AI risk assessment services score the harm an AI system can do to people and to the firm, then record the control and the owner. Model accuracy is one input. It is not the whole assessment. The method below follows ISO/IEC 42001 and the guidance in ISO/IEC 23894:2023, which is not itself a certificate.

What AI risk assessment services cover

Commission AI risk assessment services when the sheet has systems and no scores, or scores and no owners. The guidance covers AI risk management in practice. It is not a certification, and a certification body will not hand you a logo for it. ISO/IEC 42001:2023 is the management system you can certify, the AIMS. The guidance tells you how to think about harm. The standard tells you to run that thinking inside clauses 4 to 10, with Annex A controls you have judged applicable.

ISO 23894 is guidance for managing risk from AI. Use ISO 23894 to structure the conversation about harm, likelihood and the control you already run. ISO 23894 does not replace conformity with the management system. A buyer who says they follow ISO 23894 still needs an owner and a record if they want an AIMS an auditor can sample. Map your method to ISO 23894, then keep the evidence where the management system can find it. ISO 23894 will not appear as a logo beside an accredited certificate. Check NABCB or the IAF directory for the body’s scope if what you want is certification. That scope will name the management system, not the guidance.

AI risk assessment services start from intended use. A chatbot that drafts internal mail is not the same system as a chatbot that refuses a refund. Good AI risk assessment services interview the owner and look at a sample of outputs. AI risk assessment services should separate harm to a person from harm to the firm, such as a fine, a lost contract or a public error. Model accuracy can sit in the notes. AI risk assessment services that stop at accuracy have not finished.

A security risk assessment asks about confidentiality, integrity and availability. AI risk assessment services ask what the system does to a person when it works as designed. A model can be locked down and still unfair. A model can be accurate on a test set and still unsafe for the person in front of it. ISO 27001 remains the right home for security. It is the wrong place to stop.

Bring the last incident, the last override and the last complaint into AI risk assessment services. Those three tell you more than a heatmap. Scope AI risk assessment services to the inventory. A system with no owner goes on a punch list before it goes into a polished report. A spreadsheet named Final_v7 with a blank owner cell is the usual starting picture.

Where AI risk assessment services sit inside ISO 42001

AI risk assessment services produce rows you can defend, not a color that looks severe and means nothing. Update the work. AI risk assessment services that deliver a PDF and never return will be stale after the next release. You can run AI risk assessment services with internal staff if they did not build every control they are scoring. External AI risk assessment services help when the team is too close to the model to name the harm.

Tie AI risk assessment services to Annex A controls you will actually operate, and record the link in the Statement of Applicability. There are 38 controls, A.2 to A.10. A control you mark applicable needs a record. A control you exclude needs a reason. An AI impact assessment asks who is affected. AI risk assessment services ask how likely that harm is and what you already do about it. ISO/IEC 42005 is the guidance for the impact side. Use both when a system hires, scores, suggests a clinical step, or recommends a claim. The impact blog linked below is the longer note on that split.

An AI risk management framework without an inventory is a poster. Build the AI risk management framework on intended use, harm, likelihood and the control you already run. The AI risk management framework has to include systems you bought, and models a vendor trained for you. Security can feed the AI risk management framework. It does not finish it. Review the AI risk management framework when the model, the data or the user group changes.

A board can read an AI risk management framework if each open row has an owner and a date. Keep the AI risk management framework in the same place as the Statement of Applicability so controls and risks point at each other. If a vendor sends a model update, the AI risk management framework says who decides whether the previous assessment still holds.

Open an AI risk register before you buy a tool to hold it. Each row of the AI risk register names the system and the intended use. Harm to people and harm to the firm are separate columns on the AI risk register. Likelihood on the AI risk register is a reasoned label, not a false decimal. The existing control on the AI risk register must be something you can show, such as a human check or a blocked use. The owner on the AI risk register is a person, not a department mailbox. The review date on the AI risk register is the date you will look again, and someone has to attend. Copy the AI risk register columns into the sheet you already use. A second unused sheet will drift.

AI risk assessment services register scoring harm to people, not only model accuracy
System Intended use Harm to people Harm to the firm Likelihood Existing control Owner Review date
Support bot, illustration only Suggest a refund, a person approves Wrong refusal, a customer left without a reason Complaint, a chargeback, a public post Possible on ambiguous tickets Human approval above a threshold, weekly sample Named product owner A date in the next quarter

The row above is a shape you can copy. It is not a client story. Change every cell to a system you run. If you cannot name the owner, you are not ready to score likelihood.

Stage 1 will read this register as documentation. Stage 2 will ask for the weekly sample behind the “human approval” cell. A surveillance audit will ask whether the review date was kept. That is the difference between a poster and a system. The DPDP Act sits beside the harm-to-people column where personal data is in the prompt, the retrieval store or the training set. As of 31 October 2026 the full DPDP rulebook is not in force. Rules on definitions and the Data Protection Board are. Notice, security, breach intimation, rights and the main fiduciary duties start on 13 May 2027. Significant Data Fiduciaries will need to check that algorithmic software does not put Data Principal rights at risk. Put that check on the same review date.

Where a contract cites the EU AI Act, say so on the row. Prohibited practices and general-purpose obligations are already in force, and most Annex III high-risk duties have applied since 2 August 2026. The register does not create a presumption of conformity. It shows the buyer you know which system they are asking about. Seven Step Consulting does not issue ISO certificates. When you are ready for that step, the certification body is a separate engagement, with a scope you verify.

A register you can defend on one page

The columns do not need a new platform on day one. They need an owner who will open them after the next release. If the firm already has a security risk register, add the people-harm column rather than hiding AI rows in a language security staff do not use. Likelihood can be low, possible or likely, with one sentence on why. A score to two decimal places, copied from a template, will not survive a question.

Staff time is the cost teams forget. Someone has to interview the owner, read a sample of outputs and argue about the control. Market ranges for consulting in India in 2026, which are not a Seven Step rate card, often sit near ₹4 lakh to ₹8 lakh for a single-product firm and higher when several systems are in scope. A gap review alone is often quoted around ₹1.5 lakh to ₹4 lakh. Use those bands to plan. Ask what is inside the quote: interviews, the register, or only a workshop.

If the owner column is empty

Commission an AI risk assessment if the register is a color grid and the owner column is empty. We will work from the systems you already run. Start here: https://www.sevenstepconsulting.com/contact-us/

If you want the register filled from live systems

Commission an AI risk assessment when you want AI risk assessment services that leave you a register, an owner and a review date. We will score harm to people and harm to the firm, and we will say which rows are not ready to show a buyer or a Stage 2 team.