Overview of Risk Assessment and Management for Intelligent Systems under the AI Act and Beyond

Abstract: The society and emerging risk-based regulatory frameworks for AI underscore the need for rigorous risk assessment to ensure safe and reliable AI systems. In response to this imperative, this paper presents an overview of AI risk assessment (identification and analysis) and management methodologies. It begins by reviewing the worldwide regulatory landscape that drives the need for systematic AI risk assessment. Then we characterize the spectrum of AI-related risks identified in the literature, from technical failures to ethical and social impacts. Subsequently, it reviews key risk assessment methodologies proposed for AI systems, focusing on general frameworks. The paper highlights best practices and illuminates methodological gaps, highlighting areas for further research on AI risk assessment.

• The paper presents a comprehensive survey of AI risk management frameworks under the EU AI Act and global regulatory initiatives.
• It evaluates various taxonomies and methodologies for risk assessment, highlighting integration challenges and gaps in empirical validation.
• The study underscores the need for continuous, adaptive risk governance to align technical practices with regulatory and ethical mandates.

Overview of AI Risk Assessment and Management within Regulatory and Organizational Frameworks

The paper "Overview of Risk Assessment and Management for Intelligent Systems under the AI Act and Beyond" (2607.02197) presents a comprehensive survey of the global landscape of AI risk management, with a focal analysis on the legal, methodological, and operational requirements imposed by the European Union’s AI Act (AIA). The authors offer an in-depth examination of frameworks, regulatory initiatives, systematic taxonomies, and emerging best practices, while critically evaluating lingering methodological gaps and practical limitations.

Foundations: Legal and Ethical Mandates for Trustworthy AI

The European Union’s approach to AI regulation, built upon the recommendations of the High-Level Expert Group on Artificial Intelligence (AI HLEG), operationalizes the triad of lawful, ethical, and robust AI as central pillars of trustworthy deployment. The seven requirements derived from these principles—ranging from human agency and oversight to transparency, fairness, and accountability—underpin the compliance demands of the AIA. These requirements are not only conceptual but are being codified in binding regulatory demands for organizations deploying AI systems, especially those classified as high risk.

The AIA introduces a four-category risk taxonomy: unacceptable, high, limited, and minimal/no risk. The classification corresponds directly to distinct sets of obligations, creating incentives for technical risk reduction and comprehensive lifecycle assessment. For high-risk AI, mandatory compliance includes demonstrable risk management systems, continuous risk assessment processes, technical documentation, and explicit safeguards for transparency, oversight, and robustness.

Figure 1: Overview of AI risk assessment as a module in the context of a general responsible AI framework.

International Regulatory Synthesis and Standardization

The survey provides detailed comparisons of regulatory strategies across jurisdictions, including the U.S. OMB Memorandum M-24-10, Canada’s Algorithmic Impact Assessment (AIA), China’s Interim Measures for Generative AI, and voluntary frameworks such as Singapore’s Model AI Governance Framework and the UK’s AI Regulation White Paper. Jurisdictional differences highlight the trade-offs between centralized, legally binding, process-oriented regimes and decentralized, sector-specific, or purely voluntary models.

A salient feature in the regulatory landscape is the intersection with established and emerging standards, including ISO/IEC 42001 for certifiable AI management, ISO/IEC 23894 for methodological risk identification and mitigation (aligned with ISO 31000 and NIST AI RMF), as well as domain-specific NIST guidelines and sectoral regulatory overlays (GDPR DPIAs, FDA SaMD protocols). This alignment enhances interoperability, auditability, and cross-sector comparability.

Taxonomies and Methodologies for AI Risk Assessment

The paper emphasizes a granular, taxonomy-driven approach to AI risk identification. Multiple recent frameworks are synthesized:

• Causal and Domain-Oriented Taxonomies: Risks are categorized by entity, intentionality, timing, discrimination, privacy, misinformation, misuse, human interaction, systemic failures, and societal and environmental externalities.
• Systemic and Social-Scale Taxonomies: Broader risks encompass economic disruption, environmental impact, democratic erosion, power shifts, and irreversible change, as mapped by recent works (e.g., [uuk2024taxonomy] and [critch2023tasra]).
• Technical and Non-Technical Risk Corpora: Coverage spans input/data risks, inference/model uncertainty, output/decision interpretability, robustness, privacy, and ethical or reputational vectors.

Methodological advances include the AI Risk Atlas, AI TRiSM, AIRA, DRESS-eAI, and KAIRI frameworks, which integrate structured stakeholder input, data/model-level risk decomposition, continuous monitoring, scenario-based evaluation, and regulatory principle operationalization. The AI RMF’s GOVERN-MAP-MEASURE-MANAGE schema is underscored as a linchpin for systematic, adaptive risk governance over the AI lifecycle.

Challenges and Methodological Gaps

The paper highlights persistent challenges constraining current AI risk assessment methodologies:

• Fragmentation and Lack of Empirical Validation: Current risk frameworks often remain theoretical or domain/taxonomy-specific, lacking validation in diverse organizational settings and applications.
• Multidimensional and Evolving Risk Profiles: The abstract, context-dependent nature of AI risks—compounded by rapid technological innovation, adversarial threats, and cascading system interactions—demands highly adaptive, interdisciplinary, and empirically grounded tools.
• Compliance-Driven versus Value-Driven Models: Regulatory compliance can drive minimum-viable risk assessments, but often fails to incentivize or capture holistic, stakeholder-driven, and longitudinal risk management approaches.
• Integration with Engineering Workflows: AI risk management practices must be concretely embedded in ModelOps pipelines, pre-deployment assessments, continuous monitoring, and post-market surveillance to achieve robust, scalable assurance.

Implications and Future Directions

Practically, the surveyed landscape compels organizations to implement dynamic, standards-aligned risk management ecosystems—integrating technical controls, continuous auditing, stakeholder engagement, and incident response into AI engineering pipelines. The proliferation of multimodal LLMs, vision-LLMs, and embodied agents escalates both technical and socio-technical risk profiles, intensifying the demand for robust bias detection, privacy preservation, and synthetic content provenance.

Research frontiers include:

• Quantitatively scalable risk assessment for general-purpose AI (e.g., LLMs, VLMs) and domain-specific applications (e-health, e-learning, gaming, document intelligence)
• Holistic bias quantification for multimodal and synthetic data systems
• Privacy-aware risk assessment and management, especially under membership inference and synthetic manipulation threats
• Methodological convergence between formal standards (ISO/IEC, NIST), regulatory protocols (AIA, FDA, GDPR), and engineering practice

Conclusion

This work delivers an authoritative synthesis of AI risk assessment paradigms, regulatory trends, and methodological innovations under the emerging legal mandates of the AI Act and aligned global frameworks. The survey identifies a strong movement toward integrating risk assessment as a central, modular component of responsible AI, underpinned by standardized principles and adaptive methodologies. However, the challenges highlighted by ongoing fragmentation, contextual complexity, and limited empirical grounding signal the necessity for continued cross-disciplinary research and operationalization. Future work must focus on empirically validated, domain-agnostic yet context-sensitive frameworks that can support robust, continuous, and accountable risk management for evolving intelligent systems.