How to run an AI risk assessment in your organisation

Start with the use case, not the product name

The same AI product can create very different risks depending on how it is used. Drafting an internal meeting summary is different from ranking job candidates or deciding which customers receive a service. An AI risk assessment therefore needs a clear intended purpose before it needs a score.

Questions a useful assessment should cover

• What decision or task is the AI supporting and what happens if it is wrong?
• Who may be affected by the output and could the effect be significant?
• What personal, confidential or commercially sensitive data enters the system?
• Can people meaningfully review, challenge or override an output before it matters?
• What evidence is available about the supplier, model limitations and security controls?
• Could the use engage AI Act classification, transparency, GDPR or sector-specific requirements?

Assess inherent risk before relying on controls

First describe the potential harm without assuming that existing controls will work perfectly. Then identify safeguards such as access limits, human review, testing, data restrictions, supplier commitments and logging. This makes it easier to see whether residual risk is genuinely acceptable or simply being hidden by optimistic scoring.

Decide what needs escalation

Define clear triggers for specialist review. Examples include AI influencing employment, access to services, credit, education or safety; use of biometrics; large-scale personal data processing; autonomous actions; or uncertainty about an organisation's regulatory role.

A trigger is not a legal conclusion. It is a signal that the organisation should pause and perform the correct classification or legal assessment before proceeding.