYY-MM-DD>

Worked example

System: Resume Screener (INV-0044)
Assessment date: 2026-09-02
Assessed by: R. Nkemelu, Risk Analyst
Risk tier: High: special-category data, consequential decision, Annex III use
Key residual risks after controls: Demographic skew could persist up to a quarter between evals (medium likelihood, high impact). Recruiters may over-rely on the score (medium likelihood, medium impact).
Required controls confirmed in place: Inventory entry, named owner, adverse-impact eval, override capability.
Open gaps and exceptions: Monthly bias monitoring (owner: MLOps, due 2026-10-15). FRIA (owner: Legal, due 2026-10-31). Low-score review step (owner: Talent, due 2026-10-10).
Decision: Approved with conditions
Conditions: All three gaps closed by 2026-10-31 or the system is paused.
Accepted by: D. Portillo, Head of Talent (risk acceptance authority confirmed for High tier per governance charter)
Next review date: 2026-12-02

Acceptance criteria

✓The person accepting the risk has documented authority to accept risk at that tier under the governance charter.
✓Residual risks are stated with likelihood and impact, not just listed.
✓Every conditional approval names what must be true by when, and what happens if it is not.
✓The next review date is set and lands in the inventory register.

Governance controls this kit produces evidence for

Completing the artifacts above gives you a head start on the evidence requirements for these controls.

HOC-001

The worksheet plus scoring rubric is a completed, evidenced risk classification for the specific system.

BRD-006

The sign-off page records the residual risk and a named risk acceptance against defined authority, which rolls up into risk appetite reporting.

BRD-009

Each signed assessment is a source row for the multi-framework risk register, with tier, rationale, and review date.

CMP-007

The worksheet flags when an EU AI Act conformity assessment or FRIA is triggered and tracks whether it has been completed.

MON-003

The failure-mode and monitoring sections define what bias and fairness monitoring the system needs and at what cadence.

This kit backs one playbook. Read the full guidance for the reasoning behind each artifact.

Decide what to implement next

Assess your governance gaps, then create an action plan with owners and target dates. Build and export without an account; sign in when you want to save your plan.

Start the AI governance assessment →