How to run an AI risk assessment
Run an AI risk assessment from a proportionate inventory through consequence triage, legal classification and records kept current during delivery.
Count your AI systems first, then assess them in two passes. Start with a practical triage by consequence, so the board can see which systems could genuinely harm a customer, a colleague or the firm. Then apply the legal test against regulations such as the EU AI Act, with counsel. Keep the classification as a live record, because a system rarely stays low-consequence as it scales. This is not legal advice.
30 minutes with James · how this would work in your organisation
The basis for this approach
This is the two-pass delivery method already published in Tenhaw’s governance FAQ. Formal legal interpretation and classification belong with your legal owner. This is not legal advice.
The demand signal
The published governance guidance separates a practical consequence triage from the legal test. Both start from an inventory, because vendor features and tools adopted outside a programme still need to be visible.
Bring the reason this is on your agenda to a 30-minute call with James, and we can explore what it would take in your organisation.
Book a 30-minute callWhy it stalls
2 failure modes we keep meeting
The assessment starts with an incomplete list
A programme register can miss embedded vendor features and tools bought elsewhere. Enumerate the AI already in use before either consequence triage or legal classification.
The classification remains fixed as usage grows
A pilot’s use and consequences can change as it scales. Keep ownership, scope, review boundaries and the classification current instead of treating the original assessment as permanent.
If one of these sounds familiar, bring it to a 30-minute call with James and we can explore a way past it.
Book a 30-minute callHow we approach it
3 moves, in order
- 01
Count the AI and the decisions
Record the systems, purposes and owners proportionately, including embedded features. Identify what decisions the system supports or makes and who carries the authority.
- 02
Triage consequence, then apply the legal test
First classify the inventory by consequence so the board can see potential harm to customers, colleagues or the firm. Second, apply the EU AI Act’s categories with counsel where relevant. This is not legal advice.
- 03
Keep the evidence beside the work
Retain evaluation results, approval records, audit trails and change history as delivery outputs. Review the inventory and classification on a fixed cadence with named owners, and when scope changes.
Identify what decisions the system supports or makes and who carries the authority.
Prefer to talk it through? Ask us on a discovery call →
Sources
Every source below was opened and read before it was attached. Where nothing survived that check, the claim on this page was softened rather than given a plausible-looking link.
Tenhaw, AI governance and regulatory evidenceTenhaw, governance and regulatory evidence questionsEuropean Commission, AI Act framework and application timelinePrimary overview checked 5 November 2026, with a link to the final AI Omnibus text and current high-risk dates.The closest guides to this one
Nearest first, then the rest. Each one carries the same label: written from delivery, or the method we would bring. All 34 are on the hub.
What should an AI governance framework include?
Keep the AI inventory, accountable decisions and evidence connected.
Our approachDoes the EU AI Act apply to UK companies?
Check your systems, role and EU exposure.
Our approachHow do we verify an AI agent beyond a vendor demo?
Give your release decision evidence the business can inspect.
Our approachAgent identity and access
Give each workflow the authority it needs, with a way to take it away.
DeliveredWhat does an AI-native software delivery lifecycle look like?
Connect requirements, AI engineering and human release decisions.
DeliveredTarget operating model for an AI-native organisation
Design what agents do, what people decide and how the work improves.
Or bring the problem to a call instead of reading three more of these.
Book a 30-minute callWork out the next step for your team.
A 30-minute call with James Rooney to discuss your workflow, people and budget. Leave with a rough scope and a useful next step.
90-day outcome programme · £120k or £180k fixed · 90 days · excluding VAT
No time that suits? Email hello@tenhaw.com. Calendar not loading? Open it on cal.com.
Describe the work
Describe the work in a paragraph. James replies with a rough scope and budget range within two working days.
Questions this guide answers
Who should run it?
The people who understand the workflow and consequences work with risk and compliance on the first pass. Counsel and the legal owner handle the legal test and formal interpretation. Each decision needs a named accountable owner.
What counts as high risk?
Distinguish your practical consequence triage from a legal high-risk classification. The first highlights potential harm; the second applies the relevant regulatory categories with counsel. This is not legal advice.
How often should we repeat it?
Keep the inventory and classification as live records, reviewed on a fixed rhythm with named owners and revisited as scope and use change. A pilot’s classification should not simply be carried into wider use without review.
What evidence do we keep?
Keep the inventory, ownership decisions, evaluation results, approval records, audit trails and change history connected to the system. The legal owner determines which records support the specific duties; this is not legal advice.
Can Tenhaw classify our systems legally?
Tenhaw is not a law firm and does not provide legal advice. We help design the operating model and delivery discipline that produce the records your legal and risk owners need, and work alongside those owners.