Riskonami

Optional named enrichment calls. The server owns scores, UNKNOWN, and the phase sequence. Humans accept risk.

This is the product-docs version of the AI story: enough to use the tool without being surprised. For the assurance argument (why this is not “chat as assessment”), read Assurance.

The rule

You can finish an assessment with AI off. Every phase still runs. You type answers, review tables, and issue a deterministic report. AI is an overlay. It proposes. You (and the server) still own the record.

What AI may do

When you tick Allow AI enrichment on New assessment, Riskonami can run up to five named calls. That checkbox is the consent for the run. You do not get a Yes/Skip before every call. Each call that actually runs costs 1 AI token (unless a time-based grant or staff account includes AI).

Call	When	What you get
A	After you give organisation / system context (and any uploaded text)	Draft facts in empty slots — industry, targeting, similar closed fields
B	Only if you upload a diagram the gate accepts	A proposed architecture from that drawing
P3	Only if you say yes to an extra control look	Gap suggestions against existing control points
C	During control assessment	Proposed measures / owners for existing catalogue rows
D	Optional, on the report	Introduction and labeled current-practice tips. Does not change scores

Typical paid walk: 2–3 tokens (A + C, or A + B + C if there is a diagram). 4–5 only if you also ask for P3 and the report narrative.

Riskonami v2 assessment spine: phases P1 through P9, optional named AI calls in red, server work in gray — Calls A, B, P3, C, and D sit on P1, P2, P3, P5, and P9. P6–P8 have no named AI call. Gray boxes are server work and cost 0.

Silent derivation (the server filling from packs) costs 0. Saying no to P3 costs 0.

Allow AI enrichment (once per assessment)

Mid-run you only get two extra choices if AI is on: after P3 Confirm, whether to check for omitted controls (Call P3); in P9, whether to add AI introductions (Call D). Calls A, B, and C run when their conditions are met, not as a separate Yes/Skip each time.

New assessment form with Allow AI enrichment unchecked, then Start assessment. — This checkbox is the AI consent for the whole run. Leave it off to stay on the free path.

Call A reads your documents

This runs after you continue with the file pack, only if AI is on. It does not score risk, and it does not skip Confirm.

A progress dialog reading uploaded documents and filling known facts. Behind it, the file pack lists a Word description and a diagram candidate. — Call A fills empty context slots from what you typed and uploaded. You still review every cell before Confirm.

What AI must not do

Forbidden	Why it matters
Choose the next phase	The server owns the walk
Invent control points, entities, or ISO rows	Packs and your model own those
Set or “improve” a risk score	Scores are table lookup from committed state
Treat missing evidence as implemented or strong	Missing stays UNKNOWN
Formally accept organisational risk	That is a human decision in Phase 7
Become the issued report	Markdown/PDF are views of the snapshot

Issued reports disclose whether any of these calls ran.

What you still do

Confirm or correct extracted facts.
Accept or reject control proposals (reject records the decision; it does not invent pack measures).
Decide accept / mitigate / transfer on each material risk.
Choose when to write a narrative and when to issue.

Data sent to the model

Only bounded prompts built from your assessment. We do not crawl the open web. A single website URL you typed may be fetched once. Default reasoning is a transient call to the configured model; the EU assessment record is the system of record. See Assurance for residency. Next: Tokens and billing · Run an assessment · Assurance