AI risk assessment template: what to assess

What it is

Before you put a consequential AI use into the world, assess what could go wrong. An AI risk assessment, sometimes called an impact assessment, is a short, structured review of the harms a use could cause, how likely and severe they are, and what reduces them.

When you need one

You don’t need a full assessment for every AI use. Reserve it for high-impact cases: anything client-facing, anything that touches confidential or personal information, and anything that affects a decision about a person, such as hiring, credit or eligibility. For low-risk internal uses, your acceptable use policy is enough.

What to assess

• Purpose and context: what the AI does, and why.
• Affected people: who is affected, and how much.
• Potential harms: errors, bias, exclusion, privacy loss, safety and reputation, each rated for likelihood and severity.
• Fairness: how the use is checked for bias across the groups it affects.
• Transparency: whether people are told AI is involved, and whether they can challenge the outcome.
• Human oversight: who reviews outputs, and where a person can override.
• Mitigations: what reduces each significant harm, and who owns it.
• Residual risk and decision: acceptable, acceptable with conditions, or not acceptable.

The template

Work through these eight steps for each use that needs an assessment. The worked example uses fictional Meridian Creative records.

Then record each risk you find in a risk register. The downloads use the same columns as the risk register in the AI Governance Toolkit, so the file imports without edits: Risk description, Related system or use case, Category, Likelihood, Impact, Current controls, Owner, Mitigation action, Due date, Status, Accepted by and why. Replace the two example rows with your own.

Download the template (CSV)Download the template (Excel)

Free. No email. The Excel file adds the eight steps and the allowed values for each column.

Import this into the AI Governance Toolkit · $299

Keep it proportional

An assessment should match the stakes. One page is fine for a limited internal tool. A client-facing use that affects people deserves a thorough review with named mitigations and a recorded sign-off. The point is a deliberate, documented decision, not paperwork for its own sake.

Record the decision

Write down the decision, its conditions, the owner and the date you will look at it again. Revisit it when the tool, the information or the way you use it changes. A recorded decision is also what a client or partner wants to see when they ask how you approved the use.

A worked example: a request Meridian declined

Not every assessment ends in a yes. At Meridian Creative, a fictional 42-person agency, an account manager asked to keep using a call recorder they had been running on a personal account to transcribe client calls.

The operations director worked through the eight steps. The purpose was reasonable: faster account notes. The information was not. Client discussions, participant names and voices would go into a tool on a personal account, with no agreement on retention and no client consent. People affected included the clients themselves. Likelihood of harm was medium; impact was high. The only control was the account manager’s own care.

The decision was “declined”, with the reason and an alternative written down: written call notes, and the approved meeting summary assistant for internal meetings only. The request can come back once client consent and retention are agreed. Writing down the alternative matters: people route around a bare no, but they use a better option when they are given one.

Declining created a follow-up risk of its own. Recordings already made on the personal account had not been located or deleted. That went into the register with the account director as owner, a mitigation (confirm what was recorded, delete the copies, record the deletion) and a due date of October 22. A declined request with an open follow-up is a normal, healthy record. It shows the decision was deliberate and that someone is closing the gap.

Using your AI assistant

An AI assistant can turn your description of a use into a first draft and then challenge it. It can’t know facts you haven’t given it, so keep the unknowns visible and have the owner make the decision.

Using only the description below, draft a risk assessment for this AI use with these headings: purpose and context, affected people, potential harms (rate each low, medium or high for likelihood and severity), human oversight, mitigations with a suggested owner role, and residual risk. Mark anything the description doesn't tell you as UNKNOWN and list the question to ask. Do not invent controls, test results or approvals.

Description of the AI use:
[what it does, who uses it, what information goes in, who sees the output]

Review this draft risk assessment as a skeptical reviewer. For each harm, say whether the likelihood and severity ratings are supported by the facts given, which mitigations have no owner, and what evidence would show each mitigation works in practice. Do not change the decision. List the questions for the owner.

Draft assessment:
[paste]

Common questions

Related guides

• What is AI governance? A practical guide
• How to write an AI acceptable use policy
• AI vendor risk assessment: what to check

Extrasphere Media LLC. Content for general informational purposes, not legal advice and not a substitute for qualified counsel. Independent and not affiliated with ISO, the IEC, NIST, or the European Union.