AI risk assessment
One page for each use of AI, filled in before it goes live.
Use: [what the AI does, in one sentence] · Owner: [name] · Date: [date]
What it does
It reads [sources] and produces [output], which is used for [purpose] by [who].
What could go wrong
| What could go wrong | What it would cost | How it is caught |
|---|---|---|
| [It states something that isn’t in the source] | [A wrong figure reaches a client] | [A person checks figures against the source] |
| [It sees information it shouldn’t] | [A confidentiality breach] | [Access limited to named folders] |
| [It misses an item] | [A late follow-up] | [The run lists what it looked at] |
Who checks
[Role] reviews [which outputs] before [they are sent, filed or relied on]. Outputs that are not reviewed: [which, and why that is acceptable].
Decision
[Go ahead / Go ahead with limits / Not yet]. Review again on [date], or when the tool or the process changes.
