Versatile AI Risk Assessment

Ten perspectives on the same catalogue

Each analysis has its own page and answers its own question. The preview shows what awaits you there.

Understanding threats

What defines a threat, when it arises and how it differs from another.

  1. Preview of the analysis: Threat pathway Threat pathway How does harm arise? A threat is not a state but a pathway. The analysis walks through the four sections of the catalogue and shows the five effect classes at which mitigations take hold. Where the catalogue lists no mitigation, a visible gap remains. For anyone working through a threat in depth for the first time
  2. Preview of the analysis: Lifecycle Lifecycle When does which risk arise? 45 of the 52 threats arise in production, yet the mitigations take hold much earlier. The lanes show both side by side and make visible when a decision is still possible. For governance, procurement and programme management
  3. Preview of the analysis: Threat comparison Threat comparison Where does the line between two run? Similar sounding threats are easily conflated in day‑to‑day work, and then one mitigation appears to cover both. The analysis separates shared from exclusive references and makes visible what really is the same. For anyone drafting policies, training material or audit plans

Placing your own system

Which part of the catalogue applies to a concrete system boundary and what changes on a rebuild.

  1. Preview of the analysis: System context System context Which threats affect my system? Six system types, seven architectural characteristics, a grid of 52 threats that reorders itself with every answer. A single characteristic can put an otherwise atypical threat back up for review. For architecture, product ownership and anyone assessing a concrete system
  2. Preview of the analysis: Architecture change Architecture change What does a rebuild trigger? A language model integration becomes an agent, an internal assistant becomes a public one. The analysis shows in advance which threats this adds, together with the review questions of the target profile. For architecture, product ownership and anyone facing a change to the system boundary

Planning mitigations

Where mitigations take hold, at which level they act and which part of the organisation has to implement them.

  1. Preview of the analysis: Effect matrix Effect matrix How and where do mitigations take effect? All 265 mitigations by effect class and implementation level. Dense cells show where the catalogue is well covered; the empty ones show where your own organisation needs its own answer. For security and control ownership
  2. Preview of the analysis: Ownership Ownership Who has to act? The catalogue assigns every mitigation a control type, and many carry a complementary one as well. Counting only the first type, four in five mitigations are technical. Counting both shifts the picture considerably. For leadership, security ownership and anyone who has to assign responsibilities

Checking frameworks and evidence

Which provision applies, what it does not reach and which primary source the catalogue relies on.

  1. Preview of the analysis: Framework mappings Framework mappings Where is this anchored professionally and legally? A flow diagram across all 486 verified relations between seven frameworks and ten topic groups. For the EU AI Act and the GDPR, every reference carries the applicability condition of the provision. For compliance, legal, internal audit and assurance
  2. Preview of the analysis: Coverage gaps Coverage gaps What does my framework not reach? The mappings show what a framework covers. This analysis shows the other side and names the threats it does not reach, together with the frameworks that do reach them. For anyone choosing a framework or already committed to one
  3. Preview of the analysis: Evidence base Evidence base What is this based on? Every statement in the catalogue traces back to a primary document with publisher, version and locator. This analysis makes the evidence base itself the subject and shows how the references are distributed. For assessors, internal audit and anyone judging how solid a source is

Versatile AI Risk Assessment is an aid for structuring AI risks and making them transparent. It does not replace legal or professional advice and makes no binding decisions.

Related
Threat catalogue

All 52 threats in full: description, impact, example, mitigations and verified sources.

To the catalogue
EU AI Act quick check

Four short sections along the EU AI Act for a first, non‑binding orientation of your system.

To the quick check
Assess it yourself

The full assessment with system context, threat selection and evidence tracking, free of charge in the browser.

To the live demo