THE SHORT ANSWER
Assess what the AI does, which data it uses, who is affected, plausible failure and abuse, the severity and reversibility of harm, human review, accountable ownership and monitoring. Classify the use provisionally, choose controls and reassess after material change.
Start with eight connected questions
- What is the AI doing?
- What data does it use?
- Who is affected?
- What happens when it is wrong or misused?
- Can the outcome be reversed?
- Who reviews it?
- Who is accountable?
- How will performance and harm be monitored?
Consider likelihood, severity and controllability
A frequent minor error and a rare catastrophic error require different decisions. Also consider whether people can detect, stop, challenge and reverse the outcome before harm spreads.
Use a provisional business tier
| Tier | Signals | Next step |
|---|---|---|
| Lower | Non-sensitive, reversible, internal, closely reviewed | Document and test the basic workflow |
| Moderate | External communication, recommendations or meaningful operational impact | Formal owner, evaluation and monitoring |
| Higher | Sensitive data, high-impact decisions, autonomy or hard-to-reverse harm | Specialist review and stronger evidence before proceeding |
This model is a planning aid, not a statutory classification or legal conclusion.
End with a decision and residual risk
- Proceed with specified controls
- Run a limited experiment
- Redesign the use
- Escalate for specialist review
- Do not proceed
- Retire an existing system
Record assumptions, evidence gaps, control owners and the trigger for reassessment.
Evidence & context: National Institute of Standards and Technology · NIST
Sources & further reading
- Artificial Intelligence Risk Management Framework (AI RMF 1.0)
National Institute of Standards and Technology. Voluntary, rights-preserving guidance organized around GOVERN, MAP, MEASURE and MANAGE. NIST was revising AI RMF 1.0 when checked on 28 September 2026, so organizations should verify the current version before formal adoption.
- Generative Artificial Intelligence Profile (NIST AI 600-1)
NIST. Risk-management guidance, including confabulation. It does not establish a universal error rate.
- OECD AI Principles
OECD.AI. Intergovernmental principles updated in May 2024 covering inclusive benefit, human rights and fairness, transparency, robustness and accountability. They are high-level guidance rather than a complete operational control set.
Examples and exercises are illustrative unless attributed to a source. No independent expert review is claimed.
A correction, a counterexample or an experience worth sharing?
Join the conversation ↗