Checklist

AI Ethics & Risk Assessment Matrix for Assistants and Automation

A practical, reusable matrix-style checklist teams can use to evaluate privacy, bias, explainability, data minimization, security, human oversight, vendor risk, and operational safety before advancing an assistant or automation from pilot to production. Includes concrete evidence examples, rating guidance, sample mitigations, and suggested production thresholds.

How to use this matrix

This checklist helps teams assess ethical, privacy, safety, and operational risks for assistants and automation that will operate on or produce organizational knowledge. For each risk domain, answer the key questions, attach or link required evidence, assign a risk rating, and record mitigation actions, an owner, and review cadence. Use the sample thresholds to decide whether the system remains in pilot, requires remediation, or may be promoted to production.

Instructions

Work through each risk domain row with stakeholders (product owner, data owner, security, legal/compliance, UX, and a qualified subject matter expert).
Document evidence (logs, tests, datasets, design docs, access controls) and set a provisional risk rating: Low / Medium / High.
Define mitigation actions with clear owners and deadlines. Track follow-up during the review cadence.
Apply the promotion thresholds (Pilot -> Production) below before releasing to broad or sensitive audiences.

Risk Matrix

Risk Domain	Key Questions to Check	Evidence Required (examples)	Risk Rating Guidance	Suggested Mitigations / Controls	Owner (role examples)	Review Cadence
Privacy & Data Minimization	Does the system access, store, or transmit personal or sensitive data? Is data collection minimized to what is necessary? Are retention and deletion policies defined and implemented?	Data flow diagram Dataset inventory and sample records Retention policy, encryption proof, access logs	Low: no personal/sensitive data or robust pseudonymization; Medium: limited personal data with controls; High: broad access to sensitive data or weak controls.	Apply anonymization/pseudonymization, minimize fields Role-based access, encryption in transit & at rest Data retention & secure deletion procedures	Data Owner, Privacy Officer	Quarterly (or more often for high-risk data)
Security	Are authentication, authorization, and logging implemented? Are third-party integrations vetted for secure practices?	Pen test / vulnerability scan reports Access control lists, audit logs	Low: hardened environment, up-to-date patches, clear auth. Medium: some gaps with compensating controls. High: exposed endpoints, missing logs, or known vulnerabilities.	Fix critical vulnerabilities before production Enable centralized logging, alerting, and least-privilege access Secrets management and regular security reviews	Security Lead, DevOps	Monthly for production; pre-release security review
Bias & Fairness	Has the model been tested for disparate impact across user groups? Are training data and labels representative?	Bias testing reports, confusion matrices, subgroup performance Dataset provenance and labeling guidelines	Low: consistent performance across groups and audited datasets. Medium: identified disparities with mitigation plan. High: serious disparate outcomes or unrepresentative data.	Rebalance datasets, introduce fairness constraints or post-processing Human review for high-impact decisions	ML Lead, Data Scientist, Ethics Reviewer	Semi-annually or when model/data changes
Explainability & Transparency	Can clinicians, agents, or users understand how outcomes are generated? Are explanations appropriate for the audience and use case?	Model cards, decision flow diagrams, explanation examples User-facing documentation and fail-safe behaviors	Low: clear, testable explanations exist; Medium: explanations limited or technical; High: opaque outputs used for high-impact decisions.	Provide model cards and example rationales Limit automation in opaque scenarios; require human-in-loop	Product Owner, UX, ML Lead	At each major release; user feedback cycle
Safety & Reliability	What are failure modes and their impacts? Are fallback procedures and limits defined?	Failure mode analysis, uptime/SLA metrics, test logs Chaos or resilience test results	Low: safe, predictable behavior with robust fallbacks. Medium: occasional unpredictable outputs with monitoring. High: potential for physical harm, legal exposure, or major service disruption.	Define safe default behaviors and rate limits Implement monitoring, automated rollback, and canary deployments	Operations, Reliability Engineer	Continuous monitoring; weekly reviews initially
Human Oversight & Role Clarity	Who makes final decisions? When is human review mandatory? Are roles and responsibilities documented and trained?	Decision ownership doc, training logs, escalation playbooks	Low: clear human-in-loop for sensitive decisions. Medium: ambiguous handoffs. High: automation makes high-impact decisions without human control.	Define human checkpoints and approval flows Train reviewers and maintain audit trails	Process Owner, Compliance	Bi-annual or when workflows change
Vendor & Third-Party Risk	Are third-party models/services documented and contractually governed? Do vendors expose data to external parties?	Vendor risk assessments, contracts, SOC reports	Low: vetted vendor with contractual protections. Medium: partial controls. High: opaque vendor with unlimited data access or lacking guarantees.	Contractual clauses for data use, audits, and incident response Fallback plans if vendor changes terms or access	Vendor Manager, Legal	Annual or at contract renewal
Monitoring, Logging & Incident Response	Are logs sufficient to investigate issues and audits? Is there an incident response plan for model failures or data leaks?	Log retention policy, alerting rules, incident runbooks	Low: comprehensive logs and tested IR plan. Medium: logs exist but gaps in retention or testing. High: no adequate logging or untested response.	Centralized logging, regular playbook drills, SLAs for response	Site Reliability, Security Ops	Continuous; tabletop exercises bi-annually
Compliance & Legal	Are legal/regulatory obligations identified (GDPR, HIPAA, sector rules)? Are data transfers and consent handled properly?	Legal sign-off, DPIA (if required), contracts, consent records	Low: documented compliance with legal review. Medium: open questions needing counsel. High: non-compliant design or prohibited data uses.	Obtain legal review and complete any required impact assessments Implement consent, data subject rights handling	Legal, Compliance	As required by regulation and before production

Risk Rating and Promotion Thresholds (Suggested)

Immediate block to production: Any High rating in Privacy, Security, Safety, or Compliance until remediated and evidence provided.
Production eligible (after remediation): No High ratings in critical domains and no more than two Medium ratings overall; all Medium items must have documented mitigation plans with owners and timelines.
Pilot allowed: Systems with Medium ratings may remain in pilot if use is limited, monitored, and covered by explicit safeguards (e.g., limited user group, human-in-loop).

Sample Mitigation Patterns

Privacy gap: remove or mask PII fields, add pseudonymization, shorten retention to minimal period.
Bias issues: collect representative samples, retrain or rebalance, introduce human review for affected cohorts.
Security shortfall: apply patching, rotate credentials, enforce network segmentation.
Explainability gap: add model card, produce user-facing rationales, limit automation scope.

Recordkeeping & Audit Trail

Keep the completed matrix, evidence files, and remediation logs in a versioned repository or governance platform. Maintain an audit trail of sign-offs (product, security, privacy, legal) and dates for compliance and future reviews.

Notes & Warnings

This checklist is a practical governance aid, not a substitute for legal, regulatory, or domain-specific professional advice. Some settings (healthcare, finance, critical infrastructure) require bespoke controls. Avoid treating governance as a one-time checkbox: review controls after model updates, major data changes, or usage growth.

Quick Checklist (one-line pass/fail for meetings)

Privacy: [ ] Evidence and minimization in place
Security: [ ] Vulnerabilities resolved and logging enabled
Bias: [ ] Subgroup tests show acceptable parity or mitigation plan exists
Explainability: [ ] Model card and user explanations available
Human Oversight: [ ] Clear decision ownership and escalation
Vendor Risk: [ ] Contractual protections and SOC reports available
Monitoring: [ ] Alerts and incident playbook in place
Compliance: [ ] Legal sign-off or open legal actions tracked

Image hint: consider an icon set that maps to each risk domain (privacy lock, shield, scale, eye, gear) for quick visual scanning.

Discuss Ask the Librarian

Discussion

Comments and conversation will live here.