Complexity of environment

AI-related risk source: AI systems that operate in complex, open or changing environments face situations their design and training did not cover, so the environment's complexity is itself a source of risk. The artefact behind the answer is analysis of the operating environment's complexity and coverage by design and test. Use complexity of environment as a prompt in the identification step, not as a finding.

What it asks

AI-related risk source: AI systems that operate in complex, open or changing environments face situations their design and training did not cover, so the environment's complexity is itself a source of risk.

Where generative AI changes the answer

A generative AI system sits in a complex environment of vendors, APIs and retrieved content, and each connection is a place where the risk changes.

Reading it in practice

Complexity of environment is the source that grows fastest with generative AI, because every vendor, API, retrieval store and tool integration adds a place where the system's behaviour and the organisation's control both change. The evidence is an architecture and supplier map that names each connection and who owns it.

Who it binds

The assessment team that runs identification, and the business owner who knows the use. For B.2 the named role is the owner of analysis of the operating environment's complexity and coverage by design and test.

Evidence an auditor normally samples

• Analysis of the operating environment's complexity and coverage by design and test

The test you can run

Take analysis of the operating environment's complexity and coverage by design and test and trace it to the decision it supported; if the trail stops before a named person, the control is not evidenced.

Common failures

• Environment assumed to match the training conditions

Before the draft publishes

For B.2, add the sources that apply to your use to the identification checklist, with a short note on why each one is or is not present. The first artefact to produce is analysis of the operating environment's complexity and coverage by design and test.

Where this sits against the draft

B.2 carries the annex b: ai-related risk sources part of the draft's published scope, which names risk sources, the stakeholders exposed to them, risk analysis, risk treatment and controls. When the draft publishes, compare its wording on B.2 (complexity of environment) with this record and note the change in the register.