AI Risk FAQ
How do you assess AI risk?
Quick answer
Assess AI risk by identifying the system and its intended use, the people affected and the consequences of failure. Check the applicable legal classification separately from operational risk, then choose controls and an owner. High-risk provider risk-management duties and particular deployer assessments have different scopes and application dates.
The four-step AI risk assessment process
Start with the tools and embedded features actually used, including who supplies them, the data they receive and the decisions they inform. Classify the intended use under Article 6 and relevant annexes; the sector alone does not decide the result. Then examine possible harm in your context. For example, an inaccurate internal brainstorming note has different consequences from an incorrect figure in a client report. Identify the checks that could catch the error, who can stop the process and what happens when the tool is unavailable.
Common gaps in AI risk assessment
Check for missing uses, especially features enabled inside existing software. Document the reason for a classification and any exception claimed. A supplier description such as assistant does not replace an assessment of how staff actually use the feature. Record residual risk and the person accepting it. Revisit the assessment when the purpose, data, supplier or affected population changes. A risk assessment should lead to working controls, with evidence that those controls are being used.
Legal references reviewed 4 October 2026. High-risk provisions have phased application and transition rules. Sources: Commission timetable, deployer duties, impact-assessment scope and literacy guidance.
Acuity AI Advisory conducts AI risk assessments for Irish organisations; covering inventory, classification, contextual risk, and controls. See our AI governance services.