APPENDIX C · AI RISK ASSESSMENT

Match the control to the consequence.

This record captures the assessment behind the risk class. A level without its driver is not a defensible assessment.

Could a wrong result materially affect conformity, safety, customer commitment or release?consequenceDoes the output influence an operational quality decision?influenceDoes it concern a safety or critical characteristic?criticalityDoes it process sensitive or restricted evidence?sensitivityCan a reviewer inspect the evidence and reasoning behind the output?traceabilityCould a systematic error spread across products, suppliers or projects?propagationWill the model, prompt, data or retrieval configuration change frequently?volatilityDoes the use case depend on an external provider or source beyond direct control?dependencyCONTROLS AND SAFEGUARDSRESIDUAL RISK AND ACCEPTANCE