AI Risk Assessment Checklist: Governance Responsibilities and Comprehensive Review Questions

How to use this list?

This text is the English translation of Chapter 3 of the "Ethical Guidelines for Trustworthy AI" 2019 edition, pages 24–31 in print. It retains all questions from the original trial checklist, intended for contextual reading, and is not presented as a current legal compliance checklist or certification outcome. The previous section Seven Requirements and Implementation Methods Explained the rationale for each set of questions.

The core guidance of Chapter 2 is: meet seven requirements throughout the lifecycle, integrating technical and non-technical approaches; advance research, innovation, public communication, and ethical talent development to support assessment and implementation of requirements; clearly articulate capabilities, limitations, and implementation methods so users understand they are interacting with AI; promote traceability and auditability; enable participation and training for all stakeholders; and continuously identify, assess, document, and communicate trade-offs among principles and requirements.

Chapter 3 provides a non-exhaustive trial version checklist primarily intended for developers and deployers, applicable to systems that are either self-developed or obtained from third parties, especially those that directly interact with users. This checklist does not address the legal aspects of trustworthy AI, and fulfillment of the checklist does not constitute compliance or provide legal compliance advice; use must be adjusted according to specific purposes and operating environments.

The original concept envisioned piloting a checklist and governance structure through public-private partnership. The pilot would proceed in two directions: qualitatively, by selecting a small number of representative organizations from diverse fields, sizes, and sectors for in-depth feedback; quantitatively, by inviting all interested parties to participate in a public consultation. The original plan was to integrate feedback into the revised version early in 2020, first establishing cross-sectoral foundations before further developing sector-specific or application-specific frameworks. This reflects the original historical arrangement.

Integrate assessment into governance

Organizations can integrate assessments into existing governance mechanisms or establish new processes, depending on their structure, scale, and resources. The referenced organizational change research highlights that senior leadership attention is crucial for change, and broad participation helps enhance acceptance and relevance of new processes. Therefore, both day-to-day operations and senior management should be included.

When using it, not only focus on identified issues but also pay attention to questions that cannot or are difficult to answer. One possible reason is a lack of diversity in skills and capabilities among development and testing teams, thus requiring involvement from people both inside and outside the organization.

Record all results using both technical and managerial language to ensure understanding across all levels. Assessment depth should be commensurate with purpose and risk. The checklist does not predefine answers to each issue, but instead encourages reflection on how to implement trustworthy AI and what the next steps should be.

Existing laws may already require certain processes or prohibit certain outcomes, overlapping with the checklist. For example, data protection laws impose obligations regarding the collection and processing of personal data, while internal policies promoting compliance may also support ethical handling. However, meeting the checklist does not equate to meeting legal requirements. When an organization already has non-legal standards or software development processes in place, there is no need to establish a separate, isolated set of procedures; instead, the checklist can be integrated into existing workflows.

I. Human Initiative and Supervision

Basic rights

• Did an impact assessment take place when the system may harm fundamental rights? Were potential trade-offs between different principles and rights identified and documented?
• Does the system interact with human decisions, for example by recommending actions or decisions, or by presenting options? Could it intervene in the end user's decision-making in unforeseen ways, affecting autonomy?
• Have you considered informing users that a decision, piece of content, recommendation or outcome comes from algorithmic decision-making?
• If it is a chatbot or another conversational system, does the user know they are interacting with a non-human agent?

Human initiative

• Has the system entered a work or labor process? If so, has human-AI task delegation been considered to ensure meaningful interaction and appropriate human oversight and control?
• Does it enhance or extend human capabilities? Does it implement measures to prevent humans from over-relying on or becoming overly dependent on systems during work?

Human supervision

• Has an appropriate level of human oversight been considered for specific systems and applications? Can the level of human control or involvement be described?
• Who holds control? At what points and through which tools can human intervention occur? Are there mechanisms and measures to ensure human oversight or control?
• Are measures taken to make autonomous governance auditable and capable of addressing related issues?
• If the system has self-learning or autonomous capabilities, are more specific control and oversight mechanisms in place? What detection and response mechanisms have been established to assess the possibility of errors?
• Are there stop buttons or programs designed to safely halt operations when necessary? Does the program fully terminate, partially terminate, or return control to the operator?

II. Technical Reliability and Security

Defending against attacks and security protection

• Has the system been assessed for potential attacks? Have different types of vulnerabilities (such as data contamination, physical infrastructure, and network attacks) been considered?
• Are there measures or systems that protect integrity and resist potential attacks?
• Are behaviors validated in unexpected situations and environments?
• Has consideration been given to the extent to which the system might have dual-use characteristics? If so, have preventive measures been implemented, including in appropriate cases withholding research publication or deployment of the system?

Backup plan and general safety

• Are there sufficient contingency plans in place when facing adversarial attacks or other unforeseen events, for example, switching to alternative technical procedures, or pausing and requesting manual intervention before proceeding?
• Have specific risk levels been considered based on intended use? Are there established processes for measuring and assessing risks and safety? When bodily integrity is at risk, is essential information provided? Has insurance been considered to address potential damages?
• Does it identify safety risks in foreseeable alternative uses, including accidental or malicious misuse? Is there a mitigation or management plan?
• Has the system been assessed for the possibility of harm to users or third parties, potential damages, affected populations, and the severity of such harm? Have responsibilities and consumer protection regulations been considered?"
• Have environmental and animal impact considerations and safety risks been evaluated? Has the risk analysis included cybersecurity and other safety protection issues that could potentially lead to personal safety risks or damage through unintended behaviors?
• What are the consequences of erroneous results, system unavailability, or outcomes that are socially unacceptable (e.g., discrimination)?
• Are threshold values and governance procedures defined to trigger alternative or backup plans? Has the backup plan been clearly defined and tested?

Accuracy

• Are the definitions and required levels of accuracy determined specifically for a given system and application? Is there an assessment of how accuracy is measured and ensured?
• Are data sufficiently comprehensive and regularly updated? Are there measures to determine if additional data is needed, such as to improve accuracy or eliminate bias?
• Have you evaluated what harm inaccurate predictions could cause?
• Is there a way to measure whether prediction errors have become unacceptable?
• Are there measures established to gradually improve accuracy?

Reliability and reproducibility

• Are there strategies to monitor and test whether the system meets its objectives, purposes, and intended uses?
• What specific scenarios or conditions should be considered when testing for reproduction?
• Are validation methods established to measure and ensure different aspects of reliability and reproducibility?
• Is there a process description that outlines under what conditions the system fails? Are these failure scenarios clearly documented and used for reliability testing and validation?
• Is there a communication mechanism that enables end users to understand the measures ensuring system reliability?

Three. Privacy and Data Governance

Respect for privacy and data protection

• Has a mechanism been established by purpose to allow others to identify privacy or data protection issues during the training, operation, data collection, and processing activities?
• Has the dataset's data type and scope been assessed, for example, does it contain personal data?
• Have you considered not using, or using as little as possible, sensitive and personal data when developing systems or training models?
• Does the personal data notice and control mechanism establish data purposes, for example, obtaining valid consent when applicable and allowing for withdrawal?
• Has privacy been enhanced through measures such as encryption, anonymization, or aggregation?
• Should a data protection officer be involved from the outset?

Data Quality and Integrity

• Does daily data management and governance align with relevant standards, such as ISO, IEEE, or widely adopted protocols?
• Has a supervisory mechanism been established for data collection, storage, processing, and usage?
• Has the quality of external data sources been assessed for the extent of control available?
• Are there processes to ensure quality and integrity? Have other processes been considered? How can data be verified to have not been tampered with or attacked?

Data access

• What protocols, processes, and procedures were adopted to manage and ensure appropriate data governance?
• Has access to user data been evaluated for who can access it and under what conditions?
• Has it been ensured that visitors have the necessary qualifications, genuine need, and the ability to understand the details of data protection policies?
• Are there supervision logs that record who, when, where, how, and for what purpose accessed data?

IV. Transparency

Traceability

• Are traceability measures established to document the design and development methods of algorithmic systems? For rule-based systems, document the programming or modeling approach; for learning systems, document the training methodology, as well as the data inputs collected, selected, and how they were processed.
• Are test and validation methods documented? For rule-based systems, document the context and cases used; for learning models, document the data used for testing and validation.
• Have you recorded the algorithm's outputs and decisions, and considered other possible decisions under different conditions, such as the outcomes for different user subgroups?

Explainability

• Have you assessed the extent to which the AI's decisions and outputs can be understood?
• Does the assessment system influence organizational decisions to any significant extent? Why was this particular system deployed in this domain? What is its business model, for example, how does it create value for organizations?"
• Does the system provide explanations that all users can understand for why a particular choice was made or a specific result occurred?
• Were explainability considerations taken into account from the very beginning of the design? Have we studied and attempted to adopt models that are suitable for this purpose, as simple and interpretable as possible?
• Can we analyze training and testing data, and update them over time?
• Can we check interpretability after training and development, or access the model's internal workflow?

Communication

• Did you inform the end user, through explanation or otherwise, that interaction is occurring with AI rather than a human? Does the system clearly label it as AI?
• Is there a mechanism that explains the rationale and judgment criteria behind the results? Are the explanations clear and understandable, suitable for the target audience?
• Is there a process for receiving feedback and using that feedback to adjust the system? Have potential or perceived risks, such as deviations, been communicated? Has consideration been given to disclosing information to other audiences, third parties, or the public based on purpose?
• Clarify the system's purpose and identify who or what benefits from the product service. Define use cases and communicate them clearly so the intended audience can understand and perceive them as appropriate?
• Whether to consider human psychology and limitations based on purpose, such as confusion, confirmation bias, cognitive fatigue?
• Are the system's characteristics, limitations, and potential flaws clearly communicated? Have developers informed those deploying the system into product services, and have deployers informed the end users or consumers?

Five. Diversity, Non-discrimination, and Fairness

Avoid unfair bias

• Have strategies or procedures been established for input data and algorithm design to prevent or mitigate unfair biases?
• Have the dataset's composition limitations been assessed and acknowledged? Has the diversity and representativeness of data users been considered, and have specific populations or vulnerable use cases been tested?
• Are we researching and utilizing available technical tools to enhance understanding of data, models, and performance?
• Are testing and monitoring procedures for potential deviations established during the development, deployment, and usage phases?
• Has a mechanism been established by purpose to allow others to raise concerns about bias, discrimination, or poor performance? Are the procedures for who and how to raise such concerns clearly communicated? Have indirect affected parties, beyond the final users, been considered?
• Has the decision been assessed under the same conditions, and could it still change? If so, what might be the reasons for such a change? Is there a mechanism to measure or assess the potential impact of such changes on fundamental rights?
• Are appropriate, actionable "fair" definitions adopted in the design? Is this definition commonly used, and were other definitions considered prior to selection?
• Are quantitative analysis or metrics used to measure and test the fairness definition adopted? Is there a mechanism in place to ensure fairness, and have other potential mechanisms been considered?

Accessibility and Universal Design

• Is the system adaptable to a wide range of personal preferences and abilities?
• Have special needs, disability, or exclusion risk individuals been assessed for their ability to use? How can these considerations be integrated into the design, and how can they be validated?
• Can system information also be accessed by users of assistive technologies? Were these groups involved or consulted during development?
• Has the impact on potential audiences been considered? Does the development team represent the target users, as well as broader populations and other groups that may be indirectly affected?
• Have we assessed whether certain individuals or groups might disproportionately bear the negative impacts? Have we sought feedback from teams or groups with different backgrounds or experiences?

Stakeholder engagement

• Is there a mechanism that involves different stakeholders in system development and usage?
• Were affected workers and their representatives consulted and involved in preparing for the introduction of AI before implementation?

VI. Social and Environmental Well-being

Sustainable and environment-friendly

• Is there a mechanism to measure the environmental impact of development, deployment, and usage, such as what energy sources are used in data centers?
• Are measures taken to reduce environmental impacts throughout the entire lifecycle?

Social impact

• When the system interacts directly with people, does it evaluate whether it might encourage people to form attachment and empathy toward the system?
• Is it clearly indicated that social interaction is a simulation, and the system lacks human-like "understanding" and "emotions"? Note: This retains the judgment and phrasing from the 2019 original text, not considering fluent dialogue itself as evidence of mind or emotion.
• Do you fully understand the social impacts, such as the risks of unemployment or degradation of labor skills? What measures have been taken to address these?

Society and Democracy

• Has the broader social impact beyond the individual end-user been assessed, including potentially indirectly affected stakeholders?

Seven、Accountability

Auditable

• Whether mechanisms conducive to auditing are established, such as ensuring processes and outcomes are traceable and logs are maintained?
• When basic rights are involved, including in safety-critical applications, is it ensured that the system can be independently audited?

Minimize and report negative impacts

• Have you conducted a risk or impact assessment that considers different stakeholders affected directly and indirectly?
• Do you provide training and education supporting accountability practices? Which laborers or team functions are involved, and are they beyond the development stage? Are potential applicable legal frameworks discussed?
• Have you considered establishing an ethical AI review committee, or a similar mechanism, to discuss overall accountability, ethical practices and unclear grey areas?
• In addition to internal measures, have external guidance or audits been arranged to oversee ethics and accountability?
• Is there a process that allows suppliers, customers, distributors, sales representatives, and other third parties as well as employees to report potential vulnerabilities, risks, or deviations?

Right to weigh

• Is there a mechanism to identify interests, values, and potential trade-offs involved in the system?
• How do you decide on these trade-offs? Is it ensured that the decisions are recorded?

The ability to obtain relief

• Are there adequate remedies in place when harm or adverse effects occur?
• Have you used mechanisms to explain to end users and third parties how redress can be obtained?

Original closing statement: How should the list be further improved?

The original text invites all stakeholders to pilot the checklist in practice and provide feedback on whether it is actionable, comprehensive, appropriate for specific applications or domains, and how it overlaps or complements existing compliance and evaluation processes. The original plan is to submit a revised version to the committee in early 2020 based on this feedback.

The key guidance in this chapter is: when developing, deploying, and using AI, adopt and tailor checklists to specific use cases; always remember that checklists do not exhaust all possible considerations. Trustworthy AI is not about ticking boxes, but about continuously identifying requirements, evaluating solutions, improving outcomes, and involving stakeholders throughout the entire lifecycle.

Keep reading Application Opportunities, Key Concerns, and Terminology . To contact the business process, you can go back to Trustworthy AI and Ethical Frameworks , compare with the original reflection questions.

Reference and Extended Reading

"Original text: Ethics Guidelines for Trustworthy AI, April 8, 2019, European Union, printed pages 24–31." Original entry for EU Digital Strategy . This page is an unofficial English translation, retaining trial version issues and historical plans, with adjusted sections, groupings, terminology, and layout; the questions are not current certification requirements.

based on EU Reuse Guidelines , the original document uses " CC BY 4.0 This page's translation is provided under the same license and does not imply endorsement by the original organization.

"Editor's addition:" GDPR Official Text For independent inquiry of data protection requirements; NIST AI Risk Management Framework It is another publicly available framework that allows comparison of its governance, context recognition, measurement, and management approaches, and therefore the two lists cannot be considered equivalent based on this alone.