Qualitative criteria are non-numeric factors used to assess context, likely impact, and severity. In an AI risk review, they help teams consider questions that a score or benchmark may miss, such as who could be affected, whether a decision is explainable, and whether a system could contribute to discrimination or undermine privacy.
In cybersecurity and AI governance, these criteria complement quantitative testing rather than replace it. A review team may use them to evaluate risks in a system’s intended setting, document concerns, and judge what risk remains after safeguards are applied. For example, a model’s accuracy figures alone may not show how its use in a clinical workflow could affect different patient groups.