AI Risk
AI Risk Management — Inventory, Assess, and Treat Every Model
Observeri AI Risk keeps a live inventory of public and private AI models, then runs an end-to-end assessment: STRIDE threat models, AI-suggested controls, and a recorded risk treatment. Each model is classified automatically against the EU AI Act so owners know the obligations before a model reaches production.
EU Act
Automatic classification
STRIDE
Threat model
Treat
Risk decisions
AI risk management for enterprises, SMEs, and startups
Security, risk, and compliance teams work from one register instead of scattered model lists. Public foundation models and vendor APIs sit beside private fine-tunes and internal deployments, with purpose, data, owners, and residual risk kept current as the estate changes.
Why it matters
AI models reach production before the risk is known
No single model inventory
Public APIs, vendor models, and private fine-tunes live in different teams, so nobody can say which models the enterprise actually runs.
Threat models stay generic
Assessments stop at a questionnaire. Spoofing, data leakage, and privilege paths through prompts, tools, and integrations are never mapped.
Controls are chosen by guesswork
Teams pick safeguards after an incident. Suggested controls are not tied to the threat, the model, or the obligation that triggered them.
EU AI Act class is assigned too late
Purpose changes, a model moves from experiment to customer use, and the risk tier is still a slide from the last review.
The Observeri approach
Run AI risk from inventory through treatment
One inventory for every model
Register public foundation models and vendor APIs next to private fine-tunes and internal deployments, with owner, purpose, data, and hosting on each record.
STRIDE on the system, not just the model
Map spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege across data, prompts, tools, and operators.
Controls suggested from the assessment
Observeri proposes controls for the threats and the EU AI Act tier, so mitigation starts from the finding instead of a generic checklist.
Treatment with an owner and a record
Mitigate, accept, transfer, or avoid. Each decision keeps its tasks, evidence, and residual risk on the model record.
How it works
From inventory to a treated AI risk
Classify the model, assess it with STRIDE, take the suggested controls, and close the treatment on the same record.
Step 1
Build the model inventory
Public and private models in one register
Add foundation models, vendor APIs, fine-tunes, and internal deployments. Capture purpose, owner, training and prompt data, hosting, and the systems the model can reach.
Includes
Platform features
What the AI risk register holds
Public and private inventory
Track vendor models and models you train or host, with purpose, data, owner, and deployment status on every record.
EU AI Act classification
Classify models automatically from intended purpose into prohibited, high-risk, limited-risk, or minimal-risk tiers.
STRIDE threat models
Assess the model and the system around it across all six STRIDE categories, not a single generic risk score.
AI-suggested controls
Receive controls mapped to the threat and the regulatory tier, then accept, edit, or reject each suggestion.
Risk treatment
Record mitigate, accept, transfer, or avoid, with owners, tasks, and residual risk that stays attached to the model.
Connected to the GRC program
Feed treated AI risks into cyber risk, compliance evidence, and the AI Risk Operations Center without a second register.
Outcomes
A model does not ship without a decision
The estate is visible
Leaders can see every public and private model, who owns it, and whether it is still an experiment or in production.
Assessments finish in one path
Classification, STRIDE, suggested controls, and treatment happen on the same record, so reviews do not restart in a spreadsheet.
Obligations move with the model
When purpose or deployment changes, the EU AI Act tier and the open treatments update with it.
Platform capabilities
End-to-end AI risk, on one record
Classification supports the compliance workflow. It updates when purpose or deployment changes and does not replace a legal determination.
- Inventory of public foundation models, vendor APIs, private fine-tunes, and internal deployments
- Automatic EU AI Act classification into prohibited, high-risk, limited-risk, and minimal-risk tiers
- STRIDE threat modeling across model, data, prompts, tools, and operators
- AI-suggested controls tied to each threat and to the regulatory tier
- Risk treatment for mitigate, accept, transfer, and avoid, with approval and evidence
- Residual risk kept on the model record after treatment
- Reclassification when intended purpose or deployment changes
- Handoff into cyber risk, compliance evidence, and the AI Risk Operations Center
Assessment scope
4
EU AI Act tiers
6
STRIDE categories
2
Inventory classes
1
Treatment record
Know the model before it reaches production
Inventory every public and private model, classify it under the EU AI Act, assess it with STRIDE, and close the treatment with evidence.
Frequently asked questions
What does the AI model inventory cover?
The inventory covers public models, such as foundation models and vendor APIs, and private models, such as fine-tunes and internal deployments. Each record stores purpose, owner, data sources, hosting, and the current EU AI Act classification.
How does STRIDE apply to AI models?
Observeri applies STRIDE — spoofing, tampering, repudiation, information disclosure, denial of service, and elevation of privilege — across the model, its training and prompt data, integrations, and the people who operate it.
How are models classified under the EU AI Act?
Observeri classifies each model from its intended purpose and use context into the EU AI Act tiers: prohibited, high-risk, limited-risk transparency obligations, or minimal risk. Classification updates when purpose or deployment changes. It supports compliance work and is not a legal determination.
Related products
Cyber Risk Management
Live risk scoring, control mapping, FAIR quantification, and smart remediation.
AI Governance
Inventory of public and private AI models, governed through the ISO/IEC 22989:2022 life cycle.
AI Data Monitoring
Monitor, audit, and block prompts and file uploads so sensitive data stays inside the organization.
Observeri
AI agent
Welcome to Observeri - My Name is Misha, How may i help you today!
Your privacy choices
We use essential storage to remember your choices. With your permission, we also use analytics to understand website usage and marketing technologies to measure advertising, plus YouTube to show product videos. Optional tracking stays off until you choose. Read our Privacy Policy.