AI Risk Assessment Framework

Traditional information security risk assessment focuses on confidentiality, integrity, and availability of data and systems. AI risk assessment expands the scope to cover:

• Data risks: Training data quality, bias, representativeness, privacy
• Model risks: Performance, robustness, interpretability, drift
• Deployment risks: Misuse, integration failures, operational dependencies
• Societal risks: Bias, fairness, transparency, accountability, human oversight

An AI system that is perfectly secure in the traditional sense can still cause significant harm if it produces biased outputs, makes incorrect high-stakes decisions, or operates outside its intended scope. The risk framework must address these dimensions.

NIST AI RMF and ISO 23894 provide methodological guidance. This framework synthesizes practical elements from both. See the AI governance learning module for implementation walkthroughs.

Risk assessment should be conducted at each stage of the AI lifecycle. Stages and primary risk concerns:

1. Plan and design: Use case appropriateness, data availability, regulatory applicability
2. Collect and process data: Data quality, bias, privacy, consent, representativeness
3. Build and use the model: Model selection, training methodology, validation methodology
4. Verify and validate: Performance metrics, robustness testing, fairness testing, security testing
5. Deploy and use: Integration risks, operational dependencies, monitoring infrastructure
6. Operate and monitor: Drift detection, performance degradation, incident response, retraining triggers
7. Retire: Decommission process, data retention, model artifact management

Each stage has stage-specific risks. A risk identified in deployment that traces back to a data quality issue should drive feedback into the data collection stage on subsequent iterations.

Five core risk categories cover most AI risk scenarios:

• Bias and fairness: Disparate impact across demographic groups, training data bias, label bias, deployment bias
• Performance and reliability: Accuracy, robustness to adversarial inputs, robustness to distribution shift, calibration
• Safety and security: Adversarial attacks, model extraction, data poisoning, prompt injection, denial of service
• Privacy and data protection: Training data privacy, inference-time privacy, membership inference, model inversion
• Transparency and accountability: Explainability, audit trail, decision logging, human oversight effectiveness

For each AI system, score risks in each category. Use a 5-point scale for likelihood and impact, the same as you would for ISO 27001 risk assessment. The output is a risk register specific to AI systems.

Track risks per AI system. A general risk register for "AI usage in the company" is too coarse. Each significant AI system gets its own assessment.

AI risk assessment focuses on risks to your organization. AI impact assessment focuses on impacts to people affected by the AI system. These are different and both are needed.

Impact assessment dimensions:

• Affected individuals and groups: Who is subject to the AI system's decisions or outputs?
• Decision or impact significance: Hiring, credit, healthcare, education, criminal justice, content moderation, advertising
• Severity of potential harm: Financial loss, denial of service, reputational damage, physical harm, discrimination
• Reversibility: Can the impact be reversed if it turns out to be wrong?
• Disproportionate impact: Does the system disproportionately affect protected groups?
• Transparency to affected parties: Are people aware they are subject to AI decision-making?

The EU AI Act, ISO 42001, and several US state laws require impact assessments for certain AI use cases. Build the assessment process into your AI lifecycle so it happens before deployment, not retroactively.

For each identified risk, determine treatment:

1. Mitigate: Implement controls to reduce likelihood or impact
2. Transfer: Insurance, vendor responsibilities, contractual transfer
3. Avoid: Do not deploy the AI system or modify the use case to remove the risk
4. Accept: Document residual risk with senior leadership sign-off

Common AI risk controls:

• Bias testing during development and post-deployment
• Adversarial robustness testing
• Differential privacy in training
• Human review for high-stakes decisions
• Audit logging of model inputs and outputs
• Drift detection and automatic alerting
• Periodic model revalidation
• Fallback to non-AI systems when AI is unavailable

Post-deployment monitoring is essential. Risk assessment is not complete at launch. New risks emerge from deployment data, distribution shift, and adversarial activity. Schedule periodic risk reassessment, typically quarterly for high-stakes AI systems and annually for lower-risk ones.