Downstream Risk
Plain-language explanation
Risk that emerges or changes when an organization deploys an AI model within its own environment, combining upstream model capabilities, safeguards, and limitations with local access, data, tools, autonomy, scale, and business processes.
Why It Matters
A model provider's safety controls do not fully describe the risk created by a customer's deployment. Auditors need to examine both upstream dependencies and the conditions the deploying organization controls.
In Practice
Downstream risk is an AuditDIFF practitioner term, not a statement that a customer inherits a model provider’s legal liability.
Use it to distinguish model-level safety work from risks created or changed by integration. A useful question is: What can this model do in our environment that it could not do on its own?