Template· 1 min
A one-page AI risk assessment for the approval paper
Copy the structure; the examples show the level of specificity that gets approved.
AI Tools Hub Editorial · published · updated
Four categories
| Category | Risk | What to write |
|---|---|---|
| Data exposure | Input used for training or leaked | Contractual retention terms, data scope, redaction |
| Incorrect output | False content reaching users | The human review step, limits on use |
| Rights infringement | Generated output infringing others | Commercial terms checked, similarity review step |
| Availability | Vendor outage, change or shutdown | Fallback, switching effort, extent of dependency |
Worked example: data exposure
Input is limited to internal technical documentation; customer personal data is not entered. The provider's terms confirm API input is not used for training (clause attached). Pre-send redaction was judged unnecessary for this scope because documents containing personal data are excluded.
The important move is stating the exclusion. Controlling risk by narrowing scope reviews better than claiming to control it with technology.
What not to write
- "We will operate carefully given AI's limitations" — no specifics
- "Security is fully assured" — an unsupported absolute
- "This is industry standard" — what others do is not a control
- Benefit estimates with no measurement behind them
State the review date
Add one line: assessed as of this date, to be revisited on any change to the provider's terms or annually, by this named person. Otherwise the assessment silently goes stale.
FAQ
Is one page enough?
For approving one new tool, yes. A company-wide usage policy needs the policy document and an operating model as well.