Service Risk

​

The Risk Assessment

Velatir assesses AI services from the provider’s public documentation and terms. Each assessment is reviewed again when the provider’s terms change, and at least every six months. The assessment describes the service. A person in your organisation still owns the decision to use it. To open a service’s assessment, select Treat risks (or View risk management) on its row in Inventory. You can also open any service in the service catalogue. Services without an assessment show their catalogue details only. The assessment shows:

• A verdict, such as Can be used, Can be used with limitations, or Review required before use, with a short summary of what is still open.
• Suitability by data class: whether the service suits general business and personal data, confidential business data, and special categories of personal data.
• Updates: when the assessment and its source data were last updated, when the next review is due, and how many changes still need your review.
• Assessments: each assessed field with its value, its initial rating (Critical, Caution or Clear), any treatment, its current rating, and the reason.

Fields are grouped into Needs attention, Handled, No action needed and Not assessed.

​

Treat a Risk

A treatment records your organisation’s decision on one field that needs attention. Administrators can record treatments. Everyone else can read them. To change a treatment, use the edit icon on its row. To remove it, use the delete icon. The field returns to Needs attention, and the history stays in the changelog.

​

Review Changes

Providers change their services, terms and privacy policies. Velatir records each change to a service your organisation has declared or treated, and asks an administrator to review it. Changes waiting for review show up in three places:

• A badge such as 2 changes to review on the service’s row in Inventory.
• A Changed badge on each affected field in the assessment.
• The Changes to review count under Updates.

Select any of them, or View full changelog, to open the service’s Changelog. It lists the provider’s changes and your organisation’s responses, newest first. A field change shows the value and rating before and after. A policy change shows the passages of the terms or privacy policy that differ. For each change that needs review:

• Mark reviewed if it needs no action. The changelog records who reviewed it and when. Undo review puts it back.
• Record a treatment on a changed field if the change affects how you use the service. The treatment is linked to the change, and the field change counts as treated.

Changes made before your organisation declared or treated the service appear as history and need no review.

When a change affects an existing treatment

If a provider changes a value you confirmed, the confirmation no longer holds. Velatir removes it and the field returns to Needs attention. A mitigation or acceptance stays in place, and the changelog shows what it was recorded against so you can check it still covers the change.

​

Hear About Changes

Administrators receive a Service changes notification that groups the changes for each period. Each service in it links to its changelog. Choose how often changes are grouped, whether they also arrive by email, and which Microsoft Teams or Slack channels they are posted to in Notifications → Settings.

---