AI Risk Feature Overview
The AI Risk feature in TrustArc's platform enables organizations to:
•Automatically calculate AI inherent risk scores for business processes, systems, and third parties.
•Trigger appropriate AI risk assessments based on identified risk levels. There are three out-of-the-box AI risk assessments available:
EU AI Risk Assessment
AI Risk Assessment
AI Use Questionnaire
•Calculate residual risk scores after assessments are completed.
•Export results in PDF or CSV format for audits, reporting, or compliance documentation.
AI Inherent Risk Calculation
•An AI inherent risk score is automatically assigned to each Data Inventory and Business Process record.
•The score appears in muted colour with the label Needs Review until the user confirms or updates it.
•To review the score, click Review Score in the Inherent Risk box. A pop-up opens where you can:
View the current score and risk indicators
Manually adjust the score if needed
Add notes or comments for context
Risk Factors
System and business process record inherent risk is calculated using the following risk factor fields, together with the AI usage indicator field.
•Processing purposes — including processing purposes related to AI and those not related to AI
•Data elements
•Data subjects
•Volume of data subjects
•Data volume
Score Matrix
AI processing purposes selected & AI usage indicator: Yes
High AI Risk — 2 or more risk factors
Severity: High
Likelihood: Possible (can be adjusted by the reviewer)
Recommendation: Complete the EU AI Risk Assessment (EEA location)
Medium AI Risk — 1 risk factor
Severity: Medium-High
Likelihood: Possible (can be adjusted by the reviewer)
Recommendation: Complete the AI Risk Assessment
Low AI Risk — 0 risk factors
Severity: Low
Likelihood: Unlikely (can be adjusted by the reviewer)
Recommendation: Complete the AI Use Questionnaire
AI processing purposes selected & AI usage indicator: No
Low AI Risk — 2 or more, 1, or 0 risk factors
Severity: Low
Likelihood: Rare (can be adjusted by the reviewer)
Recommendation: No AI-related assessment is required.
📋 Note: Data processing risk is still assessed according to data processing rules, which may trigger a DPIA/PIA depending on the number of risk factors identified.
AI processing purposes selected & AI usage indicator: Unknown
High AI Risk — 2 or more risk factors
Severity: High
Likelihood: Possible (can be adjusted by the reviewer)
Recommendation: Complete the AI Use Questionnaire
Medium AI Risk — 1 risk factor
Severity: Medium-Low
Likelihood: Possible (can be adjusted by the reviewer)
Recommendation: Complete the AI Use Questionnaire
Low AI Risk — 0 risk factors
Severity: Low
Likelihood: Unlikely (can be adjusted by the reviewer)
Recommendation: Complete the AI Use Questionnaire
AI processing purposes selected & AI usage indicator: Not selected
Incomplete. A selection on the AI Use question is required to determine possible AI risk.
No AI processing purposes selected & AI usage indicator: Yes or Unknown
Medium AI Risk — 2 or more risk factors (AI use = Yes)
Severity: Medium-High
Likelihood: Possible (can be adjusted by the reviewer)
Recommendation: Complete the AI Risk Assessment
Medium AI Risk — 1 risk factor (AI use = Yes)
Severity: Medium
Likelihood: Unlikely (can be adjusted by the reviewer)
Recommendation: Complete the AI Use Questionnaire
Low AI Risk — 0 risk factors (AI use = Yes)
Severity: Low
Likelihood: Rare (can be adjusted by the reviewer)
Recommendation: Complete the AI Use Questionnaire
No AI processing purposes selected & AI usage indicator: No
No AI risk. No assessment is required.
No AI processing purposes selected & AI usage indicator: Not selected
No AI risk. No assessment is required.
TrustArc · AI Risk Feature Overview · support.trustarc.com