The phrase AI risk assessment has been stretched to cover two very different things. One is a governance exercise: a questionnaire mapping a deployment to a framework — NIST AI RMF, ISO 42001, the EU AI Act — producing a document that says the right words. The other is an adversarial assessment: someone actually attacking the system to find where it fails. Both have their place, but they are not substitutes, and buyers routinely purchase the first while believing they bought the second. This is what a technical AI risk assessment measures in 2026, in the order that matters, so you can tell the difference before you sign.
Prompt And Instruction Boundaries
The first question is whether the model can be made to ignore its instructions — not through obvious jailbreak strings, which most enterprise deployments now filter, but through indirect injection: adversarial instructions arriving in the data the system retrieves, the documents it summarises, the tickets it triages. A real assessment fires structured injection payloads through every untrusted content path and measures how often the model follows them. If the report only mentions direct jailbreaks and refusal rates, it tested the front door and ignored the windows.
Tool And Agent Containment
If the system can take actions — call APIs, send email, run code, operate software — the assessment must measure what happens when those actions are induced by a compromised context. The relevant finding is not whether the agent can be tricked into a bad answer, but whether it can be steered into a real-world action using credentials your monitoring trusts. The blast radius is the agent's session and its tools, not its task description, and a competent assessment maps that radius explicitly.
// WARNING
A useful filter for any vendor: ask what they will actually do to your system. If the answer is interviews, documentation review, and a questionnaire, you are buying governance. If it is payloads, reproduction steps, and a severity-scored findings report mapped to OWASP LLM Top 10 and MITRE ATLAS, you are buying an audit. Only one of those tells you whether you are exposed.
RAG Integrity And Data Exposure
For any system that answers from a corpus, the assessment must test both directions: whether retrieval respects entitlements (can a low-privilege caller surface documents they should not see), and whether the corpus can be reconstructed in aggregate by an extraction agent over time. These are distinct failures with distinct fixes, and both are invisible to a questionnaire because they only appear when someone runs the queries. A risk assessment that reviews your RAG architecture on paper but never enumerates it has not assessed the risk that matters.
Cost Surface And Supply Chain
Two surfaces get skipped almost universally. The first is economic: whether a low-cost user action can be amplified into high-cost model invocation — denial-of-wallet — and whether any circuit breaker exists. The second is provenance: what enters the model's trust boundary from outside, including tool descriptions, plugins, and dependencies pulled in by coding or MCP-style agents. A 2026 assessment that ignores cost and supply chain is measuring the model in isolation and missing the two surfaces attackers reach first.
What A Good Report Looks Like
The deliverable tells you which kind of assessment you got. A real one gives you ranked findings with reproduction steps for each, severity scored against a documented model and mapped to OWASP LLM Top 10 and MITRE ATLAS, a remediation path per finding, and ideally regression fixtures so you can re-test after fixing. A compliance deliverable gives you a conformance statement and a risk register. Keep both if your obligations require it — but do not mistake the second for evidence that your system withstands attack.
// NOTE
This is the scope our AI risk-assessment and adversarial-probing engagements run to end to end — prompt boundaries, tool containment, RAG integrity, cost, and supply chain, with a severity-scored report and reproduction steps, not a questionnaire. If you are comparing vendors, hold each one to the surface above; the gap between a checklist and an audit is exactly the gap between feeling covered and being covered.