What it means
- A simple, written method to sort every AI use case into tiers, typically low, medium and high risk.
- The tier decides how much control applies: a low-risk internal summariser needs light checks; a credit-decision model needs full testing, independent validation and human oversight.
- Criteria usually include: does it affect customers' money, rights or access to services; how autonomous is it; how much personal data; can errors be reversed; is it customer-facing.
Why it matters
- RBI FREE-AI expects use cases classified as low, medium or high risk in the AI policy, with periodic review.
- Tiering keeps effort proportionate. Without it, either everything gets heavy review (slow) or nothing does (risky).
- Many other controls (red teaming frequency, human oversight, audit depth) are triggered by tier.
Checklist
- Write tiering criteria and a short scoring sheet (5 to 8 questions) in or alongside the AI policy.
- Give examples for each tier relevant to the business (for example: chatbot FAQ = low; collections prioritisation = medium; loan underwriting = high).
- Define what each tier requires: approvals, tests, validation, monitoring frequency, oversight.
- Classify every entry in SC-AI-003 AI system inventory and record the rationale.
- Re-tier when purpose, data or autonomy changes, and at least annually.
- Have the AI committee review all high-risk classifications.
Evidence examples
- Approved tiering methodology (part of AI Policy v1.2, section on risk classification).
- Completed scoring sheets for sampled AI systems with reviewer sign-off.
- Inventory extract showing tier and last tiering date.
- Committee minutes confirming high-risk classifications.
Common pitfalls
- Tiering by technology ("it uses an LLM so it is high risk") instead of by impact on people and business.
- Business owners self-classifying everything as low risk with no challenge.
- Never re-tiering after a pilot becomes a production customer journey.
Satisfies
- VoluntaryISO/IEC 42001
- BindingEU AI Act
- SupervisoryPRA SS1/23
- VoluntaryNIST AI RMF and GenAI Profile
- BindingNYC Local Law 144 (AEDT)
- BindingTexas TRAIGA
- BindingKorea AI Basic Act
- SupervisoryOSFI E-23
- VoluntaryRBI FREE-AI
Standards crosswalk
Clause references only. Check the standard itself for the exact wording.
ISO/IEC 42001
- 6.1.1 Actions to address risks and opportunities (risk criteria)
- 6.1.2 AI risk assessment
- A.5.2 AI system impact assessment process
ISO/IEC 27001
No direct equivalent
SOC 2
- CC3.2
Key takeaways
- Tiering makes AI governance proportionate and drives the depth of every other control.
- New for AI, not covered by ISO 27001. Information classification (A.5.12) is a useful pattern to copy, but it classifies data, not AI use cases.
- Classify by impact on customers and the business, and re-tier on change.