Menu
Understand · Apply · Assure
Applicability & Risk Assessment
Define the use, identify potentially relevant regulatory context, assess risk and connect demonstrated controls to evidence and reassessment.
Jurisdiction coverage includes the EU, US, UK and India. Determination depth varies by jurisdiction and subject. Where bounded authoritative rules are insufficient, the assessment returns Further determination required.
Regulatory classification and RegulatedAI.in High, Medium and Low risk ratings are separate. The assessment guides you through Context, Applicability, Risk, Controls and Result. Other sector, jurisdiction, privacy, data protection, cybersecurity, product, safety and domain requirements may also apply.
Context
Establish the specific AI use, intended purpose and operating context against which applicability and risk will be assessed.
Assess one defined AI use. Unrelated purposes need separate assessments. Use non-sensitive descriptions and evidence references. This assessment is not saved. Refreshing, closing this tab or leaving this page can clear answers and evidence references. Keep your own record before leaving. Another tab starts a separate assessment.
Question 1
What specific task will the AI support, and what should it never do?
Why this fact matters
Defines the particular AI use and its boundaries so that applicability and risk are assessed against a clear purpose.
Question 2
What does the AI support?
Why this fact matters
The activity supported by the AI determines which sector-specific considerations need review. Distinct uses may need separate assessments.
Question 3
Where will it be supplied or used, and where will its outputs be used?
Why this fact matters
Supply, use and output locations help identify potentially relevant jurisdictions. A supplier's location alone does not settle applicability.
Question 4
What will your organisation do with the system or model?
Why this fact matters
Your organisation's actual activities help establish its responsibilities. Developing, supplying, using or changing a system can involve different obligations.
Question 5
Who could be affected by its outputs or actions?
Why this fact matters
Identifies whose safety, rights or interests could be affected, including people who do not directly use the AI.
Question 6
How is it used today or planned to be used?
Why this fact matters
Distinguishes planned, test and operational use because real-world exposure and required safeguards can differ.
Question 7
Does it infer outputs from inputs, and can its operation adapt after deployment?
Why this fact matters
Helps distinguish AI functions from conventional processing. Supplier descriptions alone do not establish the system's regulatory treatment.
Question 8
What technology and connections does it use?
Why this fact matters
Identifies technology, connected tools and model dependencies that may affect controls, limitations and change management.
Question 9
When was it first supplied/put into use, and when is the proposed use or change planned?
Why this fact matters
Supply and use dates help determine when requirements apply and whether transition arrangements need review.
Question 10
What outputs does the machine-based system generate to pursue its stated or inferred objectives, and can it operate without a person specifying each output?
Why this fact matters
The outputs, independence of operation and effects on people or environments help establish the nature of the assessed function. Adaptation after deployment is not essential for every AI system.
Provide the required factual responses in this stage to continue. Choose Unknown explicitly where a selectable fact cannot be established. Evidence gaps and unknown facts remain unresolved in the assessment outcome.