Model 06 · Risk Anatomy of an AI Use Case

Every AI use case arrives as a value story. The risk is often hidden in the details.

A “quick Copilot” may touch confidential data. A “small automation” may trigger an external system. A “simple agent” may act under an identity that nobody has thought about properly. The risk is not in the label. It lives in the data, action, autonomy, identity and process behind the request.

Risk Anatomy gives organisations a repeatable way to score that risk. It uses ten dimensions: five classic risk dimensions and five AI-specific ones. The aim is not to remove judgement, but to stop every decision depending on who happens to be in the room.

The model also separates FIRM and FLEX dimensions. FIRM criteria set the floor and cannot be averaged away. FLEX criteria allow organisational judgement within that floor. That split matters because some risks belong to policy authorities, not workshop debate.

The riskiest dimension sets the tier. That rule is deliberately blunt. It prevents a high-risk failure mode from being diluted by a set of low-risk averages.

The central idea is simple: score it before you govern it.