GOVERN-1.2 / RA-2 / A.8.2 NIST AI Risk Management Framework

Risk classification per use-case

Demonstrate that all AI systems, applications, and data-processing use-cases are assigned documented risk classifications that consistently reflect their impact on organizational assets and compliance requirements, and that security controls are appropriately scaled to each classification tier.

Description

What this control does

Risk classification per use-case requires organizations to categorize each AI system, application, or data-processing activity based on its potential impact to confidentiality, integrity, availability, and compliance obligations. Classifications drive tailored security controls, testing rigor, access restrictions, and monitoring thresholds appropriate to each use-case's risk profile. This control ensures high-risk use-cases (e.g., payment processing, PII handling, critical infrastructure) receive stronger protections than low-risk internal tools, optimizing resource allocation while preventing uniform, inadequate controls across diverse systems.

Control objective

What auditing this proves

Associated risks

Risks this control addresses

Uniform application of weak controls to high-risk systems due to lack of risk differentiation, enabling attackers to compromise sensitive data or critical operations
Over-investment in excessive controls for low-risk systems while under-protecting high-risk use-cases, leading to inefficient resource allocation and coverage gaps
Deployment of AI models in production environments without understanding bias, privacy, or safety risks specific to their use-case context
Failure to trigger mandatory compliance controls (SOC 2 Type II, PCI-DSS, HIPAA) when new use-cases introduce regulated data types
Insider threats exploiting unclassified systems to exfiltrate data or manipulate outputs in use-cases incorrectly assessed as low-risk
Inconsistent risk decisions across business units allowing identical use-cases to receive conflicting risk ratings and control requirements
Unauthorized use-case expansion (scope creep) where systems classified for one purpose are repurposed for higher-risk activities without re-assessment

Testing procedure

How an auditor verifies this control

Obtain the organization's risk classification policy or framework document defining classification tiers (e.g., critical, high, medium, low), criteria for each tier, and associated control requirements.
Request a complete inventory of in-scope systems, AI models, applications, and data-processing use-cases active during the audit period, including ownership, business purpose, and data types processed.
Select a representative sample across all classification tiers, ensuring coverage of AI/ML systems, customer-facing applications, internal tools, and third-party integrations.
For each sampled use-case, review the documented risk classification assessment including methodology applied, data sensitivity analysis, business impact evaluation, and regulatory applicability determination.
Verify that classifications are assigned by qualified personnel (risk management, data protection officers, or cross-functional review committees) and include approval records or sign-offs.
Cross-reference assigned risk classifications against implemented security controls to confirm alignment with policy requirements (e.g., high-risk systems have MFA, encryption at rest, enhanced logging).
Interview system owners and risk assessors to evaluate consistency of classification decisions across similar use-cases and identify any unclassified or improperly classified systems.
Review change management or project initiation records to confirm new use-cases undergo risk classification before production deployment and existing classifications are periodically re-evaluated.

Evidence required Collect the risk classification policy document with defined tiers and criteria; the complete use-case inventory with assigned classifications; risk assessment worksheets or decision records for sampled use-cases showing evaluation methodology and approvals; control mapping matrices linking classification tiers to required security controls; and change management tickets or project approval records demonstrating classification occurs during system onboarding and periodic reviews.

Pass criteria All sampled use-cases have documented, current risk classifications assigned using the organization's defined methodology, classifications are approved by appropriate personnel, and implemented security controls align with the requirements specified for each classification tier.

Where this control is tested

Audit programs including this control

AI Model Risk & Governance

Whether you train, fine-tune or just consume models, you need governance — inventory, risk classification, human oversight, evaluation.