Risk and reviews
Screen every AI system, rate the ones that matter, and record each review and approval. Effort goes where the risk is.
Screening first#
A short set of questions sorts systems quickly: does it use personal information, does it make or substantially help make decisions that significantly affect people, does it support a critical operation, can it act on its own. The answers are recorded, a rule suggests a rating, and a person confirms it.
Risk dimensions#
| Dimension | What it asks |
|---|---|
| Data sensitivity | Does it touch personal, financial or health information? |
| Autonomy | Does it recommend, decide with review, or act on its own? |
| External actions | Can it send, pay, change records or contact customers? |
| Financial impact | What is the cost of a wrong output or action? |
| Customer impact | Could a customer be treated unfairly or harmed? |
| Critical system access | Does it reach systems that support critical operations? |
Reviews and approvals#
A review records who checked what, when, and the outcome: a pre-deployment assessment, a periodic review, a security assessment or a change review. Approval to go live sits in the review, apart from the system's governance state, so "may we go live?" has a clear answer.
Obligations that apply#
From the control registry, each system shows the frameworks and obligations relevant to it, based on what it is and what it does. See Controls and obligations.
Automated decisions and the Privacy Act#
Screening flags systems that use personal information to make, or substantially help make, decisions that could significantly affect people. That supports your own assessment for the privacy policy changes that start on 10 December 2026. CognaOne helps you find and describe these systems; it does not certify compliance. See Privacy Act: automated decisions.
Reassess when things change#
When a release changes what a system can do, the assistant reads the change, proposes new answers with its sources and lists the controls that would follow. Ratings change only when a person confirms.