Versatile AI Risk Assessment
Robotics and vehicles

Automated driving and driver assistance

Also known as: Automated driving and advanced driver assistance systems (ADAS)

Cameras and other sensors capture traffic conditions, and the system drives under defined conditions or assists the driver.

Explore the interactive model

Export handout

A concise PDF covering how the system works, its data flows and points to investigate, ready to share.

The explanations and measures describe the typical system design. Extensive personal changes add an appendix.

Understand the use case

What defines this use case?

Assistance systems help with steering, braking and lane keeping; the driver remains responsible. Automated systems drive independently within a narrowly defined operating domain. Germany's Federal Motor Transport Authority approved the first Automated Lane Keeping System in 2021. Uber and Tesla vehicles have been involved in serious accidents.

This page describes a typical system design. Actual data flows and permissions depend on your implementation.

System design
Analysis and processing
Ability to act
Acts on physical processes
Fields of use
automotive industry, mobility
Also known as
Automated Lane Keeping System (ALKS), traffic jam pilot, Level 3 system

How it works, step by step

System design and data flows

  1. Input data

    Cameras, radar and other sensors continuously capture the road, signs, vehicles and people.

    People outside the organisation can alter road signs and markings in public spaces. The system combines cameras, radar and, depending on the vehicle, other sensors such as lidar.

  2. Processing

    Models recognise vehicles, people and markings and combine them into a picture of the traffic situation.

    The system processes sensor data to perceive the traffic situation and derive possible driving movements. Planning and vehicle control execute the authorised movements. Which tasks remain with the human depends on the scope of assistance or automation involved.

  3. Results

    The system issues steering, braking and acceleration commands or warns the driver.

    The result describes the defined model task. A match, category or forecast acquires its professional significance only in conjunction with the underlying data and intended use.

  4. Use and impact

    The vehicle moves through public traffic, and any error can immediately endanger occupants and other people.

    This is where computation leads to physical execution. The controller carries out a selected action; sensors then provide new information about the state of the environment.

Explore the system design: Select a component to see its task, incoming and outgoing data, and role in the use case. The guided walkthrough explains each phase. Then use Yes, Uncertain and No to represent your specific system variant.

9 review first11 clarify6 baseline threats

InputProcessingResultImpact Externalaccess 03 Input 40 Third-partycontent 00 AI model 12 Providerservice 03 Documentcollection 00 Memory 00 Training andfeedback 12 OtherAI agents 00 Tools andinterfaces 00 Result 00 Business appor equipment 20 person 10 Affectedperson 00 AI serviceswithout approval 01 Externalaccess 03 Input 40 Third-partycontent 00 AI model 12 Providerservice 03 Documentcollection 00 Memory 00 Training andfeedback 12 OtherAI agents 00 Tools andinterfaces 00 Result 00 Business appor equipment 20 person 10 Affectedperson 00 AI serviceswithout approval 01
  • Present
  • Depends on your system
  • Absent
  • Review first
  • To clarify
Architecture as a list

How it differs from similar use cases

Data and information

Input data and information sources

People outside the organisation can alter road signs and markings in public spaces. External cameras capture other people on the road, and driving data reveals information about the driver.

Processing and operating environment

Parts of the perception system often come from suppliers.

Storage and further use

Vehicle manufacturers train perception models using their own driving data; fleet operators generally adopt the model. Fleet driving data can feed into further development.

Results and data sharing

The system steers, brakes and accelerates the vehicle.

Using a provider does not automatically determine where processing takes place. Storage location, subcontractors, deletion periods and use for training must be checked for the specific deployment.

Assess risks and determine measures

From understanding the system to analysing risks

  1. Define the system boundary

    Record data, participants, interfaces and permissions. Resolve uncertain characteristics in the model.

  2. Investigate threats

    Relate review candidates to actual data flows: what could happen, and who would be affected?

  3. Assess risk

    Assess impacts and likelihood in the deployment context. The number of review candidates is not a risk score.

  4. Provide evidence of measures

    Select appropriate controls, assign responsibilities and define effectiveness checks. Document residual risks and approvals.

Key threats in the application context

  • 3 particularly important
  • 6 typical
  • 11 depending on the system
  • 6 additional threats for every AI system

A total of 26 threats from the threat catalogue may be relevant to this use case.

Also review: whether the outputs are substantively correct

Check probability reliability, possible test-data leakage into training and the consequences of an error in the business process.

Also review: Safety of people and equipment

Check independent safety functions, intended operating limits and the safety evidence your sector requires.

Priority review points

  1. Adversarial Inputs

    Altered road signs or stickers on the road can deliberately mislead the camera. The vehicle then misreads a speed limit or lane and responds dangerously.

  2. Overreliance

    Drivers become accustomed to the system handling the situation and turn their attention elsewhere. If it requests a takeover or fails unnoticed, too little time remains to intervene.

  3. Model Drift & Degradation

    Perception is familiar only with the regions, seasons and traffic conditions used in training. Snow, unfamiliar roadworks or unexpected behaviour by others impair obstacle recognition, and this is not immediately apparent.

6 further review candidates in the typical design

Other relevant threats

  1. Targeted Poisoning / Label Poisoning

    Falsified training labels can deliberately shift model outputs.

    Listed because of this characteristic

    • Learns from examples with correct answers

  2. Model Denial of Service

    Complex or high-volume inputs can exhaust model computing resources.

    Listed because of these characteristics

    • Controls physical processes
    • Processes text, images and speech together

  3. Privacy Attacks

    Targeted queries can recover some personal or protected training data from the model.

    Listed because of this characteristic

    • Processes personal data

  4. Sensitive Information Disclosure

    Confidential content can appear in answers, supplied context or logs.

    Listed because of this characteristic

    • Processes personal data

  5. Excessive Agency

    Tasks performed on request or automatically can exceed what is permitted.

    Listed because of this characteristic

    • Controls physical processes

  6. Multimodal Attacks

    Each additional input type, such as images or speech, opens another route for manipulation or contradictory results.

    Listed because of this characteristic

    • Processes text, images and speech together

Up to 11 further threats may apply, depending on your system design. Nine threats need to be reviewed for every AI system. Three of these are particularly important here and are therefore listed above.

System features and open questions

Each Yes adds further threats to your checklist, up to 11 in total. If you cannot yet answer a question, include its threats in your review.

How many threats a Yes adds
  • Added by this Yes
  • Also requires a Yes to another question

How your system is built

  1. Learns from your own data2 threats, plus 1 only in combination with other characteristics
  2. Determines its own work steps2 threats
  3. Processes confidential data1 threat
  4. Uses another provider's model1 threat
  5. Uses operational feedback1 threat
  6. Optimises a specified metric1 threat

How you operate the system

  1. Available to people outside the organisation4 threats
  2. Accepts queries directly through an interface3 threats
  3. Accessible over a network1 threat, plus 1 only in combination with other characteristics
  4. Incurs costs with each query1 threat
  5. Passes content to services outside your environment1 threat
  6. Shares computing resources with other customers or applications1 threat
  7. Used alongside unapproved AI services1 threat

How your system is built

Does the system determine its next steps itself based on earlier results?

A traffic jam pilot stays in its lane; more highly automated systems plan lane changes and manoeuvres themselves.

If yes, add

Does your organisation train or fine-tune the model itself using its own data?

Vehicle manufacturers train perception models using their own driving data; fleet operators generally adopt the model.

If yes, add

Does the model or its base model come from another provider, even if you host it?

Parts of the perception system often come from suppliers.

If yes, add

Does operational feedback or output later feed into analysis or training?

Fleet driving data can feed into further development.

If yes, add

Is the system intended to maximise a specified metric, such as revenue, utilisation or clicks?

If yes, add

How you operate the system

These questions arise for almost every AI system.

Controls and implementation

Measures for the priority review areas are expanded. Each linked measure explains how to implement it.

Review priorityAdversarial Inputs2 measures
Review priorityOverreliance3 measures
Review priorityModel Drift & Degradation3 measures
Targeted Poisoning / Label Poisoning3 measures
Model Denial of Service3 measures
Privacy Attacks3 measures
Sensitive Information Disclosure3 measures
Excessive Agency3 measures
Multimodal Attacks2 measures

Controls for the remaining threats are available on their pages in the threat catalogue.

AI Act provisions

When AI Act provisions apply
  1. Art. 4: AI literacy

    For every AI system Applies since 2 February 2025.

  2. Art. 6 para. 1, Art. 2 para. 2, Annex I Section B: Vehicles, aircraft, ships and railway assets

    In typical use Review trigger from 2 August 2028.

Applies to every AI system

Art. 4: AI literacy

Applies if staff or appointed representatives operate or use AI systems.

Applies since 2 February 2025.

Obligations and details
Who bears the obligations
Provider, Deployer, Product manufacturer, Provider of a general-purpose AI model

Detailed obligations

May apply in typical use

Art. 6 para. 1, Art. 2 para. 2, Annex I Section B: Vehicles, aircraft, ships and railway assets

Applies if the system performs or supports driving as a safety component of a motor vehicle, for example an Automated Lane Keeping System under UN Regulation No 157.

Applies from 2 August 2028.

Obligations and details
The general condition is
Applies if the system is a safety component of a vehicle, aircraft, ship or railway asset covered by Annex I, Section B.
Points to consider
The AI Act applies through type approval or authorisation legislation here; its other chapters do not apply directly.
Who bears the obligations
Provider, Deployer, Product manufacturer

Detailed obligations

Generally does not apply

Art. 6 para. 1, Annex I Section A: Safety component of an assessed product

Motor vehicles are listed in Annex I, Section B. Under Article 2(2), AI Act requirements apply through type approval legislation, rather than a conformity assessment under Section A.

Obligations and details
The general condition is
Applies if the system is itself a product or a safety component of a product requiring third-party assessment under Annex I legislation, such as machinery, lifts, medical devices or toys.
Exception
Systems improving only operation, performance or comfort without a safety role are not safety components under Article 6(1a)–(1c).
Who bears the obligations
Provider, Deployer, Product manufacturer

Detailed obligations

Classify your system with the quick checker All obligations in the obligations compass

Cross-cutting threats

Review these threats for every AI system, whatever its purpose.

Why these threats always belong on the checklist

Atypical system features

View 14 further questions

If any of these features does apply to your system, add the listed threats.

Sources

Related use cases

Also in the field of Robotics and vehicles

Updated: 30 September 2026. Review checklist rules version 0.3.2, threat catalogue version 2026.10.24.2. How these pages are structured