Frequently Asked Questions

Clear, practical answers regarding SME AI risk management, legal liabilities, data privacy, and governance compliance.

1. Is our company data used to train public AI models?

If your staff uses free consumer AI tiers (such as free ChatGPT or Claude web interfaces), user inputs are routinely logged and used for model training by default. To prevent model training, your organization must use enterprise API tiers, business subscriptions, or explicitly enable data privacy opt-outs.

2. What is the difference between Low, Moderate, High, and Critical AI risk?

Low Risk (0-25) applies to internal non-sensitive tasks with no PII. Moderate Risk (26-50) involves internal text with standard review. High Risk (51-75) involves sensitive customer data or financial ledgers requiring Human-in-the-Loop review. Critical Risk (76-100) involves high-stakes tasks (legal, medical, HR filtering) requiring mandatory executive sign-off.

3. Can AI generated content be copyrighted for our business?

Under current US Copyright Office guidelines and international precedents, pure AI-generated content lacking substantial human creative expression cannot be registered for copyright protection. Hybrid works with significant human editing may qualify for partial protection.

4. How does this tool calculate the composite risk index score?

The engine applies a weighted formula: Data Privacy (25%), Hallucination Severity (20%), Governance Authority (20%), Human-in-the-Loop Necessity (20%), and Copyright Exposure (15%). The composite score yields a normalized scale from 0 to 100.

5. Does this assessment tool store our business inputs on a server?

No. All calculations, preset loading, and SVG radar polygon rendering are performed 100% locally in your web browser. Zero input data or scores are submitted or stored on external servers.

6. What is Retrieval-Augmented Generation (RAG) and why is it important for SMEs?

RAG anchors AI models to your verified internal business documents. Instead of relying solely on foundation model memory (which causes hallucinations), RAG forces the model to extract answers directly from your provided knowledge base.

7. What constitutes a Human-in-the-Loop (HITL) protocol?

HITL requires a designated human employee to inspect, verify, and approve AI-generated outputs before they are delivered to customers, executed in code, or submitted to legal/financial authorities.

8. How does the EU AI Act affect small businesses outside Europe?

The EU AI Act has extraterritorial reach. If your business offers AI-driven services to individuals located within the European Union, your systems must comply with its risk tier obligations regardless of your physical headquarters location.

9. What are the main risks of using AI in candidate resume screening?

AI resume screening carries severe bias and discrimination risks if training data reflects historical hiring disparities. It also triggers strict automated decision-making disclosures under GDPR Article 22.

10. How often should an SME update its AI Risk Assessments?

We recommend re-evaluating operational AI workflows quarterly, as well as whenever an underlying AI model is upgraded or vendor terms of service change.