Inventories, risk and impact assessment
This is where governance gets practical: finding your AI, classifying it, assessing what could go wrong, and holding vendors to account.
Learning objectives
- Find AI across the organisation and record it in an inventory
- Design a proportionate risk-tiering scheme
- Assess and treat AI risks
- Choose and combine the right impact assessments
- Run AI vendor due diligence
5.1 Start with an AI inventory
You can't govern what you can't see. An AI inventory (or register) is the foundation of every governance programme — and the EU AI Act Fundamentals course recommends it as the first compliance step.
Find AI through: surveys of business units; procurement and contract records; software and SaaS asset lists (many tools have added AI features); expense claims for AI subscriptions; IT network data; and data science project lists.
| Inventory field | Example |
|---|---|
| Name and description | CV screening assistant |
| Business owner | Head of Talent Acquisition |
| Purpose and use | Ranks applicants for recruiter review |
| Built, bought or embedded | Bought — vendor X, feature of applicant tracking system |
| Model type | Machine learning classifier + LLM summaries |
| Data used | CVs, application forms (personal data) |
| People affected | Job applicants |
| Decision role | Supports human decision |
| Jurisdictions | UK, Ireland |
| Risk tier and regulatory classification | High (internal); EU AI Act Annex III — employment |
| Assessments completed | DPIA, AI impact assessment, vendor due diligence |
| Status and review date | Live; review March 2027 |
5.2 Risk tiering
Classify each use case so governance effort is proportionate. A simple internal scheme:
| Tier | Typical criteria | Governance |
|---|---|---|
| Prohibited | Banned by law or contrary to policy | Not allowed |
| High | Significant decisions about people; safety; legally high-risk; sensitive data at scale; customer-facing autonomy | Full impact assessment, committee approval, testing, monitoring, periodic audit |
| Medium | Internal decision support; customer-facing content with human review; personal data | Standard assessment, owner sign-off, monitoring |
| Low | Productivity uses with no personal data or decisions about people | Approved-tool list, acceptable use policy |
5.3 Assessing risk
For each system, assess risks across categories — for example the NIST trustworthiness characteristics or the GenAI Profile's twelve risks — rating likelihood and impact, then deciding treatment: mitigate, transfer, avoid or accept, within the organisation's risk appetite.
5.4 Impact assessments
Several assessments may apply. Combine them where you can to avoid duplication:
| Assessment | Focus | When |
|---|---|---|
| AI impact assessment (AIIA) | Impacts on individuals, groups and society (ISO/IEC 42005) | Medium- and high-risk AI |
| Data Protection Impact Assessment (DPIA) | Risks to individuals from personal data processing | Required for high-risk processing under GDPR |
| Fundamental Rights Impact Assessment (FRIA) | Impacts on fundamental rights | Required for certain deployers of high-risk AI under the EU AI Act |
| Equality impact assessment | Effects on protected groups | Public sector (UK Public Sector Equality Duty) and good practice |
| Security risk assessment | Threats to the AI system and data | All AI systems (see AI Security & Safety) |
5.5 Third-party and vendor due diligence
Most organisations buy far more AI than they build. Key questions for AI vendors:
- What does the AI do, what model(s) does it use, and who provides them?
- How is our data used, stored and retained? Is it used for training?
- What testing has been done for accuracy, bias, robustness and security? Can we see results?
- What documentation is available — model cards, transparency notes, instructions for use?
- What certifications do you hold (ISO/IEC 42001, ISO 27001, SOC 2)?
- How will you support our legal obligations (e.g. EU AI Act deployer duties, DPIAs)?
- How are incidents notified? How are model changes communicated?
- What contractual commitments — liability, IP indemnities, audit rights — will you give?
Key takeaways
- The inventory is the foundation — look in procurement, SaaS lists, expenses and surveys.
- Tier risk to make governance proportionate.
- Assess likelihood and impact; mitigate, transfer, avoid or accept.
- Combine AIIA, DPIA, FRIA, equality and security assessments where possible.
- Ask vendors about data use, testing, documentation, certifications, incidents and contracts.