AI risk assessment

An AI risk assessment examines a proposed tool or use case across the dimensions that later become incidents: what data flows in, where it goes, whether it trains models, which certifications apply at the tier in question, what misuse looks like, and which controls compensate. Privacy impact assessments and the EU AI Act's requirements formalize versions of it.

Two practices keep assessments honest: verify vendor claims against published terms rather than sales decks, and reassess on change — AI vendors revise data-handling terms often enough that an annual review misses the flip.