AI Risk Assessment
Identify material AI risks, define proportionate controls and make a defensible deployment decision.
What Is an AI Risk Assessment?
An AI risk assessment is a structured evaluation of a specific AI system, use case, vendor or proposed implementation to identify material risks and decide whether existing controls are sufficient.
Artificial intelligence can create business value while introducing risks that traditional technology assessments may not fully address. A model may produce convincing but incorrect output, expose sensitive information, influence a material decision or move from recommending an action to taking one.
Namandla helps South African organisations assess the business, data, privacy, security, vendor, operational and human-oversight risks surrounding proposed and existing AI use cases.
Likelihood
How plausible is the risk in this use case, operating environment and control context?
Impact
How serious would the consequence be for people, information, finances, customers or operations?
Control
What preventive, detective or corrective measures reduce the likelihood or impact?
AI risk should be proportionate to the consequence of failure, not simply the sophistication of the technology.
Turn Risk Findings into a Deployment Decision
The objective is not to eliminate every risk. It is to determine what could go wrong, how serious it would be, what controls are required and whether the use case should proceed.
Proceed
Approve the use case as designed, or proceed with clearly defined controls and ownership.
Pilot or Remediate
Test under controlled conditions, restrict scope, strengthen controls or redesign weak areas.
Escalate or Stop
Request specialist review or do not proceed when residual risk remains unacceptable.
The Namandla AI Risk Model
A consistent model makes it easier to compare risks across different tools, vendors and business use cases.
1. Business & Decision Risk
Purpose, process criticality, financial and customer impact, reversibility and accountability.
2. Data & Privacy Risk
Personal, employee, customer, financial and confidential information, retention, access and processing.
3. Information Security Risk
Identity, permissions, integrations, data leakage, credentials, logging and privileged access.
4. Reliability & Output Risk
Accuracy, validation, factual reliability, consistency, hallucination, explainability and consequence.
5. Human Oversight Risk
Review capability, user understanding, challenge, override, approval thresholds and automation bias.
6. Vendor & Third-Party Risk
Providers, APIs, subprocessors, retention, contracts, service changes, dependency and exit.
7. Operational & Agentic Risk
Actions, access, limits, approvals, exceptions, rollback, audit trails and suspension.
8. Legal & Reputational Risk
Privacy, sector obligations, employment, consumer impact, contracts and reputational consequence.
Classify AI Risk by Consequence
Low
Limited consequence if the AI is wrong. Use approved tools, information rules and employee guidance.
Moderate
Meaningful but controllable impact. Assign an owner, approved data, validation and monitoring.
High
Sensitive data, material decisions, customers, Finance or critical systems require formal review and explicit human oversight.
Critical
Risk cannot currently be reduced to an acceptable level. Stop until the design, technology or control environment changes.
The Namandla AI Risk Review
A focused review evaluates one proposed or existing AI application and produces an actionable executive recommendation.
Applicable Use Cases
Generative AI, enterprise applications, AI-enabled SaaS, vendors, assistants, agents, Copilot, Oracle AI and internal pilots.
Assessment Scope
Use-case definition, information, vendors, human oversight, agent authority, existing controls and residual risk.
Decision Output
Control gaps, remediation priorities, risk ownership, conditions for approval and an executive recommendation.
How the AI Risk Assessment Works
Control Data, Reliability and Human-Judgement Risk
Data & Privacy
Understand what users provide, what the AI retrieves, what the vendor receives, retention, secondary use, output visibility and whether personal or confidential information is involved.
Generative AI Reliability
Use approved knowledge sources, source verification, independent validation, expert sign-off, restricted use and traceability where incorrect output could cause harm.
Automation Bias
Ensure reviewers have sufficient knowledge, authority, evidence, time and the ability to challenge or stop an AI-supported process.
Explore corporate AI trainingAssess Risk in the Technology You Are Actually Using
AI Agents
Review identity, system and data access, tool use, authority, limits, approvals, auditability and stop mechanisms.
Explore AI agent consultingAI Vendors
Review processing, retention, model improvement, subprocessors, security, incidents, dependency and exit.
Explore AI vendor assessmentMicrosoft 365 Copilot
Assess permissions, oversharing, SharePoint, OneDrive, Teams, sensitive information and acceptable use.
Explore Copilot consultingOracle AI
Assess business processes, Oracle data, permissions, decision influence, agent authority, auditability and human approval.
Explore Oracle AI consultingAI for Finance
Protect accuracy, access, judgement, control, traceability and material financial consequences.
Explore AI for FinanceAI Risk Assessment vs AI Governance
Risk assessment
Asks what risks exist in a specific use case, vendor, agent or implementation and whether it can proceed safely.
AI Governance
Asks how the organisation should consistently control AI across its portfolio, policies and operating model.
Explore AI governance consultingA single risk review can reveal the need for broader governance improvements.
Use Recognised Principles and Escalate Specialist Work
Recognised Risk Principles
Where useful, the review can draw on the NIST AI Risk Management Framework, ISO/IEC 42001, ISO/IEC 23894 and EU AI Act risk-based principles where applicable.
Specialist Assurance
The service does not replace legal opinion, penetration testing, source-code review, model red-teaming, specialist bias testing, statutory audit or certification.
When specialist assurance is necessary, the assessment identifies the gap and recommends the appropriate escalation. A Namandla risk review is business and governance advisory, not a legal compliance audit, regulatory opinion or certification engagement.
What You Receive from an AI Risk Assessment
Risk Profile
- Use-case risk profile
- Risk register
- Risk classification
Control Findings
- Data and privacy assessment
- Vendor findings
- Control-gap analysis
Oversight Requirements
- Human-oversight requirements
- Agent-authority matrix
- Risk ownership
Decision Package
- Remediation plan
- Residual-risk view
- Executive recommendation
Who Should Request an AI Risk Review?
The service is designed for organisations preparing to buy, pilot, deploy or scale an AI-enabled process where the consequences require a documented decision.
Executive and Risk Leaders
Understand material exposure, required ownership and the conditions under which a use case should proceed.
Technology and Security Teams
Clarify information, integration, access, vendor, operational and agent-control requirements.
Business and Finance Teams
Protect decision quality, traceability and human judgement while pursuing measurable AI value.
Why Namandla: our approach connects risk to readiness, governance, enterprise technology, Finance, Oracle, Microsoft, adoption and value, helping the organisation say “Yes, under these conditions.”
AI Risk Assessment FAQs
What is an AI risk assessment?
A structured evaluation of business, data, privacy, security, reliability, vendor, operational and human risks associated with an AI system or use case.
When should we perform one?
Ideally before production, and potentially before pilots, purchasing a platform, enabling sensitive data access, giving an agent system access or scaling an existing pilot.
What generative AI risks should be assessed?
Information exposure, privacy, security, incorrect output, hallucinations, employee misuse, IP, vendor dependency, human over-reliance and reputation.
What is hallucination risk?
The risk of AI producing inaccurate or unsupported information that appears plausible.
Can AI output be trusted?
Only to the level justified by the specific system, task, controls and consequence of error.
How do we assess AI privacy risk?
Understand what personal information is processed, why, where, by whom, for how long and under what controls.
How do we assess AI security risk?
Consider identity, permissions, integrations, external services, logging, system access and privileged actions. Specialist technical testing may still be required.
How do we assess vendor risk?
Review data processing, security, retention, subprocessors, contract commitments, continuity, dependency and exit.
What is human oversight?
Meaningful ability by an appropriately qualified person to review, challenge, approve, override or stop an AI-supported activity.
What is automation bias?
Excessive human trust in automated recommendations or outputs.
How do we classify risk?
Use information sensitivity, decision significance, financial consequence, customer impact, autonomy, reversibility, operational dependency, regulation and human oversight.
How should agents be assessed?
Focus particularly on systems, data, tools, actions, approvals, limits, logging, reversibility and suspension.
Should an AI agent have its own identity?
Clear identity and traceability can become important where agents interact with enterprise systems. Technical implementation should be determined with security/platform specialists.
Can Copilot create data risk?
It can surface information users are already permitted to access, making underlying oversharing or permission weaknesses more visible.
Can AI be safely used in Finance?
Yes, where controls around accuracy, source validation, access, approvals, traceability and human judgement are appropriate.
Does every use case need a formal assessment?
Not at the same level. Proportionate governance should determine which use cases need basic controls, documented review, specialist assessment or executive approval.
What is residual risk?
The risk remaining after controls have been applied.
Who should accept AI risk?
An identified business owner with appropriate involvement from functions such as IT, security, risk, data, Finance, compliance or executive leadership depending on the use case.
What if serious risk is identified?
The use case may be redesigned, restricted, remediated, subjected to specialist review or stopped.
Is a risk assessment the same as governance assessment?
No. Risk assessment focuses on a specific use case or system; governance assessment looks at enterprise-wide control capability.
Is it a legal compliance audit?
No. It is business and governance advisory and does not replace formal legal advice or certification.