Skip to main content
A risk assessment is a point-in-time evaluation of a specific risk, backed by actual test execution data. Assessments are how you turn “we identified this risk” into “we measured it, here’s the evidence, here’s our analysis.” EU AI Act Article 9 requires risk management to be continuous and iterative — meaning you don’t assess once and walk away. You assess again whenever new information comes in: new test results, a model update, a production incident, or a new mitigation being verified.

​
When to create an assessment

You’ll typically have multiple assessments per risk over its lifetime — that’s the whole point.

​
What’s in an assessment?

​
Creating an assessment

1

Open the risk

From the Risk Register, click the risk you want to assess.
2

Click 'New Assessment'

Inside the risk’s detail view, on the Assessments tab.
3

Pick the assessment type

Initial, periodic, post-mitigation, post-incident, or pre-deployment.
4

Link test runs

Two ways:
  • By category — pick a prompt category and a date range. Alethia auto-links every test in that category from that period.
  • Manually — pick individual test runs from a list.
Alethia immediately calculates aggregate metrics: total, safe, unsafe, inconclusive, failure rate.
5

Write your findings

Required field. This is your interpretation as the human assessor — the thing only you can write.Examples of what to include:
  • “Failure rate of 18% in bias_and_fairness is unchanged from the prior assessment. The pattern of failures is concentrated in age-related questions, suggesting bias toward older candidates.”
  • “Post-mitigation failure rate dropped from 23% to 4%. The mitigation appears effective. Recommend keeping the rule and re-testing in 90 days.”
6

Recommend actions (optional)

What should happen next? Examples:
  • “Add a model output filter for age-related responses.”
  • “Re-train the model with a balanced age distribution.”
  • “Acceptable residual risk — no further action.”
7

Update likelihood / impact (optional)

If the new evidence changes how you view the risk, you can update the scores. The risk’s inherent_risk_score doesn’t change — but the assessment captures your updated view, and the residual risk score can change if you re-link mitigation evidence.
8

Save as draft, then submit for approval

Drafts are visible only inside the risk. Submit when you’re ready for a Team Admin to review.

​
Approval

For high-risk projects, assessments need a Team Admin’s approval before they’re considered final. The Team Admin can:
  • Approve — the assessment is locked; changes require a new assessment
  • Reject — sends it back as draft for revisions
Approved assessments cannot be edited (only superseded by a new assessment). This preserves the audit trail.

​
How assessments use test data

When you link test runs to an assessment, Alethia counts each one using its effective verdict — the human override if any, otherwise the AI consensus verdict. This means:
  • Failure rate is calculated on what humans actually decided, not raw AI output
  • Human review work shows up in your assessments automatically
  • The same tests can be linked to multiple assessments (e.g., an initial assessment AND a periodic one a month later)

​
Tracking risk evolution

The whole point of multiple assessments is to see how a risk changes over time. On the risk’s detail page, you’ll see a timeline:
This timeline is exactly what an Article 9 audit asks for: evidence of a continuous, iterative process.

​
Linking entire categories at once

For periodic assessments, the most efficient pattern is:
1
Set up a recurring scheduled test on the relevant prompt category.
2
Once a month, create a periodic assessment.
3
Use Link by category with a 30-day date range — every scheduled run from that month is auto-linked.
4
Write your findings, submit for approval, done.
This turns a tedious monthly compliance ritual into a 10-minute task.

​
Audit trail

Every assessment action — creation, edits, linking tests, submission, approval, rejection — is logged with full before/after snapshots in the project’s risk audit log.