Lead AI Risk Manager flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

NIST AI RMF Govern function

Cross-cutting function that establishes accountability structures, policies, workforce competence, and risk culture; it is cultivated throughout the AI lifecycle rather than completed as a single phase.

NIST AI RMF Map function

Function that frames context, identifies intended purpose, affected stakeholders, and potential impacts, and establishes the scope and categories of risk to be assessed.

NIST AI RMF Measure function

Function that applies quantitative and qualitative methods, testing, and monitoring to assess identified risks and track whether risk metrics stay within defined tolerances.

NIST AI RMF Manage function

Function that prioritizes risks, allocates treatment resources, plans response and recovery, and documents risk acceptance decisions with accountable owners and review dates.

EU AI Act prohibited practices

Unacceptable-risk uses banned outright, including social scoring by public authorities, manipulative techniques exploiting vulnerabilities, and most real-time remote biometric identification in public spaces.

EU AI Act high-risk classification

AI systems used as safety components under product legislation or listed in Annex III areas such as employment, credit, education, and critical infrastructure qualify as high-risk and trigger extensive compliance duties.

General-purpose AI model duties

Providers must supply technical documentation, training data summaries, and copyright policy; models with systemic risk also require evaluations, adversarial testing, incident reporting, and cybersecurity protections.

ISO/IEC 42001

Certifiable management system standard for AI specifying requirements for policies, roles, impact assessment, lifecycle controls, and continual improvement of an organization's AI governance.

ISO/IEC 23894

Guidance standard on AI risk management that adapts ISO 31000 processes to AI, covering risk identification, analysis, evaluation, treatment, and integration with organizational risk management.

Residual risk

The risk remaining after controls and treatments are applied; calculated as inherent risk reduced by control effectiveness and formally accepted by an accountable owner.

Risk tolerance vs appetite

Appetite is the amount of risk the organization is willing to pursue for value; tolerance is the acceptable deviation range around that appetite used to trigger escalation.

Three lines model

Assurance structure where operational teams own AI risk, a independent risk function sets frameworks and challenges, and internal audit provides independent assurance to the board.

AI system impact assessment

Structured evaluation of how an AI system affects individuals, groups, and society, covering purpose, data, affected populations, potential harms, and mitigation, often required before deployment.

Human oversight requirement

Obligation to design AI so humans can understand, intervene in, override, or halt the system, with oversight measures proportionate to risk and the autonomy granted.

Model risk validation

Independent review of a model's conceptual soundness, data quality, performance, and limitations, performed by parties separate from development before approval and periodically thereafter.

Confabulation risk

Generative AI risk where the model produces fluent but fabricated content presented as fact; mitigated by grounding, retrieval, citation, and human verification controls.

Training data provenance

Documented record of data origin, licensing, collection method, and transformations, needed for lawful use, bias assessment, and reproducibility of model behavior.

Concept drift

Degradation in model relevance when the statistical relationship between inputs and outcomes changes over time; detected through monitoring and addressed by retraining or redesign.

Data drift

Change in the distribution of input features relative to training data; a leading indicator of performance loss that can be detected without labeled outcomes.

Model inventory

Central register of AI systems and models capturing purpose, owner, tier, data sources, dependencies, validation status, and review dates; a prerequisite for effective governance.

Risk tiering

Classification of AI use cases by impact and autonomy to allocate proportionate controls; higher tiers require stronger validation, documentation, and oversight.

Algorithmic bias

Systematic and repeatable unfair disparity in model outcomes across groups; assessed through disaggregated performance metrics, fairness testing, and subgroup analysis.

Explainability requirement

Obligation to provide meaningful information about how an AI system reaches decisions, sufficient for affected persons, overseers, and regulators to understand and contest outcomes.

Post-market monitoring

Ongoing collection and review of performance and incident data after deployment, with defined thresholds that trigger investigation, reporting, or withdrawal of the system.

AI incident reporting

Process for logging, escalating, and externally reporting harmful AI events within defined timelines, including root cause analysis and corrective action tracking.

Red teaming

Adversarial testing that probes a system for harmful, unsafe, or unintended behavior, including prompt injection, jailbreaks, and data leakage, before and after release.

Prompt injection

Attack where untrusted input manipulates a model's instructions, potentially causing data exfiltration or unauthorized actions; mitigated by input isolation and least-privilege tooling.

Third-party AI risk

Risk from vendors and foundation models, managed through due diligence, contractual audit and notification rights, dependency mapping, and exit and contingency planning.

Model documentation

Structured record of intended use, training data, evaluation results, limitations, and known failure modes, supporting review, audit, and downstream users' assessments.

Kill switch and rollback

Pre-engineered capability to disable or revert an AI system rapidly, tested in advance, with defined authority and criteria for invocation during harmful behavior.

Key risk indicator

Quantitative metric with thresholds that signals rising AI risk, such as override rate, drift score, incident count, or complaint volume, tracked against tolerance limits.

Board AI risk reporting

Periodic escalation of AI risk profile, top exposures, incidents, and treatment status to the board or risk committee, aligned with enterprise risk reporting cycles.