Stage 2 · Lesson 3 of 6
Classifying systems and assigning a risk tier
Each inventory entry needs a description and a classification. Record the purpose, the users, the people affected, the decisions it informs, the data it uses, the model or vendor behind it and where it is deployed. Then classify it: is it a general-purpose tool, an internal productivity aid or a system that affects people's access to jobs, money, education or services?
Map it to the tier if it is used in the EU, and to your own internal tier, often low, medium and high, based on impact and how much a human checks its output. The tier decides how much review the system needs. Keep the reasoning written down, since a reviewer will ask why.
Common traptiering by technology ("it is just a small model") rather than by impact on people.
A question to check yourself, an AI practice session and 3 cheat sheet entries come with the full roadmap. Unlock
Resources for this stage
Start with· follow one of these
- GuideFreeNIST AI Risk Management Framework (AI RMF)
National Institute of Standards and Technology (NIST) · Intermediate
The Map function is the reasoning behind every inventory entry: context, purpose and who is affected
- GuideFreeEU AI Act: regulatory framework for AI (European Commission)
European Commission · Beginner
Provider, deployer and the risk tiers, the two labels every inventory entry needs