𝗥𝗶𝘀𝗸-𝗯𝗮𝘀𝗲𝗱 𝗔𝗜 𝗽𝗼𝗹𝗶𝗰𝘆/𝗿𝗲𝗴𝘂𝗹𝗮𝘁𝗶𝗼𝗻 𝘀𝗼𝘂𝗻𝗱𝘀 𝗼𝗯𝘃𝗶𝗼𝘂𝘀. 𝗕𝘂𝘁 𝗶𝘁 𝗿𝗲𝘀𝘁𝘀 𝗮 𝗳𝗿𝗮𝗴𝗶𝗹𝗲 𝗮𝘀𝘀𝘂𝗺𝗽𝘁𝗶𝗼𝗻: 𝘁𝗵𝗮𝘁 𝘄𝗲 𝗰𝗮𝗻 𝗮𝗰𝘁𝘂𝗮𝗹𝗹𝘆 𝗺𝗲𝗮𝘀𝘂𝗿𝗲 𝗿𝗶𝘀𝗸.
Yet risk assessment is often put forward as the first thing to answer, as if it’s the easy part.

Some frameworks push “use case–based” solutions with a pre-defined list of high-risk use cases, but then smuggle in the magic word “𝘀𝗶𝗴𝗻𝗶𝗳𝗶𝗰𝗮𝗻𝘁” — effectively saying: the given high-risk use cases are only high-risk if it causes… significant risk. A tautology that collapses under scrutiny. Or Look closely and “low-risk” use cases are never really low:
𝟭. 𝗠𝘂𝘀𝗶𝗰 𝗿𝗲𝗰𝗼𝗺𝗺𝗲𝗻𝗱𝗮𝘁𝗶𝗼𝗻 𝘀𝗲𝗲𝗺𝘀 𝗵𝗮𝗿𝗺𝗹𝗲𝘀𝘀 𝘂𝗻𝘁𝗶𝗹 𝗯𝗶𝗮𝘀 𝘀𝘆𝘀𝘁𝗲𝗺𝗮𝘁𝗶𝗰𝗮𝗹𝗹𝘆 𝘀𝗶𝗱𝗲𝗹𝗶𝗻𝗲𝘀 𝗺𝗶𝗻𝗼𝗿𝗶𝘁𝘆 𝗮𝗿𝘁𝗶𝘀𝘁𝘀.
𝟮. 𝗚𝗿𝗮𝗺𝗺𝗮𝗿 𝗰𝗵𝗲𝗰𝗸𝗶𝗻𝗴 𝗹𝗼𝗼𝗸𝘀 𝘀𝗮𝗳𝗲 𝘂𝗻𝘁𝗶𝗹 𝗮 𝘀𝗶𝗻𝗴𝗹𝗲 𝗱𝗶𝗴𝗶𝘁 𝗼𝗿 𝘄𝗼𝗿𝗱 𝗰𝗵𝗮𝗻𝗴𝗲 𝗶𝗻 𝗮 𝗺𝗲𝗱𝗶𝗰𝗮𝗹 𝗻𝗼𝘁𝗲 𝗮𝗹𝘁𝗲𝗿𝘀 𝗮 𝗱𝗶𝗮𝗴𝗻𝗼𝘀𝗶𝘀 𝗼𝗿 𝗱𝗼𝘀𝗮𝗴𝗲.

Yesterday at the Department of Health, I used Digital Scribe as a concrete example of navigating through some of the challenges.

At CSIRO’s Data61, we’re moving beyond vague 𝗹𝗶𝗸𝗲𝗹𝗶𝗵𝗼𝗼𝗱–consequence matrices and building approaches that work in practice:
• 𝗣𝗿𝗲𝗰𝗶𝘀𝗲 𝗱𝗲𝗳𝗶𝗻𝗶𝘁𝗶𝗼𝗻𝘀 of consequence, severity, scale, and impact
• 𝗦𝗲𝗽𝗮𝗿𝗮𝘁𝗶𝗻𝗴 𝗶𝗻𝘁𝗿𝗶𝗻𝘀𝗶𝗰 𝗳𝗿𝗼𝗺 𝗱𝗲𝘀𝗶𝗴𝗻 𝗿𝗶𝘀𝗸𝘀 – what’s intrinsic in any system (human, traditional software, or AI doing it) vs what emerges from AI-specific design choices
• 𝗗𝘆𝗻𝗮𝗺𝗶𝗰 𝘁𝗼𝗼𝗹𝘀 that cut through noise and thousands of best practices to surface the few risks that matter and corresponding treatments
• 𝗢𝘃𝗲𝗿𝘀𝗶𝗴𝗵𝘁 𝗺𝗼𝗱𝗲𝗹𝘀 that test effectiveness, not just presence
• 𝗠𝗮𝗿𝗴𝗶𝗻𝗮𝗹 𝗿𝗶𝘀𝗸 𝗰𝗼𝗺𝗽𝗮𝗿𝗶𝘀𝗼𝗻𝘀 – evaluating AI against existing systems even without full ground truth
• Applying all these in public administration, health, and high-stakes decision making, where decisions range from fact-finding to rule-applying to deep deliberation and discretionary judgment

I’ve shared a few redacted slides below. Always happy to discuss with others wrestling with the hardest question: if we want AI to be risk-based, how do we stop “risk” from being a vague label?

https://www.linkedin.com/feed/update/urn:li:activity:7376738527293685762