An AI agent risk assessment identifies what could go wrong when a specific agent acts, scores each risk before and after controls, and records whether the residual risk sits within appetite. Assess per capability, not per agent: reading a file and moving money carry very different risks. The template and a filled sample below can be used the same day.
How is an agent risk assessment different?
A model risk assessment asks whether a model's outputs are accurate. An agent risk assessment also asks what happens when the agent acts on an output that is wrong, out of scope, or manipulated. The harm comes from the action, so the assessment is organised around actions. This is the approach set out in agent governance is a bound, not a model.
That shifts the controls you look for. Model accuracy still matters, but so do depth, holds for a person, limits, source provenance, refusal behaviour and the ability to undo. Standards such as ISO/IEC 42001 expect an AI risk assessment as part of the management system; how that maps to agents is covered in ISO/IEC 42001 AI risk assessment for AI agents.
When should you use it?
Before go-live, at each widening of depth, after any incident involving the agent, and when an external change affects it, such as a new rule. For regulatory triggers, link this assessment to your regulatory change impact assessment so the chain is visible.
The output feeds the go-live decision. Each residual risk is compared with the AI agent risk appetite statement; anything outside appetite blocks that capability.
How do you fill in each field?
- List capabilities from the role charter, each with its intended depth.
- Identify risks per capability using a fixed set of categories: wrong output acted on, out-of-scope action, manipulated input, data exposure, unfair outcome, failure to escalate, unavailability.
- Score inherent risk as impact times likelihood, before controls, assuming the agent acts at its intended depth.
- List controls and say how each is evidenced. A control without evidence does not reduce the score.
- Score residual risk after controls.
- Compare with appetite and record the decision: accept, reduce depth, add controls, or do not deploy.
An agent can help draft parts of an assessment, such as listing controls already in place, but the scoring and acceptance stay with people; see whether an AI agent can do a compliance risk assessment.
The template
| Field | Guidance |
|---|---|
| Agent and ID | From the inventory |
| Capability | Verb and object |
| Intended depth | 1 to 4 |
| Risk category | From the fixed list |
| Risk description | What happens, to whom |
| Inherent impact (1 to 5) | Before controls |
| Inherent likelihood (1 to 5) | Before controls |
| Inherent score | Impact times likelihood |
| Controls | Each control and its evidence |
| Residual impact and likelihood | After controls |
| Residual score | |
| Within appetite? | Yes or no, with appetite line cited |
| Decision | Accept, reduce depth, add control, do not deploy |
| Risk owner | Named person |
| Review date |
A filled sample
A hypothetical consumer lender's servicing agent, two capabilities.
| Capability | Depth | Risk | Inherent | Controls and evidence | Residual | Within appetite? | Decision |
|---|---|---|---|---|---|---|---|
| Apply payment date change | 3 | Wrong account changed after weak identity check | 4 x 3 = 12 | Identity steps enforced before action (test log); one change per 90 days (limit config); customer notified by SMS (template) | 4 x 1 = 4 | Yes, change customer records at 3 | Accept |
| Apply payment date change | 3 | Change pushes payment past pay day, causing arrears | 3 x 3 = 9 | Agent shows impact on next due date (test cases); customer confirms | 3 x 2 = 6 | Yes | Accept, monitor arrears after change |
| Draft forbearance proposal | 2 | Proposal unaffordable for customer | 5 x 3 = 15 | Person reviews every draft; draft cites income and expenditure figures (sample review) | 5 x 2 = 10 | Borderline | Add control: affordability check by person before any proposal is shared |
| Draft forbearance proposal | 2 | Customer in financial difficulty not identified | 5 x 3 = 15 | Vulnerability signals route to specialist (QA scorecard) | 5 x 2 = 10 | Borderline | Add control: all forbearance cases handled by trained team |
The forbearance rows show how an agent risk assessment differs from a generic one. The draft itself carries little risk; the harm comes if a person relies on it without checking whether the customer can afford it. An affordability assessment by a person becomes the added control.
Questions people ask
Who should complete the risk assessment?
The agent owner drafts it with the team that built the agent. The second line challenges the scores. The risk owner signs the decision.
What scoring scale should we use?
Use your firm's existing operational risk scale so agent risks can be compared with everything else. A separate scale for AI makes aggregation and reporting harder.
How often should it be refreshed?
At least annually, and whenever depth changes, an incident occurs, or a relevant rule changes. A certificate lapse is also a good prompt to check the assessment still holds.