Risk Classification
Mandatory 7-factor assessment determining Assurance Class
Overview
Risk classification is a mandatory step in the ARA certification process (Phase 2). An AVB conducts the assessment to determine the appropriate Assurance Class for the system being certified. The assessment evaluates 7 risk factors, each scored 1–5.
Risk Profile Visualization
Hover over any data point to see the factor name, score, and description. The example below shows a sample assessment resulting in Class B.
This sample profile scores 4 on Consequence Severity, Data Sensitivity, and Regulatory Exposure, triggering the “3+ factors at 4+” rule for minimum Class B. The average score of 3.29 alone would not mandate Class B, but the factor concentration rule applies.
The 7 Risk Factors
Each factor is independently scored from 1 (lowest risk) to 5 (highest risk) by the certifying AVB based on system documentation and operational context.
Autonomy Scope
Breadth of autonomous decision-making.
Consequence Severity
Potential impact of system failure.
Decision Reversibility
Whether autonomous actions can be undone.
Operational Environment
Complexity and unpredictability of deployment context.
Data Sensitivity
Classification of data accessed and processed.
Scale of Impact
Number of people or systems affected.
Regulatory Exposure
Degree of regulatory oversight applicable.
Class Determination Rules
The following rules are applied in order to determine the minimum Assurance Class. Organizations may voluntarily choose a higher class but may not select a lower one.
Voluntary upgrade: Organizations may voluntarily choose a higher Assurance Class than the one determined by the risk assessment. A higher class imposes stricter ongoing monitoring requirements but may be desirable for regulatory, reputational, or contractual reasons.
Assessment Process
The risk classification assessment follows a structured six-step process conducted during Phase 2 of the certification lifecycle.
Documentation Review
AVB reviews system documentation and operational context to understand the system scope, capabilities, and deployment environment.
Independent Scoring
Each of the 7 risk factors is scored independently with documented rationale explaining the assigned score.
Score Aggregation
Scores are aggregated using the determination rules to identify the minimum Assurance Class.
Class Recommendation
The AVB produces a recommended Assurance Class based on the aggregated scores and any additional risk considerations.
Organization Acceptance
The organization may accept the recommended class or request a higher class. The organization may not request a lower class.
Record Finalization
The final Assurance Class is recorded in the certification record along with the full scoring rationale.