AI risk assessment

The process of identifying, analysing and evaluating the risks that AI systems pose to your organisation's objectives, so that you can decide which to treat. Clause 6.1.2 requires defined criteria, repeatable results and identified risk owners; clause 6.1.3 then requires a risk treatment plan drawing on the Annex A controls. Annex C lists AI-specific risk sources, such as data quality, lack of transparency and automation bias, to help you be systematic.