RISK CLASSIFICATION · AI GOVERNANCE
AI risk lies in the use, not the model
A model name does not determine risk. Purpose, role, affected people, decision impact, data flow, autonomy and consequence do.

01 · SYSTEMIs the real process described with data, tools, people and downstream decisions?
02 · CONTEXTAre purpose, role, affected people and actual decision influence supported by evidence?
03 · DUTYWere the AI Act, data protection and sector rules assessed separately and against the correct dates?
CORE METHOD
SYSTEM → CONTEXT → DUTY → CONTROL
Capture the deployed system, classify its context, justify applicable duties and translate them into verifiable controls.
Use the same model in two cases: internal drafting and applicant prioritisation. Compare affected people, decision impact, data, roles, duties and stop criteria.