AI risk identification for one organisation
A fixed-scope piece of work. I find the AI your organisation runs, identify and score its risks, and leave you a register your own people can keep current. It is the method in the free book, done with you.
For lenders, insurers and other regulated firms, and for any organisation preparing for the AI Act's high-risk rules, which apply from 2 December 2027.
What the work covers
Inventory
Find the AI your organisation runs, including tools bought with AI inside them and AI that nobody declared, and record each system's role and class under the AI Act.
Identification
A top-down workshop with senior people and a bottom-up template for each system, reconciled into one register, starting from the 91-line register rather than a blank page.
Assessment
Each line scored on the five impact dimensions, including harm to individuals, with an owner, controls, indicators and the rules it answers to.
Interaction
Which of the material risks trigger, amplify or share a driver with others, and where one control sits under many lines.
Documentation
The register and the inventory in the workbook, a FRIA and DPIA mapping for each Annex III system, and a one-page report for the board.
What you get
- An inventory of your AI systems, with role and AI Act class for each.
- Your AI risk register: scored, owned, linked to controls and to the rules each line answers to.
- The interaction view of your material risks.
- For each high-risk system in Annex III, the FRIA and DPIA mapped to the register.
- A one-page principal AI risk report for the board.
- A handover, so that your team can run the quarterly cycle without me.
What it costs
A fixed fee, agreed in writing before work starts, set by the number of AI systems and business units in scope. No day rates.
What I need from you
A sponsor, the procurement and IT lists that show what you run, a senior group for one workshop, and each system's owner for the template.
What it is not
It identifies and documents risks. It is not legal advice and it does not certify compliance.
Who does the work
Rory Roberts, FRM. I was VP and Global Head of Risk Identification at Credit Suisse and Risk Identification Lead in enterprise risk management at Standard Chartered, and I wrote the method down in AI Risk Identification: The Complete Methodology. More about me.
Start with a short call
Write to rory@eonriskservices.com or use the contact form. A short call settles the scope; the fee and the timetable follow in writing.