4 Questions to Ask About AI Risk Assessments

4 questions to ask about AI risk assessment

1. Who is in charge of our AI risk assessment? 

This question is more important than it seems. The person who leads the risk assessment is a reflection of your company’s business priorities for AI, and those priorities will dictate the ethics and compliance risks that you’ll confront later on.  

For example, if the chief technology officer is in charge of the risk assessment, that implies the company prioritizes innovation and growth more than prudent management of security and compliance risks. On the other hand, if the chief compliance officer is in charge, that may suggest the company wants to move at a more deliberate, risk-aware pace (say, if you’re in a highly regulated field such as healthcare).  

There is no single correct answer to this question; any number of executives (including the CISO or chief audit executive) could plausibly run the risk assessment. But for accountability reasons alone, somebody needs to be in charge – and who that person is will dictate a lot of what happens next, and what you’ll need to worry about. 

2. Who else is involved in our AI risk assessment? 

The risks of AI could strike your business from any number of directions, so an effective risk assessment – one that brings together the right perspectives, so you can find the right answers – requires a team approach. So, regardless of who leads the assessment, you also want to be sure all those other necessary perspectives are involved, too.  

For example, even if you, the compliance officer, aren’t leading the assessment, you absolutely should be part of the process since you’ll bring vital knowledge about regulatory obligations for privacy, anti-discrimination, antitrust ( an emerging AI risk, as we noted earlier this summer) and other issues. Most businesses will also want to include the CISO, the chief audit executive, HR, legal, and perhaps others.   

Yes, “risk assessment by committee” can be a slow-moving process, especially if you don’t assign clear objectives, accountability, and timelines for work to be done. But if you want a successful risk assessment, one that can inform all the remediation work that comes next, you’ll need to include multiple people with various perspectives and expertise. Be sure all the right people are involved.

3. Have we taken an inventory of all our AI systems and agents?  

This question gets closer to home for compliance officers. Several regulations and guidance now state that companies should maintain an inventory of their AI systems so management can implement appropriate controls and oversight.  

For example, the New York Department of Financial Services first published guidance about an inventory of AI systems in 2024; and reaffirmed that point in its latest guidance issued this month about how to perform AI risk assessments. In contrast, the EU AI Act doesn’t expressly say, “Thou shalt maintain an AI inventory,” but for all practical purposes, you can’t fulfill your compliance obligations without an inventory, since the act regulates AI according to specific use-cases.  

This question is also important because it naturally leads you to a second question: how do you know whether your inventory is current, complete, and accurate? If the answer is, “We’re not sure,” then you need to consider why not. For example, do you need stronger policies for AI usage and sourcing (say, which employees can contract with vendors for AI systems, or what agents employees can vibe-code on their own)? Do you need better tools to monitor AI behavior?  

Without an inventory, your risk management team won’t have a complete picture of AI risks. 

4. Have we assigned accountability for our AI systems and agents?  

This is the next logical question after our previous one. Once you’ve identified all the AI systems and agents your business is using, you need to know whether a specific person has been assigned responsibility for those systems and agents.  

For example, Article 26 of the EU AI Act requires companies to assign human oversight of “high-risk” AI systems (although not necessarily all AI systems). The New York Cybersecurity Rule requires a financial firm’s CISO to certify compliance with the rule. Since the rule requires an inventory of all IT assets, and that includes AI systems, then in theory, responsibility for AI systems and agents belongs to the CISO.  

If you don’t have clarity into who is responsible for which AI systems – specifically, who has accountability for the proper use of them – then your risk assessment won’t be accurate. You won’t be sure who else might be using AI, in which ways; and what risks that unsupervised usage might bring. 

Conclusion 

There are, of course, many more questions your AI risk assessment should consider. The four above simply focus on the most important understanding you need: roles and responsibilities. You need to know who is in charge of the risk assessment, and who else should participate. You need to know how many AI systems you have and who has accountability for those AI assets.   

If you don’t have answers to those questions, your risk assessment could easily wander down the wrong path – missing issues that should be brought to your attention, or not implementing remediation steps that should be taken. Then some AI-driven risk might mushroom into a major failure – and good luck with the next board meeting after that happens.