AI risk assessment

The requirement, in our words

Run a defined process for assessing AI risk that follows the policy and objectives, gives comparable results when repeated, identifies risks to the objectives, and analyses consequences for the organization, individuals and society, with realistic likelihood where applicable.

What it means for human oversight

The risk assessment decides where oversight is needed and how intense it should be. If consequences are assessed only for the organization, the overseer is not told what the system can do to a person.

How to evidence it

Attach the artefacts above to the AI risk assessment row with the system name, the owner and the date. The first one is the anchor: The risk assessment procedure. The OH-05 file is complete when the named person can produce that artefact and explain the decision it records, without asking someone else where it is.

The reviewer will sample one live decision and ask for Evidence the method gives comparable results when repeated. If that artefact for OH-05 cannot be produced, the row is a gap, whatever the policy says.

OH-05 carries 3 evidence items and 2 common gaps. For ai risk assessment, test the control on a live system at production volume, since a version that works only in a pilot has not yet been shown to work. The OH-05 statement above is ours, written from ISO/IEC 42001:2023, 6.1.2, not a reproduction of the licensed text.

Common gaps

• Consequences assessed for the organization only
• Scoring changes between assessments so results cannot be compared

Related units

• Operational planning and control
• Verification and validation
• Context and the role you play