Lead AI Risk Manager cheat sheet
Lead AI Risk Manager · Keep the key ideas within reach.
AI Risk Management
Risk = likelihood × impact; ISO/IEC 23894 and NIST AI RMF both treat risk as a function of likelihood of occurrence and severity of consequence, including harms to individuals and groups.
NIST AI RMF core has four functions: Govern (culture, accountability, policies), Map (context, stakeholders, impacts), Measure (metrics, testing, monitoring), Manage (prioritize, treat, respond, recover); Govern is cross-cutting, not a sequential step.
ISO/IEC 42001 is the certifiable AI management system standard; ISO/IEC 23894 gives AI-specific risk management guidance that extends ISO 31000; ISO/IEC 42005 covers AI system impact assessment.
EU AI Act risk tiers: unacceptable (banned, e.g., social scoring, manipulative techniques), high-risk (Annex III areas plus safety components under product law), limited-risk (transparency duties, e.g., chatbots, deepfakes), minimal-risk (no extra obligations).
EU AI Act high-risk obligations include risk management system, data governance, technical documentation, logging, human oversight, accuracy/robustness/cybersecurity, and post-market monitoring; general-purpose AI models carry separate transparency and systemic-risk duties.
NIST AI 600-1 generative AI profile lists twelve risk categories, including confabulation, information integrity, information security, harmful bias, intellectual property, and environmental impacts; treat it as a companion to the AI RMF, not a replacement.
Residual risk = inherent risk minus the effect of controls; risk acceptance must be documented by an accountable owner with defined tolerance thresholds and review dates.
Risk register entries need: asset/system ID, risk statement (cause → event → consequence), affected stakeholders, likelihood, impact, inherent and residual scores, control owner, treatment plan, and review cadence.
Three-lines model for AI: first line builds and owns model risk, second line sets frameworks and challenges, third line audits; the AI risk lead typically sits in the second line with authority to escalate to the board or risk committee.