14 min read
Lesson 4 of 5
Conducting AI Risk Assessments
From the course AI Governance & Compliance
AI risk assessment is the systematic process of identifying what could go wrong with an AI system and how to prevent or mitigate those harms.
Risk Assessment Framework
For each AI system, evaluate:
1. Impact Assessment
| Impact Category | Questions to Ask |
|---|---|
| Individual harm | Could this AI deny someone a job, loan, or service unfairly? |
| Group harm | Could this disproportionately affect a protected group? |
| Societal harm | Could widespread use erode trust, privacy, or democratic values? |
| Environmental harm | What's the carbon footprint of training and running this model? |
2. Likelihood Assessment
- How often will the AI make decisions affecting people?
- What's the error rate, and what happens when it's wrong?
- Are there feedback loops that could amplify errors over time?
- How easily could the system be manipulated or attacked?
3. Risk Matrix
| Low Impact | Medium Impact | High Impact | |
|---|---|---|---|
| High Likelihood | Monitor | Mitigate | Redesign/Stop |
| Medium Likelihood | Accept | Monitor | Mitigate |
| Low Likelihood | Accept | Accept | Monitor |
Bias Assessment
Test for bias across protected characteristics:
- Training data audit: Are protected groups proportionally represented?
- Performance parity: Does accuracy differ across demographic groups?
- Outcome equity: Are positive outcomes distributed fairly?
- Proxy analysis: Are seemingly neutral features proxies for protected characteristics?
Tools for Bias Detection:
- IBM AI Fairness 360
- Google What-If Tool
- Microsoft Fairlearn
- Aequitas (open source)
Documentation Requirements
A complete risk assessment includes:
- System description: What the AI does, how it works, who it affects
- Data documentation: Training data sources, composition, known limitations
- Risk register: Identified risks with severity, likelihood, and mitigation status
- Testing results: Bias audits, accuracy metrics, adversarial testing outcomes
- Mitigation plan: Actions taken to reduce identified risks
- Monitoring plan: How risks will be tracked in production
- Review schedule: When the assessment will be updated
Common Blind Spots
- Focusing only on technical risks and ignoring social impacts
- Testing only on average cases, missing edge cases and minorities
- Assuming training data is representative without verification
- Not considering how the AI interacts with human decision-makers
- Forgetting that AI systems change as they encounter new data
Key Takeaways
- •Assess AI risk across impact (individual, group, societal) and likelihood dimensions
- •Bias testing must cover training data, performance parity, outcome equity, and proxy variables
- •Document everything: system description, data, risks, testing, mitigation, and monitoring
- •Common blind spots include ignoring social impacts and assuming data representativeness
0 of 5 lessons marked complete
Progress is kept in this browser only.