Versatile AI Risk Assessment
Administration, justice and public safety

Police data analysis platforms

Police analysis platforms combine data from different sources and display links between people, incidents and cases as graphs, tables or maps.

Explore the interactive model

Export handout

A concise PDF covering how the system works, its data flows and points to investigate, ready to share.

The explanations and measures describe the typical system design. Extensive personal changes add an appendix.

Understand the use case

What defines this use case?

Investigators search data held in separate systems in a single step and see who is connected to whom through which incidents. In 2023, Germany's Federal Constitutional Court found the rules in Hesse and Hamburg unconstitutional because they allowed automated analysis too broadly.

This page describes a typical system design. Actual data flows and permissions depend on your implementation.

System design
Analysis and processing
Ability to act
Action permissions depend on integration
Fields of use
law enforcement
Also known as
automated data analysis, search and analysis platform, hessenDATA, VeRA

How it works, step by step

System design and data flows

  1. Input data

    The system receives incident, case and information system data and sometimes seized data.

    Reports, witness statements, seized data and tips come from outsiders. Collections identify suspects, victims, witnesses and contacts.

  2. Processing

    The software consolidates matching people, places and objects across sources and calculates their relationships.

    Processing brings approved datasets together for search, linking and analysis. Depending on the system design, relationships, patterns or unusual connections are highlighted. A technically identified connection is a starting point for investigation, rather than an established finding of fact.

  3. Results

    Results appear as graphs, tables, timelines or maps.

    The result describes the defined model task. A match, category or forecast acquires its professional significance only in conjunction with the underlying data and intended use.

  4. Use and impact

    Investigators derive leads, suspicions and further measures against people from them.

    Integration determines whether the result is simply displayed, adopted after approval or written directly into a business application. These variants differ in their data flows and permissions.

Explore the system design: Select a component to see its task, incoming and outgoing data, and role in the use case. The guided walkthrough explains each phase. Then use Yes, Uncertain and No to represent your specific system variant.

7 review first11 clarify8 baseline threats

InputProcessingResultImpact Externalaccess 04 Input 31 Third-partycontent 00 AI model 00 Providerservice 12 Documentcollection 20 Memory 00 Training andfeedback 02 OtherAI agents 00 Tools andinterfaces 00 Result 00 Business appor equipment 01 person 10 Affectedperson 00 AI serviceswithout approval 01 Externalaccess 04 Input 31 Third-partycontent 00 AI model 00 Providerservice 12 Documentcollection 20 Memory 00 Training andfeedback 02 OtherAI agents 00 Tools andinterfaces 00 Result 00 Business appor equipment 01 person 10 Affectedperson 00 AI serviceswithout approval 01
  • Present
  • Depends on your system
  • Absent
  • Review first
  • To clarify
Architecture as a list

How it differs from similar use cases

Data and information

Input data and information sources

Reports, witness statements, seized data and tips come from outsiders. Collections identify suspects, victims, witnesses and contacts.

Processing and operating environment

VeRA was procured through a Europe-wide tender, so its software comes from a vendor.

Storage and further use

The system searches combined collections for people, objects and incidents.

Results and data sharing

Provider access for operation or maintenance can allow data to leave police control.

Using a provider does not automatically determine where processing takes place. Storage location, subcontractors, deletion periods and use for training must be checked for the specific deployment.

Assess risks and determine measures

From understanding the system to analysing risks

  1. Define the system boundary

    Record data, participants, interfaces and permissions. Resolve uncertain characteristics in the model.

  2. Investigate threats

    Relate review candidates to actual data flows: what could happen, and who would be affected?

  3. Assess risk

    Assess impacts and likelihood in the deployment context. The number of review candidates is not a risk score.

  4. Provide evidence of measures

    Select appropriate controls, assign responsibilities and define effectiveness checks. Document residual risks and approvals.

Key threats in the application context

  • 3 particularly important
  • 4 typical
  • 11 depending on the system
  • 8 additional threats for every AI system

A total of 26 threats from the threat catalogue may be relevant to this use case.

Also review: whether the system disadvantages groups

Check whether selection, ranking or assessment disadvantages people with protected characteristics, such as sex, age or origin.

Priority review points

  1. Cross-Tenant Leakage (Multi-Tenant Vector DB)

    The platform combines cases that not every investigator may access. If search or graph permissions fail, investigators see people and incidents from other cases.

  2. Overreliance

    A graph connection looks like a finding even if based only on a shared address or witness statement. Accepting it unchecked can draw an uninvolved person into proceedings.

  3. RAG-Specific Attacks (Document Poisoning)

    Collections include tips and seized data that third parties may have deliberately shaped. A false entry then creates connections that recur in every later search.

4 further review candidates in the typical design

Other relevant threats

  1. Backdoor ML Model

    Training data or an adopted base model can introduce hidden triggers for misbehaviour.

    Listed because of this characteristic

    • Uses another provider's model

  2. Privacy Attacks

    Targeted queries can recover some personal or protected training data from the model.

    Listed because of these characteristics

    • Processes personal data
    • Processes confidential data

  3. Sensitive Information Disclosure

    Confidential content can appear in answers, supplied context or logs.

    Listed because of these characteristics

    • Processes personal data
    • Processes confidential data

  4. Exfiltration from ML Application

    Protected data can leak through tools, network connections, storage or insiders.

    Listed because of this characteristic

    • Processes confidential data

Up to 11 further threats may apply, depending on your system design. Nine threats need to be reviewed for every AI system. One of these is particularly important here and is therefore listed above.

System features and open questions

Each Yes adds further threats to your checklist, up to 11 in total. If you cannot yet answer a question, include its threats in your review.

How many threats a Yes adds
  • Added by this Yes
  • Also requires a Yes to another question

How your system is built

  1. Uses operational feedback2 threats
  2. Processes text, images and speech together2 threats
  3. Learns from your own data1 threat, plus 1 only in combination with other characteristics
  4. Changes data or triggers processes1 threat
  5. Learns from examples with correct answers1 threat

How you operate the system

  1. Accepts queries directly through an interface4 threats
  2. Accessible over a network2 threats, plus 1 only in combination with other characteristics
  3. Incurs costs with each query1 threat
  4. Shares computing resources with other customers or applications1 threat
  5. Used alongside unapproved AI services1 threat

How your system is built

Can the system change things itself, such as storing data, sending messages, initiating transactions or granting permissions?

If yes, add

How you operate the system

These questions arise for almost every AI system.

Controls and implementation

Measures for the priority review areas are expanded. Each linked measure explains how to implement it.

Review priorityCross-Tenant Leakage (Multi-Tenant Vector DB)3 measures
Review priorityOverreliance3 measures
Review priorityRAG-Specific Attacks (Document Poisoning)3 measures
Backdoor ML Model2 measures
Privacy Attacks3 measures
Sensitive Information Disclosure3 measures
Exfiltration from ML Application3 measures

Controls for the remaining threats are available on their pages in the threat catalogue.

AI Act provisions

When AI Act provisions apply
  1. Art. 4: AI literacy

    For every AI system Applies since 2 February 2025.

  2. Art. 5 para. 1 point d: Predicting offences solely from a profile

    Depending on use Review trigger since 2 February 2025.

  3. Annex III no. 6: Law enforcement

    In typical use Review trigger from 2 December 2027.

Applies to every AI system

Art. 4: AI literacy

Applies if staff or appointed representatives operate or use AI systems.

Applies since 2 February 2025.

Obligations and details
Who bears the obligations
Provider, Deployer, Product manufacturer, Provider of a general-purpose AI model

Detailed obligations

May apply in typical use

Annex III no. 6: Law enforcement

Applies if law enforcement uses the system to assess people or evidence, for example to profile suspects or assess tip reliability.

Applies from 2 December 2027.

Obligations and details
The general condition is
Applies if law enforcement authorities or bodies acting for them use the system, for example to assess evidence or people.
Who bears the obligations
Provider, Deployer, Product manufacturer

Detailed obligations

May apply in particular uses

Art. 5 para. 1 point d: Predicting offences solely from a profile

Applies if the system estimates whether a specific person will offend solely through profiling or personal characteristics and traits in linked data.

Applies since 2 February 2025.

Obligations and details
The general condition is
Applies if the system estimates whether someone will commit an offence solely from a profile or personal characteristics.
Exception
Systems assisting human assessment of involvement in an offence where that assessment already rests on objective, verifiable facts about criminal activity.
Who bears the obligations
Provider, Deployer, Importer, Distributor, Authorised representative, Product manufacturer, Provider of a general-purpose AI model

Detailed obligations

Classify your system with the quick checker All obligations in the obligations compass

Cross-cutting threats

Review these threats for every AI system, whatever its purpose.

Why these threats always belong on the checklist

Atypical system features

View 14 further questions

If any of these features does apply to your system, add the listed threats.

Sources

Related use cases

Also in the field of Administration, justice and public safety

Updated: 30 September 2026. Review checklist rules version 0.3.2, threat catalogue version 2026.10.24.2. How these pages are structured