AI Risk Management

Technical explanation

AI risk management applies throughout the lifecycle and combines organisational governance with system-level analysis. It examines context, stakeholders, intended and foreseeable uses, data and model limitations, security, safety, reliability, transparency, fairness, privacy, and third-party dependencies. The NIST AI RMF organises activities into Govern, Map, Measure, and Manage; ISO/IEC 23894 provides AI-specific risk-management guidance.

Business relevance

The practice helps organisations prioritise controls, make deployment decisions, allocate accountability, satisfy assurance expectations, and reduce legal, operational, reputational, and societal harm.

Implementation example

A lender maps the context of an AI-assisted credit process, measures performance and bias across relevant groups, implements human review and appeal controls, monitors drift, and records residual risk acceptance.

Limitations and common misconceptions

AI risk cannot be reduced to a single score. Risk depends on use context and affected stakeholders, and some impacts are difficult to quantify. Compliance with a framework does not automatically establish legal compliance or acceptable residual risk.

Topics

Sources