AI Risk Assessment: How to Evaluate AI Systems for Risk
TL;DR — AI risk assessment is a structured process to identify, score, and mitigate risks across your AI systems. Use a 5x5 likelihood-impact matrix scoring risks 1-25. Evaluate impact across 7 dimensions (financial, operational, regulatory, reputational, privacy, safety, ethical). Map to NIST AI RMF (Govern, Map, Measure, Manage), ISO 23894, and EU AI Act Article 9. Maintain a living risk register updated at every lifecycle stage. Every AI system — built or bought — needs assessment.
Every AI system your organization builds or buys needs a risk assessment. Not a checkbox exercise — a genuine evaluation of who uses the system, what data it accesses, what it integrates into, what permissions it holds, and what happens when it fails.
The AI governance frameworks from ISO, NIST, and the EU all mandate this process. NIST AI RMF 1.0 provides the voluntary framework. ISO 23894 defines the methodology. EU AI Act Article 9 requires a risk management system for high-risk AI. The Cloud Security Alliance published an AI Controls Matrix with 247 control objectives across 18 domains (CSA 2026). For organizations working on EU AI Act compliance, risk assessment is Step 4 of the 12-step checklist.
This post walks through the complete methodology: from stakeholder roles through the 5x5 matrix to building a living risk register. Every step maps back to the frameworks.
What Is an AI Risk Assessment?
An AI risk assessment is a structured process to identify, analyze, evaluate, and treat risks associated with AI systems throughout their lifecycle. Unlike traditional IT risk assessments, AI risk assessment must account for:
- Data risks: Training data quality, bias, personal data exposure, data poisoning
- Model risks: Hallucination, drift, adversarial attacks, prompt injection
- Operational risks: Integration failures, unauthorized access, shadow AI
- Compliance risks: GDPR, EU AI Act, HIPAA, sector-specific regulations
- Ethical risks: Bias, discrimination, transparency, accountability
The assessment produces a risk register — a living document that tracks every identified risk, its score, its treatment plan, and its residual risk level.
AI Risk Assessment Frameworks
| Framework | Scope | Key concept |
|---|---|---|
| NIST AI RMF 1.0 | Voluntary, cross-sector | Four functions: Govern, Map, Measure, Manage |
| ISO 23894 | International standard | Risk management process aligned with ISO 31000 |
| ISO 42001 | Management system standard | AI management system certification |
| EU AI Act Article 9 | Regulatory (binding) | Risk management system for high-risk AI |
| CSA AI Controls Matrix | Industry framework | 247 controls across 18 security domains |
| OECD Due Diligence | International guidance | Six-step due diligence for AI value chain |
These frameworks are complementary, not competing. NIST provides the structure. ISO provides the process. The EU AI Act makes it legally binding for high-risk systems. The CSA gives you the control catalog. Use them together.
The NIST AI RMF Four Functions
NIST AI RMF organizes AI risk management into four functions:
| Function | What it does | Key actions |
|---|---|---|
| Govern | Establish culture, policies, accountability | Assign risk owners, define risk tolerance, establish review cadence |
| Map | Identify risks and context | Catalog AI systems, identify threats, assess data flows |
| Measure | Score and prioritize risks | 5x5 matrix, likelihood-impact scoring, risk register |
| Manage | Treat and monitor risks | Mitigation controls, residual risk, continuous monitoring |
Govern is the foundation. Without clear ownership and accountability, risk assessment becomes a paper exercise. Assign a risk owner for every AI system — someone who is accountable for identifying, scoring, and treating risks throughout the system's lifecycle.
Step-by-Step AI Risk Assessment Methodology
Step 1: Identify AI systems and stakeholders
Catalog every AI system in your organization. For each system, record:
- System name, vendor, and version
- Purpose and intended use case
- Provider vs. deployer role
- Data sources (training, input, output)
- Integration points (APIs, databases, SaaS connections)
- User base (who interacts with the system)
- Risk owner (accountable individual)
Include shadow AI — unsanctioned tools count. Include AI features embedded in approved SaaS (Salesforce Einstein, Slack AI, Notion AI). Include AI agents and autonomous systems.
Step 2: Identify threats and vulnerabilities
For each AI system, identify what could go wrong:
| Threat category | Examples |
|---|---|
| Data exfiltration | Sensitive data leaked through prompts to external LLMs |
| Data poisoning | Training data manipulated to produce biased or harmful outputs |
| Prompt injection | Adversarial inputs that override system instructions |
| Model theft | Proprietary model weights or architecture extracted |
| Hallucination | Confidently wrong outputs driving bad decisions |
| Bias and discrimination | Systematic disadvantage of protected groups |
| Unauthorized access | API keys compromised, shadow AI usage |
| Regulatory violation | GDPR, EU AI Act, HIPAA non-compliance |
| Supply chain | Third-party model or data provider introduces risk |
Step 3: Score risks on the 5x5 matrix
For each identified risk, determine likelihood (1-5) and impact (1-5). Score = Likelihood × Impact, yielding values from 1 to 25.
Likelihood scale:
| Score | Level | Description |
|---|---|---|
| 1 | Rare | Unlikely to occur, no historical precedent |
| 2 | Unlikely | Could occur but not expected |
| 3 | Possible | Might occur occasionally |
| 4 | Likely | Will probably occur |
| 5 | Almost certain | Expected to occur frequently |
Impact scale (evaluate across 7 dimensions, use highest):
| Dimension | What it measures |
|---|---|
| Financial | Revenue loss, fines, remediation costs |
| Operational | Service disruption, productivity loss |
| Regulatory | Compliance violations, legal penalties |
| Reputational | Brand damage, customer trust loss |
| Privacy | Personal data exposure, GDPR breach |
| Safety | Physical harm, health impacts |
| Ethical | Bias, discrimination, fundamental rights |
Using the highest dimension score as the impact rating prevents under-counting risks that score low on financial impact but high on ethical or privacy impact (TechJack 2026).
Step 4: Map to risk tolerance thresholds
Compare calculated risk scores against your organization's tolerance thresholds:
| Score | Risk level | Required action |
|---|---|---|
| 1-4 | Low | Monitor, no treatment required |
| 5-9 | Moderate | Treat if cost-effective, monitor |
| 10-14 | High | Treatment plan required, executive sign-off |
| 15-25 | Critical | Immediate treatment, board-level escalation |
Step 5: Implement mitigation controls
For each risk requiring treatment, select controls from the CSA AI Controls Matrix or your existing security framework:
| Risk | Control examples |
|---|---|
| Data exfiltration | DLP for AI prompts, AI gateway, PII redaction |
| Prompt injection | Input validation, system prompt isolation, output filtering |
| Bias | Pre-deployment bias testing, fairness metrics, ongoing monitoring |
| Unauthorized access | API key rotation, OAuth, tenant isolation |
| Regulatory violation | DPIA, conformity assessment, audit trail |
| Hallucination | RAG grounding, citations, human review for high-stakes outputs |
Step 6: Calculate residual risk
Residual risk = Inherent risk minus control effectiveness. If a risk scores 20 (critical) and your controls reduce it by 60%, residual risk is 8 (moderate). Document both inherent and residual scores in the risk register.
Step 7: Build the risk register
The risk register is the single source of truth for every risk your organization has identified, scored, and treated. It must be:
- Initiated at ideation: Before the AI system is built or procured
- Updated during development: As new risks emerge during testing
- Finalized before deployment: Sign-off by risk owner and risk committee
- Continuously updated post-deployment: When the system changes or new threats emerge
| Field | Description |
|---|---|
| Risk ID | Unique identifier |
| AI system | Which system this risk applies to |
| Threat category | Data, model, operational, compliance, ethical |
| Description | What the risk is |
| Likelihood | 1-5 score with justification |
| Impact | 1-5 score (highest dimension) with justification |
| Inherent risk | Likelihood × Impact |
| Controls | Mitigation measures implemented |
| Residual risk | Score after controls |
| Risk owner | Accountable individual |
| Status | Open, mitigated, accepted, closed |
| Review date | Next scheduled review |
Mapping to EU AI Act Article 9
The EU AI Act requires high-risk AI systems to have a risk management system. The assessment steps map directly:
| Assessment step | EU AI Act Article |
|---|---|
| Risk management system | Art. 9(1) — Establish risk management system |
| Risk identification | Art. 9(2)(a) — Identify and analyze known and foreseeable risks |
| Risk estimation | Art. 9(2)(b) — Estimate and evaluate risks from intended use and misuse |
| Mitigation controls | Art. 9(2)(c) — Adopt appropriate risk mitigation measures |
| Testing | Art. 9(2)(d) — Test for residual risks before market placement |
For GDPR compliance, the risk assessment feeds directly into the DPIA required under Article 35.
FAQ
What is an AI risk assessment?
An AI risk assessment is a structured process to identify, analyze, evaluate, and treat risks associated with AI systems. It covers data privacy, security, bias, compliance, and operational risks. The assessment maps to frameworks like NIST AI RMF, ISO 23894, and EU AI Act Article 9.
How do you score AI risks?
Score each risk on a 5x5 matrix: likelihood (1-5) multiplied by impact (1-5), yielding scores from 1 to 25. Evaluate impact across seven dimensions: financial, operational, regulatory, reputational, privacy, safety, and ethical. Use the highest dimension score as the impact rating.
What frameworks guide AI risk assessment?
NIST AI RMF 1.0 (Govern, Map, Measure, Manage), ISO 23894 (AI risk management), ISO 42001 (AI management system), EU AI Act Article 9 (risk management system for high-risk AI), and the Cloud Security Alliance AI Controls Matrix with 247 control objectives across 18 domains.
How often should you assess AI risks?
AI risk assessment is not one-time. Assess at ideation, update during development, finalize before deployment, and review continuously post-deployment. Reassess when the AI system is modified, when new threats emerge, or when the use case changes.
What is the difference between inherent and residual AI risk?
Inherent risk is the risk level before controls are applied. Residual risk is the remaining risk after mitigation measures are implemented. The gap between inherent and residual risk demonstrates the value of your controls. Both must be documented in the risk register.
Want a self-hosted AI company brain that does all of this out of the box?
Book a demo →