A good AI risk assessment template turns a one-off exercise into a repeatable control. This guide sets out exactly what a template should contain and how to use it consistently across your AI systems. Part of our guide to the AI risk assessment.
A template standardises how every team assesses AI, so results are consistent and comparable, roll up into a portfolio view of AI risk, and give you the audit evidence ISO/IEC 42001 and the EU AI Act expect. Without one, each assessment reflects whoever ran it.
A strong template has two parts. A header capturing the system context:
And a risk table — one row per risk — with these columns:
Each system should have rows across: purpose and impact, data quality and lawful basis, bias and fairness, transparency and explainability, robustness and security, human oversight, and regulatory exposure. See types of AI risk for what to list under each.
Use a simple, consistent scale — 1–5 for likelihood and 1–5 for impact — and multiply for a score. Consistency matters more than precision: the goal is to rank risks reliably, not to compute a false-precision number.
Apply the same template to every AI system, and the individual assessments roll up into a portfolio view — which systems carry the most unmitigated risk, and where to focus. It also feeds the Statement of Applicability and evidence trail for ISO 42001.
A template is the worksheet; the assessment is the work of filling it with real, tested findings. See how to conduct an AI risk assessment.
AramGRC provides an AI risk assessment template mapped to ISO/IEC 42001 and the EU AI Act — and runs the assessment with you so the template is filled with evidence, not guesswork.
A standard worksheet for assessing an AI system — a header capturing system context and a table with one row per risk (dimension, description, likelihood, impact, score, control, owner, status).
System name, owner, purpose and risk tier in the header; and per-risk rows covering dimension, description, likelihood, impact, score, control and owner.
Templates are widely available, but the value is in one mapped to a recognised standard (ISO 42001, the EU AI Act) and filled with tested evidence rather than guesses.
For each risk dimension, describe how harm could occur, score likelihood and impact, record the control and owner, and set a status — then review on a schedule.
What an AI risk assessment is, the risks to evaluate, the process, template and framework.
The step-by-step process for running an AI risk assessment.
What an AI risk assessment template should contain, and how to use it.
You're here
How an AI risk assessment framework maps to the NIST AI RMF, ISO 42001 and the EU AI Act.
Managing AI risk across the lifecycle — beyond a one-time assessment.
How to assess the risk of AI you buy or embed from third parties.
The main categories of AI risk, with examples — bias, security, privacy, drift and more.
A free AI risk assessment tool to download (Excel), the best free toolkits, and how to choose.