Compliance

Risk

Combination of harm probability and severity.

How the laws define this

Standardizing the core concept of risk, DKS 3007:2024, the NSTDA AI Ethics Guideline, and ISO/IEC TR 5469:2024 all agree that risk evaluates potential harm or adverse consequences from an artificial intelligence system by combining likelihood or probability with severity or impact. Each document uses this dual assessment to guide the identification and mitigation of dangers throughout the AI lifecycle. However, they diverge significantly in how broadly they categorize those harms to determine regulatory measures. ISO/IEC TR 5469:2024 confines its scope strictly to functional safety hazards. DKS 3007:2024 addresses general adverse impacts arising across development, deployment, or operation, stressing proportionate mitigation based on system context. By contrast, the NSTDA AI Ethics Guideline explicitly expands risk into distinct domains—separating operational safety risks, rights-based harms like privacy and discrimination, and broad societal risks like disinformation and systemic bias—to directly tier systems and assign targeted compliance controls.

Synthesised from the 3 statutory definitions below. Each one is quoted in full, with its source.

How jurisdictions differ

What is distinctive in each definition, binding law in force first.

Jurisdiction	Instrument	Status	What is distinctive
Thailand	NSTDA AI Ethics Guideline	In Force	Categorises risks into operational safety, rights-based harms like privacy and discrimination, and broader societal risks like disinformation and systemic bias, to tier systems and determine mitigation.
ISO	ISO/IEC TR 5469:2024, Artificial intelligence — Functional safety and AI systems	In Force	Limits risk to functional safety contexts, focusing on its role in assessment and mitigation of dangers specifically in AI-enabled safety-critical systems.
Kenya	DKS 3007:2024 Information technology — Artificial Intelligence — Code of Practice for AI Applications	Adopted	Emphasises proportionate identification, categorisation and mitigation of risks across the AI lifecycle based on the system's context and potential harm.

What it triggers

Under NSTDA AI Ethics Guideline, risks are used to tier AI systems and determine mitigation measures.source
In ISO/IEC TR 5469:2024, risk guides the identification and mitigation of potential dangers in AI-enabled systems.source
Under DKS 3007:2024, risks are to be identified, categorised and mitigated across the AI lifecycle.source

Definitions (3)

Any potential adverse consequence arising from the development, deployment or operation of an AI system, assessed by likelihood and impact; risks are to be identified, categorised and mitigated across the AI lifecycle in a manner proportionate to the system’s context and potential harm.

DKS 3007:2024 Information technology — Artificial Intelligence — Code of Practice for AI ApplicationsDefinition 1 of 3

Conceptualised as the likelihood and severity of harm arising from an AI system over its lifecycle, distinguishing operational safety risks, rights‑based harms (e.g., privacy, discrimination), and broader societal risks (e.g., disinformation, systemic bias), used to tier systems and determine mitigation measures.

NSTDA AI Ethics GuidelineDefinition 2 of 3

Within functional safety, 'risk' is defined as the combination of the probability of occurrence of harm and the severity of that harm. This concept is central to risk assessment, guiding the identification and mitigation of potential dangers in AI-enabled systems.

ISO/IEC TR 5469:2024, Artificial intelligence — Functional safety and AI systemsDefinition 3 of 3

Not to be confused with

Risk assessment

'Risk assessment' is the procedure to identify and mitigate risks, whereas 'risk' is the potential adverse consequence itself being assessed.

Risk-based categorisation

'Risk-based categorisation' classifies AI systems by their risk level, while 'risk' refers to the underlying probability and severity of harm.

Questions and answers

How does NSTDA distinguish types of AI risks?

NSTDA categorises risks as operational safety risks, rights-based harms such as privacy and discrimination, and broader societal risks like disinformation and systemic bias. These distinctions help tier systems and select mitigation measures.

What is risk in functional safety for AI systems?

ISO/IEC TR 5469:2024 defines risk as the combination of harm probability and severity, central to assessing and mitigating dangers in safety-critical AI systems.

How should AI risks be handled under Kenyan standards?

DKS 3007:2024 calls for risks to be identified, categorised and mitigated proportionately to the AI system's context and potential harm across its lifecycle.