ki-risikoassessment

/ki-governance:ki-risikoassessment

Purpose

The skill delivers a structured, auditable risk assessment for a specific AI system – as an input into the internal AI asset register and as a decision-making basis for approval, conditions or rejection. Methodologically it leans on ISO/IEC 23894:2023 (AI risk management) and NIST AI RMF 1.0 (functions GOVERN / MAP / MEASURE / MANAGE); the AI Act risk classification is fed in as a mandatory trigger, without spelling out the catalogue of obligations there (cross-reference to ki-vo-compliance).

Inputs

AI system description: purpose, user groups, data categories, model type (rule-/ML-/LLM-based), supply chain (in-house development / closed-source SaaS / open source)
Deployment context: role of the organisation (provider / deployer / importer / distributor), sector, reference to particularly sensitive areas (employment, creditworthiness, law enforcement, health, education)
Data flow: training data, input, output, storage locations, third-country transfer
Previous assessments (preliminary reviews, DPIA, security analyses)

Sub-agent architecture

Researcher supplies AI Act anchors (Art. 5, 6, Annex III; Art. 26 as a reference point), GDPR anchors (Art. 22, 25, 35), professional-law evidence and standards (ISO/IEC 23894, NIST AI RMF, BSI AIC4). Drafter creates the risk assessment document with risk register, heatmap table and risk treatment plan. Reviewer checks completeness of the AI Act trigger assessment, DPA coverage, DPIA triggers and follow-up.

Process

1. System identification (NIST AI RMF: MAP 1)

Mandatory fields in the risk register:

Field	Content
System ID	Unique identifier in the AI inventory
Purpose	Specific task, user groups
Model type / provider	Rule-/ML-/LLM-based; in-house / SaaS / open source
Role of the organisation	Provider / deployer / importer / distributor within the meaning of Art. 3 AI Act
Data categories	Personal data reference, special categories Art. 9 GDPR, professional secrecy § 203 StGB
Supply chain	Training data origin, sub-providers, third country
Lifecycle phase	Concept / pilot / production / EOL

2. Risk classification – two axes

a) AI Act risk class (statutory trigger)

Classification along Art. 5, 6 and Annex III AI Act as a obligations trigger, not as an internal risk score:

Prohibited practice (Art. 5 AI Act) → use prohibited
High-risk system (Art. 6 AI Act + Annex III or Annex I) → cascade of obligations under the AI Act
Limited risk / transparency obligations (Art. 50 AI Act) → labeling
Minimal risk → no specific AI Act obligations, but Art. 4 AI Act (training) remains

Detailed review of obligations: Skill /ki-vo-compliance:hochrisiko-klassifizierung. Here only the triggering needs to be documented.

b) Internal risk score (ISO/IEC 23894 logic)

Own assessment matrix along probability of occurrence × severity of damage, each 1–5. Damage dimensions:

Confidentiality (CIA): breach of secrecy, § 203 StGB, trade secrets
Integrity: manipulation of outputs, prompt injection, data poisoning
Availability: failure, vendor lock-in, model discontinuation
Fairness / bias: discrimination within the meaning of the AGG, indirect disadvantage
Safety: physical / economic damage
Legal compliance: AI Act, GDPR, professional law, competition law
Reputation: loss of trust, supervisory proceedings

3. Damage scenarios and bias analysis

Per scenario: cause → event → damage → probability of occurrence → severity of damage → risk score. Fairness analysis according to protected categories (§ 1 AGG: race, ethnic origin, gender, religion, disability, age, sexual identity); additionally protection proxies (postal code, name, etc.).

4. Data protection triggers

DPIA obligation (Art. 35 GDPR): DSK blacklist, Annex III AI Act as an indication, automated decision-making within the meaning of Art. 22 GDPR
DPA (Art. 28 GDPR) with every external provider
Third-country transfer (Art. 44 et seq. GDPR): adequacy decision / SCC / TIA

5. Professional law triggers (if applicable)

§ 43e BRAO: outsourcing of lawyer activities – written form, obligation to confidentiality
§ 203 StGB: persons involved (para. 4); if applicable, medical / tax advisory / audit confidentiality

6. Risk treatment (ISO/IEC 23894, Chapter 6)

For each identified risk, one of the four options:

Option	Example
Avoid	Do not deploy the system, choose an alternative
Mitigate	TOMs, human oversight, bias mitigation, logging
Transfer	Contractual risk allocation, insurance (AI liability)
Accept	Document residual risk, approval decision by management

7. Follow-up

At least annually; for high-risk systems within the meaning of the AI Act semi-annually; in the event of a significant change (model update, new data source, new user group) immediately.

Sources and citation style

Binding: ../../../references/zitierweise.md.

EU and national law

Regulation (EU) 2024/1689 (AI Act) – in particular Art. 3 (definitions), Art. 4 (training), Art. 5 (prohibited practices), Art. 6 + Annex III (high-risk), Art. 50 (transparency). The obligations check is carried out in the plugin ki-vo-compliance.
Art. 22 GDPR (automated decision-making in individual cases)
Art. 25 GDPR (data protection by design)
Art. 28 GDPR (processing on behalf)
Art. 35 GDPR (DPIA)
§ 1 AGG
§ 43e BRAO (outsourcing)
§ 203 StGB (duty of confidentiality)

Industry standards

ISO/IEC 23894:2023 – Information technology — Artificial intelligence — Guidance on risk management (iso.org)
ISO/IEC 22989:2022 – AI concepts and terminology
ISO/IEC 42001:2023 – AI Management System (for embedding the assessment)
NIST AI RMF 1.0 (January 2023) incl. GenAI Profile (July 2024) – nist.gov/itl/ai-risk-management-framework
BSI AIC4 (as of 2021) – Artificial Intelligence Cloud Service Compliance Criteria Catalogue

Commentaries

Keller, in: Keller/Kapoor, KI-VO, 1st ed. 2025, Art. 6 marginal no. 1 et seq. [unverifiziert – prüfen]
Martini, in: Hartmann/Hilgendorf, KI-Recht, 2024, chapter on risk classification [unverifiziert – prüfen]
Buchner/Petri, in: Kühling/Buchner, DSGVO/BDSG, 4th ed. 2024, Art. 22 marginal no. 1 et seq.
Bertermann, in: Ehmann/Selmayr, DSGVO, 3rd ed. 2024, Art. 35 marginal no. 1 et seq. [unverifiziert – prüfen]

Case law (`[unverifiziert – prüfen in Beck-Online / juris / curia.europa.eu]`)

ECJ, judgment of 07.12.2023 – C-634/21, ECLI:EU:C:2023:957 (SCHUFA / scoring within the meaning of Art. 22 GDPR)
Federal Labour Court on co-determination for IT systems, § 87 I No. 6 BetrVG (chamber and senate decisions, in each case on a case-by-case basis)

Output format

KI-RISIKOASSESSMENT
System: <System-ID>  |  Stand: <Datum>  |  Assessor: <Rolle>

I. Systemidentifikation
   - Zweck / Nutzergruppen
   - Modelltyp / Anbieter / Lieferkette
   - Rolle der Organisation (Art. 3 KI-VO)
   - Datenkategorien (inkl. Art. 9 DSGVO / § 203 StGB)

II. Risikoklassifizierung
    a) KI-VO-Trigger: [verboten / Hochrisiko / begrenzt / minimal]
       → Pflichtprüfung in /ki-vo-compliance
    b) Interner Risk-Score (1–25 je Dimension)
       Vertraulichkeit / Integrität / Verfügbarkeit / Fairness /
       Sicherheit / Rechtskonformität / Reputation

III. Schadensszenarien
     <Tabelle: Ursache | Ereignis | Schaden | EW | SH | Score>

IV. Datenschutz-Trigger
    - DSFA-Pflicht Art. 35 DSGVO: ja/nein – Begründung
    - AVV Art. 28 DSGVO: vorhanden/fehlt
    - Drittlandtransfer: Mechanismus

V. Berufsrechts-Trigger (falls einschlägig)
    - § 43e BRAO / § 203 StGB / Spezialgesetz

VI. Risk-Treatment
    <Tabelle: Risiko | Option | Maßnahme | Verantwortlich | Frist>

VII. Restrisiko und Freigabeempfehlung
     🟢 / 🟡 / 🔴 mit Begründung

VIII. Wiedervorlage
      Datum: <jährlich / halbjährlich / ereignisbezogen>

IX. Quellenverzeichnis

Risks / typical errors

Duplicating AI Act obligations in substance instead of cross-referencing – maintenance effort and contradictions.
Risk score without a comprehensible scale (document a 5×5 matrix).
Reducing bias analysis to § 1 AGG – proxy variables (e.g. postcode, name) are overlooked.
Forgetting the DPA, because the AI tool is perceived as "just software" – LLM-as-a-Service is generally processing on behalf.
§ 43e BRAO / § 203 StGB not addressed in the case of a lawyer / doctor client.
Follow-up undefined ("as needed") – set a specific deadline.
Framing standards as "mandatory", although they are voluntary (exception: harmonised standards Art. 40 AI Act – presumption of conformity, not bindingness).