Platform
AI risk assessments that keep up as your systems change
Aicura's AI risk assessment rates each AI system and agent when you add it to the register, explains the rating and suggests controls for every risk it finds. When a system changes in a way that matters, it is assessed again. Impact assessments add who the system affects and how.
Included in Essentials, Pro and Enterprise. Impact assessments are in Pro. Compare plans
Start from a draft, not a blank spreadsheet
A new AI tool goes live next month and someone has to assess it. By hand that means a spreadsheet, a framework you are half sure you are reading correctly and a lot of analyst time for every system. Aicura drafts the assessment from what the register already knows, and your people review it and make the call.
Assessed when added, assessed again when it changes
Adding a system to the register starts its first risk assessment. A change that matters saves a new version of the system and runs the assessment again. You can also run one whenever you choose from the system's assessment history.
Each run reads a fixed copy of the system as it stood at that moment, so the assessment always describes what was actually assessed.
A rating with its reasons
Each assessment opens with an overall rating of Low, Moderate, High or Critical and the reasons behind it, then the risk tier and the level of human oversight that goes with it. A system with no completed assessment reads Not Assessed and is never assumed to be low risk.
- Risks across areas such as security, bias and fairness, privacy and data protection, reliability, transparency, accountability and human oversight.
- Each risk carries its own rating, a written rationale and suggested controls.
- A written risk summary sits beside the details of the version assessed, and the run waits for a person to review it.
Pro
See who a system affects, and how
An impact assessment asks who the system affects and how. It opens by naming the system owner, the executive accountable, the privacy lead and any external review, each drawn from the register or flagged where the register names nobody.
Written sections follow on the rights affected and how each is protected, documentation and traceability, misuse and unintended actions. The Impact tab counts the rights and mitigations for every system.
All your AI risks and controls in one place
Risks and Controls gathers what the assessments produced into one set, grouped by the system each risk belongs to. Every time you publish it, the set keeps its earlier versions.
- Each risk carries its rating, a position and the controls that address it.
- Each control tracks separately whether it applies, whether it is in place and whether it has been tested.
- Actions, sign-offs (attestations) and the set's own evidence sit beside it. Publishing saves a new version.
Pro
Keep your GRC platform in step
GRC Connect copies risks, controls and actions to ServiceNow GRC, so risk teams can keep working where they already track risk. Before the first run, map where your records live, which fields carry across and what the values become. Every sync shows on the set's Sync tab, and comments made in ServiceNow GRC appear on the risk.
Frameworks
Frameworks in each plan
In Settings you choose which frameworks Aicura applies to your assessments and reviews. The frameworks available depend on your plan and your country. These apply in every country, and your country's pricing page lists its own.
Pro
- ISO/IEC 42001:2023
- NIST AI RMF 1.0
- NIST SP 800-218A secure generative AI development
Questions
What does AI risk assessment software do?
AI risk assessment software checks each AI system against a structured set of risk areas, such as security, fairness and privacy, and records the result. Aicura assesses every AI system and agent when it is added to the register, gives it an overall rating with the reasons, lists each risk with suggested controls, and assesses it again whenever the system changes in a way that matters. The results roll into one published set of risks and controls.
What is the difference between an AI risk assessment and an AI impact assessment?
An AI risk assessment asks what could go wrong with the system and how serious it would be. An AI impact assessment asks who the system affects and how, which of their rights are affected and what reduces the harm to them. Aicura runs both against the same system on its AI register. Its impact assessments open with who is accountable and count the rights and mitigations they identify.
Does Aicura give us a compliance score?
No. Each Aicura risk assessment gives a system a risk rating of Low, Moderate, High or Critical, with a written rationale and the risks behind it. That is a risk rating for one system, not a compliance score, a certification or legal advice. Assessment output is guidance for your judgement. Nothing in Aicura approves or refuses a system.
How do AI risk assessments stay current?
In Aicura, adding a system to the register starts its first risk assessment automatically. Saving a change that matters keeps the old version, saves a new one and re-runs the assessments that depend on it. You can also run an assessment whenever you choose. Every run is kept in the system's assessment history, with the version it read and the rating it gave.
Which frameworks do assessments use?
You choose the frameworks Aicura applies to its assessments in Settings, from those your plan includes. The frameworks available depend on your plan and your country, and your country's pricing page lists which plan carries each one.
Run your first assessment
Add a system to the register and its risk assessment starts straight away. Review the rating, the risks and the suggested controls, then publish them as one set.