AI risk assessment template
A Word document for assessing one AI tool or use before you approve it. It records what goes in, who is affected, which rules apply and who signed it off.
What's in it
- What the tool does, who supplies it, who uses it and whose lives its output reaches.
- The data going in: whether it is personal or confidential, where the supplier keeps it and whether it trains on it.
- Whether the output makes or shapes a decision about a person.
- The EU AI Act position for this use, with the article behind each step: scope, your role, and the prohibited, high-risk and transparency tests.
- Whether a data protection impact assessment is needed under UK GDPR.
- A register of seven common risks, each with room for likelihood, impact, controls and an owner.
- Human review, what people are told, what happens when it goes wrong, the decision, the review trigger and the sign-off.
Each section carries a marked line saying what to record or decide, so the gaps are easy to see before anyone signs. The sections follow the seven questions to ask before you approve a new AI tool.
When to use it
Use it whenever someone asks to bring in a new AI tool, when an approved tool starts being used for something new, and when a supplier changes its terms or how it handles your data. One assessment per tool or use is enough for most organisations, kept with the approval it supports.
It works best next to a written policy. The approved-tools section of an AI policy says who may approve a tool, and this template is the record of how they decided. If you have no policy yet, the policy generator drafts one from six answers.
How it fits with other assessments
Three different exercises get called an AI risk assessment, and the risk assessment guide explains which is which. This template is the organisational one: the record behind an approval decision.
It points to the other two without replacing them. Its EU AI Act section asks the classification questions, and the EU AI Act check works them through for a single system. Its data protection section asks whether a DPIA is needed, and the ICO guidance on AI and data protection covers when one is required and what it has to contain. The DPIA screening test for AI tools helps you answer it.
Get the document
To send you the document we ask for your name, work email and organisation, and those details reach us when you submit. The Word file is built in your browser. There is a separate box if you would also like a specialist to walk through it with you. See the privacy notice.