AI risk assessment

Is there a register of every AI system used in the organisation?

Does the register also include informally used tools (shadow AI)?

Does every AI system have a named owner?

Is it defined which data may and may not be entered into external AI services?

Are there controls preventing personal data or sensitive information from being shared with external AI services?

Is it established where data is processed and stored (jurisdiction)?

Do contracts govern the supplier right to use entered data for model training?

Have the AI systems been tested for robustness against adversarial attacks and prompt injection?

Are there processes for handling hallucinations and incorrect output?

Is interaction with AI systems logged for traceability?

Is there human oversight for decisions of material consequence that are based on AI?

Is it clear who carries responsibility for AI based decisions?

Are affected parties informed that AI is used in decision processes?

Have you assessed which AI systems are classified as high risk under the AI Act?

Are AI risks included in the general risk analysis?

Is there an AI policy approved by the leadership?