Home / Requirement record / 6.4.2.3
6.4.2.3
Identification of risk sources
The organization identifies where AI-related risk can come from, starting from the Annex B list: how complex the operating environment is, missing transparency or explainability, how far the system is automated, machine learning, hardware issues, life cycle issues and technology readiness. The step before 6.4.2.3 supplies its input, so run both together.
- What it asks
- The organization identifies where AI-related risk can come from, starting from the Annex B list: how complex the operating environment is, missing transparency or explainability, how far the system is automated, machine learning, hardware issues, life cycle issues and technology readiness.
- Where generative AI changes the answer
- Risk sources for generative AI sit in the model, the training and retrieval data, the prompt, the integration and the people who rely on the output.
- Who it binds
- The AI risk owner, the assessment team and the business owner of each generative AI use. For 6.4.2.3 the named role is the owner of risk sources identified per AI system against the Annex B list.
- Evidence an auditor normally samples
- Risk sources identified per AI system against the Annex B list
- The test you can run
- Ask for risk sources identified per AI system against the Annex B list and for its last review date; an artefact nobody can date is paperwork rather than a control.
- Common failures
- Machine learning treated as the only source of AI risk
- Before the draft publishes
- For 6.4.2.3, run the step once, by hand, on one live generative AI use, and keep the working paper. A method that has never been run on a real use is a template. The first artefact to produce is risk sources identified per AI system against the Annex B list.
- Where this sits against the draft
- 6.4.2.3 carries the risk management process part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on 6.4.2.3 (identification of risk sources) with this record and note the change in the register.