# [System name]: AI risk assessment form

> For reference purposes only. Not legal advice. Draft for review by a qualified professional.

**How to use this template.** Complete one form per AI system. Answer the five screening questions honestly: if you are not sure, treat it as the cautious case and get it reviewed. The result is a first filter for the EU AI Act risk tiers, not a legal determination. Template version 1.0, last reviewed 2026-10-02. Certainty: simplified. Some EU dates changed in 2026 under the Digital Omnibus on AI; check the current text.

## 1. System description

| Field | Entry |
|---|---|
| System name | [Name] |
| Owner | [Name and role] |
| Purpose | [What it does and why] |
| Source | [In-house or vendor, and vendor name] |
| Your role | [Provider, deployer, or not sure] |
| Regions where built, sold or used | [EU / US (states) / UK / India] |
| People affected | [Who is affected by its outputs] |

## 2. Screening questions

For each question, mark Yes, Not sure or No, and write your reasoning.

| # | Question | Answer | Reasoning |
|---|---|---|---|
| 1 | Does it use manipulative techniques that cause harm, score people on their social behavior, infer emotions at work or school, or could it be used to generate intimate images of real people without consent or child sexual abuse material? | [ ] | [ ] |
| 2 | Does it make or shape decisions about people's jobs, credit, education, access to essential services, law enforcement, migration or justice? | [ ] | [ ] |
| 3 | Is it a safety component of a regulated product, such as a medical device, vehicle or machine? | [ ] | [ ] |
| 4 | Does it identify or categorize people using biometric data, or help run critical infrastructure? | [ ] | [ ] |
| 5 | Does it interact directly with people, or generate text, images, audio or video that people will see? | [ ] | [ ] |

## 3. Resulting tier

The tier is the highest-weight question answered Yes or Not sure (Q1 weighs 4, Q2 to Q4 weigh 3, Q5 weighs 1).

- [ ] Likely prohibited (stop and get legal review)
- [ ] Possibly high-risk
- [ ] Transparency duties
- [ ] Likely minimal

Number of "Not sure" answers: [ ]. If any, the result assumes the cautious case. Resolve them before relying on it.

## 4. Affected people and groups

[Who could be affected, including vulnerable groups. Note any people who cannot easily contest a decision.]

## 5. Risks and mitigations

| Risk | Likelihood (Low/Medium/High) | Severity (Low/Medium/High) | Mitigation | Residual risk | Owner |
|---|---|---|---|---|---|
| [ ] | | | | | |

## 6. Oversight arrangements

[Who can review, override and stop the system, and how they are trained.]

## 7. Reviewer sign-off

| Role | Name | Decision | Date | Next review |
|---|---|---|---|---|
| Reviewer | [Name] | [Approve / approve with conditions / reject / defer] | | |
| Accountable owner | [Name] | | | |

*Speak to qualified legal counsel before launch if the tier is possibly high-risk or likely prohibited.*

---

For reference purposes only. This site offers general guidance for learning and planning; it is not legal advice and creates no lawyer-client relationship. Rules change often, so check the primary sources and qualified counsel before you act.