Model Risk Tiering

The initial assessment of a vendor's AI system's raw risk level before any mitigating controls are applied. This evaluation is based on the model's intrinsic characteristics and its intended use case.

• Key Factors: Data sensitivity, decision autonomy, potential for physical or psychological harm, and impact on fundamental rights.
• Example: A model used for autonomous credit denial has a higher inherent risk than one used for product recommendation.
• Output: A preliminary risk score that dictates the depth of the subsequent due diligence process.

The quantification of risk that remains after internal controls and vendor-provided mitigations are factored in. This score represents the true risk exposure an organization accepts.

• Calculation: Inherent Risk - Mitigating Controls = Residual Risk.
• Controls Evaluated: Human-on-the-loop oversight, guardrail configurations, output moderation APIs, and data encryption.
• Decision Point: If the residual risk exceeds the organization's risk appetite, the vendor engagement must be restructured or rejected.

A granular assessment of the specific operational context in which the AI model will be deployed. The same model can have vastly different risk profiles depending on its application.

• Criticality Tiers:
  • Low-Impact: Internal productivity tools, non-customer-facing summarization.
  • Medium-Impact: Customer service chatbots with human escalation paths.
  • High-Impact: Autonomous financial trading, medical diagnosis support, or critical infrastructure control.
• Regulatory Trigger: High-impact use cases often trigger mandatory conformity assessments under frameworks like the EU AI Act.

A tiered categorization of the data the model will process, which is a primary driver of privacy and compliance risk. This classification directly informs the required security controls.

• Public Data: No restrictions; marketing copy or public web data.
• Internal Data: Confidential business information; requires access controls.
• Sensitive Data: PII, PHI, or financial records; mandates encryption, anonymization, and strict access logging.
• Prohibited Data: Data types that are contractually or legally barred from third-party processing, triggering an automatic rejection of the vendor.

An evaluation of the third-party provider's organizational capability to manage AI risk, independent of the model's technical specifications. A high-risk model from an immature vendor is an unacceptable combination.

• Assessment Vectors:
  • Documentation: Availability of model cards, system cards, and transparency reports.
  • Security Posture: Adversarial robustness benchmarks, red-teaming reports, and incident response protocols.
  • Operational Maturity: Model deprecation policies, rollback procedures, and API stability commitments.
• Outcome: A vendor maturity score that acts as a multiplier on the technical risk score.

A dynamic process that acknowledges risk is not static. A model's tier assignment must be periodically reviewed and automatically adjusted based on real-world triggers.

• Re-evaluation Triggers:
  • Model Update: A new version or significant fine-tuning is released by the vendor.
  • Concept Drift: Monitoring detects that the statistical relationship between inputs and outputs has shifted.
  • Incident Response: A safety or security failure in production triggers an immediate out-of-cycle review.
  • Regulatory Change: A new legal obligation, such as a systemic risk threshold, is introduced.
• Mechanism: Automated data drift detection pipelines feed into a quarterly manual governance review.

The raw risk assessment of a vendor's AI system before any mitigating controls are applied. This rating evaluates the model's potential for harm based on its intended use case, data sensitivity, and decision autonomy. A medical diagnosis model would receive a high inherent risk rating, while a product recommendation engine would score low. This baseline score determines the initial tier placement and the intensity of subsequent due diligence required.

The quantification of risk that remains after internal controls and vendor mitigations are applied. This score reflects the true exposure an organization accepts when deploying a third-party AI system. Key factors include:

• Effectiveness of guardrail configurations
• Vendor security certifications (SOC 2, ISO 27001)
• Contractual indemnification clauses
• Output moderation API coverage

A model may have a high inherent risk but an acceptable residual risk after robust controls are implemented.

The structured process of verifying that an AI system meets the essential requirements of a specific regulation, such as the EU AI Act. For high-risk tier models, this involves third-party notified body evaluation. The assessment examines:

• Training data quality and bias testing
• Technical documentation completeness
• Human oversight mechanism adequacy
• Accuracy, robustness, and cybersecurity benchmarks

Successful completion is a prerequisite for CE marking and market access in regulated jurisdictions.

The interconnected network of data providers, model developers, fine-tuners, and tooling vendors that contribute components to a final AI system. Risk tiering must evaluate every link in this chain, as a low-risk application can inherit critical vulnerabilities from an upstream dependency. Supply chain mapping identifies concentration risk, single points of failure, and transitive trust assumptions that could undermine the tier classification.

A formal, structured inventory of all software, data, and model components used to construct an AI system. Analogous to a software bill of materials in cybersecurity, the AIBOM enables:

• Rapid vulnerability assessment when upstream flaws are discovered
• Verification of license compliance across dependencies
• Audit trail completeness for regulatory inspections
• Accurate tier reclassification when components change

An AIBOM is increasingly mandatory for high-risk tier systems under emerging regulations.

A standardized assessment tool used to evaluate a third-party AI provider's security, privacy, and ethical practices before procurement. The questionnaire's depth scales with the model's risk tier:

• Low tier: Basic security posture and privacy policy review
• Medium tier: Detailed data handling, retention, and sub-processor disclosure
• High tier: On-site audits, penetration test results, and algorithmic fairness evidence

Responses feed directly into inherent and residual risk scoring calculations.