AICOMPASS - How Decisions Are Made

Risk classification inputs

Each AI use case is classified through observable risk triggers, not vague subjective scoring.

Input	Example trigger	Effect
Impact domain	Employment, credit, healthcare, safety	High-risk signal
Personal data	Candidate profile and assessment data	DPIA required
Autonomy	Automated recommendation or action	Oversight required
Audience	Customer, employee, candidate, public	Transparency required
Reversibility	Decision hard to reverse	Escalate route

Trigger	Evidence Required	Reviewer
Personal data	DPIA, data lineage, retention policy	DPO
Employment impact	Fairness test, appeal process, human oversight plan	HR Risk + Legal
External user impact	Transparency notice, complaint path, monitoring plan	Legal + Compliance
Agent tool access	Permission matrix, action log, kill-switch test	Security