AI Risk Assessment

Why AI risk assessment is no longer optional

Every AI system that makes or influences decisions about individuals carries risk: risk of bias, risk of privacy violation, risk of non-compliance. In New York City, Local Law 144 mandates annual bias audits for employment AI. In the EU, the AI Act requires continuous risk management for high-risk systems. GDPR Article 22 adds protections against purely automated decisions. These are not separate problems — they are layers of the same obligation.

What we assess

Algorithmic bias and fairness. We evaluate whether your AI system produces differential outcomes across protected categories. For employment AI subject to LL144, this includes disparate impact analysis across race/ethnicity, sex, and their intersections (e.g., Hispanic women, Asian men). For EU-facing systems, we extend this to cover all characteristics protected under the EU Charter of Fundamental Rights. Our analysis goes beyond statistical parity to examine whether differential outcomes are justified by legitimate, documented criteria.

Data governance and privacy. AI systems are only as fair as the data that trains them. We assess data provenance, representativeness, completeness, and potential sources of bias. For systems processing EU personal data, we evaluate compliance with GDPR principles including data minimization, purpose limitation, and lawfulness of processing — and the additional data governance requirements of EU AI Act Article 10.

Transparency and explainability. The EU AI Act (Article 13) requires high-risk systems to be transparent enough for deployers to understand and supervise their output. GDPR Articles 13-14 require individuals to be informed about automated decision-making. LL144 requires candidate notification about AEDT use. We assess whether your system meets all applicable transparency obligations and recommend improvements where gaps exist.

Human oversight adequacy. Article 14 of the EU AI Act requires that high-risk AI systems be designed to enable effective human oversight. We evaluate whether your human-in-the-loop processes are substantive or merely procedural — because rubber-stamping AI outputs does not satisfy the requirement. We assess for automation complacency risk and recommend oversight structures that provide genuine control.

Regulatory coverage

A single Lexara risk assessment is designed to address obligations across multiple frameworks simultaneously. The following regulations are evaluated within a unified methodology:

NYC Local Law 144 — annual independent bias audit, publication of results, candidate notification, intersectional demographic analysis. Enforcement intensified following the NYS Comptroller's December 2025 audit findings.

EU AI Act (Annex III high-risk) — risk management system (Art. 9), data governance (Art. 10), transparency (Art. 13), human oversight (Art. 14), accuracy/robustness (Art. 15). Conformity assessment required by 2 August 2026 under the regulation as currently in force; the Digital Omnibus on AI provisionally agreed on 7 May 2026 proposes to defer this deadline to 2 December 2027 (Annex III stand-alone) and 2 August 2028 (Annex I embedded). Until the Omnibus is formally adopted and published in the Official Journal, the original deadline applies.

GDPR Article 22 — rights related to automated decision-making, right to explanation, right to human intervention. Applies in parallel with the AI Act for systems affecting EU individuals.

EEOC/Title VII — federal anti-discrimination framework applicable to employment decisions. Four-fifths rule for adverse impact analysis.

Deliverables

A comprehensive risk assessment report documenting: algorithmic fairness analysis with statistical methodology and results, data governance evaluation, transparency gap assessment, human oversight adequacy review, multi-regulatory compliance matrix showing which obligations are met and which require remediation, and a prioritized remediation plan.

Common questions

Related services