AI Risk Management: Unpacking Harm, Hazards, and Vulnerabilities

To deploy and operate AI-enabled systems that are safe, trustworthy, and assured, it is important to understand the distinct roles between risk, harm, hazard, and vulnerability. Though often used interchangeably, each of these terms plays a unique role in identifying, assessing, and mitigating potential harm in AI-enabled systems. Let’s break down these concepts to grasp their importance and how they support risk management.

Harm: The Negative Consequence

Harm refers to the negative consequences. These include (but are not limited to):

• Operations: Disruption of services, damage to infrastructure, diminished function, or operational setbacks.
• People and animals: Health and safety can be impacted.
• Human rights and breaches of law: Violations can have profound legal and ethical implications.
• Property and the environment: Damage can lead to financial loss and environmental degradation.
• Communities and society: The social fabric and community well-being can be adversely affected.

Vulnerability vs. Hazard

Of the terms discussed in this piece, vulnerability and hazard are the two most often used interchangeably. However, vulnerability is a subclass of hazards, with all vulnerabilities being hazards but not all hazards being vulnerabilities. 

• Vulnerability: Typically associated with (cyber) security, vulnerabilities are weaknesses that can be exploited to cause harm.
• Hazard: Any source of potential harm. Hazards can include vulnerabilities, but they are broader and can include things like design flaws or limitations that may lead to adverse outcomes.

Risk: How Bad is the Hazard?

Risk exists when a hazard has a concrete likelihood of causing harm. If a hazard has no current change of leading to harm, then there is no real risk present. For example, smallpox has been successfully eradicated for humans; therefore, people are not at risk for harm from smallpox.  However, when a hazard has the potential to cause harm, understanding the amount of risk it poses becomes important.

Two factors determine the magnitude of risk:

• Probability: The likelihood that the hazard will cause harm.
• Consequence: The severity of the harm if the hazard materializes.

The formula to assess risk is straightforward:

Level of Risk = Probability × Consequence

This formula allows for a structured approach to assessing risks. A common tool used in this process is the risk matrix, which helps organizations visualize the relative risk levels of hazards. In a risk matrix, hazards that are more likely to occur or that could cause severe harm are placed in higher risk levels, typically shaded in red or orange, while those with lower risk levels are positioned in the green zones. This visual representation helps organizations prioritize which risks need more immediate attention.

Risk Management: The End Goal

Risk management is the process of moving identified hazards into a lower level in the risk matrix, ideally into the green low-risk area. This is done throught processes and system improvements that either reduce the probability of harm or the severity of the consequence. 

The steps involved in effective risk management are:

• Identification: Identifying potential hazards and vulnerabilities.
• Assessment: Determining the risk level by evaluating the probability and consequences of identified hazards.
• Mitigation: Implementing strategies to reduce the likelihood and impact of harm.

By systematically managing risks, organizations can better protect their operations, people, property, and communities, thereby ensuring that AI-enabled systems are not only effective but also safe and trustworthy.

Conclusion

Understanding the distinctions between harm, hazard, vulnerability, and risk is crucial for deploying safe AI systems. By clearly defining these concepts and applying a structured approach to risk management, organizations can mitigate potential harm and ensure that their AI-enabled systems are safe and trustworthy. As AI-enabled systems become more capable, a strong foundation in risk management will be key to harnessing their benefits while minimizing harm.