A five-step methodology you can apply as-is — built for ISO/IEC 42001, aligned with the EU AI Act
Every organization that adopts AI eventually has to answer one question: "What risks can our AI systems actually create?" AI risk assessment is a core requirement of ISO/IEC 42001 and the starting point of EU AI Act compliance — yet most teams stall on where to begin. This article lays out a five-step methodology you can apply directly, the scales to score with, and the five mistakes that most often undermine the result.
What makes AI risk different
AI risk is not general IT risk. IT risk is dominated by external threats — hacking, outages, unauthorized access. AI risk is largely intrinsic: it arises from how the system itself behaves.
- Bias — the system produces unfair outcomes for particular groups (a recruitment model disadvantaging one gender or age band).
- Opacity — decisions cannot be explained to those affected (a loan rejection no one can account for).
- Malfunction — unintended, incorrect outputs (a clinical support system suggesting a wrong diagnosis).
- Data quality — defects in training data flowing straight into outputs (a model trained on biased historical records).
- Security vulnerability — exposure to adversarial inputs engineered to force misclassification.
- Accountability gaps — unclear responsibility for AI-driven outcomes.
- Supply-chain risk — risks inherited from external models and APIs and passed through to your own service.
A methodology that doesn't surface these categories isn't an AI risk assessment — it's an IT risk assessment with a new title. That distinction is exactly what ISO/IEC 42001's risk requirements (Clauses 6.1.2 and 8.2) exist to enforce, and it's the single most likely place a certification audit will raise a finding.
The five-step process
Step 1 — Build the AI system inventory
You cannot assess what you haven't listed. Start by identifying every AI system in the organization — including externally sourced ones: model APIs, cloud ML services, AI features inside SaaS products. For each system, record:
- Name and purpose
- Owning function and responsible person
- Business processes it touches
- Data types used and their sources
- Built in-house or externally procured
- Degree of decision automation — fully automated, human-reviewed, or assistive
In an audit, the first question about any risk register is where the inventory behind it came from. A register covering three systems in an organization visibly running twenty is a scoping problem before it is anything else.
Step 2 — Analyze the context
The same AI technology carries very different risk depending on where it operates. For each system, work through four dimensions:
- Purpose and intent — what decision does the AI support or replace?
- Affected stakeholders — employees, external customers, vulnerable groups?
- Regulatory environment — does the use case fall under the EU AI Act's high-risk categories, or sector rules in finance or healthcare?
- Operating environment — real-time or batch? Can an erroneous decision be rolled back?
Step 3 — Identify the risks
With context established, derive concrete risk scenarios — casting the net as wide as possible at this stage:
- Multidisciplinary workshops — AI developers, business owners, legal and compliance, and data protection together. Each function sees risks the others miss.
- Structured checklists — cross-check against the risk sources in ISO/IEC 23894 and the NIST AI RMF Playbook so nothing is dropped.
- Incident history — review real failures of similar systems (public AI incident databases are a practical source).
Step 4 — Analyze and evaluate
Score each identified risk on two axes — likelihood and impact:
| Rating | Likelihood | Impact |
|---|---|---|
| 5 | Near-certain under current operating conditions | Severe legal sanctions, large-scale harm, business interruption |
| 4 | Significant probability of occurring | Regulatory breach, substantial financial or reputational damage |
| 3 | Possible but not frequent | Operational disruption, limited harm |
| 2 | Only in unusual circumstances | Minor inconvenience, minimal harm |
| 1 | Rarely occurs | No material effect |
Multiply the two ratings for a risk score, then band the results:
| Score | Risk level | Response policy |
|---|---|---|
| 20–25 | Critical | Treat immediately |
| 12–19 | High | Treat as a priority |
| 6–11 | Medium | Treat on a planned schedule |
| 1–5 | Low | Monitor |
Step 5 — Treat the risks
For each evaluated risk, choose one of four strategies:
- Avoid. The risk is too high — don't deploy the system, or withdraw it. The EU AI Act's prohibited practices are the regulatory version of this decision.
- Reduce. Bring the risk within tolerance through technical and organizational controls — bias detection and mitigation, human-in-the-loop review, model monitoring with defined re-evaluation cycles, stronger data-quality procedures. This is the most common strategy.
- Transfer. Shift risk to a third party through insurance or contract — most typically, explicit AI responsibility clauses in supplier agreements.
- Accept. The risk sits within the organization's risk appetite — but acceptance must carry formal management approval, not a shrug.
Record the treatment decisions and controls — this feeds directly into the Statement of Applicability that Clause 6.1.3 requires.
Risk assessment vs. impact assessment — don't merge them
ISO/IEC 42001 requires two related but distinct exercises, and conflating them is a common structural error:
| AI risk assessment | AI impact assessment | |
|---|---|---|
| Focus | Risks to the organization | Effects on external stakeholders |
| Perspective | Protecting the organization | Protecting individuals and society |
| ISO/IEC 42001 | Clauses 6.1.2 / 8.2 | Clauses 6.1.4 / 8.4 |
| EU AI Act parallel | Risk management system (Art. 9) | Fundamental rights impact assessment (Art. 27) |
The standard expects both: the risk assessment protects the organization; the impact assessment governs what the AI does to everyone else. For the outward-facing half, see our overview of ISO/IEC 42005.
The five mistakes that undermine assessments
- Reusing the IT risk methodology unchanged. An ISO 27001 process applied verbatim will miss bias and opacity entirely — define AI-specific risk categories first. (On where the two standards' risk lenses genuinely differ: ISO 42001 vs ISO 27001.)
- Only the development team in the room. AI risk is not purely technical. Without legal, HR, customer service, and compliance, the business-context risks stay invisible.
- Treating it as a one-off. Models change as data accumulates. Model updates, environment changes, and new regulation should each trigger re-assessment — set the triggers explicitly.
- Leaving external AI services out. If you consume external model APIs or AI-enabled SaaS, their risks transfer to your service. They belong inside your assessment scope.
- Assessing without documenting. Both an ISO 42001 audit and EU AI Act conformity work demand documented evidence. An undocumented assessment is, for compliance purposes, an assessment that didn't happen — see the ten documents your certification audit will check.
Practitioner's checklist
- Prepare: complete the AI system inventory; form a cross-functional team; get management approval of the risk appetite.
- Assess: context analysis per system; risk scenarios identified (AI-intrinsic categories included); likelihood and impact scored; risks banded and prioritized.
- Treat: strategy chosen per risk; mitigating controls defined with owners; accepted risks formally approved by management.
- Maintain: results documented; re-assessment cycle set (at least annually); re-assessment triggers defined for model updates.
The bottom line
AI risk assessment is not paperwork for a certificate. It is how an organization understands, in advance, what its AI can do to the business and to the people the business touches — the foundation everything else in responsible AI operation stands on. If the five-step process feels like too much to stand up at once, start with Step 1. Knowing where AI actually lives in your organization is the starting point of all AI governance.
Want a quick read on where your organization stands? Our free AI governance readiness assessment takes about 10 minutes, requires no document uploads, and shows how prepared you are for ISO/IEC 42001 — risk assessment included.
Related
📗 The risk standard: our ISO/IEC 23894 overview — AI risk management guidance in depth.
🔍 Where audits go wrong: the 5 nonconformities most likely to appear in your ISO 42001 audit.
⚖️ The regulatory picture: how ISO 42001, the EU AI Act, and NIST AI RMF fit together.
🗺 The whole portfolio: part of our SC 42 AI Standards Map — the international AI standards portfolio, explained.