Building an AI Risk Assessment Framework: Step-by-Step Template

Every AI governance programme begins with risk assessment. This guide provides a step-by-step template for conducting AI risk assessments that satisfy regulatory requirements and provide genuine organisational value.

Step 1: Use Case Identification

Document every AI system in deployment or development. Include the purpose, data sources, decision scope, affected individuals, and business owner. Most organisations are surprised by the breadth of AI deployment once they conduct a thorough inventory.

Step 2: Risk Classification

Apply the EU AI Act risk tiers: prohibited, high-risk, limited-risk, and minimal-risk. For UK firms, also consider sector-specific requirements from the FCA, ICO, and PRA.

Step 3: Impact Assessment

For each high-risk system, assess the potential impact on individuals, the organisation, and wider society. Consider bias, fairness, transparency, and explainability dimensions.

Step 4: Control Design

Design proportionate controls for each risk, including human oversight mechanisms, monitoring requirements, and escalation procedures.