Define the scenario and assessment criteria
Describe intended use, foreseeable misuse, users, data flows and dependencies before assigning ratings. Separate the model from the application and workflow around it. A summarisation error becomes a different risk when its output informs an employment or financial decision without adequate checking.
ISO/IEC 42001:2023 distinguishes AI risk assessment, treatment and system impact assessment. Establish criteria that support consistent assessment, including acceptance criteria, and explain how insufficient evidence affects the decision. An uncertain supplier statement should not be converted into a confident low-risk rating.
Assess impacts beyond organisational loss
Examine potential consequences for individuals, groups and society as well as your organisation. Consider exclusion, unequal error rates, misleading outputs, privacy intrusion and barriers to challenge. Engage operational specialists and relevant affected-party perspectives instead of relying exclusively on the development team.
Keep impact assessment connected to, but distinguishable from, risk assessment. Record who may be affected, how impacts arise and which assumptions need testing. A familiar security rating should not flatten different consequences into an unexplained score or conceal harm that does not immediately cost the organisation money.
Treat risks with testable safeguards
Choose treatments that address the scenario: restrict tasks, limit data, introduce validation, alter the workflow or stop the proposed use. Define human oversight precisely, including reviewer competence, available information and authority to intervene. A nominal approval button does little if reviewers cannot detect errors.
Compare necessary controls with Annex A and document applicability decisions. Set owners, dates and evidence requirements with appropriate approval and residual-risk acceptance. Vendor evaluations can inform treatment, but general benchmarks do not prove performance on your data, user population or configuration.
Reassess after deployment and change
Monitor failure patterns, complaints, overrides and performance measures relevant to the use case. Define reassessment triggers for model changes, new data sources, expanded users or changed downstream decisions. Where provider visibility is limited, document the limitation and choose monitoring and operating constraints accordingly.
AI governance connects findings to approval authority; the existing ISO 42001 service covers the wider management system. Horizon organises risks, controls, owners, evidence and reviews. Accountable people decide treatment and acceptance, not the platform.