AI RISK ASSESSMENT TEMPLATE
ASSESSMENT INFORMATION
| Field |
Information |
| Organization |
[ORGANIZATION NAME] |
| AI System Name |
[SYSTEM NAME] |
| Assessment ID |
[ASSESSMENT-ID] |
| Assessment Date |
[DATE] |
| Assessor(s) |
[NAME(S) AND ROLE(S)] |
| Assessment Type |
☐ Initial ☐ Periodic ☐ Change-Triggered ☐ Post-Incident |
| Version |
[VERSION] |
EXECUTIVE SUMMARY
Overall Risk Rating
| Rating |
Assessment |
| ☐ Low |
Acceptable risk; proceed with standard controls |
| ☐ Medium |
Moderate risk; implement enhanced controls |
| ☐ High |
Significant risk; require senior approval and robust controls |
| ☐ Critical |
Unacceptable risk; do not proceed without substantial changes |
Key Risk Summary
| Risk Category |
Count |
Highest Severity |
| Technical Risks |
[#] |
☐ Critical ☐ High ☐ Medium ☐ Low |
| Ethical Risks |
[#] |
☐ Critical ☐ High ☐ Medium ☐ Low |
| Legal/Compliance Risks |
[#] |
☐ Critical ☐ High ☐ Medium ☐ Low |
| Operational Risks |
[#] |
☐ Critical ☐ High ☐ Medium ☐ Low |
| Reputational Risks |
[#] |
☐ Critical ☐ High ☐ Medium ☐ Low |
Top Risks
- [RISK 1]: [BRIEF DESCRIPTION]
- [RISK 2]: [BRIEF DESCRIPTION]
- [RISK 3]: [BRIEF DESCRIPTION]
SECTION 1: AI SYSTEM CONTEXT
1.1 System Overview
| Field |
Description |
| System Name |
[NAME] |
| System Type |
[CLASSIFICATION/PREDICTION/GENERATION/ETC.] |
| Business Purpose |
[DESCRIBE] |
| Deployment Status |
☐ Development ☐ Testing ☐ Production ☐ Retired |
| System Owner |
[NAME, ROLE] |
1.2 Regulatory Classification
| Framework |
Classification |
| EU AI Act |
☐ Prohibited ☐ High-Risk ☐ Limited Risk ☐ Minimal Risk |
| Colorado AI Act |
☐ High-Risk ☐ Not High-Risk |
| Internal Classification |
☐ Critical ☐ High ☐ Medium ☐ Low |
1.3 Stakeholders
| Stakeholder |
Interest |
Impact Level |
| [STAKEHOLDER 1] |
[INTEREST] |
☐ High ☐ Medium ☐ Low |
| [STAKEHOLDER 2] |
[INTEREST] |
☐ High ☐ Medium ☐ Low |
| [STAKEHOLDER 3] |
[INTEREST] |
☐ High ☐ Medium ☐ Low |
1.4 Deployment Context
| Factor |
Description |
| Geographic Scope |
[REGIONS] |
| User Population |
[DESCRIPTION AND SIZE] |
| Integration Points |
[SYSTEMS INTEGRATED WITH] |
| Decision Types |
[DECISIONS SUPPORTED/MADE] |
| Automation Level |
☐ Fully Automated ☐ Human-Assisted ☐ Human-in-the-Loop |
SECTION 2: RISK IDENTIFICATION
2.1 Technical Risks
| ID |
Risk |
Description |
Likelihood |
Impact |
Risk Level |
| T1 |
Model Accuracy Degradation |
[DESCRIPTION] |
☐ H ☐ M ☐ L |
☐ H ☐ M ☐ L |
[LEVEL] |
| T2 |
Model Drift |
[DESCRIPTION] |
☐ H ☐ M ☐ L |
☐ H ☐ M ☐ L |
[LEVEL] |
| T3 |
Data Quality Issues |
[DESCRIPTION] |
☐ H ☐ M ☐ L |
☐ H ☐ M ☐ L |
[LEVEL] |
| T4 |
System Failures |
[DESCRIPTION] |
☐ H ☐ M ☐ L |
☐ H ☐ M ☐ L |
[LEVEL] |
| T5 |
Scalability Limits |
[DESCRIPTION] |
☐ H ☐ M ☐ L |
☐ H ☐ M ☐ L |
[LEVEL] |
| T6 |
Integration Failures |
[DESCRIPTION] |
☐ H ☐ M ☐ L |
☐ H ☐ M ☐ L |
[LEVEL] |
| T7 |
Adversarial Attacks |
[DESCRIPTION] |
☐ H ☐ M ☐ L |
☐ H ☐ M ☐ L |
[LEVEL] |
| T8 |
[ADDITIONAL] |
[DESCRIPTION] |
☐ H ☐ M ☐ L |
☐ H ☐ M ☐ L |
[LEVEL] |
2.2 Ethical and Fairness Risks
| ID |
Risk |
Description |
Likelihood |
Impact |
Risk Level |
| E1 |
Algorithmic Bias |
[DESCRIPTION] |
☐ H ☐ M ☐ L |
☐ H ☐ M ☐ L |
[LEVEL] |
| E2 |
Discrimination |
[DESCRIPTION] |
☐ H ☐ M ☐ L |
☐ H ☐ M ☐ L |
[LEVEL] |
| E3 |
Lack of Transparency |
[DESCRIPTION] |
☐ H ☐ M ☐ L |
☐ H ☐ M ☐ L |
[LEVEL] |
| E4 |
Privacy Violations |
[DESCRIPTION] |
☐ H ☐ M ☐ L |
☐ H ☐ M ☐ L |
[LEVEL] |
| E5 |
Autonomy Undermining |
[DESCRIPTION] |
☐ H ☐ M ☐ L |
☐ H ☐ M ☐ L |
[LEVEL] |
| E6 |
Harmful Outputs |
[DESCRIPTION] |
☐ H ☐ M ☐ L |
☐ H ☐ M ☐ L |
[LEVEL] |
| E7 |
Misinformation |
[DESCRIPTION] |
☐ H ☐ M ☐ L |
☐ H ☐ M ☐ L |
[LEVEL] |
| E8 |
[ADDITIONAL] |
[DESCRIPTION] |
☐ H ☐ M ☐ L |
☐ H ☐ M ☐ L |
[LEVEL] |
2.3 Legal and Compliance Risks
| ID |
Risk |
Description |
Likelihood |
Impact |
Risk Level |
| L1 |
EU AI Act Non-Compliance |
[DESCRIPTION] |
☐ H ☐ M ☐ L |
☐ H ☐ M ☐ L |
[LEVEL] |
| L2 |
State AI Law Non-Compliance |
[DESCRIPTION] |
☐ H ☐ M ☐ L |
☐ H ☐ M ☐ L |
[LEVEL] |
| L3 |
Data Protection Violations |
[DESCRIPTION] |
☐ H ☐ M ☐ L |
☐ H ☐ M ☐ L |
[LEVEL] |
| L4 |
IP Infringement |
[DESCRIPTION] |
☐ H ☐ M ☐ L |
☐ H ☐ M ☐ L |
[LEVEL] |
| L5 |
Consumer Protection Issues |
[DESCRIPTION] |
☐ H ☐ M ☐ L |
☐ H ☐ M ☐ L |
[LEVEL] |
| L6 |
Employment Law Violations |
[DESCRIPTION] |
☐ H ☐ M ☐ L |
☐ H ☐ M ☐ L |
[LEVEL] |
| L7 |
Sector-Specific Regulations |
[DESCRIPTION] |
☐ H ☐ M ☐ L |
☐ H ☐ M ☐ L |
[LEVEL] |
| L8 |
[ADDITIONAL] |
[DESCRIPTION] |
☐ H ☐ M ☐ L |
☐ H ☐ M ☐ L |
[LEVEL] |
2.4 Operational Risks
| ID |
Risk |
Description |
Likelihood |
Impact |
Risk Level |
| O1 |
Human Oversight Failures |
[DESCRIPTION] |
☐ H ☐ M ☐ L |
☐ H ☐ M ☐ L |
[LEVEL] |
| O2 |
Skills/Training Gaps |
[DESCRIPTION] |
☐ H ☐ M ☐ L |
☐ H ☐ M ☐ L |
[LEVEL] |
| O3 |
Process Failures |
[DESCRIPTION] |
☐ H ☐ M ☐ L |
☐ H ☐ M ☐ L |
[LEVEL] |
| O4 |
Vendor/Third-Party Risks |
[DESCRIPTION] |
☐ H ☐ M ☐ L |
☐ H ☐ M ☐ L |
[LEVEL] |
| O5 |
Change Management Failures |
[DESCRIPTION] |
☐ H ☐ M ☐ L |
☐ H ☐ M ☐ L |
[LEVEL] |
| O6 |
Business Continuity Risks |
[DESCRIPTION] |
☐ H ☐ M ☐ L |
☐ H ☐ M ☐ L |
[LEVEL] |
| O7 |
[ADDITIONAL] |
[DESCRIPTION] |
☐ H ☐ M ☐ L |
☐ H ☐ M ☐ L |
[LEVEL] |
2.5 Reputational and Strategic Risks
| ID |
Risk |
Description |
Likelihood |
Impact |
Risk Level |
| R1 |
Public Trust Damage |
[DESCRIPTION] |
☐ H ☐ M ☐ L |
☐ H ☐ M ☐ L |
[LEVEL] |
| R2 |
Media Attention |
[DESCRIPTION] |
☐ H ☐ M ☐ L |
☐ H ☐ M ☐ L |
[LEVEL] |
| R3 |
Customer Backlash |
[DESCRIPTION] |
☐ H ☐ M ☐ L |
☐ H ☐ M ☐ L |
[LEVEL] |
| R4 |
Competitive Disadvantage |
[DESCRIPTION] |
☐ H ☐ M ☐ L |
☐ H ☐ M ☐ L |
[LEVEL] |
| R5 |
[ADDITIONAL] |
[DESCRIPTION] |
☐ H ☐ M ☐ L |
☐ H ☐ M ☐ L |
[LEVEL] |
SECTION 3: RISK ANALYSIS
3.1 Risk Scoring Matrix
| Impact ↓ / Likelihood → |
Low |
Medium |
High |
| High |
Medium |
High |
Critical |
| Medium |
Low |
Medium |
High |
| Low |
Low |
Low |
Medium |
3.2 Detailed Risk Analysis
Risk ID: [ID]
| Aspect |
Analysis |
| Risk Title |
[TITLE] |
| Category |
[CATEGORY] |
| Description |
[DETAILED DESCRIPTION] |
| Root Causes |
[CAUSES] |
| Affected Stakeholders |
[STAKEHOLDERS] |
| Potential Consequences |
[CONSEQUENCES] |
| Likelihood Assessment |
☐ High ☐ Medium ☐ Low |
| Impact Assessment |
☐ High ☐ Medium ☐ Low |
| Inherent Risk Level |
[LEVEL] |
| Existing Controls |
[CONTROLS] |
| Control Effectiveness |
☐ Effective ☐ Partial ☐ Ineffective |
| Residual Risk Level |
[LEVEL] |
[REPEAT FOR EACH SIGNIFICANT RISK]
SECTION 4: RISK TREATMENT
4.1 Risk Treatment Options
| Option |
Description |
When to Use |
| Avoid |
Eliminate the risk by not proceeding |
Unacceptable risk, no viable controls |
| Mitigate |
Implement controls to reduce likelihood/impact |
Risk can be reduced to acceptable level |
| Transfer |
Shift risk to third party (insurance, contracts) |
Risk better managed by others |
| Accept |
Acknowledge risk without additional action |
Low risk or cost of control exceeds benefit |
4.2 Risk Treatment Plan
| Risk ID |
Treatment |
Actions |
Owner |
Deadline |
Status |
| [ID] |
☐ Avoid ☐ Mitigate ☐ Transfer ☐ Accept |
[ACTIONS] |
[OWNER] |
[DATE] |
[STATUS] |
| [ID] |
☐ Avoid ☐ Mitigate ☐ Transfer ☐ Accept |
[ACTIONS] |
[OWNER] |
[DATE] |
[STATUS] |
| [ID] |
☐ Avoid ☐ Mitigate ☐ Transfer ☐ Accept |
[ACTIONS] |
[OWNER] |
[DATE] |
[STATUS] |
4.3 Control Requirements
| Risk ID |
Required Controls |
Implementation |
| [ID] |
[CONTROLS] |
[DETAILS] |
| [ID] |
[CONTROLS] |
[DETAILS] |
SECTION 5: RISK MONITORING
5.1 Key Risk Indicators (KRIs)
| KRI |
Risk(s) Monitored |
Threshold |
Frequency |
| [KRI 1] |
[RISKS] |
[THRESHOLD] |
[FREQUENCY] |
| [KRI 2] |
[RISKS] |
[THRESHOLD] |
[FREQUENCY] |
| [KRI 3] |
[RISKS] |
[THRESHOLD] |
[FREQUENCY] |
5.2 Monitoring Schedule
| Activity |
Frequency |
Responsible |
| KRI monitoring |
[FREQUENCY] |
[ROLE] |
| Control effectiveness review |
[FREQUENCY] |
[ROLE] |
| Risk reassessment |
[FREQUENCY] |
[ROLE] |
| Stakeholder reporting |
[FREQUENCY] |
[ROLE] |
5.3 Escalation Triggers
| Trigger |
Action |
Escalate To |
| KRI breach |
[ACTION] |
[ROLE] |
| New risk identified |
[ACTION] |
[ROLE] |
| Control failure |
[ACTION] |
[ROLE] |
| Incident occurs |
[ACTION] |
[ROLE] |
SECTION 6: APPROVAL
6.1 Risk Acceptance
| Residual Risk |
Accepted By |
Rationale |
| [RISK] |
[NAME, ROLE] |
[RATIONALE] |
6.2 Assessment Approval
| Role |
Name |
Signature |
Date |
| Assessor |
|
|
|
| Risk Owner |
|
|
|
| Compliance |
|
|
|
| Executive Sponsor |
|
|
|
6.3 Conditions for Approval
☐ All critical and high risks have treatment plans
☐ Residual risks are within risk appetite
☐ Required controls are implemented/planned
☐ Monitoring is established
☐ [ADDITIONAL CONDITIONS]
APPENDIX A: RISK REGISTER
[COMPLETE RISK REGISTER IN TABULAR FORMAT]
APPENDIX B: CONTROL INVENTORY
[LIST OF ALL CONTROLS MAPPED TO RISKS]
APPENDIX C: ASSESSMENT METHODOLOGY
[DESCRIBE METHODOLOGY USED]
This AI Risk Assessment Template is provided for informational purposes. Organizations should customize based on their specific context and risk management framework.