Governance
AI Risk Assessment
A structured risk assessment rates a specific AI initiative or use case, so you have a clear finding before you commit further.
Before you put money and reputation behind a new AI initiative, you want an honest view of what could go wrong. This assessment reviews one specific initiative against named criteria: data sensitivity, autonomy, reversibility and the systems involved. You receive a written risk rating with the reasoning behind it, ready for the people who have to decide. The decision stays with them.
- A written risk rating for one specific AI initiative
- Reasoning tied to named criteria, not a gut feeling
- A report ready for leadership, boards or funding reviews
$5,900
20–30 working days
Optional maintenance $295/mo
What it is
AI Risk Assessment runs a structured, point-in-time review of a specific AI initiative or use case, producing a written risk rating and the reasoning behind it, rather than ongoing monitoring you have to interpret yourself. The finished report is yours to share with leadership, a board or a funding review.
Why businesses buy it
Launching an AI initiative without a structured risk review is a gamble with someone else's approval. When something goes wrong, the first question is whether anyone looked at the risks first. Building your own assessment framework takes time most teams do not have. This assessment applies a clear framework to your initiative and documents the findings, so leadership decides on evidence. The written scope names the initiative covered and what the report includes before you order.
Problems this solves
A new AI initiative is close to launch with no risk review
The assessment runs a structured, point-in-time review of one AI initiative or use case. It produces a written risk rating and the reasoning behind it before you commit further.
A board or funder wants a risk view you cannot provide
The finished report is yours to share with leadership, a board or a funding review. Each rating comes with plain reasoning so readers can follow the logic.
Monitoring tools produce data but no clear judgment
This is a reviewed assessment, not ongoing monitoring you have to interpret yourself. Your own policies, up to twenty documents, set the standard the initiative is checked against.
A good fit if
You are about to approve, fund or launch a specific AI initiative and need a documented risk rating first.
You need one thorough assessment, not an ongoing monitor watching for change over time.
Leadership or a board wants to see a written rating and reasoning before signing off, not just a verbal assurance.
You are evaluating more than one AI use case and need a consistent way to rate and compare them.
Not the right fit if
You need to know how the EU AI Act classifies your AI systems and what it requires of you. See EU AI Act Readiness Assessment.
You need ongoing monitoring after the initiative launches, not a one-time rating. See AI Compliance Monitoring, or AI Agent Risk Monitor.
You need the full governance build spanning policy, risk and audit together, not a single assessment. See AI Governance System.
You need a running list of every AI tool in use, not a rating for one specific initiative. See AI Model Inventory.
You need ongoing approval oversight for models generally, not a rating for one use case. See AI Model Governance.
How it works
- We define the initiative in scope with you. What it does, what data it touches, and who is accountable for the decision the rating will inform.
- A structured assessment framework is applied. Covering data sensitivity, autonomy, reversibility and the systems involved, so the rating rests on named criteria, not a gut call.
- Findings are gathered against each criterion. Drawing on your existing policies, the systems in scope, and conversations with the people who actually run the initiative day to day.
- A written risk rating is produced. High, medium or low, with the reasoning behind it laid out so your decision-maker can see exactly what drove the result.
- The rating is reviewed with you before it is final. Questions about the reasoning get answered while the assessment is still open, not after it is filed away.
- A findings report is delivered for the record. Ready to sit alongside a board paper, a funding request, or your own governance register.
What you provide within 72 hours
Your portal lists these the moment you order. Delivery starts the working day after everything is in and your access is checked.
- Your business information (company basics, hours and brand voice), shared during intake, or confirmation we can reuse what you gave us on an earlier order.
- A clear description of the specific initiative or use case to be assessed.
- Any current AI tools, vendors or policies relevant to that initiative.
- A governance owner who can answer questions about data, scope and accountability during the review.
- Written authorization to review the systems the initiative touches.
- Admin access and API keys for every connected system, shared by adding our team as a user or creating a key you control, never by email.
- One decision-maker who receives the final rating and signs off the report.
The 72-hour rule. Send everything on your checklist, including access, within 72 hours of ordering so your build starts on time.
Timeline
Start
business information confirmed and the initiative to be assessed defined.
Weeks 1–2
Assessment framework applied and findings gathered against each criterion.
Week 3
Draft risk rating and reasoning produced for your governance owner to review.
Weeks 3–4
Findings report finalized, ready to sit alongside a board or funding request.
Week 4
Your review and two rounds of changes to the rating or its reasoning.
Go-live
Live, recorded handoff session, and the 30 days of support begins.
| Option | Delivery time | Price |
|---|---|---|
| Standard | 20–30 working days | $5,900 |
| Express | 15–25 working days | $6,800 |
| Rush | 10–20 working days | $7,650 |
What you receive at handover
- A written risk rating for each use case within the initiative in scope, with its reasoning (advisory; remediation work is not included)
- A controls list for each use case, mapped to your internal policies
- A register of the AI systems reviewed, with owners and risk levels
- A sign-off page recording your governance owner's decision on each use case
- A recorded 60-minute handoff session to walk through the report
- 30 days of support for follow-up questions
Expected benefits and how to measure them
- Can give decision-makers a clear risk picture before more budget is committed.
- Helps you catch issues while they are still easy to change.
- Gives you a document to point to when asked how risk was considered.
- Risks addressed
- Count the risks in the report. At your next review, count how many have been addressed or accepted by an owner.
- Time to a go or no-go decision
- Compare the time from proposal to decision with similar initiatives that had no formal assessment.
- Problems after launch
- List issues found after launch and mark whether the assessment had flagged them.
Before you start: Write down the initiative's purpose, data sources and users before the review starts. Note any concerns already raised by staff, clients or the board.
These are things to track, not promised results. Outcomes depend on your data, your team and your market.
Running costs
The build price is one-time. There is no ongoing running cost for the assessment itself once it is delivered, since it produces a written report rather than a system to host afterwards.
Where the initiative under review needs cloud access or AI usage during the assessment, that bills to your own accounts, typically $20 to $300 depending on how much access the review needs.
Ask about running costsCustom requirements
Assessing more than one initiative, or reviewing more than three connected systems? Add a note at checkout for a written Change Quote, while your original order keeps its normal timeline. Larger or bespoke projects use the Custom AI request form.
Request a custom versionKeep it running
Monthly maintenance covers monitoring, fixes and change hours, useful for re-running a rating when the initiative changes materially rather than commissioning a fresh assessment from scratch. It starts after the 30 days of support.
$295/mo (5% of the build price a month, includes 2 change hours)
Optional. Starts after the post-launch support period. Cancel any month.
How maintenance worksHow this compares
| Do it yourself with a SaaS tool | Hire a custom agency | Upmark Labs | |
|---|---|---|---|
| Price | A GRC platform bundles risk scoring into a broader subscription | A risk consultancy bills by the hour for the review | Ours is one fixed price, shown on this page before you buy |
| Scope | A platform's scoring depends on data you configure yourself | An agency's scope depends on how the engagement is billed | Ours is written to one named initiative, with its own criteria |
| Delivery | A platform still needs setup before a score means anything | A risk consultancy review can run several weeks | Ours has a fixed delivery time shown before you buy, with faster options |
| Output | A platform gives you a number without much reasoning behind it | An agency deliverable depends on what was agreed | Ours is a rating plus the written reasoning behind it |
Questions about this product
How much does AI Risk Assessment cost?
The assessment is one fixed price for everything on the Scope Card: agreeing the initiative in scope, applying the framework, gathering findings and delivering the written rating with a recorded walkthrough. You can see that price at each delivery speed in the price panel on this page. A second initiative, or a materially changed one, is quoted separately before any work starts.
Is there a running cost for AI Risk Assessment once it is delivered?
No separate running cost applies to the assessment itself, since it produces a written report rather than an ongoing system to host. If the initiative under review needs cloud access or AI usage during the assessment, that bills to your own accounts, typically $20 to $300 depending on how much access the review actually needs.
How is AI Risk Assessment different from an ongoing monitor?
AI Risk Assessment is a point-in-time review that produces one written rating for a specific initiative, delivered once and then complete. AI Compliance Monitoring and AI Agent Risk Monitor instead run continuously once live, watching for change rather than rating a single decision. Many buyers commission an assessment before launch, then add ongoing monitoring once the initiative is running.
Is AI Risk Assessment legal advice?
No. It gives you a structured risk rating, a controls list and a sign-off page for each use case. It supports your own compliance process but is not legal advice and does not certify compliance. For how the EU AI Act classifies your systems, see EU AI Act Readiness Assessment. Involve your legal adviser for final decisions.
What happens if AI Risk Assessment finds a high risk?
The rating and its reasoning go to the decision-maker you named, with the specific factors that drove the result set out clearly, so they can decide how to proceed. The assessment states the rating; it does not block the initiative or make the call for you, because whether to proceed with a high-rated initiative is a decision for your leadership, not the report.
Can an AI Risk Assessment be re-run later if the initiative changes?
Yes. If the initiative changes in a small way, a light re-review often fits inside the monthly change hours that come with maintenance. A materially different initiative, or reviewing a second use case beyond the one in scope, is treated as a new assessment and quoted before that work starts, so pricing stays clear upfront every time.
Can we cancel AI Risk Assessment maintenance later?
Yes. Maintenance has no lock-in, so you can cancel any month once the 30 days of included support has ended. Because an assessment is a point-in-time deliverable rather than a running system, many buyers only keep maintenance active around the times they expect to need a re-review.
Who owns the finished AI Risk Assessment report?
You do. The report is delivered as your own document, ready to sit inside a board pack, a funding request or your governance register, not held inside a platform we control. We run the assessment and hand over the written rating and reasoning with a recorded session, and it is yours to share, file or reference however you need.
Get a written risk rating before you commit further.
Order AI Risk Assessment and a written rating for your initiative is ready on a fixed delivery date.
Works well with
