Risk Assessment for AI, Minus the Jargon

Risk assessment sounds intimidating. It is structured worrying, and you already know how to worry.

For each AI system, ask four questions. What could go wrong? How bad would it be? How likely is it? What are we going to do about it? Write down the answers. Congratulations: you have performed a risk assessment.

ISO 42001 asks for a bit more structure around this. Assess risks across the AI lifecycle, not just at launch. Consider risks to individuals, groups, and society — not only risks to your company. Revisit the assessment when things change: new data, new use, new regulations.

Let me make it concrete. A hiring team uses AI to screen resumes. What could go wrong? It could systematically disadvantage qualified candidates from certain backgrounds. How bad? Very — for the candidates, and legally for the company. How likely? History says: likely enough to check. What now? Test for bias before deployment, keep a human in the final decision, monitor outcomes by group.

That is the whole exercise. No mysticism. Just honest, written-down thinking about consequences before they happen.

The organizations that get hurt by AI are rarely the ones that never thought about risk. They are the ones that thought about it, nodded, and never wrote it down.

Write it down.

I explain frameworks; I don't give legal counsel.