{"slug":"ai-risk-assessment","id":"AIPT-CTL-0008","title":"AI risk assessment and lifecycle risk register","kind":"process","kind_label":"Process","purpose":"Identifies, rates and treats the risks that a specific AI system poses to health, safety, rights and the organisation itself, and keeps that analysis alive from design through retirement.\n","description":"For each in-scope system a cross-functional team runs a structured assessment: it lists foreseeable harms under intended use and reasonably foreseeable misuse, rates likelihood and severity, records existing and planned mitigations and decides whether residual risk is acceptable. Findings feed a per-system risk register with an owner and review date for each item. The assessment is redone on material change, after significant incidents and on a fixed cadence, and its outputs feed the testing plan, the human-oversight design and the release decision. Residual-risk acceptance is signed by an accountable person rather than the delivery team.\n","owner_role":"AI system owner","frequency":"per_system","frequency_label":"Once per AI system","risk_subdomains":["1.1","1.3","5.1","7.3","6.5"],"evidence":[{"type":"risk_assessment","title":"AI system risk assessment","description":"Method, identified risks, ratings, treatments and residual-risk decision for one system."},{"type":"risk_register","title":"Per-system AI risk register","description":"Live list of risks with owner, rating, treatment status and next review."},{"type":"approval_record","title":"Residual-risk acceptance","description":null}],"framework_references":[{"framework":"iso_42001","framework_name":"ISO/IEC 42001:2023","reference":"Clause 6.1.2, 6.1.3, 8.2, 8.3","note":null,"confidence_level":"high"},{"framework":"iso_23894","framework_name":"ISO/IEC 23894:2023","reference":"Clause 6.4, 6.5, 6.6","note":"Risk identification, analysis, evaluation, treatment and monitoring.","confidence_level":"high"},{"framework":"nist_ai_rmf","framework_name":"NIST AI RMF 1.0","reference":"MAP 3, MAP 4, MANAGE 1.2, 1.3, 2.1","note":null,"confidence_level":"high"}],"obligations":[{"slug":"eu-ai-act-risk-management-system","title":"Establish a risk management system for high-risk AI","relationship":"satisfies","note":"Continuous lifecycle risk process with register, testing evidence and residual-risk acceptance.","confidence_level":"high","is_binding":true,"policy":"eu-ai-act","jurisdiction":"eu","url":"https://aipolicytracker.org/obligations/eu-ai-act-risk-management-system"},{"slug":"australia-vaiss-accountability-and-risk-management","title":"Establish accountability processes and a risk-management process (guardrails 1 and 2)","relationship":"satisfies","note":"Guardrail 2: per-use-case lifecycle risk process.","confidence_level":"high","is_binding":false,"policy":"australia-voluntary-ai-safety-standard","jurisdiction":"australia","url":"https://aipolicytracker.org/obligations/australia-vaiss-accountability-and-risk-management"},{"slug":"uk-principles-safety-security-robustness","title":"Ensure AI systems are safe, secure and robust throughout their lifecycle","relationship":"satisfies","note":"Lifecycle identification and management of risks.","confidence_level":"medium","is_binding":false,"policy":"uk-ai-regulation-white-paper","jurisdiction":"uk","url":"https://aipolicytracker.org/obligations/uk-principles-safety-security-robustness"},{"slug":"us-nist-ai-rmf-map","title":"Map context, intended use and potential impacts (Map)","relationship":"supports","note":"Risk categorisation and benefit-cost analysis.","confidence_level":"medium","is_binding":false,"policy":"us-nist-ai-rmf","jurisdiction":"us","url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-map"},{"slug":"us-nist-ai-rmf-manage","title":"Prioritise, respond to and monitor AI risks (Manage)","relationship":"satisfies","note":"Risk treatment planning and resource allocation for mapped and measured risks.","confidence_level":"medium","is_binding":false,"policy":"us-nist-ai-rmf","jurisdiction":"us","url":"https://aipolicytracker.org/obligations/us-nist-ai-rmf-manage"},{"slug":"singapore-mgf-internal-governance","title":"Establish internal governance structures and measures for AI","relationship":"supports","note":"Adding AI risks to enterprise risk management.","confidence_level":"medium","is_binding":false,"policy":"singapore-model-ai-governance-framework","jurisdiction":"singapore","url":"https://aipolicytracker.org/obligations/singapore-mgf-internal-governance"},{"slug":"south-korea-ai-basic-act-art-34-high-impact-ai-risk-management-plan","title":"Operators of high-impact AI must establish and operate a risk management plan","relationship":"satisfies","note":"Per-system risk plan with identified risks and treatments.","confidence_level":"high","is_binding":true,"policy":"south-korea-framework-act-on-the-development-of-artificial-intelligence-and-establishment-of-a-foundation-for","jurisdiction":"south-korea","url":"https://aipolicytracker.org/obligations/south-korea-ai-basic-act-art-34-high-impact-ai-risk-management-plan"},{"slug":"india-ai-guidelines-principles-and-risk-based-governance","title":"Adopt the guiding principles and risk-based governance (voluntary)","relationship":"supports","note":"Proportionate risk classification and mitigation per system.","confidence_level":"medium","is_binding":false,"policy":"india-ai-governance-guidelines","jurisdiction":"india","url":"https://aipolicytracker.org/obligations/india-ai-guidelines-principles-and-risk-based-governance"},{"slug":"singapore-mgf-human-involvement","title":"Determine the appropriate level of human involvement in AI decisions","relationship":"supports","note":"Probability and severity of harm drive the involvement level.","confidence_level":"medium","is_binding":false,"policy":"singapore-model-ai-governance-framework","jurisdiction":"singapore","url":"https://aipolicytracker.org/obligations/singapore-mgf-human-involvement"},{"slug":"us-colorado-deployer-risk-management-program","title":"Deployers must implement a risk management policy and programme","relationship":"satisfies","note":"Per-system identification, documentation and mitigation of algorithmic discrimination risk.","confidence_level":"high","is_binding":true,"policy":"us-colorado-ai-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-deployer-risk-management-program"},{"slug":"us-colorado-ai-act-developer-reasonable-care","title":"Developers must use reasonable care to avoid algorithmic discrimination","relationship":"satisfies","note":"Identifies and treats discrimination risk per system.","confidence_level":"high","is_binding":true,"policy":"us-colorado-ai-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-ai-act-developer-reasonable-care"},{"slug":"us-colorado-ai-act-deployer-reasonable-care","title":"Deployers must use reasonable care to avoid algorithmic discrimination","relationship":"supports","note":"Discrimination risk identified for each consequential-decision use.","confidence_level":"high","is_binding":true,"policy":"us-colorado-ai-act","jurisdiction":"us-colorado","url":"https://aipolicytracker.org/obligations/us-colorado-ai-act-deployer-reasonable-care"}],"related_controls":["ai-impact-assessment","accuracy-robustness-security-testing","human-oversight-and-override","post-market-monitoring-and-drift-detection"],"review_status":"verified","confidence_level":"high","last_verified_at":"2026-09-26","reviewed_by":"Bhaskar Bhatt","updated_at":"2026-10-15T06:46:22+00:00","url":"https://aipolicytracker.org/controls/ai-risk-assessment","context_url":"https://aipolicytracker.org/controls/ai-risk-assessment.md"}