Risk does not live in the model name. It lives in the combination of data, decision, population, authority, scale, and consequence.
Low consequence
Examples include brainstorming, formatting, and drafts that receive ordinary human review. Controls can focus on data boundaries, acceptable use, and basic quality checks.
Moderate consequence
Examples include recommendations that shape internal prioritization or customer communication. Add documented ownership, validation, monitoring, and a clear correction path.
High consequence
Examples influence access, money, employment, safety, regulated records, or material business action. Require formal approval, representative testing, human authority, durable evidence, security review, and tested rollback.
Critical consequence
Examples can create irreversible harm, broad systemic impact, or decisions where meaningful human control is weak. Some uses should not proceed. Others require independent review, continuous oversight, strict constraints, and executive accountability.
Reclassify when the workflow changes
A harmless drafting model can become high consequence when its output automatically changes a clinical, financial, security, or employment process. Classification follows actual use, not the procurement label.