Risk Tiering and Impact Assessment

Governance that applies the same process to a spam filter and a loan decisioning system fails at both. It is too heavy for the first and too light for the second, and the classification that separates them is the load-bearing part of any governance system.

Classify by consequence, not by technique

The instinct is to tier by technology: deep learning is high risk, a rules engine is low. That is wrong in both directions. A simple logistic regression allocating benefits can cause more harm than a large model summarising internal documents.

The dimensions that predict consequence are these. Whose interests are affected, and whether they chose to be subject to the system. What decision it makes or influences, and whether that decision affects access to something significant such as employment, credit, housing, healthcare or liberty. Reversibility, meaning whether an error can be detected and corrected before it causes harm. Autonomy, meaning whether a human meaningfully reviews each output or the system acts alone at volume. Scale, since the same error rate at a thousand and a million decisions are different problems.

The EU AI Act's risk tiers encode a version of this: prohibited practices, high-risk systems defined by domain and function, systems with transparency obligations, and everything else. Adopting a compatible internal taxonomy means one classification serves both internal governance and regulatory obligation.

What an impact assessment establishes

Done before building, an impact assessment answers: who is affected and how, what the plausible failure modes are and what each would cost whom, what data is used and whether its use is appropriate, what alternatives exist including not building it, what mitigations are planned, and what residual risk remains and who accepts it.

The question that most often changes a design is the first. Teams reliably identify the user and reliably miss the third parties: the people whose data trains the system, those affected by decisions they did not request, and those whose work the system changes. Enumerating them explicitly is where an assessment earns its cost.

When it breaks

Self-assessment produces optimistic classification. A team classifying its own project has an incentive toward the lighter tier, and no ill intent is required for that incentive to operate. Independent review of the classification, even briefly, corrects most of it.

Assessment becomes documentation. Written after the design is fixed, it records decisions rather than informing them. The timing is the difference between a governance artefact and a governance activity.

Aggregate low risk hides individual high risk. A recommendation system is low risk on average and high risk for the person whose recommendations are systematically worse. Risk to an individual and expected risk across the population are different quantities, and averaging obscures exactly the harm that matters.

Reassessment is not triggered. A system assessed at design and then extended with new capabilities has an assessment describing something else. Material change, not elapsed time, is the right trigger, and defining what counts as material is part of the process design.