THE CORE AIM OF VOCABULARY MASTERY · AI RISK ASSESSMENT · CONTEXT → HAZARD → EXPOSURE → CONTROL → REVIEW
Did you know the same AI system can be reasonably useful in one setting and unacceptable in another? AI risk assessment vocabulary helps us explain why. Terms such as hazard, risk, likelihood, impact, exposure, risk register, mitigation, residual risk and risk owner describe how teams examine what might go wrong before deciding whether, where and how to use artificial intelligence.
The core aim of vocabulary mastery for AI risk assessment is to turn broad concerns into a traceable decision: identify the intended use, name the hazard, estimate possible harm, evaluate controls, assign responsibility and decide what evidence is needed before and after deployment. The question is not just whether an AI system works. It is whether it works sufficiently well, for the right people, under appropriate safeguards.
This guide sits inside the eduKateSG Vocabulary Hub. The related AI Safety Vocabulary explains safety concepts; AI Governance Vocabulary addresses organisational responsibilities; and AI Human Oversight Vocabulary clarifies who can intervene.
Central proposition: AI risk assessment is meaningful when it connects a concrete use case to foreseeable harm, evidence, accountable controls and an explicit decision.
The 60-second AI risk assessment router
- Context: intended use, stakeholders, deployment environment, decision authority.
- Hazard: failure mode, misuse scenario, exposure path.
- Risk: likelihood, severity, impact, uncertainty.
- Control: preventive safeguard, detection, human approval, fallback.
- Decision: accept, reduce, avoid, transfer where appropriate, or delay.
- Follow-through: owner, residual risk, monitoring, reassessment.
The AI risk assessment vocabulary architecture
| Term | Meaning | Practical question |
|---|---|---|
| Intended use | The specific job and conditions for which AI is proposed. | What decision does it support? |
| Hazard | A circumstance or source with potential to cause harm. | What could go wrong? |
| Exposure | How people, assets or environments could encounter the hazard. | Who or what could be affected? |
| Likelihood | How plausible a harmful event is under stated conditions. | How often or under which circumstances? |
| Severity | The seriousness of a plausible harmful outcome. | How damaging could it be? |
| Control | A technical, procedural or human safeguard. | What reduces the chance or consequence? |
| Residual risk | Risk remaining after controls are considered. | What is still unresolved? |
| Risk owner | The person or function accountable for risk treatment. | Who can make and review decisions? |
| Risk register | A structured record of scenarios, assessments, controls and decisions. | Where is the reasoning documented? |
Hazard, vulnerability and risk are different
A hazard is a potential source of harm. A vulnerability is a weakness that may permit a failure or misuse to occur. Risk concerns the possibility and consequences of harm in context. For example, an educational chatbot can make an unsupported statement. That is a failure mode. If parents use the statement to make a consequential school decision, the exposure and potential impact are different from a low-stakes classroom brainstorming exercise.
There is no universal numeric risk formula that captures every AI situation. Some organisations use likelihood-impact matrices; others incorporate uncertainty, systemic harms, duration, reversibility or affected populations. Vocabulary mastery means understanding what the chosen assessment actually measures rather than treating a colour-coded score as the whole truth.
Worked example: a tuition diagnostic assistant
Imagine a learning assistant that reads practice answers and suggests which mathematics topics a pupil should revisit. This could be genuinely helpful: a teacher may receive a clearer picture of recurring misunderstandings. But there are plausible risks. The system could confuse a transcription error with a misconception, overstate certainty, miss contextual information or expose sensitive pupil records.
A sensible assessment defines the assistant as a recommendation tool, not an autonomous decision-maker. It maps affected people, the categories of input data, error types and downstream decisions. It then considers safeguards such as minimising stored data, testing different question formats, allowing teacher review, and clearly labelling uncertain findings.
A miniature risk register
| Scenario | Potential effect | Possible control | Review evidence |
|---|---|---|---|
| Incorrect topic diagnosis | Wasted revision or overlooked learning gap | Teacher confirmation and explanation trace | Comparison with marked student work |
| Sensitive data disclosure | Loss of privacy | Access control, minimisation, retention policy | Permission tests and access review |
| Uneven performance by level | Some learners receive weaker recommendations | Subgroup and item-type evaluation | Error analysis across topic and level |
| Overreliance on suggestions | Judgement replaced by a score | Clear review workflow and override | Teacher decisions and exception logs |
Notice what this register does not say: it does not claim that all risks have been eliminated. Instead, it makes the relationship between scenario, effect, safeguard and evidence intelligible.
Inherent risk versus residual risk
Inherent risk is an assessment before particular mitigating controls are accounted for. Residual risk is what remains after they are considered. A safeguard may reduce one dimension without removing another: a review step might catch incorrect advice but does not automatically prevent unauthorised access to stored records.
Residual risk also changes. A model updated with new data, a newly connected tool, a more sensitive user group or a change in workload can alter the original assessment. This is why risk management belongs throughout an AI system’s lifecycle.
Risk acceptance is a decision, not a model score
An AI project can meet a selected technical benchmark yet remain unsuitable for a particular use. Conversely, a limited but useful tool may be appropriate when decisions are reversible, users understand its boundaries and capable humans retain control. Risk acceptance refers to an authorised decision that remaining risk is tolerable for the purpose—not a declaration that no harm is possible.
Mapping AI risk to the NIST framework
The NIST AI Risk Management Framework organises relevant work into four functions: Govern, Map, Measure and Manage. These functions are iterative and context-sensitive, not a simple one-time sequence or a universal certification. Governance establishes responsibilities; mapping frames context and possible harms; measurement examines evidence; and management prioritises and responds to identified risks.
How to learn AI risk assessment vocabulary
- Write the exact use case and the consequential decision it may influence.
- List affected people and the information flowing through the system.
- Describe three plausible hazard scenarios without assuming they have already occurred.
- For each, distinguish exposure, consequence and available evidence.
- Name preventive and detective controls; identify who owns them.
- Record residual uncertainty and conditions for re-evaluation.
- Explain the decision in plain language a parent, student or nontechnical colleague could follow.
Common mistakes and how to repair them
- Risk equals error rate: a metric may help, but consequence and exposure also matter.
- Every AI problem has one owner: clarify responsibility for data, model, application and real-world decision.
- The highest benchmark wins: evaluate intended use, harms and operating conditions.
- A safeguard equals zero risk: document residual risk and control limitations.
- Assessment happens once: reconsider material changes and operational evidence.
- Compliance equals fitness: procedural conformity cannot replace meaningful use-case evaluation.
Frequently asked questions
What is AI risk assessment?
It is a structured examination of possible harms, their context, likelihood or plausibility, consequences, available controls and the decisions needed to manage them.
What is a risk register?
It is a record that connects risk scenarios to evidence, assessed impact, controls, ownership and follow-up.
What is residual risk?
It is the risk remaining after relevant safeguards or treatments have been applied or considered.
Does passing an AI benchmark mean the system is low risk?
Not necessarily. A benchmark may omit real-world conditions, affected populations, security, privacy or high-consequence errors.
Who should approve an AI risk assessment?
That depends on the organisation and application. The approving person or function should have appropriate authority and access to relevant technical and contextual evidence.
Where this article fits in eduKateSG
- Vocabulary Hub
- AI Safety Vocabulary
- AI Governance Vocabulary
- AI Human Oversight Vocabulary
- AI Model Bias Vocabulary
The AI risk assessment vocabulary standard
Mastery means being able to describe what the system is for, how a harm could occur, how serious it may be, who could be affected, what controls exist and what evidence would justify proceeding, changing course or declining deployment. It is the language of careful decisions—not fear or hype.