AI and Algorithm Risk Fundamentals
Core concepts
AI and algorithm risk is the potential for an AI system to cause harm, loss, or regulatory breach through its behavior, outputs, or the way it is built and operated. Candidates must distinguish model risk (error, bias, overfitting, drift), data risk (quality, provenance, representativeness, privacy), operational risk (availability, latency, integration failure), security risk (adversarial inputs, data poisoning, model theft), and third-party risk (vendor, foundation-model, and API dependencies). Know the difference between inherent risk (before controls) and residual risk (after controls), and between model and non-model algorithmic risk (rules-based automation can also cause harm).
Understand the lifecycle: problem definition, data collection, development, validation, deployment, monitoring, and decommissioning. Risk profile changes at each stage. Also know explainability and interpretability as risk-relevant properties, not just nice-to-haves, and uncertainty (aleatoric vs. epistemic) as a driver of downstream harm.
Traps
Questions often conflate bias with fairness (bias is a property; fairness is a normative goal), or accuracy with safety. Another trap: assuming generative AI risk equals classical model risk. It does not; hallucination, prompt injection, and emergent behavior add categories. Watch for questions that treat inherent risk as if controls were already applied.
Rule of thumb
If a question asks where risk begins, answer at problem definition and data, not at deployment. Risk is designed in early and only detected late.
Worked example
A credit-scoring model is 95% accurate overall but 70% accurate for a protected subgroup. The overall metric hides subgroup risk. The correct framing: this is a data and model risk issue with fairness implications, requiring subgroup validation, not merely a higher global accuracy target.