Which activities are included in the identification process for AI risk?

• A. Inventorying AI use
• B. Creating and reviewing AI-related loss event scenarios
• C. Inventorying AI use and creating and reviewing AI-related loss event scenarios
• D. Conducting vulnerability scans of AI systems

Answer: (C)

Identifying AI risk starts with two complementary activities: cataloging what AI is in use and outlining potential loss events that could result from that use. Mapping AI use gives you the scope—which models exist, what data they rely on, where they operate, who accesses them, and what processes depend on them. Imagining loss events then translates that scope into plausible outcomes—privacy breaches, biased or incorrect decisions, safety hazards, regulatory penalties, or financial losses—and ties them to the assets involved. This combination creates a clear picture of exposure and informs subsequent analysis of likelihood, impact, controls, and monitoring.

Vulnerability scans focus on technical weaknesses in AI systems, which is a different phase—more about identifying specific flaws rather than identifying the broader risk landscape and potential loss events.