AI risk assessment
Also called algorithmic impact assessment, AI impact assessment
An AI risk assessment is a structured review of the harms an AI system could cause, how likely they are and how they are controlled. It covers risks such as bias, errors, weak explainability, data misuse and security. Firms run it before deployment and repeat it through the system's life as use and performance change.
How it works
A firm first records the system's purpose, users, data and decisions it influences, then classifies it by risk tier. Reviewers test for bias, accuracy, robustness and drift, and check privacy and security controls. Findings are scored against the firm's risk appetite, mitigations are agreed, and an accountable owner signs off before launch. High-risk systems get deeper validation and more frequent review.
Regulators expect firms to know what AI they use and how it can fail. Under the EU AI Act, providers of high-risk systems must run a risk management system across the lifecycle, and some deployers must assess impacts on fundamental rights. In the US, bank supervisors fold AI into model risk management. A documented assessment is the main evidence firms can show supervisors.
The rules
Requires a continuous risk management system for high-risk AI; Annex III duties apply from 2 December 2027 under Regulation (EU) 2026/1744.
Providers of Annex III high-risk AI systemsReplaces SR 11-7 and SR 21-8 as the Federal Reserve's guidance on managing model risk.
Federal Reserve-supervised banking organisationsVoluntary framework setting out how to govern, map, measure and manage AI risks.
Voluntary for any organisation using AICommon questions
Is an AI risk assessment required by law?
It depends on the system and jurisdiction. The EU AI Act requires risk management for high-risk AI systems and fundamental rights impact assessments by some deployers. Data protection law may require a DPIA. Elsewhere, supervisors expect it as part of model risk management.
How is an AI risk assessment different from a DPIA?
A data protection impact assessment focuses on risks to individuals from processing personal data. An AI risk assessment is wider, covering accuracy, bias, robustness, security and operational risk even where no personal data is involved. Firms often link the two.
Who should carry out an AI risk assessment?
The business owner of the system usually leads, with input from data science, model risk, compliance, legal, data protection and information security. Independent validation by a second-line function is common for higher-risk systems.
How often should AI risk assessments be updated?
Firms typically reassess when a system changes materially, when monitoring shows drift or incidents, and on a fixed cycle set by risk tier. The EU AI Act describes risk management for high-risk systems as a continuous process across the lifecycle.
