Steps to Identify the Scope and Scale of AI Systems

Before an organization can effectively manage AI risks, it needs to identify its AI systems’ full scope and scale. This is where you assess where AI is being used, what risks it introduces, and how deeply it integrates with existing operations. 

Identify the Scope and Scale of AI Systems

1. Define AI Use Cases and Business Impact

Start by mapping out all AI-driven applications across your organization. Consider the following table of use cases to service at scoping:

AI Use Case	Examples	Potential Risk Level
Customer engagement and automation	Chatbots, AI-powered call centers, automated email responses	Low to Moderate (dependent on data handling)
Decision support systems	AI-driven hiring tools, credit risk assessments, medical diagnostics	High (direct impact on individuals)
Operational automation	AI-based data entry, workflow automation, supply chain optimization	Low to Moderate
Personalized recommendations	AI-powered content recommendations, e-commerce product suggestions	Moderate (depends on fairness and data privacy)
Fraud detection and security	AI for transaction monitoring, anomaly detection, cybersecurity threat identification	High (critical for compliance and financial security)
Predictive analytics and business intelligence	AI-driven market forecasting, risk analysis, and financial modeling	Moderate to High
AI in healthcare and life sciences	AI-assisted diagnoses, drug discovery, personalized treatment plans	Very High (regulatory and ethical considerations)
AI in legal and compliance	Contract review, AI-driven policy enforcement, regulatory compliance automation	High (due to legal liability and regulatory oversight)

2. Inventory AI Systems and Data Sources

To manage AI risks effectively, you need a clear view of all AI models and the data they rely on.

• List all AI-powered systems. Identify both in-house AI solutions and third-party AI tools integrated into business workflows.
• Assess data sources. Determine what data AI models use, including structured data (customer records, financial transactions) and unstructured data (text, images, voice data).
• Classify AI models based on risk. Rank AI systems by sensitivity level (e.g., low-risk automation vs. high-risk predictive models).