Assessment · Governance · Assess and know

4Risk tiering and risk register

Which AI is high risk, and are those risks owned and treated?

Every AI system gets a risk tier and sits in one register mapped across frameworks.

AutomatedStakeholder interviewsUses your existing assessments 2 controls 3 engines

How we collect

AutomatedData class, autonomy and exposure from collected factsRuns today
Stakeholder interviewsQuestionnaire: 320 assessment questions scoped to each systemRuns today
Uses your existing assessmentsYour existing risk register as a CSV or spreadsheetNeeds your export or setup
Uses your existing assessmentsDirect import from ServiceNow, OneTrust or Credo AIPlanned

Status labels show what runs today, what needs an export or setup from you, and what is planned.

What you get

Risk tier per system with the reasons
Findings in condition, criteria, cause, consequence, fix form
One register mapped to NIST AI RMF, ISO/IEC 42001, the EU AI Act and 247 CSA AI controls

Questions we ask

Who is affected if this AI is wrong?
Can it act without a person?

We can start from

Existing risk registers as CSV or spreadsheet; direct ServiceNow, OneTrust and Archer imports are planned

Example output

Standards coverage

AICost-GovControl203

Framework	Requirements mapped	Met	Partly met	Not met
NIST AI RMF	All functions	Counted	Counted	Counted
ISO/IEC 42001	Clauses and Annex A controls	Counted	Counted	Counted
EU AI Act	Duties for your role and categories	Counted	Counted	Counted

Data sources

Source	What we read	Status
Questionnaire	The short interview for what data cannot show: purpose, owners, decisions AI informs, regulations in scope.	Runs today
Microsoft Graph and Entra ID	Service principals, OAuth grants, app registrations, sign-ins to AI apps, Copilot usage reports. Read-only scopes, metadata only.	Runs today

Executable policy

Controls switched on by tier: high tier gets review, evals and caps

Continuous checks

Re-tier when data class, autonomy or model changes

Engines that run it

EU AI Act Quick Check engine EU AI Act Readiness engine Governance Watch engine

Price and govern a workflow →

Built on governance engine modules

P9 LiveRegulation, Audit & Compliance

Which obligations apply to you, dated and watched?

Assess & Govern

P19 PlannedVertical Governance

What does your industry add on top, HIPAA, legal privilege, finance?

Assess & Govern

AICost governance controls in this module

AICost-GovControl201Runs today

Risk tier for every AI use

What it is

A consistent score for each AI use based on data sensitivity, decision impact, autonomy, users and regulatory exposure, mapped to a tier.

Why it is needed

Not every AI use needs the same controls. Tiers put effort where harm, spend and legal exposure are highest.

Why enterprises need it

Teams need to tell a meeting-notes assistant apart from an agent that changes customer records, and set controls to match.

What you get:Controls sized to the riskLow-risk uses approved fasterLegal classification checked where it applies

Run by: Regulation, Audit and Compliance engineEU AI Act Readiness engine EU AI Act Quick Check engine
Data: Questionnaire, Microsoft Graph and Entra ID
Evidence produced: Risk table: system, data sensitivity, decision impact, autonomy, users, regulatory exposure, tier, required controls.
Maps to: NIST AI RMF: Map, Measure; EU AI Act: risk categories; ISO/IEC 42001: risk assessment

AICost-GovControl203Partly automated

One risk register across frameworks

What it is

A single AI risk register that keeps the specific requirement of each framework: EU AI Act, NIST AI RMF, ISO/IEC 42001, GDPR and sector rules.

Why it is needed

Separate registers per framework duplicate work and hide gaps.

Why enterprises need it

Audit, legal and security teams can work from one list and still answer each framework in its own terms.

What you get:One register, many frameworksLess duplicate evidenceGaps visible across standards

Run by: Regulation, Audit and Compliance engineShared Responsibility RegisterAssurance Library engine Evidence Journal engine
Data: Questionnaire
Evidence produced: Risk register: risk, systems affected, framework references, likelihood, impact, control, owner, status.
Maps to: NIST AI RMF; ISO/IEC 42001; EU AI Act; GDPR

Frameworks


NIST AI RMF and NIST AI 600-1	Govern, Map, Measure and Manage activities, including the generative AI risks
ISO/IEC 42001	AI management system: policy, roles, risk treatment, suppliers, monitoring, internal audit, improvement
EU AI Act	Category and role per system, prohibited uses, high-risk duties, transparency, AI literacy, incident reporting

Stakeholders

Chief Risk OfficerComplianceCISO

← 3. Use-case value and priorities All modules 5. Regulatory applicability →

Vendor / Model	Field	Why it’s inferred
Anthropic — Claude Sonnet 4.6	`cachedInput`	Derived at 10% of input rate — Anthropic publishes 90% cache-hit discount on this tier.
Anthropic — Claude Sonnet 4.5	`cachedInput`	Derived at 10% of input rate; same 90% cache-hit convention as Sonnet 4.6.
Anthropic — Claude Sonnet 4.5	`batchInput`	Derived at 50% of standard input — Anthropic documents uniform 50% Batch discount.
Anthropic — Claude Sonnet 4.5	`batchOutput`	Derived at 50% of standard output — Anthropic documents uniform 50% Batch discount.
Anthropic — Claude Haiku 4.5	`cachedInput`	Derived at 10% of input rate — Anthropic 90% cache-hit discount convention.
OpenAI — GPT-5.4 Mini	`cachedInput`	Derived at 10% of input — OpenAI documents automatic 90% discount on cache hits across GPT-5.x tier.
OpenAI — GPT-5.4 Nano	`cachedInput`	Derived at 10% of input — OpenAI 90% cache-hit convention.
OpenAI — GPT-5.4 Nano	`batchInput`	Derived at 50% of input — OpenAI Batch API uniform 50% discount.
OpenAI — GPT-5.4 Nano	`batchOutput`	Derived at 50% of output — OpenAI Batch API uniform 50% discount.
OpenAI — GPT-5.4 Pro	`cachedInput`	Derived at 10% of input — OpenAI 90% cache-hit convention.
OpenAI — GPT-5.4 Pro	`batchInput`	Derived at 50% of input — OpenAI Batch API uniform 50% discount.
OpenAI — GPT-5.4 Pro	`batchOutput`	Derived at 50% of output — OpenAI Batch API uniform 50% discount.
OpenAI — GPT-5.2	`cachedInput`	Derived at 10% of input; no residency uplift.
OpenAI — GPT-5.2	`batchInput`	Derived at 50% of input.
OpenAI — GPT-5.2	`batchOutput`	Derived at 50% of output.
OpenAI — GPT-5	`cachedInput`	Derived at 10% of input.
OpenAI — GPT-5	`batchInput`	Derived at 50% of input.
OpenAI — GPT-5	`batchOutput`	Derived at 50% of output.
OpenAI — GPT-5.5 Pro	`cachedInput`	Derived at 10% of input — OpenAI does not publish a cached rate for *-pro models; using the family convention.
OpenAI — GPT-5.5 Pro	`batchInput`	Derived at 50% of input.
OpenAI — GPT-5.5 Pro	`batchOutput`	Derived at 50% of output.
OpenAI — GPT-5.2 Pro	`cachedInput`	Derived at 10% of input — pro-tier convention.
OpenAI — GPT-5.2 Pro	`batchInput`	Derived at 50% of input.
OpenAI — GPT-5.2 Pro	`batchOutput`	Derived at 50% of output.
OpenAI — GPT-5.1	`batchInput`	Derived at 50% of input.
OpenAI — GPT-5.1	`batchOutput`	Derived at 50% of output.
OpenAI — GPT-5 Pro	`batchInput`	Derived at 50% of input.
OpenAI — GPT-5 Pro	`batchOutput`	Derived at 50% of output.
OpenAI — GPT-5 Nano	`cachedInput`	Derived at 10% of input.
OpenAI — GPT-5 Nano	`batchInput`	Derived at 50% of input.
OpenAI — GPT-5 Nano	`batchOutput`	Derived at 50% of output.
Google — Gemini 3 Flash	`cachedInput`	Derived at 10% of input — Google caching discount convention ~90%.
Google — Gemini 3.1 Flash-Lite	`cachedInput`	Derived at 10% of input — Google caching convention.
Google — Gemini 3.1 Flash-Lite	`batchInput`	Derived at 50% of input — Google Batch API uniform 50% discount.
Google — Gemini 3.1 Flash-Lite	`batchOutput`	Derived at 50% of output — Google Batch API uniform 50% discount.
Google — Gemini 2.5 Pro	`cachedInput`	Derived at 10% of input.
Google — Gemini 2.5 Flash	`cachedInput`	Derived at 10% of input.
Google — Gemini 2.5 Flash-Lite	`cachedInput`	Derived at 10% of input — Google caching convention.
Google — Gemini 2.5 Flash-Lite	`batchInput`	Derived at 50% of input — Google Batch API uniform 50% discount.
Google — Gemini 2.5 Flash-Lite	`batchOutput`	Derived at 50% of output — Google Batch API uniform 50% discount.
xAI — Grok 4 (legacy)	`cachedInput`	Extrapolated at 25% of base.

Vendor / Model

Field

Why it’s inferred

Anthropic — Claude Sonnet 4.6

cachedInput

Derived at 10% of input rate — Anthropic publishes 90% cache-hit discount on this tier.

Anthropic — Claude Sonnet 4.5

cachedInput

Derived at 10% of input rate; same 90% cache-hit convention as Sonnet 4.6.

Anthropic — Claude Sonnet 4.5

batchInput

Derived at 50% of standard input — Anthropic documents uniform 50% Batch discount.

Anthropic — Claude Sonnet 4.5

batchOutput

Derived at 50% of standard output — Anthropic documents uniform 50% Batch discount.

Anthropic — Claude Haiku 4.5

cachedInput

Derived at 10% of input rate — Anthropic 90% cache-hit discount convention.

OpenAI — GPT-5.4 Mini

cachedInput

Derived at 10% of input — OpenAI documents automatic 90% discount on cache hits across GPT-5.x tier.

OpenAI — GPT-5.4 Nano

cachedInput

Derived at 10% of input — OpenAI 90% cache-hit convention.

OpenAI — GPT-5.4 Nano

batchInput

Derived at 50% of input — OpenAI Batch API uniform 50% discount.

OpenAI — GPT-5.4 Nano

batchOutput

Derived at 50% of output — OpenAI Batch API uniform 50% discount.

OpenAI — GPT-5.4 Pro

cachedInput

Derived at 10% of input — OpenAI 90% cache-hit convention.

OpenAI — GPT-5.4 Pro

batchInput

Derived at 50% of input — OpenAI Batch API uniform 50% discount.

OpenAI — GPT-5.4 Pro

batchOutput

Derived at 50% of output — OpenAI Batch API uniform 50% discount.

OpenAI — GPT-5.2

cachedInput

Derived at 10% of input; no residency uplift.

OpenAI — GPT-5.2

batchInput

Derived at 50% of input.

OpenAI — GPT-5.2

batchOutput

Derived at 50% of output.

OpenAI — GPT-5

cachedInput

Derived at 10% of input.

OpenAI — GPT-5

batchInput

Derived at 50% of input.

OpenAI — GPT-5

batchOutput

Derived at 50% of output.

OpenAI — GPT-5.5 Pro

cachedInput

Derived at 10% of input — OpenAI does not publish a cached rate for *-pro models; using the family convention.

OpenAI — GPT-5.5 Pro

batchInput

Derived at 50% of input.

OpenAI — GPT-5.5 Pro

batchOutput

Derived at 50% of output.

OpenAI — GPT-5.2 Pro

cachedInput

Derived at 10% of input — pro-tier convention.

OpenAI — GPT-5.2 Pro

batchInput

Derived at 50% of input.

OpenAI — GPT-5.2 Pro

batchOutput

Derived at 50% of output.

OpenAI — GPT-5.1

batchInput

Derived at 50% of input.

OpenAI — GPT-5.1

batchOutput

Derived at 50% of output.

OpenAI — GPT-5 Pro

batchInput

Derived at 50% of input.

OpenAI — GPT-5 Pro

batchOutput

Derived at 50% of output.

OpenAI — GPT-5 Nano

cachedInput

Derived at 10% of input.

OpenAI — GPT-5 Nano

batchInput

Derived at 50% of input.

OpenAI — GPT-5 Nano

batchOutput

Derived at 50% of output.

Google — Gemini 3 Flash

cachedInput

Derived at 10% of input — Google caching discount convention ~90%.

Google — Gemini 3.1 Flash-Lite

cachedInput

Derived at 10% of input — Google caching convention.

Google — Gemini 3.1 Flash-Lite

batchInput

Derived at 50% of input — Google Batch API uniform 50% discount.

Google — Gemini 3.1 Flash-Lite

batchOutput

Derived at 50% of output — Google Batch API uniform 50% discount.

Google — Gemini 2.5 Pro

cachedInput

Derived at 10% of input.

Google — Gemini 2.5 Flash

cachedInput

Derived at 10% of input.

Google — Gemini 2.5 Flash-Lite

cachedInput

Derived at 10% of input — Google caching convention.

Google — Gemini 2.5 Flash-Lite

batchInput

Derived at 50% of input — Google Batch API uniform 50% discount.

Google — Gemini 2.5 Flash-Lite

batchOutput

Derived at 50% of output — Google Batch API uniform 50% discount.

xAI — Grok 4 (legacy)

cachedInput

Extrapolated at 25% of base.

4Risk tiering and risk register

How we collect

What you get

Questions we ask

We can start from

Example output

Standards coverage

Data sources

Executable policy

Continuous checks

Engines that run it

Built on governance engine modules

AICost governance controls in this module

Frameworks

Stakeholders

Methodology

Primary sources

Inferred values (marked with * in calculator tables)

Immediate steps you can take