Inherent Risk Rating

The degree of independent decision-making authority granted to the AI system. Higher autonomy correlates directly with increased inherent risk.

• Human-in-the-loop: System recommends, human decides. Lowest inherent risk.
• Human-on-the-loop: System executes, human monitors and can override.
• Human-out-of-the-loop: Fully autonomous execution with no real-time oversight. Highest inherent risk.

Example: A fully autonomous trading agent executing financial transactions without pre-trade human approval carries extreme inherent risk due to potential for rapid, irreversible damage.

The severity of potential harm if the model's output is incorrect, biased, or unsafe. This maps directly to regulatory frameworks like the EU AI Act's high-risk classification.

• Safety-critical: Decisions affecting human life (medical diagnosis, autonomous vehicle control).
• Rights-impacting: Decisions affecting legal status, financial access, or employment.
• Operational: Decisions affecting business processes with reversible financial impact.
• Low-stakes: Non-material decisions like content recommendations.

Example: An AI screening job candidates inherently carries high risk due to potential disparate impact on protected groups, triggering employment law scrutiny.

The classification of data the model processes, stores, or was trained on. Risk scales with identifiability and regulatory penalty exposure.

• Special Category Data: Biometric, health, political affiliation data under GDPR Article 9.
• Personally Identifiable Information (PII): Any data that can directly or indirectly identify an individual.
• Proprietary/Confidential: Trade secrets, financial projections, intellectual property.
• Public Data: Information lawfully available to the public.

Example: A vendor model trained on unencrypted patient health records carries extreme inherent risk due to HIPAA and GDPR violation potential, regardless of the model's accuracy.

The number of vectors through which a malicious actor can manipulate, extract, or corrupt the model. A larger attack surface increases inherent risk.

• Public API without rate limiting: Exposed to model extraction and membership inference attacks.
• User-supplied input processing: Vulnerable to prompt injection and jailbreak attempts.
• Third-party training data ingestion: Susceptible to data poisoning.
• Client-side deployment: Exposes model weights to direct IP theft and inversion.

Example: A publicly accessible chatbot with file upload capability has a high inherent risk profile due to combined prompt injection and malicious file vectors.

The degree to which the model's internal reasoning is inscrutable. Opaque models carry higher inherent risk because failures are harder to predict, detect, and audit.

• Black-box deep neural networks: Billions of parameters with no clear decision path. High opacity.
• Ensemble methods: Combining multiple opaque models compounds the explainability problem.
• Interpretable architectures: Decision trees, linear models, or models with built-in feature attribution. Low opacity.

Example: A vendor's proprietary trillion-parameter transformer model used for loan adjudication carries high inherent risk because the model interpretability score is effectively zero, making disparate impact testing extremely difficult.

The complexity and dependency structure of the algorithmic supply chain. Risk increases with the number of upstream dependencies and the difficulty of substitution.

• Single-source foundation model: Reliance on one vendor's proprietary API (e.g., GPT-4, Claude). High vendor lock-in risk.
• Multi-tier fine-tuning chain: A model fine-tuned on another fine-tuned model, obscuring model provenance.
• Critical tooling dependency: Reliance on a single vendor for vector databases, orchestration, or guardrails.
• Open-source with verified build: Transparent, reproducible artifact. Lower concentration risk.

Example: A vendor solution built exclusively on a single hyperscaler's proprietary model and inference infrastructure concentrates operational and regulatory risk, creating a single point of failure for API stability and compliance.

The quantification of risk that remains after internal controls and vendor mitigations are applied. While inherent risk represents the raw, unmitigated exposure, residual risk is the final metric that determines if a vendor relationship is acceptable. The gap between inherent and residual risk demonstrates the effectiveness of your control environment.

• Formula: Inherent Risk - Control Effectiveness = Residual Risk
• Target: Must fall within the organization's defined risk appetite
• Example: A model with high inherent risk may be approved if strong guardrails reduce residual risk to Low

A framework for classifying third-party AI models based on their potential for harm to determine the intensity of required oversight. Tiering directly informs the inherent risk rating by mapping model characteristics—such as autonomy level, decision impact, and data sensitivity—to predefined risk buckets.

• Tier 1 (Low): Advisory tools with full human override
• Tier 2 (Medium): Decision-support systems affecting non-critical operations
• Tier 3 (High): Autonomous systems impacting safety, rights, or financial standing
• Tier 4 (Critical): Life-altering decisions with no human intervention

A structured evaluation of the societal and ethical consequences of an automated decision system before deployment. This assessment feeds directly into the inherent risk rating by identifying the severity and scope of potential harm across dimensions like fairness, privacy, and fundamental rights.

• Key Dimensions: Individual autonomy, group equity, environmental impact
• Regulatory Alignment: Mandated by frameworks like the EU AI Act for high-risk systems
• Output: A risk score that informs the inherent rating and triggers required mitigations

A standardized assessment tool used to evaluate a third-party AI provider's security, privacy, and ethical practices before procurement. The questionnaire gathers the raw data points—training data provenance, bias testing results, adversarial robustness—that populate the inherent risk rating model.

• Coverage Areas: Data governance, model explainability, incident response
• Scoring: Responses are weighted to calculate a composite inherent risk score
• Integration: Feeds automated vendor risk management platforms for continuous monitoring

The process of verifying that an AI system meets the essential requirements of a specific regulation, such as the EU AI Act. The inherent risk rating determines which conformity assessment route is required—internal review for low-risk systems versus third-party notified body certification for high-risk ones.

• Self-Assessment: Permitted for minimal-risk AI
• Third-Party Audit: Mandatory for high-risk classification under EU AI Act Article 43
• Documentation: Technical file must demonstrate how inherent risks were identified and mitigated

The network of data providers, model developers, and tooling vendors that contribute components to a final AI system. Inherent risk rating must account for transitive risk—vulnerabilities inherited from upstream dependencies that compound the overall exposure.

• Components: Foundation models, fine-tuning datasets, orchestration frameworks
• Risk Aggregation: A single poisoned dataset can elevate the inherent risk of the entire chain
• Transparency Requirement: AI Bill of Materials (AIBOM) documents all supply chain nodes