What Is an AI Risk Assessment?
An AI risk assessment is a systematic evaluation of the potential risks associated with an AI system. It identifies what could go wrong, evaluates the likelihood and impact, and determines what controls are needed to manage those risks.
Unlike traditional IT risk assessments, AI risk assessments must address unique challenges: algorithmic bias, model drift, explainability gaps, and the potential for automated systems to cause harm at scale.
Why AI Risk Assessment Matters
AI Risks Are Different
AI systems can fail in ways that traditional software cannot. They can develop biases from training data, drift from their original performance, and make decisions that humans cannot explain or predict.
Regulatory Requirements
The EU AI Act requires risk assessments for high-risk AI systems. Even if not legally required, risk assessment demonstrates due diligence and governance maturity.
Stakeholder Protection
Unassessed AI risks can harm customers, employees, and partners. Risk assessment is fundamental to responsible AI use.
The 12-Question AI Risk Assessment Checklist
Governance Questions
1. Is there a named owner accountable for this AI system?
Every AI system needs clear ownership. If something goes wrong, who is responsible?
2. Is there documented approval for this AI system's use?
Formal approval ensures the organization has consciously decided to accept the risks.
3. Are there written policies governing this AI system?
Policies define acceptable use, boundaries, and expectations.
Technical Questions
4. Do you understand what data this AI system uses?
Know your inputs. Garbage in, garbage out — and potentially biased or harmful outputs.
5. Can you explain how this AI system makes decisions?
Explainability is essential for accountability. Black boxes create accountability gaps.
6. Do you monitor this AI system's performance over time?
AI systems can drift. What worked at deployment may not work months later.
Impact Questions
7. What happens if this AI system makes a mistake?
Understand the worst-case scenario. Financial loss? Reputational damage? Physical harm?
8. Who is affected by this AI system's decisions?
Identify all stakeholders: customers, employees, partners, the public.
9. Could this AI system create unfair outcomes for certain groups?
Bias risk is real. Assess potential for discriminatory outcomes.
Control Questions
10. Are there human review points for critical decisions?
Human oversight is essential, especially for high-impact decisions.
11. Can you stop this AI system quickly if needed?
Kill switches and rollback capabilities are essential controls.
12. Do you have an incident response plan for AI failures?
When something goes wrong, you need a documented response process.
How to Use This Checklist
Step 1: Complete for Each AI System
Run through these questions for every AI tool in your inventory.
Step 2: Score Your Responses
Yes = 2 points, Partial = 1 point, No = 0 points. Maximum score is 24.
Step 3: Classify Risk Level
- Score 0-8: Critical gaps — immediate action required
- Score 9-16: Developing — improvement plan needed
- Score 17-24: Strong foundation — maintain and monitor
Step 4: Prioritize Actions
Focus on "No" answers first. These represent the biggest gaps.
Next Steps
Use our free Governance Checklist to assess your AI systems. For a comprehensive assessment with gap analysis and a 30-day action plan, consider the AI Accountability Assessment.