Acceptance criteria
Configurable factors such as vendor location, training on inputs, trust-center availability, account tier, autonomy, data sensitivity and tool power.
Why it matters
The risk in an AI tool usually sits in its data-handling terms, which change without the domain changing.
How to verify
Risk scores, with sources and factors, for five tools.
OWASP adoption context
Risk scoring spans ordinary employee AI and MCP-extended workflows because sensitivity, autonomy and tool power vary independently of approval status.
Framework mappings
Configurable risk factors can support a repeatable method for documenting and prioritizing inherent risk. The buyer must still define the method and connect scores to threats, likelihood, impact and response decisions.
Sensitivity, autonomy and tool-power factors can inform the likelihood and magnitude of impacts. A product score does not by itself document the full range of beneficial and harmful impacts.
Scoring connectors and agent workflows helps prioritize review of runtime-fetched tools and components exposed to agentic supply-chain risk. Scores do not verify component integrity.
The configurable factors provide an AI risk-analysis step and inputs to repeat assessments and supplier due diligence. Risk criteria, likelihood, impact, ownership, acceptance and treatment remain the buyer’s responsibilities; a trust center is not assurance.
Security-relevant scoring factors supply risk-analysis inputs; external-vendor factors also support supplier due diligence. The buyer must define risk criteria, likelihood, impact, ownership, acceptance and treatment. A score or vendor trust center is not a complete assessment or assurance; the supplier link applies only to external relationships.
ISO/IEC 42001: Validated tool and workflow risk factors provide inputs to the defined AI risk-assessment process and periodic or change-driven reassessments. A score does not establish a complete assessment, risk acceptance, treatment plan or assessment of effects on people or society. Supplier-specific factors, such as provider use of inputs and account terms, can also inform a defined responsible-AI supplier review; this supplier link applies only to external suppliers and validated evidence.