AI workflow risk assessment template for a UK small business

Name the operational task, intended user, input category, output and decision that follows. ‘Use AI for customer service’ is too broad; ‘prepare a draft category for non-sensitive website enquiries before a person reads them’ can be examined. Record why assistance is being considered and whether a template, search rule or ordinary software could meet the need with less uncertainty. Assessment belongs to the specific purpose and configuration, not the product name alone. A provider can support both low-consequence drafting and unsuitable high-consequence decisions, so each use needs its own boundary and owner.

Consider how an incorrect, invented, biased, incomplete or disclosed output could affect a customer, worker, supplier or the business. Distinguish a disposable internal draft from an output that changes eligibility, price, employment, health, safety, rights or access to a service. Identify who could notice each error and whether correction is realistic before harm occurs. High consequence, weak detectability or difficult reversal argues for manual handling or specialist review. Avoid converting ethical and operational questions into a comforting average score; preserve the individual red flags and the reason each matters.

Use non-sensitive, representative material created for testing where possible. Specify success measures based on accuracy, reviewer effort, error types and operational fit rather than assumed savings. State a small volume, duration, authorised users, access settings and deletion plan. Stop immediately for prohibited information, repeated material errors, unexplained output, security concerns or reviewer overload. Record incidents and changes to provider terms or models. A completed template supports a manual, assist, bounded-pilot or stop decision; it is not legal advice, a data protection impact assessment determination or a security certification.