<!-- AI risk assessment · from Chapter 31 of The Product 360 Handbook -->

# AI risk assessment · [Feature] · [Date]

**Owner:** [PM]   **Reviewers:** [security, legal, privacy, responsible AI]   **Next review:** [Date]

## System description
- What it does, for whom, and what decisions or actions it influences:
- Our role: provider / deployer
- Jurisdictions and likely risk classification (confirm with counsel):

## Risks
| # | Risk | Category (accuracy, bias, privacy, security, safety, IP, transparency, over-reliance) | Likelihood | Impact | Mitigations | Residual risk | Owner |
|---|---|---|---|---|---|---|---|
| 1 | | | | | | | |

## Controls
- Human oversight design:
- Logging and audit (what is retained, for how long, who can access it):
- Transparency to users:
- Security: prompt injection, data exfiltration, credential scope:
- Monitoring and incident response (link):

## Documentation customers may request
- [ ] System description and intended use
- [ ] Data handling and residency
- [ ] Evaluation results and known limitations
- [ ] Human oversight and controls
- [ ] Incident response process
- [ ] Relevant certifications or framework alignment (for example ISO/IEC 42001, NIST AI RMF)

## Sign-off
| Role | Name | Date | Decision |
|---|---|---|---|
| | | | |