Example 1: Aluminum annealing optimization, adaptive control and product routing
An AI system impact assessment and an AI risk assessment for one connected system with four decision points. The two analyses sit in separate sections and link by ID: impacts describe what could happen to whom, risks describe how likely it is and what controls change that.
Approval decision
Approved with conditions Advisory use only. The system may analyze history, run in shadow mode, and recommend recipes and loads for human approval. It may propose new matrix entries, which stay labeled unverified until people promote them on verified outcomes. It has no control authority, no fault-recovery authority, and no release authority. Three permissions are restricted and two are not approved.
Decision recorded per permission, with conditions, owners and reassessment triggers, on the Decision tab.
Needs attention
Open points that shape the decision.
Assessment record
- System
- Annealing Optimization, Adaptive Control and Product Routing Assistant (illustrative)
- Organization and role
- Northfield Aluminum, Rolling Plant 2 (fictional). In-house build, so the plant acts as both provider and deployer in the EU AI Act sense.
- Intended purpose
- Improve consistency, reduce avoidable scrap, and match product to suitable downstream applications. These are objectives, not demonstrated results.
- How it works
- The system does not hold a complete set of instructions. Where a product, material or load is not covered by an existing entry, it infers the output needed, states its assumptions, proposes a recipe, assesses it, and adds it to its recipe and routing matrices. The matrices are never complete and grow with every new product and cycle, so AI assistance is needed continuously.
- Out-of-scope uses
- Designing or qualifying the annealing process. Certifying or releasing product. Any safety function or protective system. Treating an AI-proposed, unverified entry as an established recipe.
- Lifecycle stage
- Pre-deployment evaluation
- Affected parties
- Furnace operators and maintenance personnel. Metallurgy and quality staff. Production planners. Downstream customers and their workers. The local environment. The business.
- Assessment type
- AI system impact assessment (Impact tab) and AI risk assessment (Risk tab), kept separate and linked by ID.
- Assessed on
- Oct 19, 2026. Review due by Jan 19, 2027, or earlier on a change trigger.
Open Example 2: a vendor-supplied digital twin of the same furnaces. It can supply thermal estimates to this system, which this assessment treats as a dependency.
Real versus fictional: the plant, system, people and ratings are invented for this sample. Process details are deliberately generic, and no operating parameters appear. Standards and regulations are named to show alignment, not to claim conformity. Verify every reference against its current official text before relying on it.
System and authority
Four capabilities, each with its own requested and approved authority. Success at predicting properties does not by itself justify live control or automatic product disposition, so each is assessed separately.
What this assessment assesses
Because the matrices are never complete, this assessment covers the process by which the system grows, not a fixed set of entries: how it makes assumptions, how its proposals are labeled, tested and promoted, and who decides. It is a living assessment, reviewed on a schedule and on triggers. Individual entries are not assessed one by one.
Life of a matrix entry
Only verified entries are treated as established. A digital twin (Example 2) can pre-screen a proposed entry and rule it out. It cannot verify one, because the twin and the generator can share the same blind spots.
Capabilities
| ID | Capability | Inputs | Output | Requested | Approved |
|---|
Is it AI?
What makes this AI is inference. Where the matrices have no instructions for a case, the system infers the output needed and proposes a recipe, instead of looking one up or following a rule that people wrote. Looking up a verified entry is automation. Proposing one that does not exist is inference, and it needs testing and monitoring, not just verification.
The determinations below are provisional for this illustrative sample. Confirm each with the developer. EU AI Act Art. 3(1) and recital 12 separate inference from rules defined solely by people. Verify current wording.
| Component | Technique (assumed) | Infers from data? | Determination | Confirm with the developer |
|---|---|---|---|---|
| Inferring the output needed and the assumptions to make | A model that infers a target and fills gaps in incomplete inputs | Yes | Likely AI | How targets and assumptions are produced, and what the system may never assume. |
| Recipe and load planning for cases not in the matrix (C1) | A model that proposes cycle parameters and placement | Yes: it infers beyond stored entries | Likely AI | Method, training data, and limits on distance from verified entries. |
| Matrix population and expansion (C5) | Generates, assesses and adds entries | Yes | Likely AI | Whether one model both generates and assesses. Independent checks are needed either way. |
| Property prediction (C3) | A model learned from historical outcomes, or a physics-based calculation | Likely yes | Likely AI | Whether the model is learned or physics-based. |
| Adaptive process control (C2) | Classical adaptive control, or a learned model | Depends | To be determined | Classical adaptive control is not AI. A learned model that adjusts settings is. |
| Product routing (C4) | A fixed rule on a prediction, or a learned ranking | Depends | To be determined | A fixed rule on an AI prediction inherits the prediction’s risk. |
| Hard limits, interlocks and release status | Deterministic limits and rules | No | Not AI, still governed | IEC 61508 and IEC 62443 still apply. |
Authority levels
Authority level is a Zeno term, not taken from a standard. It describes what the AI may do and relates to human-AI configuration (NIST AI RMF) and human oversight (EU AI Act Art. 14). Chips show where each capability is approved.
Boundary against the safety layer
Product recovery is subordinate to personnel safety, equipment protection and applicable product-quality requirements. The AI system sits outside the safety function. It cannot bypass, modify or override interlocks, protective systems or established fault responses, and none of them may depend on it.
Furnace hazards exist with or without AI. This assessment asks one question about them: does the AI change, bypass or weaken any independent protective layer? Safety design belongs to qualified process, controls and safety engineers.
What a temperature record means
Furnace temperature is not automatically product temperature. Zone readings are not treated as proof of each product’s thermal history.
| Record type | Basis | How the system treats it |
|---|---|---|
| Commanded setpoint | Commanded | An instruction, never evidence of what was achieved. |
| Furnace-zone temperature | Measured | Evidence about the zone. Not evidence about every product in it. |
| Load or material temperature, where fitted | Measured | Strongest available evidence, limited to the measured positions. |
| Temperature inside the product | Estimated | Model output with stated uncertainty. Labeled as an estimate everywhere it appears. |
| Missing, suspect or reconstructed values | Reconstructed | Flagged. Where the basis is insufficient, the system abstains and refers for review. |
Regulatory classification
To be determined EU AI Act risk category.
No Annex III use case obviously applies to an industrial heat-treatment process. Whether the system is a safety component of machinery, which could bring it under Art. 6(1) and Annex I (for example via Regulation (EU) 2023/1230), depends on its role and needs legal and conformity-assessment review. Until that is settled, this sample uses the requirements for high-risk systems (Art. 9 to 15) as a good-practice reference.
Art. 27 (fundamental rights impact assessment) is tied to Annex III uses and is not applied here. Standards this assessment points to, without claiming conformity: IEC 61508 and ISO/IEC TR 5469 (functional safety and AI), ISO 12100 (machinery risk assessment), IEC 62443 (industrial control system security), and domain furnace-safety and pyrometry requirements.
Impact analysis
What could happen to whom. Severity is the worst credible outcome before controls and is rated without regard to likelihood. Likelihood and controls are handled only on the Risk tab.
Impact categories and severity scales
Severity is rated per category. The highest category rating drives an impact and ratings are never averaged across categories.
| Impact category | Harm type (NIST AI RMF) | 1 Minor | 2 Moderate | 3 Major | 4 Severe |
|---|
Intended benefits
Benefits are part of an impact assessment, but they are objectives here, not results: more consistent treatment, less avoidable scrap, better matching of product to suitable applications. None is claimed as established.
Impact register
Risk analysis
How likely each failure is and what changes that. Each risk links to the impacts it threatens and takes its severity from the most severe linked impact. Inherent risk is before controls and residual risk is after them.
Risk matrix
Scales and acceptance rules are on the Method tab.
Risk register
Worked scenario: a zone-heating disturbance
A heating zone underperforms during a cycle in a simulated batch. The same six steps are shown under the current approval and under a hypothetical where control authority were enabled. The point is the evidence question and the authority boundary at each step, not operating instructions.
What would have to be true before control authority is considered
- A separate assessment covering that permission, not an extension of this one.
- A validated operating envelope with limits enforced outside the model.
- Independent confirmation that protective functions do not depend on the AI.
- Evaluated disturbance cases and fault-injection testing run by controls engineering.
- Operator training and a defined, rehearsed way to revert.
- Concurrence from the Site EHS Manager, Controls Engineering and Quality, with the accountable executive.
Decision and conditions
A staged decision. Each permission is decided separately, because approving the system to advise is not approval to act.
Permissions
| ID | Permission | Level | Decision | Conditions and evidence required | Risks | Approver |
|---|
Residual risk acceptance
| Risk | Residual | Treatment decision | Accepted by |
|---|
Conditions of approval
- Outputs are labeled as estimates with their data basis and uncertainty wherever they appear.
- The system abstains and refers for review when a never-assumed input is missing, or when a case falls beyond the limit on how far an AI-proposed entry may sit from verified entries.
- AI-proposed entries are labeled unverified, show their assumptions, and need human approval and a trial under instrumented load before first production use.
- Only people promote an entry to verified, on specification-specific outcomes. Unverified entries never seed other entries or count as evidence.
- Operators can decline any recommendation without penalty, and the decision is recorded.
- The system has no write path to product release status or to any protective function.
- Every batch record carries the model version, the recommendation, the human decision and the decider.
- Post-deployment monitoring compares shadow predictions with verified outcomes and reports to the AI Governance Lead.
Reassessment triggers
- A new alloy or safety-relevant application, a new furnace, or any change to instrumentation or sensor placement. Routine new entries that pass the approval gate are not triggers.
- A new version of the model, recipe logic or routing logic, or any unauthorized change.
- A change to the generation method, the approval gates or the promotion criteria.
- The share of unverified entries, or the trial failure rate, passes its agreed limit.
- A near miss, incident, customer complaint or quality escape traced to a system output.
- Monitoring shows drift between predictions and verified outcomes.
- A request for any restricted or not-approved permission.
- A change in regulation, or a conclusion on the EU AI Act classification question.
Sign-off
| Role | Responsibility | Signature |
|---|---|---|
| Plant Manager (accountable executive) | Accepts High residual risk and the overall decision | Sample, unsigned |
| Site EHS Manager | Concurs on any risk linked to human safety | Sample, unsigned |
| Controls Engineering Manager | Confirms the control and protection boundary | Sample, unsigned |
| Quality Manager | Owns release authority and product-quality risks | Sample, unsigned |
| AI Governance Lead | Owns this assessment, change control and monitoring | Sample, unsigned |
Terms and alignment
Where this assessment uses a term from a standard, framework or regulation, it says which. Where it uses its own term, it says so. This is a reading aid, not a substitute for the official texts. This sample is not affiliated with or endorsed by ISO, IEC, NIST, the EU institutions or IAPP.
| Term used here | Meaning in this assessment | Alignment |
|---|
Governance professional vocabulary
The structure follows the lifecycle language of AI governance practice: use case, impact assessment, risk tolerance, residual risk, go or no-go decision, human oversight, and post-deployment monitoring. Check these against the current IAPP AI Governance Professional body of knowledge, which this sample does not reproduce.
Method
How the assessment was built, and how its steps line up with the main standards and frameworks. Govern, in the NIST AI RMF sense, runs through every step.
Steps and alignment
| Step | ISO 31000 and ISO/IEC 23894 | NIST AI RMF 1.0 | ISO/IEC 42001 and 42005 | EU AI Act |
|---|---|---|---|---|
| 1. Scope and context | Scope, context and criteria | MAP 1 | Context of the organization. Scope of the impact assessment | Intended purpose (Art. 3(12)) |
| 2. Impact analysis | Not a separate step. Feeds consequence | MAP 5 | 42005. Clause 6.1.4 and Annex A.5 | Art. 27 where it applies. Not applied here |
| 3. Risk analysis and evaluation | Risk identification, analysis, evaluation | MAP 5, MEASURE 1 to 2 | Clause 6.1.2 | Art. 9 risk management system |
| 4. Risk treatment and residual risk | Risk treatment | MANAGE 1 to 2 | Clause 6.1.3 and Annex A controls | Art. 9 to 15 requirements |
| 5. Approval decision | Risk acceptance by the risk owner | MANAGE 1.1, 1.3, 1.4 | Top-management accountability | Art. 26 deployer obligations |
| 6. Monitor and reassess | Monitoring and review | MANAGE 4, GOVERN | Performance evaluation and improvement | Art. 72 monitoring. Art. 73 serious incidents |
Likelihood scale
Qualitative and judged against the controls in place. No numeric probabilities are claimed.
| Level | Meaning |
|---|---|
| 1 Remote | Not expected during the life of the system, given the controls. |
| 2 Unlikely | Could occur, but only through a combination of failures. |
| 3 Possible | Could occur during the life of the system under realistic conditions. |
| 4 Likely | Expected to occur repeatedly unless something changes. |
Rating and acceptance rules
Rating is severity multiplied by likelihood: 1 to 3 Low, 4 to 6 Medium, 8 to 9 High, 12 to 16 Critical.
- Critical cannot be accepted at plant level. It needs further treatment or exclusion of the permission.
- High is accepted only by the Plant Manager, with documented conditions.
- Medium is accepted by the risk owner, with the Quality Manager or EHS concurring where their category is involved.
- Low is accepted by the risk owner.
- Any risk linked to a human-safety impact of severity 3 or 4 also needs the Site EHS Manager’s concurrence, whatever its rating.
Limitations
- Ratings are the assessor’s qualitative judgments on an invented system. They are not findings about a real one.
- The matrix is coarse. Multiplying ordinal scales hides differences, and a rating should never replace the reasoning shown beside it.
- Residual ratings assume the conditions of approval are met. They do not carry over if a restricted permission is enabled.
- OT security is treated as a source of risk, not a category of harm. Its consequences land in the impact categories above.
- The system grows after approval, so this assessment covers the process by which it grows. It is a living document, and individual matrix entries are not assessed one by one.
- Metallurgical, controls and safety-engineering content is generic and needs review by qualified specialists before any real use.