Risk Scores Are Opinions, Not Facts

"Our tool is low risk." It sounds like a measurement. It isn't. It's an opinion wearing a lab coat.

Every risk score is a judgment call made by someone, using some method, with some assumptions. Which harms did they consider? Which did they dismiss? Did they imagine your use case, or a generic one? A "low risk" rating for a chatbot answering FAQs means nothing if you're using it to screen job applicants.

This doesn't make risk scores useless. It makes them starting points. When a vendor hands you a risk rating, ask three questions: Who did the assessment — you, or an independent party? What methodology did they use? And what would change the score — what use case or data type would push this from low to high?

If the vendor can't answer, the score is marketing. If they can, you've just learned more about the product than the score itself ever told you.

Treat every risk label as an invitation to ask "says who, and based on what?" That's not cynicism. That's diligence.

I explain frameworks; I don't give legal counsel.