T2 — AI Risk Assessment — free template

Document Control

Field	Entry
Document ID	T2-AI-XXXX
Version	0.1
AI function / agent	name, registry ID
Linked T1 (intake)	T1-AI-XXXX, tier
Linked T3 (context of use)	T3-AI-XXXX
Risk facilitator	role
Date	YYYY-MM-DD

Risk Team (cross-functional, per Annex 22 §2.1)

Role	Name	Present
Process / clinical SME	name	Y/N
Quality / CSV	name	Y/N
Data scientist / AI engineer	name	Y/N
IT / platform	name	Y/N
Business owner	name	Y/N

Approvals

Role	Name	Signature	Date
Business owner	name	e-signature	date
SME	name	e-signature	date
Quality / CSV	name	e-signature	date

Revision History

Version	Date	Author	Change summary
0.1	date	author	Initial assessment

1. Context of Use (summary from T1 / T3)

Field	Entry
Decision supported
Question of interest
Component(s) assessed	from T1 Section 6
Posture per component	Cat 5 / Annex 22 / Pattern A
Human role	decides and signs / reviews each output / none
Input sample space and subgroups	sites, products, document types, defect classes, languages

2. Model Risk (FDA 2025 draft, Step 3)

2.1 Definitions

Level	Model influence	Decision consequence
Low	One of several inputs; independent evidence always reviewed; human decides	Wrong decision is caught downstream before any GxP impact; administrative only
Medium	Main input to a human decision; human review present but framed by the AI output	Wrong decision could affect a GxP record or delay a quality action, but is recoverable
High	Sole or determining input; automated action or minimal review	Wrong decision could reach a patient, a released batch, or a regulatory submission

2.2 Matrix

Influence ↓ / Consequence →	Low	Medium	High
High	Medium	High	High
Medium	Low	Medium	High
Low	Low	Low	Medium

2.3 Rating

Component	Influence	Consequence	Model risk	Rationale
C1	L/M/H	L/M/H	L/M/H
C2

3. Failure-Mode Library (AI-specific, pre-populated)

ID	Failure mode	Typical cause	Typical effect	Candidate controls	Gov.
FM-01	False negative on a critical subgroup	Rare subgroup under-represented in training or test data; threshold too high	Missed defect, drift, safety signal, or compliance finding	Stratified test set with critical subgroups; subgroup acceptance criteria (Annex 22 §4.2); confidence threshold with "undecided" (§9.2); periodic re-challenge	G6, G7
FM-02	False positives / alert flood	Threshold too low; noisy inputs	Alert fatigue; reviewers ignore real signals	Precision target; de-duplication; alert-fatigue KPI; feedback-driven suppression under change control	G4, G7
FM-03	Out-of-distribution input	New site, supplier, product, document type, or language outside the input sample space	Unreliable output that still looks confident	Documented input sample space (§3.1); OOD / input-drift monitoring (§10.4); scope checks that refuse or escalate	G4, G6
FM-04	Performance drift over time	Process, equipment, lighting, or population changes; model unchanged	Silent loss of sensitivity or precision	Performance monitoring on validated metrics (§10.3); periodic re-challenge; drift thresholds with a response playbook	G4
FM-05	Confidence mis-calibration	Model over- or under-confident; bands set on uncalibrated scores	Autonomy bands route wrong cases	Calibration test (reliability diagram, Brier score); boundary-case tests on each band	G4, G7
FM-06	Automation bias in human review	Reviewer trusts the AI output; high volume; draft frames judgment	HITL control ineffective; errors pass sign-off	HITL challenge test with seeded errors; acceptance-rate monitoring (flag > 98% sustained); reviewer training (§3.3)	G2, G7
FM-07	Bias or inequity across sites, products, or populations	Training data concentrated in some sites or populations	Unequal performance; wrong decisions for a subgroup	Subgroup metrics per site/product/population; bias monitoring; representative data plan	G8
FM-08	Test-data leakage	Test data used in development; staff with test access tune the model	Inflated validation result; real performance lower	Test-data independence, access control, audit trail, staff independence (Annex 22 §6)	G3, G6
FM-09	Prompt injection / adversarial input (agents, LLMs)	Instructions hidden in source documents or user input	Agent ignores policy, leaks data, or takes unintended action	Input sanitisation; instruction hierarchy; red-team test set; tool allowlist; output checker	G5, G7
FM-10	Tool misuse or unintended action (agents)	Model selects the wrong tool or wrong parameters, or loops	Wrong data written; wrong system touched; cost overrun	≤5-tool allowlist; deterministic orchestration where the path must be reproducible; read-only by default; rate limits and kill switch; trajectory tests	G5, G7
FM-11	Hallucination / unsupported claim (generative)	Model generates content not in the approved sources	False statement enters a GxP record or submission	Approved-source grounding; span-level citations; deterministic checker; refusal on unsupported claims; HITL	G1, G6
FM-12	Vendor or foundation-model change	Vendor updates or deprecates the model; silent behavior change	Validated state lost without a change record	Model version pinning; vendor change-notification clause; regression suite ready; change control on model swap	G6
FM-13	Non-reproducible output (probabilistic)	Sampling variability	Same case gives different answers; cannot reconstruct for an inspector	N-run testing with distribution acceptance; log the full output, version, and parameters per execution	G3, G6
FM-14	Configuration drift / unauthorised change	Prompt, threshold, or index edited outside change control	Untested behavior in production	Configuration control with detection of unauthorised change (Annex 22 §10.2); hash checks	G3, G6
FM-15	Label error in training or test data	Mislabelled ground truth	Model learns or is scored against the wrong answer	Multi-expert adjudication (§5.3); labeller attribution (ALCOA+); no AI-generated test labels (§5.6)	G1, G6

4. FMEA Table (ICH Q9(R1))

ID	Failure mode (use-specific)	Effect	S	P	D	RPN	Control(s)	Verified in (T6 test ID / T8 KPI)	S	P'	D'	Residual RPN	Accept?
FM-01													Y/N
FM-..

5. Control Mapping to the Governance Plane (G1–G8)

Category	Question it answers	Controls applied to this use
G1 Evidence provenance	Where did this come from?	approved sources, citations, data lineage
G2 Decision provenance	What did the human do, and why?	accept/modify/reject capture, rationale
G3 Traceability & audit	Can we reconstruct it for an inspector?	Part 11 trail, execution history
G4 AI observability	Is it behaving as validated?	metric, drift, calibration monitoring
G5 Identity & access	Who or what may touch it?	agent identity, tool allowlist, RBAC
G6 Validation & change control	How do we know it works, and what happens on change?	T6 tests, version pinning, predetermined changes (T9)
G7 Autonomy & safety	When does the human take over?	confidence bands, HITL gates, kill switch, degraded mode
G8 Responsible AI & regulatory	Would we explain this to a regulator?	subgroup/bias monitoring, DPIA, AI Act classification

6. Residual Risk Conclusion

Field	Entry
Highest residual RPN
Any residual S = 5 items?	Y/N — list with justification
Overall residual risk	Acceptable / Acceptable with conditions / Not acceptable
Conditions (if any)	e.g., advisory-only until 3 months of monitoring data; restricted to sites A–B
Required T6 depth	Low / Medium / High, per Section 2 note

7. Re-assessment Triggers

Change to intended use, context of use, output classes, or input sample space (e.g., new site, product, defect class, document type, or language)
Model retraining, recalibration, foundation-model version change, or vendor model change
Change to prompt, tool allowlist, thresholds, or confidence bands
Monitoring threshold breached (T8), or drift confirmed
Deviation, CAPA, complaint, or inspection finding involving the AI output
HITL acceptance rate outside the expected band (e.g., < 60% or > 98% sustained)
New or finalised regulation or guidance (e.g., final Annex 22, Annex 11 revision, final FDA AI guidance)
Periodic review (T10), at the tier frequency

Appendix A — Worked Example: UC-M2 CPV Signal Agent (illustrative)Illustrative worked example

Model risk (Section 2)

Component	Influence	Consequence	Model risk	Rationale
C1 SPC / capability engine	High	High	High	Determines which drifts are flagged; a miss can allow an out-of-trend batch to be released
C2 MSPC model (static PCA)	High	High	High	Only detector for multivariate interactions (e.g., a pH × temperature effect on glycosylation)
C3 Narrative LLM	Low	Medium	Low	Explains a signal the scientist can see on the chart; does not decide
C4 Orchestrator	Medium	Medium	Medium	Prioritisation and routing affect how quickly a signal is dispositioned

FMEA extract (Section 4; scores illustrative)

ID	Failure mode	S	P	D	RPN	Control	Verified in	P'	D'	Residual
FM-01	MSPC misses a real multivariate drift at a new site	5	3	4	60	Site-stratified held-out detection test; quarterly re-challenge with 25 seeded historical drifts; APQR cross-check	T6-ACC-03; T8-KPI-02	2	2	20
FM-02	Alert flood from benign seasonal raw-material variation	3	4	2	24	Precision ≥ 0.80 target; lot-effect specialist; feedback suppression under change control	T6-ACC-05; T8-KPI-01	2	2	12
FM-03	Batches from a new line fall outside the NOC envelope	4	3	3	36	Input-space monitor (> 5% outside NOC for non-process reasons → alert); model-transfer protocol (T9)	T8-KPI-03	2	2	16
FM-06	Scientists accept every signal disposition proposed by the agent	4	3	4	48	Acceptance-rate monitoring (flag > 0.98); quarterly seeded benign/real mix	T6-HITL-01; T8-KPI-04	2	2	16
FM-11	Narrative mis-states a Ppk value	3	3	2	18	Checker numeric-consistency rule; the chart is shown alongside	T6-GRD-01	1	1	3

Conclusion. Residual risk acceptable with conditions: advisory to MS&T only for the first 3 months of production, then the full signal routing. T6 depth: High (C1, C2); Low (C3). Re-assess on any new site onboarding.