Qualitative risk assessmentis most appropriate when reliable quantitative data is unavailable or too costly to gather. In such cases, qualitative methods (like risk matrices or expert judgment) provide valuable input based on impact and likelihood without requiring precise numerical data.

This approach is especially useful in new or evolving domains (e.g., cybersecurity or AI) where historical data may be lacking.