AI Risk Assessment Calculator
The formula
What the ai risk assessment tells you
The 5×5 matrix the risk industry actually uses, for ai risk assessment: gross likelihood × impact, discounted by how well your controls actually work.
Calculation: gross = likelihood × impact (1–25); net = gross × (1 − controls). Enter your inputs and every substitution is shown below the result.
Reading the result
Scores rank attention; they do not price losses. Anything 15+ gets a treatment plan with a named owner.
Rules of thumb: Most organisations carry 3–5 reds; more usually means likelihood inflation, not danger.
Limitations and best practice
Control ratings drift optimistic — audit one control’s evidence and re-mark the rest against it.
This calculator gives an estimate based on standard formulas; it is not professional financial, medical, legal or engineering advice. Verify anything you plan to act on with a qualified professional and your own records.
Frequently asked questions
Why discount by controls?
Do these scores compare across teams?
Source & methodology
ISO 31000-aligned qualitative risk matrices.
How AI Risk Assessment works — and what your result really means
This page was written for one job: turning your own inputs into a defensible figure, with the working shown. Searchers land on an AI Risk Assessment page for three reasons — to plan, to compare options, and to check that somebody else’s arithmetic is honest. This tool serves all three, and everything after the calculator explains the model instead of hiding it.
In plain terms, AI Risk Assessment answers the question "Net risk score?". The measurement matters because it converts a situation that feels complicated — several inputs pulling in different directions — into a single number you can act on. Within Technology & Computing, AI & Machine Learning is the context where this figure is quoted most often, and professionals treat it as a first-pass screen rather than a verdict.
In Technology & Computing the same quantity is often quoted under two or three different conventions. The formula printed above fixes one convention and applies it consistently, which is what makes results from this page comparable with each other.
What makes a calculation page trustworthy is that its copy is derived from its own arithmetic: here net risk score = 9.1 / 25, recomputed every time a field changes, and the sensitivity section ranks the inputs that move the result — Likelihood (1 = rare … 5 = almost certain) first, at ≈10.0 % of the headline for a ten-percent error either way in that input. Read the sections in order and you will be able to reproduce every figure by hand.
Every input in AI Risk Assessment, and what it does to the answer
The engine implements a single stated model: gross = likelihood × impact (1–25); net = gross × (1 − controls). There is no hidden coefficient and no login-gated precision — the formula printed is the formula executed, which is also what makes the result citable.
Likelihood (1 = rare … 5 = almost certain) (example value 4) is a numeric input whose unit is fixed by the label; a wrong unit is a wrong answer wearing a plausible disguise. If you are unsure what belongs in this field, look at the printed steps: the substitution shows exactly how the engine uses it.
Impact (1 = negligible … 5 = severe) (example value 4) is a quantity rather than a category — precision here is cheap and worth having. This input feeds the formula directly; a defensible figure here is worth more than false precision anywhere else.
Control effectiveness (0–100 %) (example value 43) is a measured number in the unit named by the label; the formula does not convert for you. Rates are the most mis-transcribed input on any page like this; copy it from the document rather than retyping from memory.
AI Risk Assessment with real numbers, step by step
Abstract formulas are hard to trust, so here is the complete substitution using the default inputs, written the way an examiner would want it. Starting figures: Likelihood (1 = rare … 5 = almost certain), Impact (1 = negligible … 5 = severe), Control effectiveness (0–100 %). The endpoint of that chain is 9.1 / 25 of net risk score, sitting in the “Amber — needs an owner and a date” band.
- Gross = 4 × 4 = 16
- Net = 16 × (1 − 43 %) = 9.1
Gross score — 16 / 25. Compare it against the main result of 9.1 / 25 before drawing conclusions.
Control credit — 6.9 pts. Compare it against the main result of 9.1 / 25 before drawing conclusions.
Likelihood × impact band — High×High. Read next to the headline, this is the figure that shows the shape of the trade-off.
Keep this worked example open while you enter your own figures: matching the shape of the substitution is the fastest way to spot a unit or convention mistake.
How far AI Risk Assessment can reasonably move
The honest version of any estimate is a corridor, and this one is cheap to produce: AI Risk Assessment was recomputed at 5 points along the dominant input, with every other field left untouched.
| Likelihood (1 = rare … 5 = almost certain) setting | Net risk score |
|---|---|
| 80 % of the example value | 7.3 / 25 |
| 90 % of the example value | 8.2 / 25 |
| example inputs | 9.1 / 25 |
| 110 % of the example value | 10.0 / 25 |
| 120 % of the example value | 10.9 / 25 |
That spread — 7.3 / 25 at the low end, 10.9 / 25 at the high — is what a careful read of AI Risk Assessment looks like: a band you can state out loud, with the reason for each edge. Reproduce it in the form above by editing Likelihood (1 = rare … 5 = almost certain) alone; the substitution steps will follow your figures exactly.
What actually moves your AI Risk Assessment
Generic advice says “it depends on your inputs”; this section says exactly how much. Each field was perturbed by ±10 % in isolation and the net risk score recomputed, so the ranking below is measured rather than asserted. Read it as a map of where AI Risk Assessment is fragile — drawn for the example inputs, which is the map you want when deciding what to measure carefully.
- Likelihood (1 = rare … 5 = almost certain) +10 % → AI Risk Assessment = 10.0 / 25 · −10 % → 8.2 / 25 (the net risk score shifts ≈10.0 %)
- Impact (1 = negligible … 5 = severe): ten percent up gives 10.0 / 25, ten percent down gives 8.2 / 25 — ≈10.0 % of the net risk score either way
- Control effectiveness: ten percent up gives 8.4 / 25, ten percent down gives 9.8 / 25 — ≈7.5 % of the net risk score either way
Likelihood (1 = rare … 5 = almost certain) is the dominant lever here: ten percent either way moves the result by about 10.0 %, from 8.2 / 25 to 10.0 / 25. That is where a careless figure does the most damage, so check it against a source, and Impact (1 = negligible … 5 = severe) is effectively tied with it (≈10.0 % for the same nudge), so verify the pair together. Everything below that can stay approximate, which is a licence to stop chasing data that would not change the decision.
Reading the result: bands, zones and thresholds
The value above only becomes useful the moment you know what it is being measured against. On the example inputs the band reads “Amber — needs an owner and a date”; your own figures place you on a different rung of the same ladder. The sensitivity list shows how far a modest input error moves you along that ladder: for Likelihood (1 = rare … 5 = almost certain), ±10 % covers 8.2 / 25 to 10.0 / 25. The practical reading rules: ask what would have to change to move you one band. If the answer is “a small, plausible input difference”, the band itself is not the finding — the uncertainty is.
Where AI Risk Assessment sits next to similar measures: this tool answers “how much is the AI Risk Assessment”, while the related calculators answer “what do I do about it”. Reading the result alone tends to over-weight a single snapshot; pairing it with the companion tools above turns the number into a decision.
Common mistakes with AI Risk Assessment (and the fix)
Control ratings drift optimistic — audit one control’s evidence and re-mark the rest against it. This calculator gives an estimate based on standard formulas; it is not professional financial, medical, legal or engineering advice. Verify anything you plan to act on with a qualified professional and your own records.
Stopping at the first plausible answer. If the result surprises you, the productive question is which input would have to be wrong for the surprise to disappear — then go check that input.
One mistake is specific to this engine: assuming every input matters equally. The computation above shows Likelihood (1 = rare … 5 = almost certain) dominating — a careful figure there beats false precision everywhere else.
Another is comparing across contexts: an AI Risk Assessment computed with one set of conventions should never be lined up against a figure computed with another. Check the inputs behind both before ranking them.
AI Risk Assessment verification checklist
- State, in one sentence, which convention each rate, unit or period in the form is using.
- Confirm the example values are plausible for your own situation before replacing them.
- Re-verify Likelihood (1 = rare … 5 = almost certain) against a source document — ten percent of error there moves the headline by ≈10.0 %.
- Compare the output against one published benchmark or a colleague’s independent estimate.
- Verify each input against its original source document, not memory.
- Confirm the answer against one independent method or published benchmark for AI Risk Assessment.
Five steps from raw inputs to a figure you can defend
The tool does the arithmetic; the routine below is what makes the arithmetic trustworthy. Five steps, a minute total — and afterwards you will know not just what the number is, but which assumption produced it.
Step 1 — one document, one pass. Open the statement, label or record that holds likelihood (1 = rare … 5 = almost certain), impact (1 = negligible … 5 = severe), control effectiveness (0–100 %) and transcribe straight into the form. Transcription from a single source removes the mismatch errors that appear when figures are assembled from three different places. Write the figure down before moving on; memory flatters whichever number you saw last.
Step 2 — enter the conservative case first. Resist the flattering scenario. Type the inputs you would defend in front of a sceptical reader, read the Net risk score (9.1 / 25 for the example values), and note the verdict band. If the answer changes your behaviour, it deserves a second run with different assumptions.
Step 3 — isolate your variables. Change one field, observe, revert. The live sensitivity list does the ranking for the default inputs; verify it against your own, because dominance shifts when the starting point shifts. Numbers are cheap to produce and expensive to retract; the extra minute is the cheapest insurance available.
Step 4 — run the scenario trio. Expected, pessimistic, optimistic. The gap between pessimistic and expected is the number to plan against; the optimistic result is useful only as a ceiling. Say the answer out loud before you save it; if it sounds wrong, the model did not change, your understanding did.
Step 5 — write the one-line memo. “Net risk score = 9.1 / 25 on this date, from these inputs.” That line is the entire deliverable; everything else on this page is how you earned the right to write it. If the answer changes your behaviour, it deserves a second run with different assumptions.
The real-world conversations AI Risk Assessment settles
In AI & Machine Learning the figure computed here is usually the first one somebody asks to see. Having it — with the formula behind it — changes your position in the conversation from participant to reference. A figure with a date beside it becomes evidence; without one it stays an anecdote.
The companion outputs — Gross score and Control credit — exist for the second stage of that screen: the headline sizes the prize, while the companions describe the trade-off you are accepting to get it. One decimal place more than your data supports is one decimal place of fiction.
Nothing here is stored or transmitted, so the habit of checking is free: open the page, re-enter current figures, compare with the number you saved last time. The fastest sanity test is to guess the answer first and see how far the calculation disagrees.
People also ask about AI Risk Assessment
What affects AI Risk Assessment the most?
Measured on this engine, Likelihood (1 = rare … 5 = almost certain) is the dominant lever: moving it ±10 % shifts the net risk score across 8.2 / 25 to 10.0 / 25 — about 10.0 % of the headline, with Impact (1 = negligible … 5 = severe) next at ≈10.0 %. The ranked list in the sensitivity section is computed live, not asserted from a template.
Do impact (1 = negligible … 5 = severe) and likelihood (1 = rare … 5 = almost certain) matter equally?
AI Risk Assessment here is co-driven: Likelihood (1 = rare … 5 = almost certain) and Impact (1 = negligible … 5 = severe) produced ≈10.0 % and ≈10.0 % responses, which is a tie for practical purposes. Everything below those two is a rounding error by comparison.
What is a typical AI Risk Assessment?
On the worked example above AI Risk Assessment comes out at 9.1 / 25. Treat that as one point on a distribution rather than a norm: the bands, the companion outputs and the sensitivity ranking tell you how wide the plausible range really is.
How do I calculate AI Risk Assessment by hand?
gross = likelihood × impact (1–25); net = gross × (1 − controls) is the entire method. Work the inputs in that order — Gross = 4 × 4 = 16 — and you will reach 9.1 / 25 on the default figures, the same number this tool prints.
What happens to AI Risk Assessment if likelihood (1 = rare … 5 = almost certain) changes by 10 %?
Try it in the form above and the printed substitution will follow you; the pre-computed answer for the defaults is 8.2 / 25 to 10.0 / 25 across the ten-percent probe, i.e. ≈10.0 % sensitivity on the net risk score.
Is the AI Risk Assessment result of 9.1 / 25 good or bad?
Good and bad are comparisons, so the honest test is three questions: where does your own AI Risk Assessment sit against the 9.1 / 25 reference above, how far would a plausible input error move it (≈10.0 % per ten percent on Likelihood (1 = rare … 5 = almost certain)), and what does the alternative option compute to?
What affects AI Risk Assessment the most?
Sensitivity depends on where you start, but the inputs Likelihood (1 = rare … 5 = almost certain) and Impact (1 = negligible … 5 = severe) typically move AI Risk Assessment further than the rest because they enter the formula multiplicatively. If you can only measure two things well, measure those and hold the others at conservative defaults.
Is AI Risk Assessment accurate?
The arithmetic is exact: gross = likelihood × impact (1–25); net = gross × (1 − controls) is evaluated with full floating-point precision and every substitution is printed in the worked example. What limits accuracy is input quality and the model’s assumptions, so treat the 9.1 / 25 result as the correct answer to the question you typed — and check the assumptions section before acting on it.
Why discount by controls?
A 20-score hazard half-mitigated is a 10, and 10s behave like a different risk class.
Do these scores compare across teams?
Only if the likelihood and impact scales are calibrated to the same definitions — the matrix is shared, the calibration is organisational.
Is my data private on this page?
Yes — computation happens locally in your browser, with no account, no tracking of your inputs and nothing sent to a server. The printed formula is the whole story of what happens to your figures.
The vocabulary of AI Risk Assessment
- Gross score
- 16 / 25 in the default AI Risk Assessment calculation — one of the secondary figures an experienced reader checks before trusting the primary number.
- Control credit
- 6.9 pts for the AI Risk Assessment worked case; it sits next to the main result because it carries context the headline leaves out.
- Likelihood × impact band
- High×High for the AI Risk Assessment worked case; it sits next to the main result because it carries context the headline leaves out.
- Net risk score
- The primary output of this tool: 9.1 / 25 for the default inputs, computed exactly from gross = likelihood × impact (1–25); net = gross × (1 − controls).
- Worked example
- The calculation written out in full so that nothing on this page has to be taken on trust.
- Verdict band
- The plain-language label — here “Amber — needs an owner and a date” — mapping the computed figure onto experience-based ranges for Technology & Computing.
- Sensitivity (±10 %)
- How far the AI Risk Assessment moves when a single input is nudged ten percent either way; the ranked list on this page is computed live from this engine.
The provenance of this AI Risk Assessment calculation
There is no black box on this page — the engine evaluates gross = likelihood × impact (1–25); net = gross × (1 − controls). Source of record: ISO 31000-aligned qualitative risk matrices. Where a professional version of this calculation differs, it differs in inputs and jurisdiction-specific coefficients, not in the algebra — which is why re-checking your inputs beats hunting for a second calculator.
Treat the output as a precise answer to the question you typed: exact arithmetic, transparent formula, published source, no hidden rounding. The design constraint was set by usefulness rather than by comfort: an estimate you can interrogate beats an answer you have to trust.
After the number: what to do with it
Re-run the calculation with your own figures, stress the two most sensitive inputs by ±10 %, and only then act on the result.
This page was written for people who need one trustworthy number before their next decision, and the promise is that nothing above required trust. Bookmark the tool, re-run it whenever an input moves by more than a few percent, and keep the date with the number.