← Back to concept explainers

Concept Fable

Risk assessment

Conclusion first:Risk Assessment is the identification, analysis and grading of potential risks in an AI use case or system, determining possible harm, compliance obligations, probability, severity and required controls. Enterprise Agent risk assessment must cover data sensitivity, permission scope, automated actions, customer impact, error reversibility, model uncertainty, vendor dependency and human oversight. Its output should feed into the risk register, control design, go-live approval and continuous monitoring, not stop at a one-off questionnaire.

Risk Assessment · Risk Management

Read the story first. There is no rush to give a definition here; let the question grow on its own first.

Fable

Before the new bridge broke ground, the stonemason first counted where it would collapse

The mountain town used to have only a wooden bridge, where pedestrians walked slowly and at most two carts could cross at a time. The bridge grew old, and the mayor wanted to build a new bridge that could let carriages and cargo teams cross at the same time.

The merchant urged them to start work, and the stonemason said the drawings were not difficult. The mayor almost released the funds directly, because everyone saw the speed the new bridge would bring, but no one seriously discussed the harm it might cause.

Someone suggested making the bridge railings higher, as a precaution. But railings can only stop people from falling; they cannot stop floods, overloaded convoys, nighttime missteps, material substitution or absent maintenance.

During the first trial, three salt carts went onto the bridge at the same time. The bridge deck did not collapse, but the piers were cracked. The town mayor then realized that a single safety measure could not cover different risk scenarios, and that no major accident had occurred only by luck.

The stonemason paused work and laid out the risks one by one: who will use the bridge, what cargo will it carry, what is the worst consequence, how likely is it to happen, who will be affected, what controls are needed, and which risks will remain even after reinforcement.

They divided ordinary pedestrians, heavy vehicles, rainstorms, and night market peaks into different levels. High-risk scenarios added weight limits, inspections, night lights, and bridge closure rules, while low-risk scenarios no longer piled on meaningless checks.

The new bridge was completed ten days late, but with far fewer arguments afterward. Every important decision had a reason: why it was allowed, why it was restricted, why manual watch was needed, why some situations required temporarily closing the bridge.

The mayor understood that counting dangers before construction is not a ritual that slows building. It is about making possible harm, severity and control measures clear before speed arrives, so the new bridge does not bear load on luck. The stonemason also wrote each control down for the bridge keeper to see. Who checks the weight-limit sign, who fills the night lamps with oil, who has the authority to close the bridge in a storm—none of this can remain only on the drawings. If a risk has no owner, it will turn back into unaccountable panic when it truly arrives. After the new bridge opened, the mayor still kept that risk table. It was not a document for completion, but a shared basis for later inspections, adjusting weight limits, adding lamps and closing the bridge. Later, during the review, everyone wrote this lesson into daily rules: first look at where on site the outcome truly changed, then decide what to keep, what to repair and what to restrict. If you look only at surface busyness, you will fall in the same place next time.

Reveal

This story is about: risk assessment

Risk Assessment is the identification, analysis and grading of potential risks in an AI use case or system, determining possible harm, compliance obligations, probability, severity and required controls. Enterprise Agent risk assessment must cover data sensitivity, permission scope, automated actions, customer impact, error reversibility, model uncertainty, vendor dependency and human oversight. Its output should feed into the risk register, control design, go-live approval and continuous monitoring, not stop at a one-off questionnaire.

What matters is that it is not just a term, but a structural problem that repeatedly appears in real AI / Agent systems. Understanding it lets you judge when to add a model, when to change a process, and when to add governance.

Metaphor mapping

  • New bridge: AI / Agent use cases preparing to go live
  • Higher railing: shallow patches targeting only a single risk
  • Salt carts crack the bridge piers: new risks exposed after automation scales up
  • Lay it out item by item: identify risk scenarios, affected objects, probability, and severity
  • Weight limits, inspections, night lights, bridge closures: design controls by risk level
  • Reasons for permission and restriction: risk assessment supports go-live decisions
  • Risk remaining after hardening: residual risk

Andy Ren Xu's judgment

The practical value of this concept is that it helps you break "AI features that look smart" into deliverable, verifiable, and governable units of work.

impact assessmentDPIAAI impact assessmentrisk classification

Related distinctions

This concept is easily confused with adjacent concepts; it is recommended to continue to the comparison page.

京ICP备2026014272号