Service
AI Risk Assessment for UK Businesses: Risks Found, Owned and Fixed
An AI risk assessment lists the AI you use or plan to use. It scores what could go wrong and gives each risk an owner and a fix. HAeX carries it out for UK businesses. You get a risk register you can keep up to date. Price is scoped on a call.
- You get a register with owners, not a list of worries.
- Each risk has a fix you can act on.
- We flag legal questions for your own adviser.
It is a structured look at what could go wrong with AI in your business. You see how likely each risk is and how bad it would be. Then you decide what to do about it.
What is an AI risk assessment?
It is not a test of the model alone. It covers the whole use: the data, the people, the supplier and the decisions that follow. The result is a register, a living document you review.
When do I need one?
You need one before you put AI into a process that touches personal data, money, or decisions about people. You also need one if a client or insurer asks.
A DPIA is a form of risk assessment required by UK GDPR for high risk processing. Many firms do a risk assessment first, then a DPIA where it is flagged. We help with both.
For a sector example, see how we approach AI for financial advisers and brokers.
AI risk assessment
What do you assess?
We score six areas for each AI use.
Data:
what personal or sensitive data goes in, and where it goes.
Accuracy:
what happens if the output is wrong.
Security:
who can access the tool and the data.
People:
who uses it, and whether they are trained.
Suppliers:
what the provider does with your data.
Law:
which UK rules apply, including automated decisions.
Each risk gets a score for likelihood and impact, using a simple scale we explain in the document.
Staff data carries its own risks. We assess them before an embedded AI team starts measuring work.
Here is a worked example with assumed figures. It is not a client result.
What does a worked example look like?
Say a firm uses AI to draft replies to client emails. We list five risks: client data in a public tool, a wrong answer sent out, a leaked prompt, an untrained user and a provider change. Two score high. For each we set an owner and a fix, such as an approved tool and a rule that a person reads every reply.
We can work through this with your own details on a free call.
What is in the risk register?
It is one table. Each row holds the risk, its score, its owner, the fix, a due date and a status.
The register lives in a file you control. We hand it over with a short guide on how to update it. You review it on a set date. A register that is never reviewed does not protect you.
Is there an AI risk assessment template I can use?
Yes. Our free AI policy and DPIA builder gives you a first draft in minutes. Its DPIA path follows the ICO structure.
Templates are a good start for one tool and a clear use. For several tools, personal data at scale or decisions about people, a person should look at it with you. That is where this service helps.
AI risk assessment
How does an assessment run, step by step?
It runs in four steps.
- 1
Discovery call (30 minutes)
You tell us what AI you use or plan to use.
- 2
Audit and quote
We list each use and its data, then quote in writing.
- 3
Assess
We score the risks with the people who own the work.
- 4
Report and review
You receive the register, the fixes and a review date.
Yes. We work with the minimum data we need. Usually we need a description of the process, not the data itself.
Is the assessment itself safe under UK GDPR?
Where we do see personal data, we say so in advance, and we agree how it is handled. Our wider AI governance and compliance service covers policy and staff briefings.
What does an AI risk assessment cost, and how long does it take?
Price depends on the number of AI uses and how much personal data they touch. We scope it on a free call and quote in writing.
A single use can be done quickly. A firm with several uses takes longer. If you are building automations, our AI Automation service includes a data flow note with every build.
What is the next step?
Start with the free 30 minute call. List the AI tools in use and what each is used for.
We will say whether a template is enough or you need a full assessment. The free AI readiness assessment is a good first check.
Questions that come up
What is the difference between a risk assessment and a DPIA?
A DPIA looks at risks to people from using their data and is required for high risk processing. A risk assessment is wider.
How often should we review the register?
On a set date, and whenever you add a new tool or a new use. We recommend a set interval that you agree.
Does the EU AI Act need a risk assessment?
It can, for some uses. See AI compliance consulting.
Can you assess AI we bought from a supplier?
Yes. We review the use, the data flow and the supplier's terms.
Do we need an assessment for ChatGPT use?
For client data, yes. For general drafting with no personal data, a short policy may be enough.
Can I do it myself?
Yes, with our free tools, for simple cases. We help when the case is not simple.
What happens on the call
- 1
You list the AI tools in use and what for
- 2
We say whether a template is enough
- 3
You leave with a short list of what to automate first and a rough idea of cost
Prefer to talk first? Ring 07435 708864.
What you now know
- What an AI risk assessment is
- When you need one
- What we assess
- What a worked example looks like
- What the risk register holds
- Whether a template is enough
- How an assessment runs
- That the process is safe under UK GDPR
- What it costs and how long it takes
- Your next step
Find and fix AI risks
The first call is free. We tell you what an assessment would cover and who would own each risk.