AI risk assessment for regulated industries
Calibrate estimates the probability of each risk your organisation carries, shows the evidence behind the estimate, and leaves the decision with you.
Fear is what a risk feels like before it has a size. Give it a probability, a range and an owner, and it becomes something you can plan around.
Approach
A percentage does not. Calibrate replaces colour ratings with probabilities over a stated period, so a risk committee, a board and a supervisor are all reading the same thing.
What calibrated means. Of ten risks rated at 10%, about one should happen. An estimate that holds to that standard is one you can plan around.
Estimate
Every risk gets a likelihood over your horizon and an interval around it. Where the data is thin the interval is wide, and the estimate says so.
Evidence
Each driver that moved the number points to its source: an incident, a control test, a supplier record, a line from a meeting.
Outcome
As incidents and near-misses are logged, past estimates are compared with outcomes, so you can see how well the numbers have held.
Platform
Choose a sector to see an example estimate. Switch on the proposed safeguard to see its effect on the probability.
Sectors
Each sector has its own risk library, its own evidence sources and the frameworks it reports against.
Operational resilience, critical third parties, concentration and exit, incident reporting.
DORA · EBA outsourcing guidelines · Basel operational risk
Model risk, conduct, reserving and outsourcing.
Solvency II · MiFID II · AML
Confidentiality, conflicts, deadlines, AI on privileged material.
GDPR · professional secrecy · AML
Patient safety, decision support, device software, medication.
MDR · ISO 14971 · patient safety law
Work at height, lifting, subcontractor chains, schedule pressure.
ISO 45001 · work environment rules
Ransomware, identity compromise, supplier breaches, recovery time.
NIS2 · ISO/IEC 27001 · CIS Controls
Out-of-scope behaviour, drift, data leakage, high-risk use cases.
EU AI Act · ISO/IEC 42001 · NIST AI RMF
How it works
A risk register, incident log, supplier list, or the recording of a risk workshop. Calibrate reads it and flags duplicates, missing owners and overdue actions.
Each risk comes back with a probability, a range, its drivers and proposed safeguards. Nothing in your register changes yet.
Accept, adjust or dismiss each proposal with a reason. The decision, its evidence and its date go into the committee pack.
Governance
Proposals arrive as tracked changes. Every applied change can be undone.
A driver the model cannot source is removed before you see it.
The model never overwrites a likelihood or impact rating. It proposes and explains.
Appetite position, indicators and overdue items are computed the same way every time.
Bring one register, or one risk you keep coming back to. In a 40-minute walkthrough we run it through Calibrate with you, and you keep the result.