Skip to content
AI Compliance Tool
Check my AI risk
PlatformSolutionsPricingRegulationsFree toolsGuides Partners Sign in

AI Risk Assessment for Business: A Practical Method

A severity × likelihood × exposure method for assessing AI risk in a small business, with a worked example, the unknown-is-not-safe rule and escalation triggers.

By AI Compliance Tool editorial team · Published 2026-10-14 · Reviewed 2026-10-14 · Reviewer: Pending independent review · 10 min read

Key takeaways

  • Score each identified harm on three scales (severity, likelihood, exposure) and multiply; the product tells you where to spend attention, not whether you are compliant.
  • Unknown is not safe. If you cannot find out whether a vendor trains on your data or how a model changed, score likelihood as high until you can.
  • Legal triggers sit on top of the score: a low-scoring tool can still need a Quebec PIA, an EU prohibited-practice screen or an Ontario posting disclosure.
  • Record residual risk and who accepted it. The signature is the control.
  • Get specialist review when a tool decides about people, touches health, financial or biometric data, operates in the EU in an Annex III category, or when you cannot describe how it works.

Risk assessment is the step most small businesses skip because it sounds like something that needs a consultant. It does not. It needs a method that fits on one page, a willingness to write down what you do not know, and a signature from the person who accepts what is left.

This guide gives you that method, applies it to a realistic example, and tells you when a one-page assessment is not enough.

What an AI risk assessment is for

Three things:

  1. Ranking. Deciding which of your ten or twenty AI tools deserve attention first.
  2. Evidence. Producing the record that privacy laws, the EU AI Act and some US state laws expect. Quebec Law 25 s. 3.3 requires a privacy impact assessment for projects to acquire, develop or overhaul an information system involving personal information. GDPR Art. 35 requires a DPIA for processing likely to result in high risk, including systematic automated evaluation. California’s CCPA regulations (effective 1 January 2026) require documented risk assessments for high-risk processing including ADMT for significant decisions, with assessments for existing processing due by 31 December 2027. The EU AI Act Art. 9 requires providers of high-risk systems to run a lifecycle risk management system from 2 December 2027.
  3. Decisions. Forcing someone to accept the residual risk by name, or to say no.

It is not a compliance certificate. A good score does not satisfy any law; it tells you where the law is most likely to matter.

The model: severity × likelihood × exposure

For each tool, list the harms that could plausibly occur. Then score each harm on three 1 to 5 scales and multiply.

Severity (how bad if it happens)

ScoreMeaningExamples
1Nuisance, easily fixedAwkward phrasing in an internal draft
2Minor cost or embarrassmentWrong price quoted, corrected same day
3Real harm to a person or the business, recoverablePersonal data disclosed to a vendor without consent; a customer misled
4Serious, lasting harmApplicant rejected on a discriminatory basis; breach requiring regulator notification
5Severe or irreversiblePhysical, financial or legal harm to a person that cannot be undone

Likelihood (how often, given your actual use)

ScoreMeaning
1Hard to imagine in normal use
2Possible with misuse
3Likely to happen at some point in a year
4Likely to happen monthly
5Happening now or unknown

Note the last row. Unknown is scored as 5. If you do not know whether the vendor trains on your inputs, whether the model changed last week, or whether a human actually reviews the tool’s recommendations, you do not get to assume the comfortable answer.

Exposure (how many people or how much value)

ScoreMeaning
1One internal user, no external people
2A team, or a handful of customers
3Hundreds of people or a material revenue line
4Thousands of people, or any applicants, patients or tenants
5Public at large, or decisions about people’s livelihood, health or housing

Multiply: the maximum is 125. Use bands to rank: 1 to 15 low, 16 to 45 moderate, 46 to 80 elevated, 81 and above critical. The bands are for prioritising your time; they are not legal categories.

Before you look at the score, check three triggers that override it:

  • Prohibited use. Anything matching EU AI Act Art. 5 (manipulation, exploiting vulnerabilities, social scoring, emotion recognition at work or in education, untargeted facial scraping and others; nudification and synthetic CSAM from 2 December 2026) or the Texas TRAIGA intent-based prohibitions is a no, whatever the score.
  • Decision about a person. If the tool makes or materially shapes a decision about an applicant, employee, customer, tenant or patient, you are in the territory of GDPR Art. 22, Quebec s. 12.1, EU Annex III (employment and other listed uses, high-risk from 2 December 2027), Colorado SB 26-189 (from 1 January 2027), Illinois HB 3773 and NYC Local Law 144 for employment, and the CCPA ADMT rules. That means notices, human review routes and records regardless of score.
  • Mandatory assessment. Quebec s. 3.3 PIA, GDPR Art. 35 DPIA and CCPA s. 7150 risk assessments apply by their own tests. Do them, and fold this scoring into them.

Worked example: Kestrel Staffing

Kestrel Staffing is a 22-person recruitment agency in Mississauga placing warehouse and logistics staff across Ontario, with a small client in Dublin. It is assessing three tools.

Tool A: drafting assistant for job ads

Harm: inaccurate or non-compliant wording published. Severity 2, likelihood 3, exposure 2. Score 12 (low). Legal triggers: none; no personal data entered; the recruiter edits every ad. Residual risk accepted by the marketing lead. Control: existing review step.

Tool B: meeting-recorder extension on recruiters’ laptops

Harms identified:

  1. Candidate health or immigration details transcribed and stored by a consumer-tier vendor. Severity 3, likelihood 5 (vendor retention and training use unknown), exposure 4 (all candidates interviewed by video). Score 60 (elevated).
  2. Recording without the candidate’s knowledge. Severity 3, likelihood 4, exposure 4. Score 48 (elevated).

Legal triggers: personal information (PIPEDA; Ontario has no private-sector statute, so PIPEDA applies to commercial activity); the Dublin client’s candidates bring GDPR. Decision: Suspend the consumer extension; move to a business-tier tool with contractual retention and no training use; add a spoken consent line at the start of calls. Re-score after vendor answers arrive.

Tool C: applicant ranking feature in the applicant-tracking system

Harms identified:

  1. Ranking produces a disparate effect on a protected group. Severity 4, likelihood 5 (vendor has not provided any testing evidence; unknown), exposure 5 (livelihood decisions, thousands of applicants a year). Score 100 (critical).
  2. Recruiters treat the rank as the decision and never open low-ranked applications. Severity 4, likelihood 4 (observed in a spot check), exposure 5. Score 80 (elevated).

Legal triggers: this is a decision about people. In Ontario, Kestrel has more than 25 employees, so ESA s. 8.4 requires each publicly advertised posting to state that AI is used to screen, assess or select applicants (in force 1 January 2026). For the Dublin role, EU Annex III point 4 makes recruitment high-risk with deployer obligations from 2 December 2027, and GDPR Art. 22 applies today if the ranking is effectively the sole basis of rejection. Decision: keep the feature Suspended until the vendor supplies adverse-impact testing; require recruiters to review every application above a minimum threshold and record the review; add the s. 8.4 statement to posting templates now; get specialist review (see below). Residual risk cannot be accepted yet because likelihood is unknown.

The example shows the method doing its job: Tool C’s critical score comes mostly from “unknown”, and the fix is information plus a human review control, not a ban.

What to record

One page per tool, attached to the inventory entry:

  • Harms listed, with the three scores and the product.
  • Legal triggers checked (prohibited use, decision about a person, mandatory assessment) with a yes or no and a note.
  • Controls in place and controls to add, each with an owner and date.
  • Residual risk statement and the name and date of the person accepting it.
  • Next review date and the change triggers that reopen the assessment.

This structure maps to the NIST AI RMF Map (context and harms), Measure (scores) and Manage (controls and acceptance) functions, and to the ISO/IEC 23894:2023 risk-process stages. Both are voluntary guidance; alignment with them is not certification.

When to get specialist review

Do the one-page assessment yourself, then escalate to a privacy lawyer, employment lawyer or qualified assessor when any of the following is true:

  • The tool makes or materially shapes decisions about people’s employment, credit, housing, insurance, health or access to services.
  • It processes health, financial, biometric or children’s data.
  • You operate in the EU and the use is in an Annex III category, or you are a provider (you build or substantially modify the system) rather than a deployer.
  • You cannot explain, in two sentences, how the tool reaches its output.
  • The vendor will not answer the training, retention and testing questions.
  • The tool is an agent with write, send or spend permissions.
  • An incident has already occurred.

Specialist review does not replace your assessment; it reads it. Arriving with the one-page record, the inventory entry and the vendor’s answers turns an open-ended engagement into a short one.

Sources

Frequently asked

Is this method required by any law?
No specific scoring method is required. Laws such as Quebec Law 25 s. 3.3 (PIA), GDPR Art. 35 (DPIA) and the California CCPA ADMT regulations require assessments with certain content; this method is a practical way to produce them, and it aligns with the voluntary NIST AI RMF Map, Measure and Manage functions.
How long does one assessment take?
For a productivity tool with no personal data, under an hour. For a tool that makes or shapes decisions about people, half a day plus vendor follow-up. The vendor follow-up is usually the long pole.
What score means we should not use the tool?
There is no universal threshold. Use the score to rank; use the legal triggers and the unknown-is-not-safe rule to decide. A tool with a known prohibited use is a no regardless of score.
Can we reuse a privacy impact assessment?
Yes, and you should. A Quebec PIA or GDPR DPIA covers much of the data side. Add the AI-specific harms (wrong outputs, automation bias, model drift, agent actions) and the exposure count, and cross-reference both documents.

This guide is general information, not legal advice. Laws and dates are drawn from our verified regulatory dataset and link to official sources; check them for changes after the review date.