Lesson 4 of 7 · 9 min read
Assessing an AI System's Risk
A practical AI risk assessment turns frameworks into a repeatable intake: register the use case, ask a small set of questions that decide risk (purpose and affected people, data, autonomy and actions, exposure to untrusted input, model source, regulatory category), assign a tier, apply the controls that tier requires, and record owners, residual risk and review dates. Done well, it is fast for low-risk uses and thorough for high-risk ones, and it produces the evidence that the NIST AI RMF, ISO/IEC 42001 and the EU AI Act all ask for.
free sign-in, no card required
Practise it as an interviewer asks it
Compare the NIST AI RMF, ISO/IEC 42001 and the EU AI Act. Does one satisfy another?What are the EU AI Act risk tiers, and what must a high-risk provider do?What are the four functions of the NIST AI RMF, and how do you use each?What is an AI use-case register, and how do you route use cases to controls?A startup shipped a chatbot with no governance. What do you set up first?What is ISO/IEC 42001, is it certifiable, and how does it relate to ISO 27001?