AI risk assessment
Definition
A structured process to identify, analyse and evaluate the risks an AI system poses to people, organizations and society, so they can be treated and monitored.
An AI risk assessment applies the classic risk management cycle (identify, analyse, evaluate, treat) to the specific ways AI systems fail: biased outputs, unreliable predictions, security attacks, privacy leaks, misuse and harm to fundamental rights. ISO/IEC 23894 adapts ISO 31000 to AI, and the NIST AI RMF organizes the same work in its Map and Measure functions, with Manage covering treatment.
A good assessment starts from the context of use: who is affected, what decisions the system supports, how much autonomy it has and what happens when it is wrong. Likelihood and severity are rated against the organization's risk appetite, and each risk receives an owner, controls and monitoring indicators. Under the EU AI Act, providers of high-risk systems must run a risk management system across the whole lifecycle.
Example: a bank screening loan applications with a model rates the risk of indirect discrimination as high, adds bias testing before release and requires human review of every rejection.
Where this term is assessed
Assessed in the Responsible AI Practitioner (RAIP), domain 2: Risk and impact assessment.
Also covered in: Responsible AI for Executives (RAI-X)
Primary sources
- NIST AI RMF 1.0 (Map, Measure)
- ISO/IEC 23894:2023