You need to assess the risk of your AI system before deploying it. This template takes 15 minutes and covers what regulators and auditors actually look for.
The template
Fill this out for each AI system you deploy:
1. System identification
| Field | Your answer |
|---|---|
| System name | e.g., Customer support chatbot |
| Description | What it does in one sentence |
| AI model | e.g., Claude Sonnet 4.6 via API |
| Provider | e.g., Anthropic |
| Data processed | What data does it see? |
| Users | Internal only? External customers? |
| Decision impact | What happens based on its output? |
2. Risk scoring
Score each factor 1-3:
| Factor | 1 (Low) | 2 (Medium) | 3 (High) |
|---|---|---|---|
| Impact of wrong output | Minor inconvenience | Financial loss | Physical/legal harm |
| Data sensitivity | Public data | Internal data | PII / regulated data |
| Autonomy level | Human reviews all output | Human reviews some | Fully autonomous |
| User vulnerability | Technical users | General public | Vulnerable groups |
| Scale | <100 users | 100-10K users | >10K users |
| Reversibility | Easy to undo | Difficult to undo | Irreversible |
Total score: Add all six factors.
| Score | Risk level | Action needed |
|---|---|---|
| 6-9 | Low | Basic controls (logging, monitoring) |
| 10-14 | Medium | Enhanced controls (human review, testing, observability) |
| 15-18 | High | Full controls (governance framework, legal review, EU AI Act compliance) |
3. Controls checklist
Based on your risk level:
Low risk (all AI systems):
- Logging of all AI interactions
- Spending limits set
- Provider has DPA (if processing personal data)
- Team knows the system exists (AI inventory)
Medium risk (add these):
- Output validation before user sees it
- Regression testing for prompt changes
- Human review process for edge cases
- Observability dashboard
- Incident response plan
High risk (add these):
- Formal governance framework
- Legal review of AI usage
- EU AI Act conformity assessment (if applicable)
- Regular bias and fairness audits
- External security review
- Prompt injection testing
4. Sign-off
| Field | Value |
|---|---|
| Assessed by | Name, role |
| Date | YYYY-MM-DD |
| Risk level | Low / Medium / High |
| Approved by | Name, role (for medium/high) |
| Next review | Date (quarterly recommended) |
Examples
Example 1: AI coding assistant (internal)
- Impact: Low (developer reviews code)
- Data: Medium (source code)
- Autonomy: Low (human reviews)
- Users: Low (technical)
- Scale: Low (<50 devs)
- Reversibility: Low (git revert)
- Score: 7 → Low risk
- Controls: Logging, spending limits, GDPR-compliant provider
Example 2: Customer support chatbot
- Impact: Medium (wrong answers lose customers)
- Data: High (customer PII)
- Autonomy: High (responds without review)
- Users: Medium (general public)
- Scale: High (>10K users)
- Reversibility: Medium (can correct but damage done)
- Score: 15 → High risk
- Controls: Full governance, human escalation, bias testing, legal review
Keep it simple
This template is intentionally lightweight. A 15-minute assessment is infinitely better than no assessment. You can always add depth later as your AI usage matures.
See our AI governance guide for the full framework.
Related: AI Governance for Startups · EU AI Act for Developers · AI Security Checklist · LLM Observability