AI Risk Assessment Template
An AI risk assessment template helps you look at one AI system before it goes live and ask what could go wrong, who it would affect, and what you will do about it. Use this free AI risk assessment template (it also works as an AI impact assessment) to score each risk, record your mitigations, and get a clear sign-off.
Download for Word
Claude
ChatGPTI need to write an AI Risk Assessment. Act as an expert technical writer and draft one for me. Use this structure, keeping each section clear, concise, and genuinely useful to the reader: 1. Assessment details 2. System description 3. Purpose and intended use 4. Owner and stakeholders 5. Data 6. Affected people 7. Risk identification 8. Risk scoring 9. Mitigations 10. Residual risk 11. Monitoring plan 12. Sign-off 13. Review date Before you begin, ask me for the details you need: the product, team, or audience this is for, and anything specific I should include. Then write the full AI Risk Assessment in clean, well-formatted Markdown.
Write an AI Risk Assessment using the structure below. Keep each section clear, concise, and genuinely useful to the reader. Structure: 1. Assessment details 2. System description 3. Purpose and intended use 4. Owner and stakeholders 5. Data 6. Affected people 7. Risk identification 8. Risk scoring 9. Mitigations 10. Residual risk 11. Monitoring plan 12. Sign-off 13. Review date Use rich formatting so it reads well in a knowledge base: - Clear headings and subheadings for each section. - Callout boxes for asides: a Tip callout for advice, a Note callout for helpful context, and a Warning callout for anything a reader must not miss. - Tables for structured or comparison content. - Numbered lists for sequential steps and bulleted lists for options. - Bold for key terms and any values people must not get wrong.
Connected HelpDocs over MCP? Add "save this as an unpublished HelpDocs article" to the prompt and the draft lands in your knowledge base, ready to review.
## The AI risk assessment template ### 1. Assessment details You'll find the system name, the date the assessment ran, its version, who filled it out, and the reviewers who weighed in. ### 2. System description Explain what the system does in everyday language. Say whether you built it yourself or bought it, name the model or vendor behind it, and describe how people actually use it. ### 3. Purpose and intended use Explain what business problem this takes on, which decisions or tasks it helps with, and any uses it isn't meant for. Then spell out how much a person looks over its output before any action is taken. ### 4. Owner and stakeholders Who owns the system and answers for it, plus the teams building, running, and using it. ### 5. Data Describe the datasets the system draws on for input, training, or tuning. Cover their sources, note any personal or confidential content inside them, and say where storage and processing happen. ### 6. Affected people Think through everyone whose experience changes because of what the system produces, whether they see it straight away or only feel it indirectly. That's likely to include customers, staff, applicants, or the general public. Call out any group that would be hit differently from the rest. ### 7. Risk identification Go through each category in turn and write down the risks that actually apply to this system. - **Accuracy:** output that's wrong, stale, or fabricated - **Bias and fairness:** results that disadvantage particular groups - **Privacy:** personal information leaked, stored beyond what's needed, or used for a different purpose - **Security:** prompt injection, stolen data, or access rights being abused - **Transparency:** users not realizing AI is involved or how a result came about - **Safety:** injury to people from what the system does or advises - **Legal and compliance:** violating contracts, regulations, or intellectual property rights - **Vendor:** reliance on one provider, shifting terms, or losing the service altogether ### 8. Risk scoring Rate each risk's likelihood and impact on a plain scale (say, 1 to 5), then multiply the two scores to get a rating. Before you start, agree on which ratings count as low, medium, and high. | Risk | Category | Likelihood | Impact | Rating | Mitigation | Owner | | --- | --- | --- | --- | --- | --- | --- | | TODO | TODO | TODO | TODO | TODO | TODO | TODO | ### 9. Mitigations Go through each significant risk and list the controls you'll set up to address it. Depending on the situation, that could mean human review steps, extra testing, tighter data restrictions, access limits, monitoring, or notices to users. You might also decide against using AI for part of the task. Assign an owner and a due date to every control you list. ### 10. Residual risk Name the risk that's still left once mitigations are in place, and say whether you can accept it. If you can't, describe what has to change before this system can go live. ### 11. Monitoring plan Once your system is live, this covers how you'll keep an eye on it: what you're measuring, how often you check, who reviews the numbers, and what would push you to reassess. ### 12. Sign-off Capture the names of whoever signed off on the assessment and the residual risk, plus the dates. | Role | Name | Decision | Date | | --- | --- | --- | --- | | System owner | TODO | TODO | TODO | | Approver | TODO | TODO | TODO | ### 13. Review date The next time you'll revisit this assessment, and any developments that would pull that review in sooner.
The AI risk assessment template
Write up a separate assessment for each AI system. Bring this structure over into a new article and trade the sample guidance under each heading for facts about the system you’re looking at.
1. Assessment details
You’ll find the system name, the date the assessment ran, its version, who filled it out, and the reviewers who weighed in.
2. System description
Explain what the system does in everyday language. Say whether you built it yourself or bought it, name the model or vendor behind it, and describe how people actually use it.
3. Purpose and intended use
Explain what business problem this takes on, which decisions or tasks it helps with, and any uses it isn’t meant for. Then spell out how much a person looks over its output before any action is taken.
4. Owner and stakeholders
Who owns the system and answers for it, plus the teams building, running, and using it.
5. Data
Describe the datasets the system draws on for input, training, or tuning. Cover their sources, note any personal or confidential content inside them, and say where storage and processing happen.
6. Affected people
Think through everyone whose experience changes because of what the system produces, whether they see it straight away or only feel it indirectly. That’s likely to include customers, staff, applicants, or the general public. Call out any group that would be hit differently from the rest.
7. Risk identification
Go through each category in turn and write down the risks that actually apply to this system.
- Accuracy: output that’s wrong, stale, or fabricated
- Bias and fairness: results that disadvantage particular groups
- Privacy: personal information leaked, stored beyond what’s needed, or used for a different purpose
- Security: prompt injection, stolen data, or access rights being abused
- Transparency: users not realizing AI is involved or how a result came about
- Safety: injury to people from what the system does or advises
- Legal and compliance: violating contracts, regulations, or intellectual property rights
- Vendor: reliance on one provider, shifting terms, or losing the service altogether
8. Risk scoring
Rate each risk’s likelihood and impact on a plain scale (say, 1 to 5), then multiply the two scores to get a rating. Before you start, agree on which ratings count as low, medium, and high.
| Risk | Category | Likelihood | Impact | Rating | Mitigation | Owner |
|---|---|---|---|---|---|---|
| TODO | TODO | TODO | TODO | TODO | TODO | TODO |
9. Mitigations
Go through each significant risk and list the controls you’ll set up to address it. Depending on the situation, that could mean human review steps, extra testing, tighter data restrictions, access limits, monitoring, or notices to users. You might also decide against using AI for part of the task. Assign an owner and a due date to every control you list.
10. Residual risk
Name the risk that’s still left once mitigations are in place, and say whether you can accept it. If you can’t, describe what has to change before this system can go live.
11. Monitoring plan
Once your system is live, this covers how you’ll keep an eye on it: what you’re measuring, how often you check, who reviews the numbers, and what would push you to reassess.
12. Sign-off
Capture the names of whoever signed off on the assessment and the residual risk, plus the dates.
| Role | Name | Decision | Date |
|---|---|---|---|
| System owner | TODO | TODO | TODO |
| Approver | TODO | TODO | TODO |
13. Review date
The next time you’ll revisit this assessment, and any developments that would pull that review in sooner.
Tip
Make sure your reviewers and auditors can’t miss a single assessment. Start a free HelpDocs trial and keep your AI risk assessments there, with version history and permissions.
How to fill in this AI risk assessment template
Your assessment only matters when it changes what you decide, not when it gets filed away. These habits help:
- Name the system you’re assessing. Hand-waving about “AI can be wrong” leads nowhere. Explain how this particular system could fail and what happens when it does.
- Ask the people it affects. Both the folks running the system and those living with its output will catch risks your project team overlooks.
- Use one scale everywhere. Lock down your rating levels up front, so a “high” means the same thing in every assessment you run.
- Make each control an action item. A mitigation without a named owner and a due date won’t get done.
- Write down what you’re leaving in place. A documented sign-off on remaining risk shields everyone when scrutiny comes back around.
- Run it again when things change. Swap in a new model, fresh data, or a different use case and you have a fresh risk profile to review.
Use it alongside our AI governance policy template to spell out which systems require an assessment and who signs off on each.
Go further
