What an AI risk assessment actually checks

Business owners tell us they know they should “do something about AI,” but are not sure what an assessment would involve or what they would get. This is what a good one looks at, and what it should leave you with.

1. What AI is actually in use

The first job is an inventory. That includes the obvious tools like ChatGPT, Copilot and Gemini, but also AI note-takers, AI features added to your existing software, and browser extensions. Most organizations find more than they expected.

2. What data goes into it

For each tool, we look at what information staff put in: client or patient details, employee records, financials, contracts, passwords. The same tool can be low risk for drafting a newsletter and high risk for summarizing case notes.

3. What the vendor does with it

We read the terms. Does the vendor train its models on your data? How long does it keep it? Where is it stored? Who are its sub-processors? For healthcare, will it sign a Business Associate Agreement?

4. Who can get in, and whether you can see it

Are staff using company accounts with single sign-on and multi-factor authentication, or personal accounts? Are audit logs turned on? If someone leaves, can you cut off their access and keep the business’s data?

5. Whether there are rules, and whether people know them

We check for a written AI use policy, a named owner for AI decisions, a process for approving new tools, and whether staff have been trained. A policy nobody has read does not count.

6. Whether your own AI tools can be tricked

If you run a chatbot on your website or connect AI to your systems, we test it for prompt injection (instructions hidden in text that make the AI misbehave), data leakage and excessive permissions, using the OWASP Top 10 for LLM Applications as the checklist.

What you should get at the end

• An AI inventory you can keep up to date
• A short list of findings ranked by real risk, in plain language
• A 30/60/90-day action plan with owners
• A mapping to recognized frameworks (NIST AI RMF, ISO/IEC 42001, HIPAA) so the work holds up with auditors, insurers and buyers

Our AI Risk Assessment is fixed-price, a flat $5,000, and follows the eight steps of the PrimeTech AI Trust Framework.