How the risk level is set
Each question scores 0 (low risk) to 3 (high risk) across four areas: data (sensitivity, where it goes), impact (who sees the output, whether money moves, whether it can be undone), reliability (AI-generated content, exception rate, dependence on other systems) and oversight (monitoring and ownership).
- High risk: any single answer at the top of the scale for money, irreversible actions or special-category data, or a total of 60% or more. A person should approve outputs before they take effect.
- Medium risk: 35–59%. Automate, but with spot checks, alerts and an easy way to pause.
- Low risk: below 35%. Standard monitoring is enough.
Safeguards are recommended for each answer that scored 2 or more. This is a practical checklist, not legal advice. If personal data, health information, payments or regulated advice are involved, check your obligations properly (for example under GDPR or your industry’s rules).
Human in the loop, in practice
- Approve before sending: the automation drafts; a person clicks send. Good for customer-facing AI replies and quotes.
- Approve above a threshold: refunds under £50 go through; larger ones wait for a person.
- Review samples: a person checks a random 5–10% each week for low-to-medium risk workflows.
- Escalate exceptions: anything the automation cannot classify goes to a person rather than a guess.
Read automation mistakes that cost businesses time and money for real-world failure patterns, and check whether the process is worth automating at all with the Automation Suitability Scorecard.