AI Risk Assessment Template: Score Any AI Tool (Free)

Use this AI risk assessment template before you approve a new AI tool or a new use of an existing one. It takes 20 to 40 minutes, works for any AI tool and lines up with NIST AI RMF and ISO/IEC 42001. Copy it, or download it as a Word document.

Part 1: The use case

Tool name and plan	[e.g. Claude Team]
Requested by	[name, team]
What it will be used for	[one sentence: task and outcome]
Who will use it	[roles, number of users]
Data that will go in	[public / internal / confidential / personal / special category]
Who could be affected by the output	[clients, employees, applicants, the public]
Does the output feed a decision about a person?	[yes / no, which decision]

Part 2: Risk scoring

Score each risk for likelihood (1 rare to 5 almost certain) and impact (1 minor to 5 severe). Risk = likelihood × impact. 15 or more is high, 8 to 14 medium, 7 or less low.

Risk	Likelihood	Impact	Score	Control
Confidential or personal data used to train the vendor's model				Business plan with training off; DPA signed
Data breach at the vendor				SOC 2 / ISO 27001; SSO; least data needed
Wrong or made-up output (hallucination) reaches a client				Human review before sending
Bias or unfair outcome for a person				No automated decisions; bias spot checks
Copyright or IP problem in the output				Check vendor IP terms; review before publishing
Prompt injection or misuse of an AI agent				Limit agent permissions; approval before actions
Breach of law or client contract				Check contracts; client disclosure
Vendor changes terms or shuts down				Export data regularly; alternative identified

Part 3: Vendor checks

☐ SafeScore checked on KurateAI: [score, date]
☐ Vendor questionnaire sent and answered (template)
☐ Privacy policy and terms read for the plan we will use
☐ DPA signed (if personal data)

Part 4: Decision

Overall risk	[low / medium / high]
Decision	[approve / approve with conditions / reject]
Conditions	[e.g. no client names; review all outputs]
Approved by and date	[name, date]
Review date	[3 to 12 months]

Record the result in your AI risk register.