Risk & Impact

What could change, for whom, and how serious could the consequences be?

A proportionate method for classifying AI uses and assessing safety, rights, equity, operational, reputational and financial impacts before and after deployment.

Operating principles

What good
looks like.

Context matters

The same model can create very different risk in different workflows.

Affected people count

Assessment includes patients, carers, staff and communities—not only the operator.

Benefits are tested

Expected value and opportunity cost receive the same scrutiny as harm.

Residual risk is owned

Acceptance is explicit, informed, reviewable and within delegated authority.

Put it into practice

Make it
operational.

Triage the use case

Classify impact, autonomy, data sensitivity, reach, reversibility and novelty.

Map stakeholders and harms

Consider unequal performance, exclusion, automation bias and workflow displacement.

Select controls

Translate risks into testable requirements, thresholds, oversight and fallback procedures.

Reassess change

Trigger review when purpose, population, model, data, supplier or context changes.

Minimum evidence set

Make the decision
reviewable.

01Initial risk classification

02AI or algorithmic impact assessment

03Hazard and control register

04Residual-risk acceptance record

Move from knowledge to practice

Design governance teams can operate.

Connect accountability, evidence and oversight to the way AI is actually delivered and used.

Start a conversation ↗