AI Impact-Risk Prioritization Matrix

How to use this document

• What it is for. This is a base matrix to compare AI initiatives on common criteria, plotting the value they bring against the risk they create, and to decide which ones to pursue, which to condition, which to hold and which to drop. It is the only prioritization method of [ORGANIZATION NAME]: the "AI Use Case Portfolio" uses its scores and quadrant, not a calculation of its own.
• Who should own it. The AI lead maintains the method; system owners score value; the AI committee (or management, in small organizations) decides priority. Enter the function in [RESPONSIBLE FUNCTION] and the person in [OWNER].
• Decisions to take first. Before adopting it, decide whether to adjust the criterion weights (Section 6) and the quadrant thresholds (Section 7), which are given as indicative values; who scores risk independently (Section 8) and how often the prioritization session takes place.
• Fields to complete. Replace the bracketed fields, such as [ORGANIZATION NAME], [AI COMMITTEE], [REVIEW FREQUENCY] and [COMPLETE]. Keep [OPTIONAL] clauses only if they apply.
• Country variants. This document has no country variants. Adjust the screening gates in Section 4 to the laws that apply to your organization; see "Related regulatory references."
• Review. Ask Legal and the data protection officer to validate the screening gates and risk scales, and management (finance or strategy) to validate the value scales.
• Approval and publication. Have the AI committee approve it, record the approval in "Version history" and share it with whoever proposes AI initiatives so they prepare their scoring sheets on the same criteria.
• What it is not. The matrix ranks and documents portfolio decisions; it does not replace the impact assessment, the data protection impact assessment or each system's risk register. Its risk axis (R) is a prioritization score: it does not replace the risk level (Low, Medium, High or Unacceptable) from the "AI Risk Classification Matrix", which is what sets the approval lane.

AI Impact-Risk Prioritization Matrix

Field	Value
Organization	[LEGAL ENTITY NAME]
Function owning the method	[RESPONSIBLE FUNCTION]
Owner	[OWNER]
Deciding body	[AI COMMITTEE]
Approved by	[APPROVED BY]
Effective date	[DATE]
Review frequency	[REVIEW FREQUENCY]

1. Purpose

1.1 This matrix sets out how [ORGANIZATION NAME] compares and prioritizes AI initiatives by the value they bring and the risk they create, using explicit criteria, traceable scores and recorded decisions.

1.2 It aims to prevent two common mistakes: pushing initiatives forward out of novelty or pressure without measuring their risk, and blocking valuable initiatives out of fear without analyzing whether the risk can be controlled.

2. Scope

2.1 It applies to every proposed use of AI that requires resources, data or approval from [AI COMMITTEE], including:

a) AI systems developed in-house;
b) third-party AI tools or services integrated into business processes;
c) AI features switched on in products already under contract, when they change how data is processed or affect decisions about people;
d) extending an existing system to a new purpose, population or country.

2.2 Low-level productivity tools already authorized under the "Responsible AI Use Policy (Including Generative AI)" do not need to go through the matrix unless they are used for a new purpose.

2.3 Initiatives reach the matrix through the "AI Use Case Proposal Form" (state "Proposed") and are scored in state "Under assessment".