Compliance

Risk assessment

Procedure to identify and mitigate social, ethical and legal risks.

How the laws define this

Regulators and international frameworks uniformly understand a risk assessment as a structured, systematic process to identify and evaluate potential harms across an AI system's lifecycle in order to determine mitigation strategies and safeguards. However, these instruments diverge significantly regarding the specific scope of harm evaluated and the required compliance tools. The Council of Europe Framework Convention on AI, Human Rights, Democracy, and Rule of Law focuses heavily on systemic impacts regarding democracy, human rights, and the rule of law. In contrast, the National Innovation Centre for Privacy Enhancing Technologies (NICPET) specifically targets technical trade-offs between privacy leakage and utility. Furthermore, operational requirements vary: instruments like Malta — Towards Ethical and Trustworthy AI and the Interim Guidelines for Use of AI (Public Service) explicitly require Data Protection Impact Assessments and tiered risk classifications, whereas the Proposal for Parliamentary Resolution on Guidelines and Risk Assessments for the Use of Artificial Intelligence (B 42) calls for standardized templates and sectoral consequence analyses tailored to public-sector deployments.

Synthesised from the 9 statutory definitions below. Each one is quoted in full, with its source.

How jurisdictions differ

What is distinctive in each definition, binding law in force first.

Jurisdiction	Instrument	Status	What is distinctive
California, United States	California AB 2392 — Public Postsecondary Education: Generative AI Procurement Standards and Training	Awaiting Entry	Limits risk assessment to pre-procurement or deployment evaluation focused on harms, misuse, abuse, bias, explicitly tied to purchasing decisions for GenAI in public postsecondary education.
China	Ethics-Safety Guidelines for Artificial Intelligence Applications 1.0	In Force	Emphasizes systematic identification, analysis, and evaluation of ethical and safety risks across the entire AI application lifecycle.
Argentina	Disposition 2/2023 – "Recommendations for a Trustworthy Artificial Intelligence"	In Force	Adds categorization, likelihood/severity evaluations, prioritized mitigation plans, early-stage screening, continuous monitoring, and ties to project decisions.
Netherlands	National Innovation Centre for Privacy Enhancing Technologies (NICPET)	In Force	Focuses on privacy-enhancing technologies, integrating DPIAs, human-rights assessments, privacy leakage/utility trade-offs, pre-screening, and ongoing monitoring.
Ukraine	Council of Europe Framework Convention on AI, Human Rights, Democracy, and Rule of Law	Proposed	Centers on evaluating impacts on human rights, democracy, rule of law to classify risk levels and design safeguards, oversight mechanisms under international treaty.
World Economic Forum	AI Agents in Action: Foundations for Evaluation and Governance	In Force	Applies specifically to AI agents, basing safety/suitability on evaluation evidence to inform mitigation strategies.
Japan	Draft AI R&D Guidelines for International Discussion	Draft	Structures appraisal across R&D lifecycle with stage-gated evaluations for harms like misuse, privacy breaches, bias, safety failures before wider release.
Malta	Malta — Towards Ethical and Trustworthy AI (Malta's Ethical AI Framework)	Adopted	Includes DPIA-style assessments for personal data and documented mitigation plans across full AI lifecycle for safety, privacy, security, socio-ethical risks.
Ireland	Interim Guidelines for Use of AI (Public Service)	Superseded	Specifies risk classification (low/medium/high), accompanies DPIA for personal data, and outlines monitoring in public service AI use cases.
Denmark	Proposal for Parliamentary Resolution on Guidelines and Risk Assessments for the Use of Artificial Intelligence	Withdrawn	Evaluates likelihood/impacts covering data protection, bias, discrimination, legal rights, security; calls for standardized templates and sectoral analyses.

What it triggers

Under California AB 2392, the risk assessment must support measures that reduce harmful or illegal outputs and inform purchasing decisions for generative AI in public postsecondary education.source
Under Argentina's Disposition 2/2023, the risk assessment calls for early-stage screening, continuous monitoring and documented mitigation measures tied to AI project decisions.source

Definitions (10)

A systematic process to identify, categorize, evaluate and document social, ethical, legal and technical risks posed by an AI project, including likelihood and severity evaluations and prioritized mitigation plans. The Recommendations call for early-stage screening, continuous monitoring and documented mitigation measures tied to project decisions.

Disposición 2/2023 – "Recomendaciones para una Inteligencia Artificial Fiable" (Recommendations for a Trustworthy Artificial Intelligence)Definition 1 of 10

Risk assessment denotes a structured appraisal of potential harms across the R&D lifecycle — encompassing downstream misuse, privacy breaches, bias and safety failures — and recommends stage-gated evaluations and mitigation measures prior to wider release.

Draft AI R&D Guidelines for International DiscussionDefinition 2 of 10

A structured evaluation of privacy, security and societal risks associated with a PET deployment, encompassing DPIAs, human-rights-focused assessments and measurement of privacy leakage and utility trade-offs. NICPET operationalises risk assessments as part of pre-screening and ongoing monitoring to inform mitigation and compliance actions.

National Innovation Centre for Privacy Enhancing Technologies (NICPET)Definition 3 of 10

A structured process to identify, evaluate and mitigate safety, privacy, security and socio‑ethical risks across an AI system's lifecycle, including DPIA‑style assessments where personal data are involved and documented mitigation plans.

Malta — Towards Ethical and Trustworthy AI (Malta's Ethical AI Framework)Definition 4 of 10

A documented process to identify and evaluate potential harms, impacts on rights, safety and security from an AI use case, classify risk level (eg. low/medium/high), and specify mitigations and monitoring; where personal data are involved this includes or is accompanied by a Data Protection Impact Assessment.

Interim Guidelines for Use of AI (Public Service)Definition 5 of 10

A systematic evaluation of an AI system's potential impacts on human rights, democracy, and the rule of law used to classify risk levels and to inform the design and implementation of appropriate safeguards, mitigation measures, and oversight mechanisms.

Council of Europe Framework Convention on AI, Human Rights, Democracy, and Rule of LawDefinition 6 of 10

The process of determining the safety and suitability of an AI agent based on evaluation evidence, identifying potential harms, and informing mitigation strategies.

AI Agents in Action: Foundations for Evaluation and GovernanceDefinition 7 of 10

Refers to the systematic process of identifying, analyzing, and evaluating potential ethical and safety risks associated with AI applications throughout their lifecycle.

人工智能应用伦理安全指南 1.0Definition 8 of 10

Structured analyses evaluating the likelihood and potential impacts of specific AI uses, covering aspects such as data-protection/privacy effects, algorithmic bias and discrimination, effects on legal rights, security and resilience. The proposal calls for standardized templates and sectoral consequence analyses, particularly for public-sector AI deployments.

Proposal for Parliamentary Resolution on Guidelines and Risk Assessments for the Use of Artificial Intelligence (B 42)Definition 9 of 10

A risk assessment is the documented evaluation of a system’s potential harms, misuse, abuse, and bias before procurement or deployment. Under AB 2392, the assessment must support measures that reduce harmful or illegal outputs and inform purchasing decisions.

AB 2392 — Public Postsecondary Education: Generative AI Procurement Standards and TrainingDefinition 10 of 10

Not to be confused with

AI Impact Assessment

AI Impact Assessment refers to a documented analysis of risks and harms before deployment, while risk assessment is the procedure to identify and mitigate such risks.

Risk Management

Risk management is the systematic process of managing identified AI-related risks, whereas risk assessment focuses on their initial identification and evaluation.

Questions and answers

What must a risk assessment cover under California AB 2392?

It evaluates a system’s potential harms, misuse, abuse, and bias before procurement or deployment. The assessment supports measures to reduce harmful or illegal outputs and informs purchasing decisions.

How does risk assessment apply across the AI lifecycle?

Several definitions, like China's guidelines and Argentina's recommendations, describe it as a systematic process spanning the full lifecycle, from early screening to continuous monitoring.

When is a DPIA involved in risk assessment?

Definitions from the Netherlands, Malta, and Ireland note that where personal data are involved, risk assessment includes or is accompanied by a Data Protection Impact Assessment.