Running an AI Risk Assessment Workshop That Produces Decisions, Not Documents
A one-day structure for getting risk, legal, engineering and the business into the same register — and out with an owned treatment plan.
Risk workshops fail in a predictable way: they produce a comprehensive register that nobody owns and nothing changes. The fix is structural, not motivational.
The one-day shape
- Morning · Scope and classify. Walk the system inventory. Agree what is in scope before arguing about severity.
- Late morning · Harms, not hazards. Name who is affected and how, in concrete terms. "Model bias" is a hazard; "qualified applicants in one region are screened out" is a harm you can test for.
- Afternoon · Controls that exist versus controls you wish existed. Be brutal about the difference.
- Close · Named owner and a date, per risk. No exceptions, no "the AI committee".
A risk without an owner and a date is a note, not a treatment.
Invite the people who can say yes. A workshop composed entirely of delegates produces recommendations; a workshop with budget authority in the room produces decisions. Keep it to twelve people or fewer — beyond that, participation collapses into performance.