GLOSSARY

The coordinated process of identifying, analysing, evaluating, treating, monitoring, and communicating risks arising from the design, development, deployment, and use of AI systems.

The practice helps organisations prioritise controls, make deployment decisions, allocate accountability, satisfy assurance expectations, and reduce legal, operational, reputational, and societal harm.

A lender maps the context of an AI-assisted credit process, measures performance and bias across relevant groups, implements human review and appeal controls, monitors drift, and records residual risk acceptance.

AI risk cannot be reduced to a single score. Risk depends on use context and affected stakeholders, and some impacts are difficult to quantify. Compliance with a framework does not automatically establish legal compliance or acceptable residual risk.

AI risk management applies throughout the lifecycle and combines organisational governance with system-level analysis. It examines context, stakeholders, intended and foreseeable uses, data and model limitations, security, safety, reliability, transparency, fairness, privacy, and third-party dependencies. The NIST AI RMF organises activities into Govern, Map, Measure, and Manage; ISO/IEC 23894 provides AI-specific risk-management guidance.