Assessment · Governance · Assess and know

4Risk tiering and risk register

Which AI is high risk, and are those risks owned and treated?

Every AI system gets a risk tier and sits in one register mapped across frameworks.

AutomatedStakeholder interviewsUses your existing assessments 2 controls 3 engines

How we collect

  • AutomatedData class, autonomy and exposure from collected factsRuns today
  • Stakeholder interviewsQuestionnaire: 320 assessment questions scoped to each systemRuns today
  • Uses your existing assessmentsYour existing risk register as a CSV or spreadsheetNeeds your export or setup
  • Uses your existing assessmentsDirect import from ServiceNow, OneTrust or Credo AIPlanned

Status labels show what runs today, what needs an export or setup from you, and what is planned.

What you get

  • Risk tier per system with the reasons
  • Findings in condition, criteria, cause, consequence, fix form
  • One register mapped to NIST AI RMF, ISO/IEC 42001, the EU AI Act and 247 CSA AI controls

Questions we ask

  • Who is affected if this AI is wrong?
  • Can it act without a person?

We can start from

Existing risk registers as CSV or spreadsheet; direct ServiceNow, OneTrust and Archer imports are planned

Example output

Standards coverage

AICost-GovControl203
FrameworkRequirements mappedMetPartly metNot met
NIST AI RMFAll functionsCountedCountedCounted
ISO/IEC 42001Clauses and Annex A controlsCountedCountedCounted
EU AI ActDuties for your role and categoriesCountedCountedCounted

Data sources

SourceWhat we readStatus
QuestionnaireThe short interview for what data cannot show: purpose, owners, decisions AI informs, regulations in scope.Runs today
Microsoft Graph and Entra IDService principals, OAuth grants, app registrations, sign-ins to AI apps, Copilot usage reports. Read-only scopes, metadata only.Runs today

Built on governance engine modules

P9 LiveRegulation, Audit & Compliance

Which obligations apply to you, dated and watched?

Assess & Govern
P19 PlannedVertical Governance

What does your industry add on top, HIPAA, legal privilege, finance?

Assess & Govern

AICost governance controls in this module

AICost-GovControl201Runs today
Risk tier for every AI use
What it is

A consistent score for each AI use based on data sensitivity, decision impact, autonomy, users and regulatory exposure, mapped to a tier.

Why it is needed

Not every AI use needs the same controls. Tiers put effort where harm, spend and legal exposure are highest.

Why enterprises need it

Teams need to tell a meeting-notes assistant apart from an agent that changes customer records, and set controls to match.

What you get:Controls sized to the riskLow-risk uses approved fasterLegal classification checked where it applies
Run by
Regulation, Audit and Compliance engineEU AI Act Readiness engineEU AI Act Quick Check engine
Data
Questionnaire, Microsoft Graph and Entra ID
Evidence produced
Risk table: system, data sensitivity, decision impact, autonomy, users, regulatory exposure, tier, required controls.
Maps to
NIST AI RMF: Map, Measure; EU AI Act: risk categories; ISO/IEC 42001: risk assessment
AICost-GovControl203Partly automated
One risk register across frameworks
What it is

A single AI risk register that keeps the specific requirement of each framework: EU AI Act, NIST AI RMF, ISO/IEC 42001, GDPR and sector rules.

Why it is needed

Separate registers per framework duplicate work and hide gaps.

Why enterprises need it

Audit, legal and security teams can work from one list and still answer each framework in its own terms.

What you get:One register, many frameworksLess duplicate evidenceGaps visible across standards
Run by
Regulation, Audit and Compliance engineShared Responsibility RegisterAssurance Library engineEvidence Journal engine
Data
Questionnaire
Evidence produced
Risk register: risk, systems affected, framework references, likelihood, impact, control, owner, status.
Maps to
NIST AI RMF; ISO/IEC 42001; EU AI Act; GDPR

Frameworks

NIST AI RMF and NIST AI 600-1Govern, Map, Measure and Manage activities, including the generative AI risks
ISO/IEC 42001AI management system: policy, roles, risk treatment, suppliers, monitoring, internal audit, improvement
EU AI ActCategory and role per system, prohibited uses, high-risk duties, transparency, AI literacy, incident reporting

Stakeholders

Chief Risk OfficerComplianceCISO
← 3. Use-case value and priorities All modules 5. Regulatory applicability →
📖 Data sources & methodology 172 text models · 9 embeddings · 44 vision · 62 audio · 8 vector DBs across 10 vendor pages · last verified 2026-10-18

Methodology

  • All prices are USD per 1 million tokens, current as of 2026-10-18.
  • Vendor-published values have no mark. Inferred/extrapolated values are marked with * and listed below.
  • Batch API discounts are 50% off standard rates across providers that offer Batch mode.
  • Prompt caching discounts vary by provider (typically 80-90% off cached input tokens).
  • Regional data-residency surcharges (Anthropic 1.1x, OpenAI 1.1x, Google regional tiers) are NOT included in base rates.
  • Long-context pricing tiers apply when input exceeds model threshold.
  • Embedding prices are input-only (no output tokens generated).

Primary sources

Last-verified date is the most recent successful daily snapshot (aicost_pricing_snapshots) or, when no snapshot exists yet, the latest successful crawler run (aicost_crawler_runs). 10 of 10 vendors are currently verified. Aggregator services (TokenCost, AI Pricing Guru, etc.) are not listed.

Anthropic
2026-10-18
https://www.anthropic.com/pricing
Daily snapshot since Sep 2023 · 704 days captured
Anthropic Docs
2026-10-18
https://platform.claude.com/docs/en/about-claude/pricing
Daily snapshot since Sep 2023 · 704 days captured
OpenAI
2026-10-18
https://openai.com/api/pricing/
Daily snapshot since Sep 2023 · 705 days captured
Google AI
2026-10-18
https://ai.google.dev/gemini-api/docs/pricing
Daily snapshot since Dec 2023 · 680 days captured
Google Vertex
2026-10-18
https://cloud.google.com/vertex-ai/generative-ai/pricing
Daily snapshot since Dec 2023 · 680 days captured
DeepSeek
2026-10-18
https://api-docs.deepseek.com/quick_start/pricing
Daily snapshot since May 2024 · 619 days captured
xAI
2026-10-18
https://x.ai/api
Daily snapshot since Nov 2024 · 537 days captured
Mistral
2026-10-18
https://mistral.ai/pricing
Daily snapshot since Dec 2023 · 678 days captured
Cohere
2026-10-18
https://cohere.com/pricing
Daily snapshot since Sep 2023 · 704 days captured
Voyage AI
2026-10-18
https://docs.voyageai.com/docs/pricing

Inferred values (marked with * in calculator tables)

Derived from industry conventions, not directly published by the vendor. Typical conventions: cached input = 10% of base (90% off), Batch API = 50% of base (50% off).

Vendor / Model Field Why it’s inferred
Anthropic — Claude Sonnet 4.6 cachedInput Derived at 10% of input rate — Anthropic publishes 90% cache-hit discount on this tier.
Anthropic — Claude Sonnet 4.5 cachedInput Derived at 10% of input rate; same 90% cache-hit convention as Sonnet 4.6.
Anthropic — Claude Sonnet 4.5 batchInput Derived at 50% of standard input — Anthropic documents uniform 50% Batch discount.
Anthropic — Claude Sonnet 4.5 batchOutput Derived at 50% of standard output — Anthropic documents uniform 50% Batch discount.
Anthropic — Claude Haiku 4.5 cachedInput Derived at 10% of input rate — Anthropic 90% cache-hit discount convention.
OpenAI — GPT-5.4 Mini cachedInput Derived at 10% of input — OpenAI documents automatic 90% discount on cache hits across GPT-5.x tier.
OpenAI — GPT-5.4 Nano cachedInput Derived at 10% of input — OpenAI 90% cache-hit convention.
OpenAI — GPT-5.4 Nano batchInput Derived at 50% of input — OpenAI Batch API uniform 50% discount.
OpenAI — GPT-5.4 Nano batchOutput Derived at 50% of output — OpenAI Batch API uniform 50% discount.
OpenAI — GPT-5.4 Pro cachedInput Derived at 10% of input — OpenAI 90% cache-hit convention.
OpenAI — GPT-5.4 Pro batchInput Derived at 50% of input — OpenAI Batch API uniform 50% discount.
OpenAI — GPT-5.4 Pro batchOutput Derived at 50% of output — OpenAI Batch API uniform 50% discount.
OpenAI — GPT-5.2 cachedInput Derived at 10% of input; no residency uplift.
OpenAI — GPT-5.2 batchInput Derived at 50% of input.
OpenAI — GPT-5.2 batchOutput Derived at 50% of output.
OpenAI — GPT-5 cachedInput Derived at 10% of input.
OpenAI — GPT-5 batchInput Derived at 50% of input.
OpenAI — GPT-5 batchOutput Derived at 50% of output.
OpenAI — GPT-5.5 Pro cachedInput Derived at 10% of input — OpenAI does not publish a cached rate for *-pro models; using the family convention.
OpenAI — GPT-5.5 Pro batchInput Derived at 50% of input.
OpenAI — GPT-5.5 Pro batchOutput Derived at 50% of output.
OpenAI — GPT-5.2 Pro cachedInput Derived at 10% of input — pro-tier convention.
OpenAI — GPT-5.2 Pro batchInput Derived at 50% of input.
OpenAI — GPT-5.2 Pro batchOutput Derived at 50% of output.
OpenAI — GPT-5.1 batchInput Derived at 50% of input.
OpenAI — GPT-5.1 batchOutput Derived at 50% of output.
OpenAI — GPT-5 Pro batchInput Derived at 50% of input.
OpenAI — GPT-5 Pro batchOutput Derived at 50% of output.
OpenAI — GPT-5 Nano cachedInput Derived at 10% of input.
OpenAI — GPT-5 Nano batchInput Derived at 50% of input.
OpenAI — GPT-5 Nano batchOutput Derived at 50% of output.
Google — Gemini 3 Flash cachedInput Derived at 10% of input — Google caching discount convention ~90%.
Google — Gemini 3.1 Flash-Lite cachedInput Derived at 10% of input — Google caching convention.
Google — Gemini 3.1 Flash-Lite batchInput Derived at 50% of input — Google Batch API uniform 50% discount.
Google — Gemini 3.1 Flash-Lite batchOutput Derived at 50% of output — Google Batch API uniform 50% discount.
Google — Gemini 2.5 Pro cachedInput Derived at 10% of input.
Google — Gemini 2.5 Flash cachedInput Derived at 10% of input.
Google — Gemini 2.5 Flash-Lite cachedInput Derived at 10% of input — Google caching convention.
Google — Gemini 2.5 Flash-Lite batchInput Derived at 50% of input — Google Batch API uniform 50% discount.
Google — Gemini 2.5 Flash-Lite batchOutput Derived at 50% of output — Google Batch API uniform 50% discount.
xAI — Grok 4 (legacy) cachedInput Extrapolated at 25% of base.

Pricing is cross-verified against the LiteLLM community registry when available. Daily snapshots are kept in aicost_pricing_snapshots; every change is logged to aicost_price_changelog with old & new values for full audit trail. Read the full methodology →