AI Risk Assessment Template

All states Compliance & Regulatory Updated August 10, 2026 Free Word and PDF

Draft it with AI

Answer a few questions and the AI editor drafts each section from your answers, on your state's version. Review it, then export Word and PDF.

$99 one time, or $249/mo for everything

Ezel is drafting software, not a law firm. Editing by hand is free.

Or take the blank template

Enter your email and it downloads right away. No account needed.

AI RISK ASSESSMENT TEMPLATE

USE GATE

This worksheet supplies an internal process, not a universal legal classification. Before scoring risk, complete Section 1.2 from current official legal sources and authoritative versions of any voluntary or contractual framework. Keep legal obligations, standard requirements, contractual commitments, and internal policy controls in separate rows so one is not mistaken for another.

ASSESSMENT INFORMATION

Field	Information
Organization	[ORGANIZATION NAME]
AI System Name	[SYSTEM NAME]
Assessment ID	[ASSESSMENT-ID]
Assessment Date	[DATE]
Assessor(s)	[NAME(S) AND ROLE(S)]
Assessment Type	☐ Initial ☐ Periodic ☐ Change-Triggered ☐ Post-Incident
Version	[VERSION]

EXECUTIVE SUMMARY

Overall Risk Rating

Rating	Assessment
☐ Low	Acceptable risk; proceed with standard controls
☐ Medium	Moderate risk; implement enhanced controls
☐ High	Significant risk; require senior approval and robust controls
☐ Critical	Unacceptable risk; do not proceed without substantial changes

Key Risk Summary

Risk Category	Count	Highest Severity
Technical Risks	[#]	☐ Critical ☐ High ☐ Medium ☐ Low
Ethical Risks	[#]	☐ Critical ☐ High ☐ Medium ☐ Low
Legal/Compliance Risks	[#]	☐ Critical ☐ High ☐ Medium ☐ Low
Operational Risks	[#]	☐ Critical ☐ High ☐ Medium ☐ Low
Reputational Risks	[#]	☐ Critical ☐ High ☐ Medium ☐ Low

Top Risks

[RISK 1]: [BRIEF DESCRIPTION]
[RISK 2]: [BRIEF DESCRIPTION]
[RISK 3]: [BRIEF DESCRIPTION]

SECTION 1: AI SYSTEM CONTEXT

1.1 System Overview

Field	Description
System Name	[NAME]
System Type	[CLASSIFICATION/PREDICTION/GENERATION/ETC.]
Business Purpose	[DESCRIBE]
Deployment Status	☐ Development ☐ Testing ☐ Production ☐ Retired
System Owner	[NAME, ROLE]

1.2 Regulatory Classification

Do not select a legal classification from memory or analogy. Record the current source, applicable role and use, effective date, territorial trigger, analysis owner, and conclusion.

Authority or Framework	Type	Current Citation / Version and URL	Applicable Role / Use	Effective Date	Classification / Requirement	Analysis Owner
[LAW OR REGULATION]	Legal	[OFFICIAL SOURCE]	[PROVIDER/DEPLOYER/OTHER; USE]	[DATE]	[CONCLUSION AND BASIS]	[NAME/ROLE]
[STANDARD OR GUIDANCE]	Voluntary / Contractual / Other	[AUTHORITATIVE SOURCE]	[SCOPE]	[DATE/VERSION]	[CONTROL OR MAPPING]	[NAME/ROLE]
Internal risk tier	Internal Policy	[POLICY/VERSION]	[SCOPE]	[DATE]	☐ Critical ☐ High ☐ Medium ☐ Low	[NAME/ROLE]

1.3 Stakeholders

Stakeholder	Interest	Impact Level
[STAKEHOLDER 1]	[INTEREST]	☐ High ☐ Medium ☐ Low
[STAKEHOLDER 2]	[INTEREST]	☐ High ☐ Medium ☐ Low
[STAKEHOLDER 3]	[INTEREST]	☐ High ☐ Medium ☐ Low

1.4 Deployment Context

Factor	Description
Geographic Scope	[REGIONS]
User Population	[DESCRIPTION AND SIZE]
Integration Points	[SYSTEMS INTEGRATED WITH]
Decision Types	[DECISIONS SUPPORTED/MADE]
Automation Level	☐ Fully Automated ☐ Human-Assisted ☐ Human-in-the-Loop

SECTION 2: RISK IDENTIFICATION

2.1 Technical Risks

ID	Risk	Description	Likelihood	Impact	Risk Level
T1	Model Accuracy Degradation	[DESCRIPTION]	☐ H ☐ M ☐ L	☐ H ☐ M ☐ L	[LEVEL]
T2	Model Drift	[DESCRIPTION]	☐ H ☐ M ☐ L	☐ H ☐ M ☐ L	[LEVEL]
T3	Data Quality Issues	[DESCRIPTION]	☐ H ☐ M ☐ L	☐ H ☐ M ☐ L	[LEVEL]
T4	System Failures	[DESCRIPTION]	☐ H ☐ M ☐ L	☐ H ☐ M ☐ L	[LEVEL]
T5	Scalability Limits	[DESCRIPTION]	☐ H ☐ M ☐ L	☐ H ☐ M ☐ L	[LEVEL]
T6	Integration Failures	[DESCRIPTION]	☐ H ☐ M ☐ L	☐ H ☐ M ☐ L	[LEVEL]
T7	Adversarial Attacks	[DESCRIPTION]	☐ H ☐ M ☐ L	☐ H ☐ M ☐ L	[LEVEL]
T8	[ADDITIONAL]	[DESCRIPTION]	☐ H ☐ M ☐ L	☐ H ☐ M ☐ L	[LEVEL]

2.2 Ethical and Fairness Risks

ID	Risk	Description	Likelihood	Impact	Risk Level
E1	Algorithmic Bias	[DESCRIPTION]	☐ H ☐ M ☐ L	☐ H ☐ M ☐ L	[LEVEL]
E2	Discrimination	[DESCRIPTION]	☐ H ☐ M ☐ L	☐ H ☐ M ☐ L	[LEVEL]
E3	Lack of Transparency	[DESCRIPTION]	☐ H ☐ M ☐ L	☐ H ☐ M ☐ L	[LEVEL]
E4	Privacy Violations	[DESCRIPTION]	☐ H ☐ M ☐ L	☐ H ☐ M ☐ L	[LEVEL]
E5	Autonomy Undermining	[DESCRIPTION]	☐ H ☐ M ☐ L	☐ H ☐ M ☐ L	[LEVEL]
E6	Harmful Outputs	[DESCRIPTION]	☐ H ☐ M ☐ L	☐ H ☐ M ☐ L	[LEVEL]
E7	Misinformation	[DESCRIPTION]	☐ H ☐ M ☐ L	☐ H ☐ M ☐ L	[LEVEL]
E8	[ADDITIONAL]	[DESCRIPTION]	☐ H ☐ M ☐ L	☐ H ☐ M ☐ L	[LEVEL]

2.3 Legal and Compliance Risks

ID	Risk	Description	Likelihood	Impact	Risk Level
L1	Applicable AI-Law Non-Compliance	[CITATION, REQUIREMENT, AND DESCRIPTION]	☐ H ☐ M ☐ L	☐ H ☐ M ☐ L	[LEVEL]
L2	Jurisdiction / Effective-Date Error	[DESCRIPTION]	☐ H ☐ M ☐ L	☐ H ☐ M ☐ L	[LEVEL]
L3	Data Protection Violations	[DESCRIPTION]	☐ H ☐ M ☐ L	☐ H ☐ M ☐ L	[LEVEL]
L4	IP Infringement	[DESCRIPTION]	☐ H ☐ M ☐ L	☐ H ☐ M ☐ L	[LEVEL]
L5	Consumer Protection Issues	[DESCRIPTION]	☐ H ☐ M ☐ L	☐ H ☐ M ☐ L	[LEVEL]
L6	Employment Law Violations	[DESCRIPTION]	☐ H ☐ M ☐ L	☐ H ☐ M ☐ L	[LEVEL]
L7	Sector-Specific Regulations	[DESCRIPTION]	☐ H ☐ M ☐ L	☐ H ☐ M ☐ L	[LEVEL]
L8	[ADDITIONAL]	[DESCRIPTION]	☐ H ☐ M ☐ L	☐ H ☐ M ☐ L	[LEVEL]

2.4 Operational Risks

ID	Risk	Description	Likelihood	Impact	Risk Level
O1	Human Oversight Failures	[DESCRIPTION]	☐ H ☐ M ☐ L	☐ H ☐ M ☐ L	[LEVEL]
O2	Skills/Training Gaps	[DESCRIPTION]	☐ H ☐ M ☐ L	☐ H ☐ M ☐ L	[LEVEL]
O3	Process Failures	[DESCRIPTION]	☐ H ☐ M ☐ L	☐ H ☐ M ☐ L	[LEVEL]
O4	Vendor/Third-Party Risks	[DESCRIPTION]	☐ H ☐ M ☐ L	☐ H ☐ M ☐ L	[LEVEL]
O5	Change Management Failures	[DESCRIPTION]	☐ H ☐ M ☐ L	☐ H ☐ M ☐ L	[LEVEL]
O6	Business Continuity Risks	[DESCRIPTION]	☐ H ☐ M ☐ L	☐ H ☐ M ☐ L	[LEVEL]
O7	[ADDITIONAL]	[DESCRIPTION]	☐ H ☐ M ☐ L	☐ H ☐ M ☐ L	[LEVEL]

2.5 Reputational and Strategic Risks

ID	Risk	Description	Likelihood	Impact	Risk Level
R1	Public Trust Damage	[DESCRIPTION]	☐ H ☐ M ☐ L	☐ H ☐ M ☐ L	[LEVEL]
R2	Media Attention	[DESCRIPTION]	☐ H ☐ M ☐ L	☐ H ☐ M ☐ L	[LEVEL]
R3	Customer Backlash	[DESCRIPTION]	☐ H ☐ M ☐ L	☐ H ☐ M ☐ L	[LEVEL]
R4	Competitive Disadvantage	[DESCRIPTION]	☐ H ☐ M ☐ L	☐ H ☐ M ☐ L	[LEVEL]
R5	[ADDITIONAL]	[DESCRIPTION]	☐ H ☐ M ☐ L	☐ H ☐ M ☐ L	[LEVEL]

SECTION 3: RISK ANALYSIS

3.1 Risk Scoring Matrix

Impact ↓ / Likelihood →	Low	Medium	High
High	Medium	High	Critical
Medium	Low	Medium	High
Low	Low	Low	Medium

3.2 Detailed Risk Analysis

Risk ID: [ID]

Aspect	Analysis
Risk Title	[TITLE]
Category	[CATEGORY]
Description	[DETAILED DESCRIPTION]
Root Causes	[CAUSES]
Affected Stakeholders	[STAKEHOLDERS]
Potential Consequences	[CONSEQUENCES]
Likelihood Assessment	☐ High ☐ Medium ☐ Low
Impact Assessment	☐ High ☐ Medium ☐ Low
Inherent Risk Level	[LEVEL]
Existing Controls	[CONTROLS]
Control Effectiveness	☐ Effective ☐ Partial ☐ Ineffective
Residual Risk Level	[LEVEL]

[REPEAT FOR EACH SIGNIFICANT RISK]

SECTION 4: RISK TREATMENT

4.1 Risk Treatment Options

Option	Description	When to Use
Avoid	Eliminate the risk by not proceeding	Unacceptable risk, no viable controls
Mitigate	Implement controls to reduce likelihood/impact	Risk can be reduced to acceptable level
Allocate / Finance	Allocate duties or financial consequences through contracts or insurance without assuming legal responsibility disappears	Another party or financial mechanism can address a defined portion of the risk
Accept	Acknowledge risk without additional action	Low risk or cost of control exceeds benefit

4.2 Risk Treatment Plan

Risk ID	Treatment	Actions	Owner	Deadline	Status
[ID]	☐ Avoid ☐ Mitigate ☐ Transfer ☐ Accept	[ACTIONS]	[OWNER]	[DATE]	[STATUS]
[ID]	☐ Avoid ☐ Mitigate ☐ Transfer ☐ Accept	[ACTIONS]	[OWNER]	[DATE]	[STATUS]
[ID]	☐ Avoid ☐ Mitigate ☐ Transfer ☐ Accept	[ACTIONS]	[OWNER]	[DATE]	[STATUS]

4.3 Control Requirements

Risk ID	Required Controls	Implementation
[ID]	[CONTROLS]	[DETAILS]
[ID]	[CONTROLS]	[DETAILS]

SECTION 5: RISK MONITORING

5.1 Key Risk Indicators (KRIs)

KRI	Risk(s) Monitored	Threshold	Frequency
[KRI 1]	[RISKS]	[THRESHOLD]	[FREQUENCY]
[KRI 2]	[RISKS]	[THRESHOLD]	[FREQUENCY]
[KRI 3]	[RISKS]	[THRESHOLD]	[FREQUENCY]

5.2 Monitoring Schedule

Activity	Frequency	Responsible
KRI monitoring	[FREQUENCY]	[ROLE]
Control effectiveness review	[FREQUENCY]	[ROLE]
Risk reassessment	[FREQUENCY]	[ROLE]
Stakeholder reporting	[FREQUENCY]	[ROLE]

5.3 Escalation Triggers

Trigger	Action	Escalate To
KRI breach	[ACTION]	[ROLE]
New risk identified	[ACTION]	[ROLE]
Control failure	[ACTION]	[ROLE]
Incident occurs	[ACTION]	[ROLE]

SECTION 6: APPROVAL

6.1 Risk Acceptance

Residual Risk	Accepted By	Rationale
[RISK]	[NAME, ROLE]	[RATIONALE]

6.2 Assessment Approval

Role	Name	Signature	Date
Assessor
Risk Owner
Compliance
Executive Sponsor

6.3 Conditions for Approval

☐ All critical and high risks have treatment plans
☐ Residual risks are within risk appetite
☐ Required controls are implemented/planned
☐ Monitoring is established
☐ [ADDITIONAL CONDITIONS]

Approval records an internal decision only. It does not override a prohibition, mandatory control, regulator or customer right, contractual obligation, or required independent review identified in Section 1.2.

APPENDIX A: RISK REGISTER

[COMPLETE RISK REGISTER IN TABULAR FORMAT]

APPENDIX B: CONTROL INVENTORY

[LIST OF ALL CONTROLS MAPPED TO RISKS]

APPENDIX C: ASSESSMENT METHODOLOGY

[DESCRIBE THE ACTUAL METHODOLOGY, DEFINITIONS, SCORING SCALE, EVIDENCE STANDARD, UNCERTAINTY, REVIEWERS, AND VERSION USED. DO NOT CLAIM ALIGNMENT OR CONFORMITY WITHOUT A COMPLETED CONTROL-BY-CONTROL MAPPING TO THE AUTHORITATIVE VERSION.]

SOURCES AND REFERENCES

Current official legal authorities applicable to this system: [INSERT CITATIONS AND URLS]
Authoritative versions of standards, guidance, contractual frameworks, and internal policies actually used: [INSERT TITLES, VERSIONS, DATES, AND URLS OR CONTROLLED LOCATIONS]

This framework-neutral AI Risk Assessment Template is provided for informational purposes. Organizations must customize it to their actual system, authority inventory, and documented methodology.

Insert Image

Insert Table

Need to customize this document?

About this template

Last updated: August 10, 2026
Citations checked: August 10, 2026
Jurisdiction: All states
Category: Compliance & Regulatory

Legal authority

Jurisdiction-, sector-, role-, and use-specific AI, privacy, consumer-protection, employment, intellectual-property, safety, and other authority: [INSERT CURRENT OFFICIAL CITATIONS AND URLS BEFORE USE]

Compliance documents are what regulated businesses use to prove they follow the rules that apply to their industry, whether that is privacy, anti-money-laundering, consumer protection, or sector-specific requirements. Regulators look for consistent policies, up-to-date records, and clear evidence of employee training. The cost of getting compliance paperwork right is almost always smaller than the cost of an enforcement action, fine, or public disclosure.

Not legal advice

This template is provided for informational purposes. We recommend having an attorney review any legal document before signing, especially for high-value or complex matters.

Checked against the law it cites

A reviewer verified this template's legal citations against the official source on August 10, 2026.

Draft your AI Risk Assessment Template in the editor

Answer a few questions, let the AI editor draft each section from your answers, review it, and download Word and PDF. $99 one time, or $249 per month for every document and every Ezel app.