Technology risk and ethics evaluator · free AI skill

Evaluates a proposed emerging technology deployment across seven risk dimensions — ethical, regulatory, security, privacy, operational, reputational, and strategic — producing a scored risk register with…

Purpose

Produce a defensible, scored risk assessment for a proposed emerging technology deployment — spanning ethics, regulation, security, and operations — so an executive can make a documented go/no-go decision and hand a governance body a prioritized mitigation plan instead of a vague concern list.

When to Use

Invoke this skill when the user asks to:

Assess the risks of adopting or deploying an emerging technology (AI model, biometrics, blockchain, autonomous systems, etc.)
Build a risk register or risk case for a technology decision
Prepare a responsible-AI or ethics sign-off for a proposed system
Evaluate a vendor or internal build against regulatory and security exposure
Create board- or committee-ready documentation for a technology investment
Decide whether to proceed, pilot, or halt an emerging tech initiative

Inputs Required

Before starting, collect:

Technology: What is being deployed — model type, platform, or system class
Deployment context: Where and how it will be used (internal tool, customer-facing product, decision-automation, etc.)
Affected populations: Who is impacted — customers, employees, regulated groups, vulnerable users
Data involved: What data the system ingests, produces, or infers, and its sensitivity
Jurisdictions: Markets/regulatory regimes the deployment touches (e.g., EU AI Act, GDPR, HIPAA, sector rules)
Decision autonomy: Human-in-the-loop, human-on-the-loop, or fully autonomous
Risk appetite: The organization's tolerance — conservative / balanced / aggressive

If jurisdictions or risk appetite are missing, assume multi-jurisdictional exposure (GDPR + EU AI Act baseline) and a balanced appetite, and note the assumption.

Instructions

Step 1: Scope and Classification

Establish the assessment frame before scoring:

Classify criticality: Is this a high-risk use case under prevailing frameworks (EU AI Act Annex III categories, NIST AI RMF profiles)? Flag if it touches employment, credit, biometrics, safety, or essential services.
Map the decision surface: What decisions does the technology make or influence, and what is the cost of a wrong decision to an affected person?
Set the scoring scale: Use Likelihood (1–5: Rare, Unlikely, Possible, Likely, Almost Certain) and Impact (1–5: Negligible, Minor, Moderate, Major, Severe). Risk Score = Likelihood × Impact (1–25).

Step 2: Evaluate Across Seven Risk Dimensions

For each dimension, identify 2–4 discrete risks. For every risk, capture: description, likelihood (1–5), impact (1–5), score, and a one-line rationale for the rating.

Dimension 1 — Ethical & Fairness Risk Bias, discriminatory outcomes, consent, transparency, dignity, and impact on vulnerable populations. Probe: Can affected people understand or contest a decision? Are outcomes equitable across protected groups?

Dimension 2 — Regulatory & Compliance Risk Exposure under applicable regimes (EU AI Act, GDPR, CCPA, HIPAA, sector-specific rules). Probe: Does this trigger conformity assessment, DPIA, or disclosure obligations? What is the penalty ceiling for non-compliance?

Dimension 3 — Security Risk Attack surface, model/data poisoning, adversarial inputs, prompt injection, supply-chain exposure. Probe: What can an attacker cause the system to do, and what is the blast radius?

Dimension 4 — Privacy & Data Risk Data minimization, inference of sensitive attributes, retention, re-identification, cross-border transfer. Probe: Does the system infer data it was never given, and can individuals exercise their rights?

Dimension 5 — Operational & Reliability Risk Model drift, failure modes, human override quality, monitoring gaps, dependency on a single vendor. Probe: How will you know the system is failing before a customer does?

Dimension 6 — Reputational & Trust Risk Public perception, media scenario, stakeholder trust, precedent-setting. Probe: What is the headline if this goes wrong, and how defensible is the decision in hindsight?

Dimension 7 — Strategic & Lock-In Risk Vendor dependency, irreversibility, opportunity cost, misalignment with organizational values or long-term posture. Probe: How hard is it to exit if the assessment turns out to be wrong?

Step 3: Build the Risk Register

Consolidate all identified risks into a single table sorted by score (highest first). Columns: Risk ID, Dimension, Risk Description, Likelihood, Impact, Score, Severity Band.

Severity bands: 1–4 Low, 5–9 Moderate, 10–14 High, 15–25 Critical.

Step 4: Heat-Map Summary

Produce a compact likelihood × impact distribution — count of risks per band and a plain-language summary of where the concentration sits (e.g., "concentrated in High regulatory and privacy risk").

Step 5: Prioritized Mitigations

For every High and Critical risk, provide: a specific mitigation (control, safeguard, or design change — not "monitor closely"), the residual score after mitigation, the owner function (e.g., Security, Legal, Product), and whether the mitigation is a precondition to launch or a post-launch action.

Step 6: Go / No-Go Recommendation

State a clear recommendation calibrated to the stated risk appetite: Proceed, Proceed with conditions (list the launch-blocking preconditions), Pilot with limits, or Do not proceed. Justify against the residual risk profile. Be decisive.

Output Format

Structure: Executive summary → scope classification → seven dimension analyses → consolidated risk register (table) → heat-map summary → prioritized mitigations (table) → go/no-go recommendation
Length: 1,100–1,500 words
Format: Structured document with two tables (risk register, mitigations); dimension analyses as labeled bullets
Sections: Executive Summary, Scope & Classification, Risk Dimensions (7), Risk Register, Heat-Map Summary, Prioritized Mitigations, Recommendation
Tone: Chief Risk Officer — measured, evidence-oriented, decisive; no hedging in the final recommendation

Quality Checklist

Before delivering output, verify:

[ ] All 7 dimensions are assessed with at least 2 discrete risks each
[ ] Every risk has a numeric likelihood, impact, score, and severity band
[ ] The risk register is sorted by score, highest first
[ ] Every High and Critical risk has a specific mitigation with a residual score and named owner function
[ ] The classification step flags whether the use case is high-risk under EU AI Act / NIST AI RMF
[ ] A single go/no-go recommendation is stated with launch-blocking preconditions named if conditional

Notes

The most commonly underweighted dimensions are Strategic Lock-In and Reputational Trust — force explicit scores rather than letting them default to Low.
If the deployment involves automated decisions about people, treat transparency and contestability as launch-blocking unless proven otherwise — regulators increasingly require them.
Residual risk, not inherent risk, should drive the recommendation; a Critical inherent risk with a strong mitigation may be acceptable, while a High risk with no viable control may not be.
When jurisdictions are ambiguous, default to the strictest applicable regime rather than the most convenient one.

How to use this skill

This file is a Claude Code skill in Anthropic's standard format — markdown with YAML frontmatter at the top.

Installing in Claude Code:

~/.claude/skills/<folder-name>/SKILL.md — auto-loads in every session anywhere on your machine (recommended for skills you'll use across multiple projects)
<your-project>/.claude/skills/<folder-name>/SKILL.md — auto-loads only when working in that project (recommended for project-specific skills)

Restart Claude Code or open a new session to register.

Using in Claude.ai, ChatGPT, Gemini, or other AI tools:

Drag this file into a new chat, or copy and paste its contents
Send your task or request as your next message — the AI will apply the skill where it fits

For Claude Code skill details: https://docs.anthropic.com/en/docs/claude-code/skills