Lesson 1 of 5 · 15–25 minutes

Risk

🏠The everyday picture

Before opening a new service counter, a bank decides what the counter will and won't do, who may use it, what could go wrong, and who to call when it does. Then it trains staff and opens.

📘What it really is

Start with a one-page purpose and limits statement:
who it serves: for example, Sharma Textiles' customer-team staff (not customers directly, at first);
what it does: answers questions from approved company documents with sources; looks up a customer's summary for staff allowed to see it; drafts follow-up emails for approval;
what it must never do: give answers not supported by approved documents; reveal data a user can't see; send anything without approval; give legal, medical or financial advice; make decisions about people (credit, hiring, discipline);
who owns it: a named person responsible for its behaviour and the knowledge base.
An AI risk assessment (extending your Module 73 risk register):
wrong answers acted on (hallucination, outdated documents);
data leaks (across users, to the provider, through logs);
prompt injection through documents, notes or questions;
unapproved or wrong actions;
cost overruns and outages;
unfair or inappropriate outputs (tone, bias, language);
over-reliance: staff stop checking. For each: likelihood, impact, controls (from Modules 84 to 89), owner, and the test that proves the control works.
Decide the level of human oversight by impact: information answers with sources can go straight to staff; anything reaching customers or changing data goes through approval.
Good governance frameworks to borrow from: NIST's AI Risk Management Framework and ISO/IEC 42001 describe ways to manage AI risk; India's government has published AI governance guidelines. Take the practical ideas; a small team doesn't need the full machinery.

🖱️Try it

Write assistant-charter.md: purpose, users, allowed and forbidden behaviour, owner, and oversight level per feature. Add at least eight AI-specific risks to your risk register, each with controls and the test that proves them.

✅Quick check

Why write down what the assistant must never do?

Show the answer

It sets clear limits that design, prompts, tools and tests can enforce and check.

Name two AI-specific risks beyond ordinary security risks.

Show the answer

Any two: hallucinated answers acted on, prompt injection, over-reliance, unapproved actions, unfair or inappropriate outputs, cost overruns.