Insights / Guide / AI governance, risk and compliance
GuideTiering AI risk in a way people can use
Not every AI use needs the same level of control. Three simple risk tiers keep effort proportionate and give teams a quick answer on what each use requires.
Many organisations respond to AI with one of two extremes. Some apply the same heavy approval process to everything, so a team wanting to summarise meeting notes waits months alongside a team building an automated credit decision. Others apply almost no control at all. Both fail: the first drives people to work around the process, the second leaves serious risks unmanaged.
Not every AI use needs the same level of control. Tiers keep effort proportionate. This guide sets out a three-tier model that managers can apply without specialist help, and explains what each tier requires.
What a good tiering model looks like
A tiering model is useful only if people can use it. That means a small number of tiers, defined by questions anyone can answer, with clear requirements for each. A model with seven tiers and a 40-question assessment will be applied inconsistently or not at all.
- Who sees the output: only staff, or customers and the public?
- Does a person review every output before it is used?
- Could the output affect decisions about individuals, safety, legal rights or large sums of money?
- What data does the system use, and is any of it personal or confidential?
The questions deliberately avoid technical detail. A manager does not need to know how a model works to say whether customers will see its output or whether it influences who gets a loan. Those are the facts that drive risk, and they are facts the business already knows.
The answers to these four questions place most uses in a tier within a few minutes. Borderline cases go to a named person for a decision.
Low risk
Drafting internal text with human review needs light controls. This tier covers most everyday use: summarising documents, drafting internal emails, preparing first versions of presentations, brainstorming and translating internal material. A person reviews every output and nothing goes outside the organisation without that review.
- Use only approved tools.
- Follow the data rules in the acceptable-use policy.
- The user checks the output and remains responsible for it.
- No registration or approval needed beyond the tool itself.
Consider a finance team that uses an approved assistant to draft the commentary for monthly management accounts. The analyst checks every figure against the ledger and edits the wording before it goes to the finance director. The assistant saves time, the analyst remains accountable and no formal registration is needed.
Keeping this tier light is essential. It is where most of the productivity benefit lies, and burdening it with process gives people a reason to use unapproved tools instead.
Medium risk
Customer-facing or decision-support uses need testing and monitoring. This tier includes chat assistants that answer customer questions, tools that draft customer correspondence at volume, systems that recommend actions to staff and models that forecast demand or flag unusual transactions.
- Register the use with an owner, purpose and data sources.
- Test before launch on realistic examples, including difficult and unusual cases.
- Define what good performance looks like and how it will be measured.
- Monitor in use, sampling outputs regularly and tracking complaints or corrections.
- Give users a clear way to report problems and a fallback when the system is wrong.
The point of these controls is to catch problems before customers or staff are harmed by them. Testing shows whether the system is good enough to launch. Monitoring shows whether it stays good enough as questions, data and the underlying tool change over time. Both need an owner who has the time and authority to act on what they find, including switching the system off.
Take a typical wholesaler that introduces a chat assistant to answer delivery and returns questions on its website. Before launch, the team tests it on several hundred real questions from past enquiries, including awkward and angry ones, and agrees an acceptable error rate. After launch, a service lead reviews a sample of conversations each week, and any customer can ask for a person at any point. The controls are real but take only a few hours a week to run.
High risk
Decisions about people, safety or large sums need approval, records and regular audit. This tier covers uses such as screening job applicants, setting credit limits, prioritising patients or service users, controlling physical equipment or approving significant payments. Errors here can harm individuals, breach regulation or cost serious money.
- Formal approval by a named senior owner before launch.
- Documented assessment of accuracy, fairness, security and data protection.
- A defined role for human judgement, with authority to override the system.
- Records of decisions sufficient to explain any individual outcome.
- Scheduled audit, at least annually, and a review whenever the system or its data changes.
Regulation may set the tier for you
Some uses are classed as high risk by regulation in certain jurisdictions, or are subject to sector rules. Check those requirements first; the internal model should never place a use in a lower tier than the law does.
Common mistakes
Organisations that introduce tiering tend to make similar mistakes. Knowing them in advance saves a lot of rework.
- Defining tiers by technology rather than use: the same model can be low risk for drafting and high risk for screening applicants.
- Over-classifying to be safe, which pushes everyday uses into slow processes and encourages workarounds.
- Treating approval as the end: medium and high risk uses need ongoing monitoring, not just a launch decision.
- Leaving ownership vague, so nobody acts when a monitored system starts to drift.
- Writing the model in technical language that managers cannot apply without help.
The fix in each case is the same principle: classify by what the system does and who it affects, keep the requirements proportionate and give every registered use a named owner who knows what they are responsible for.
Linking tiers to the rest of governance
Tiers become more useful when other processes use them. Procurement can apply lighter checks to tools used only for low-risk tasks. Internal audit can focus its annual plan on high-risk uses. Training can be targeted, with every employee learning the low-risk rules and owners of medium and high uses receiving more detailed guidance. The tier becomes a shared shorthand that saves time across the organisation.
Making the model work in practice
Publish the tiers on one page with examples from your own organisation. Ask managers to place their team’s uses in a tier and register anything at medium or high. Have one person or a small group review placements for consistency in the first few months, then spot-check.
Keep the register simple: a shared list with the use, its tier, its owner, the data it uses, when it was last reviewed and any open issues. A spreadsheet is enough for most organisations at first. What matters is that it is current and that someone looks at it regularly, not the sophistication of the tool that holds it.
Review the model itself every year. As tools become more capable and uses more ambitious, some low-risk activities will drift into medium risk, for example when an internal drafting tool starts sending replies to customers automatically.
Begin by listing ten current or planned AI uses and placing each in a tier with the four questions above. If the placements feel right and the requirements feel proportionate, you have a model your people can use.
Source: Intelliversal analysis.
