What is an AI risk assessment?

An AI risk assessment is a structured exercise that identifies what could go wrong with a specific use of AI, how likely and how severe each harm would be, and which controls bring it to an acceptable level. It is done for a use, not for a technology: the same agent carries different risks in refunds and in lending.

Why does it matter for agents?

An agent that acts creates risks a drafting tool does not: a payment sent to the wrong account, a record changed that cannot be restored, a customer told something false in the organisation's name. The assessment is where those harms are named and tied to a decision about how far the agent may act and who must approve what it cannot do alone.

It is also where the human risk shows up. A control that depends on a reviewer only works if the reviewer is competent. A good assessment asks whether the people in the loop are trained for what they will see, and records the answer.

How does it work in practice?

Most assessments follow the same sequence:

1. Describe the use: the agent, each capability, the data it reads, the systems it can change.
2. Identify harms for each capability: to customers, the organisation, third parties.
3. Rate likelihood, severity and reversibility. Reversibility matters most for agents, because a hard-to-undo action needs a higher bar.
4. Map controls: depth limits, held actions, approval by a named person, source requirements, monitoring.
5. Name the people controls and the competence each needs.
6. Record residual risk and who accepted it.

The AI agent risk assessment template lays these out as fields. ISO/IEC 23894 gives guidance on AI risk management, and the NIST AI Risk Management Framework's Map and Measure functions cover the same ground.

What is an example?

Take an insurer assessing an agent that drafts claim settlements. The harm with the highest severity is an overpayment that is hard to recover. The control is that settlements above the customer's own limit are held for a named claims handler. The assessment then asks: are those handlers trained to read the agent's evidence and reject a draft built on an external, unverified document? If the answer is "not yet", the agent stays at draft only until they are.

How is it different from a competency assessment?

An AI risk assessment judges a system in a use. A competency assessment judges a person against a standard, as described in what competency-based assessment is. They meet at one point: the risk assessment says which people controls exist, and the competency assessment proves those people can carry them. Neither replaces the other.

It also differs from a data protection impact assessment under GDPR Article 35, which focuses on risks to people's personal data. Many organisations run both and cross-refer.

Which terms are related?

• Training needs assessment: finds the skill gaps the risk assessment exposed; see the AI literacy needs assessment template.
• Compliance risk assessment: a separate exercise an agent may help draft, discussed in whether an AI agent can do a compliance risk assessment.
• Residual risk: what remains once controls are in place.

For the people side of the topic, read AI literacy and certification for people who work with agents.