AI Risk Assessment

The risks that actually materialise

AI risk conversations tend to drift toward the dramatic and away from the likely. The failures that genuinely happen to ordinary businesses are mundane: confidential information pasted into a tool with unclear data handling, a confidently wrong output reaching a customer, a regulator asking a question nobody prepared for, or a bill that quietly grew tenfold. This assessment scores the six that recur.

Reading your score

• Under 2.5 — low. Standard precautions are enough. Proceed, but keep human review on anything customer-facing.
• 2.5 to 4 — moderate. Proceed with the highest-scoring area addressed first. Most businesses land here, and most can move down a band with two or three concrete controls.
• Over 4 — high. Do not begin implementation until mitigations are in place. At this level the exposure is not theoretical, and retrofitting controls after launch costs several times more than building them in.

The two risks people systematically underrate

Accuracy risk in low-stakes-looking work

The question is not "how often is it wrong" but "what happens when it is wrong and nobody notices". A summarisation tool that drops one clause in fifty is harmless in internal notes and serious in a client contract. Rate the consequence, not the frequency.

Cost overrun

Usage-based pricing means costs scale with success. A pilot costing very little at ten users can behave very differently at four hundred. Set a spending cap in the vendor dashboard on day one — not day ninety — and review it weekly for the first quarter.

What to do next

If team adoption scored highest, the problem is people rather than technology; the skills gap analysis will tell you whether to train, hire or outsource. If vendor dependency scored highest, take the shortlist through the vendor scorecard, where contract flexibility and exit options are scored explicitly.