How to classify AI agents by risk

Score the agent on its riskiest capability, not its average one. Classify AI agents by risk using five factors: the highest depth any capability holds, how reversible its actions are, who is affected, how sensitive the data is, and whether a law treats the use as high-risk. A named risk owner signs the tier, and the tier sets the controls.

What is risk classification for, and who owns it?

Classification decides how much attention each agent gets. A read-only agent that summarises internal policies does not need the testing, approvals and board reporting of an agent that agrees payment plans with customers. Without tiers, firms either over-control everything and stall, or under-control the agents that matter.

The second-line risk function owns the method and the tier definitions. The process owner proposes a tier for each agent. A risk lead confirms or changes it. The tier is recorded on the inventory and drives everything from approval routes to review frequency.

Which factors decide the tier?

• Highest depth. An agent with nine capabilities at depth 1 and one at depth 4 is a depth 4 agent for classification.
• Reversibility. Can a wrong action be undone fully, partly, or not at all? Our guide to how to classify actions by how reversible they are gives the scale.
• Who is affected. Internal staff, business customers, retail customers, or customers who may be vulnerable.
• Data sensitivity. Public, internal, personal, or special-category data such as health.
• Legal status. Whether the use falls into a regulated category, such as creditworthiness assessment of individuals, which the EU AI Act lists as high-risk.

A simple rule works: the tier is set by the worst factor, and two factors at the top level move the agent up one more tier where you have one.

What are the steps?

1. Agent, depth 1: gathers the facts. From the agent's brief, capability matrix and connected systems, it lists depths, target systems, data categories and the customer groups served.
2. Agent, depth 2: drafts a proposed tier with the factor that drove it, using the firm's tier definitions.
3. Person, process owner: reviews the draft, correcting facts the agent could not see, such as a customer group it serves through a partner.
4. Person, legal or compliance: decides the legal question. Whether the use falls under a regulated category is a legal judgement, set out in how to classify an AI agent under the EU AI Act risk categories for EU uses.
5. Person, risk lead: confirms the tier and signs it.
6. Agent, depth 3: records the tier on the inventory and applies the matching control set: approval route, certification frequency and reporting line.
7. Agent, depth 1: watches for triggers. A new capability, higher depth, new data source or new customer group prompts reclassification, which goes back to step 2.

Which decisions does a named person keep?

The risk lead keeps the final tier. Compliance keeps the legal classification. The process owner keeps the facts about how the agent is used. The agent can draft and record, but it should never set its own tier: an agent asked to judge its own risk has every reason in its inputs to under-state it, and no accountability for being wrong.

What record does the method produce?

Each classification leaves a short, signed record: the facts gathered, the proposed tier, any corrections, the legal view, the confirmed tier with its deciding factor, and the date. The AI agent risk assessment template is a usable format. The deciding factor matters most, because it tells a later reviewer what would have to change to move the agent down a tier.

What controls follow from each tier?

An illustrative three-tier scheme:

• Lower tier: read-only or drafting agents, internal users, no special-category data. Owner approval, certification at the normal interval, quarterly review.
• Middle tier: routine execution affecting customers, reversible actions, personal data. Risk approval as well as owner approval, monthly review of holds and refusals.
• Higher tier: money movement or hard-to-undo actions, retail or vulnerable customers, special-category data, or a legally high-risk use. Executive sign-off, more frequent certification, every held action approved by a named person, and inclusion in board reporting.

What should you measure?

Count agents in each tier and how that changes. Track how many reclassifications were triggered by the agent's own monitoring compared with those found in reviews, and how many agents are overdue for review in their tier. Board reporting should show tier movement, not only totals; see how do you report on AI agent risk to the board?

Where does it usually go wrong?

Averaging. A mostly harmless agent with one dangerous capability gets a low tier. Classify by the worst capability.

Classifying the model, not the agent. Two agents on the same model can carry very different risk because they do different things. The tier belongs to the agent and its capabilities.

Tiers that never move. A new tool is connected, the agent can now send emails to customers, and its tier still says internal-only. Reclassification triggers must be automatic.

Tier without consequences. If every tier gets the same controls, the exercise is paperwork. Tie each tier to concrete differences in approval, testing and reporting.

Where Pryme fits

In Pryme, each capability has its own depth earned through Attest, and each verdict names the bound that decided, so the facts behind classification come from the platform rather than from memory. The role of tiers within wider control is covered in agent governance is a bound, not a model.