Compliance and Enterprise Risk Committee's (CERC) Artificial Intelligence Risk Subcommittee (AIR)

CERC-AIR

Purpose and Structure

  • The CERC-AIR Subcommittee was created at the joint suggestion of the Provost's Advisory Council on Artificial Intelligence and the Compliance and Enterprise Risk Committee (CERC) in 2025. Its purpose is to provide a risk assessment and risk mitigation advice to Berkeley units, departments, schools and colleges by reviewing proposed new AI tools or new uses of existing tools. 
  • While the committee expects that the majority of the proposals it reviews will involve administrative uses of AI, the committee welcomes proposals on tools used in teaching and research as well.
  • CERC-AIR comprises representatives from CERC and other units across campus. CERC-AIR counts faculty, staff, and students among its members.  
  • CERC-AIR's review may occur simultaneously with independent reviews conducted by other offices for privacy, security, or accessibility, as appropriate.  

Overview  

  • CERC-AIR's review is informed by the UC AI Council’s Risk Assessment Guide.
  • CERC-AIR advises on risk in the specific context of a particular AI use case. CERC-AIR does not "approve" or "deny" applications or tools. Rather, it provides guidance on what risks exist and how they may be mitigated.
  • CERC-AIR consultation is highly encouraged as a valuable due diligence process. However, it is not required by campus policy, nor is CERC-AIR resourced to review whether applicants have carried out its guidance. 
  • CERC-AIR regularly communicates its assessments to applicants, and provides summaries to its parent committee, CERC, and other campus committees such as the Provost's Advisory Council on AI. 

AI Risk Assessment Process

  • Proposals may be referred to CERC-AIR through a variety of channels, including but not limited to the procurement process, IRB, and individuals who are developing their own tools can also consult with CERC-AIR directly. CERC-AIR meets monthly as a whole committee to refine guidance and a cluster of members offer CERC-AIR office hours several times weekly to rapidly triage incoming requests.
  • If you are not sure whether you should have a proposal reviewed by CERC-AIR, you may attend office hours or complete an AI Risk Pre-Screening. The Screening provides an immediate autoscore, which the submitter can use to consider whether they wish to complete a Full Risk Assessment Application. 
  • If you are certain that you wish to complete the Full AI Risk Assessment, you may do so without first submitting a Pre-Screening.
  • The result of CERC-AIR's review is a high level risk assessment as well as specific recommendations for the unit head to consider. CERC-AIR may also refer proposals to other specialized offices or committees as appropriate.

Membership and Authority 

  • Like its parent committee (CERC), the AI Risk Subcommittee brings together key university functions to ensure enterprise risk management aligns with campus vision and goals. Committee representatives—from each Vice Chancellor’s office, Campus Counsel, Audit, HR, Police, Athletics, Graduate Education, student groups, and Ethics, Risk, and Compliance Services—are invited to appoint the subcommittee's members. Additional at-large members join to contribute specialized expertise. CalNet-authenticated users may view the roster.

Contact

Submit an AI Risk Assessment

Ethical and Privacy Considerations when Using AI

FAQs

Why should I participate in the AI risk assessment process?

AI poses enormous potential to improve our lives, but also includes risks. CERC-AIR is comprised of diverse experts who can advise a unit on risks that they may not have yet considered, and how to mitigate them. It also provides a shared language to use in discussing these risks with vendors, members of the unit's project team, and compliance and legal experts across the UC system.

Who will review the AI risk assessment I submit?

All risk assessments are reviewed by a subset of CERC-AIR members; a few of these assessments are escalated for review by the entire committee. 

Where can I direct questions about this process?

Please email cerc-air@berkeley.edu and/or book a 15-minute office hours session.

What is the relationship between UC Berkeley’s AI Risk Assessment and the UC AI Council's AI Risk Assessment Guide?

Areas of CERC-AIR's review correspond with the UC AI Council’s Risk Assessment Guide, which, itself, is based upon the National Institute of Standards and Technology's AI Risk Management Framework.

What subject areas comprise this assessment?

This assessment collects information about to what extent the proposed tool comports with the UC's Responsible AI Principles. These principles are gathered in five sections; they are: 1) Appropriateness / Shared Benefit and Prosperity, 2) Privacy and Security, and 3) Transparency, 4) Fairness and Non-Discrimination, Human Values, and 5) Accountability and Accuracy, Reliability and Safety.

Is this assessment the same as the security review or privacy review? How do these relate?

This assessment is independent. The same proposals may go through one, two, or all three reviews, depending on what the proposal involves. These three reviews are not directly dependent on one another and can proceed in parallel.