AI risk assessment template for small businesses

An AI risk assessment helps a business decide whether a proposed use is suitable, what could go wrong and which controls must be in place. It should happen before live personal or confidential information enters the workflow, not after a problem appears.

This template is a practical starting point for a small business. It is not legal advice and it does not replace a data protection impact assessment, security review or sector-specific requirement where one is needed.

1. Describe the purpose

Write one sentence explaining the business problem and the intended result. Name the process owner and the people affected. Avoid vague aims such as using AI to improve efficiency. A useful purpose might be preparing a draft summary of incoming enquiries for a member of staff to review.

2. Map the information

• What information enters the workflow?
• Does it include personal, confidential or commercially sensitive material?
• Where did the information come from?
• Who may access it?
• Where is it stored and for how long?
• Can the task be completed with less information?

Check the live ICO AI and data protection risk toolkit when personal data is involved. The correct assessment depends on the actual use, not simply the name of the software.

3. Identify possible harm

Consider inaccurate output, unfair treatment, loss of confidentiality, security failure, copyright concerns, poor customer communication and over-reliance by staff. Describe who could be affected and how serious the outcome could be.

The AICC Responsible AI tools include project, data and harm assessment resources that can support a structured review.

4. Review the supplier and system

• What service and account type will be used?
• How does the supplier handle submitted data?
• What access controls and logs are available?
• Can the business export its records and configuration?
• How will changes to the service be communicated?
• What fallback exists if the service is unavailable?

Do not treat a well-known brand as proof that every setting or use is suitable.

5. Define testing and human review

Prepare representative examples, including unusual and incomplete cases. State what a good output looks like and which errors make the workflow unacceptable. Name the person who will review results and the point where approval happens.

For higher-impact work, a person should be able to understand the source information, challenge the output and choose the fallback route.

6. Record controls and remaining risk

For every risk, record the preventive control, the person responsible and the evidence that the control works. Then state the remaining risk after those controls. The business owner should approve that remaining risk before launch.

Use a simple risk record

A useful row contains the risk, possible effect, people affected, likelihood, severity, current control, required action, owner and review date. Add a link to the evidence, such as a test result, supplier setting or training record. Avoid a single overall score that hides a serious issue. The written reasoning is often more useful than the number.

7. Set a review date

Review after the pilot, after a significant system change and at an agreed regular interval. Record incidents, corrections and staff feedback. A risk assessment is a living record, not a one-time form.

Assess a proposed AI workflow

Blue Canvas can map the process, test the use case and document practical controls as part of an AI audit.

Book a free 15-minute call