Assessment of likelihood

The organization should assess the likelihood of each event and its consequences, recognizing that for AI systems historical data can be scarce, that likelihood can change as the system learns or its context shifts, and that the assessment should state its uncertainty. The step before 6.4.3.3 supplies its input, so run both together.

What it asks

The organization should assess the likelihood of each event and its consequences, recognizing that for AI systems historical data can be scarce, that likelihood can change as the system learns or its context shifts, and that the assessment should state its uncertainty.

Where generative AI changes the answer

Likelihood for generative AI depends on exposure and on whether anyone gains from breaking the system, not only on the model's own error rate.

Who it binds

The AI risk owner, the assessment team and the business owner of each generative AI use. For 6.4.3.3 the named role is the owner of likelihood assessment with its basis and uncertainty stated.

Evidence an auditor normally samples

• Likelihood assessment with its basis and uncertainty stated

The test you can run

Ask for likelihood assessment with its basis and uncertainty stated and for its last review date; an artefact nobody can date is paperwork rather than a control.

Common failures

• Likelihood scored from intuition with no stated basis

Before the draft publishes

For 6.4.3.3, run the step once, by hand, on one live generative AI use, and keep the working paper. A method that has never been run on a real use is a template. The first artefact to produce is likelihood assessment with its basis and uncertainty stated.

Where this sits against the draft

6.4.3.3 carries the risk management process part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on 6.4.3.3 (assessment of likelihood) with this record and note the change in the register.