AI risk assessments should specify threat models, required guardrails, and tests for whether those guardrails work.

“What are the risks that matter within each of these risks? What are the kind of threat models that you're really looking for?”

“You need to specify for each of those risks,”

“what are the guardrails that need to be in place?”

“And what are the tests they need to run to see whether those guardrails are effective?”