Enter for every AI system. Go as deep as your system letter, and implement in your mode.
Why it exists
Judge each risk on how likely it is and how much harm it would do — and, for AI that affects people, add a dedicated assessment of the harm to their rights, because that harm is often the largest and is the one ordinary risk scoring is worst at seeing. A model that is merely inconvenient to the business can be devastating to an individual it decides wrongly about; a risk process that scores only business impact will rank that risk far too low. Where AI touches people, assess the impact on their fundamental rights explicitly — a structured check of how the system could affect the rights, freedoms, and fair treatment of the people subject to it — alongside the operational, financial, and reputational assessment.
What to actually do
Score each risk on likelihood and harm, across all the dimensions of harm. Assess operational, financial, regulatory, and reputational impact — and, wherever AI affects people, add the impact on their rights as a first-class dimension, not a footnote. The worst harm an AI system does is frequently to a person, not to a balance sheet.
Run the rights assessment before deploying AI that affects people. For systems that decide or materially shape decisions about individuals, complete the structured assessment of impact on their rights as a condition of the go-live gate, connecting it to the privacy and explainability assessments of those domains.
Controls
Baseline1 controls
Control 223
Complete a lightweight documented AI risk assessment per use case before approval.
BaselinePreventiveall rolesper system
What it is
One page: what could go wrong, for whom, how likely, and what we do about it. The full assessment of this dimension, the privacy impact assessment of Domain 3 and the impact evaluation of Domain 1 are consolidated, above Baseline, into a single AI system impact assessment covering purpose, affected people, possible harms and benefits, and mitigations.
How to implement it · Minimum structure
Use case: what the AI does, who uses it, what data it touches
What could go wrong: e.g. a wrong answer relied on, confidential data leaked, someone treated unfairly
For whom: the organisation, customers, staff, others
How likely and how bad: low, medium or high for each
What we do about it: the measure and who owns it
Decision: approved, approved with conditions, or rejected; signed and dated
How to start
Make a one-page template with these headings and complete it for the next AI use awaiting approval.
Evidence
A signed one-page assessment for each approved AI use.
Mode: light / standard / full
light
The proposer fills the page and the owner-manager signs it.
standard
The system owner fills it and the approver of new uses signs it.
full
A mandatory intake step, reviewed by the risk function, feeding the unified impact assessment.
Enhanced2 controls
Control 221
Assess each catalogued risk on likelihood and harm across all impact dimensions.
EnhancedPreventiveall rolesper system
What it is
Business impact and impact on people both scored.
How to implement it · Minimum content
Likelihood on a 1–5 scale with written anchors (e.g. 1 = less than once in five years)
Business harm scored separately: operational, financial, regulatory, reputational
Harm to people scored as its own dimension: rights, fair treatment, safety and wellbeing of those affected
Overall rating driven by the highest harm dimension, not an average
Assessor, date and the evidence behind each score
Resulting priority and link to the treatment decision
How to start
Agree the 1–5 scales and their definitions on one page, then score the ten highest catalogued risks.
Evidence
The scored assessments, showing both business and people dimensions for each catalogued risk.
Mode: light / standard / full
light
Management and the AI lead score risks together in a spreadsheet, yearly and on change.
standard
System owners score with the risk lead, who checks consistency across systems.
full
The risk function runs scoring workshops using enterprise scales plus the people dimension.
Control 222
Complete a rights-impact assessment before deploying AI that affects people.
EnhancedPreventiveall rolesper system
What it is
A gate condition for person-affecting systems.
How to implement it · Minimum structure
Purpose and the decision about people the system makes or shapes
People affected: groups, approximate numbers, vulnerable groups
Rights at stake: non-discrimination, privacy, ability to contest, access to work, credit or services
Possible harms per group, with likelihood and severity
Mitigations: human review, explanation, appeal route, bias testing; links to the privacy and explainability assessments
Residual impact, go-live sign-off, and review on material change
How to start
Identify which planned or live systems decide or materially shape decisions about individuals, and schedule the assessment before their next go-live or change.
Evidence
Each completed assessment, referenced in the go-live decision for its system.
Mode: light / standard / full
light
Two pages on purpose, affected people, harms and mitigations, signed by the owner-manager.
standard
The system owner completes it; the data-protection lead reviews it before the gate.
full
Full assessment reviewed by the data-protection officer and legal, a condition of committee approval.
Evidence
The risk assessments with their scoring; the completed rights-impact assessments tied to go-live decisions. The one-page risk assessments; the unified impact assessment where applicable.