DSIT publishes an AI Risk Management Toolkit. It measures the machine, not the room.

On 8 September DSIT published the AI Risk Management Toolkit: non-statutory guidance for anyone in the public sector designing, procuring or running AI. It implements Section D of the Orange Book and is built to sit beside the Cyber Assessment Framework. It is competent work — nine risk categories, a five-point likelihood and impact model, a risk-appetite matrix from Averse to Eager, and a treatment table mapped to avoid, limit, transfer and accept.

Every one of the nine categories measures the system, or the organisational process wrapped around the system. None of them measure the environment the system lands in.

Financial, legal, transparency, fairness, accountability, contestability, technical robustness, security, people and environment. Read the identification questions under each and the pattern holds: does it work, is it fair, is it secure, who signs for it. The human turns up in Appendix 3, filed under non-quantifiable impacts — “morale and job satisfaction”, “adaptation challenges”, “loss of human skills and knowledge”. That is the culture of use, and it is recorded as a consequence to measure after something has gone wrong, not a risk to screen for before deployment. The toolkit’s section on estimating likelihood offers four methods for the technical failure mode and none for the psychological one.

That is the estate’s thesis, written out by omission. Deployment risk is capability multiplied by culture. A technically sound tool in a team that has quietly stopped doing its own thinking is a high-risk deployment, and this toolkit would score it green.

A second gap matters to health and care specifically. DCB0129 and DCB0160 are not mentioned once. An NHS body using this toolkit will run it beside its clinical safety case with no guidance on how the two join.

Where the instruments sit

The toolkit is a frame. The estate was built to sit inside frames like it, not to replace them. Read against the nine categories:

• PEOPLE & ENVIRONMENTThe toolkit asks whether the system could affect an individual’s physical or mental wellbeing. The AI Interaction Risk Screen is the instrument that assesses a person’s actual pattern of reliance — displacement or supplementation — before go-live and at every review.
• LIKELIHOODThe toolkit offers historical data, model analysis, expert judgement and monitoring for estimating how likely a risk is. None of those reach the culture term. The Damping Audit is that method: a structured read of whether a team still has its own sensing intact.
• RISK APPETITEThe matrix is meant to be set at board level and cascaded. On paper. The Cultural Safety Case is the document that makes the culture term auditable alongside DCB0160, so the appetite reaches the point of use rather than stopping at the signature.
• ACCOUNTABILITYThe toolkit wants an identifiable owner and clear lines of responsibility across the lifecycle. Specify and the Overseer’s Bible write down what the overseer is actually watching for, in language a nurse can act on without a data scientist.
• TREATMENTThe treatment table assumes you will know when performance drifts and can prove what happened. The Glass Ledger is the hash-chained, fail-closed record that lets you evidence it.
• STAFF IMPACTAppendix 3 lists loss of skill and dependence on the tool as impacts to measure. After the Machine profiles how a clinician’s practice is changing around the tool, which is the honest way to measure them.

What this entry is not

It is not a criticism of the toolkit for failing to be something it was never written to be. A public-sector risk register needs the capability side done well, and this does it well. The entry records that the culture side is absent, that the absence is now dated and citable, and that the instruments to fill it are already open, versioned and free.

Sources