Risk, Ethics & Compliance ยท RSK-01
AI risk appetite
The board or equivalent has approved a statement of how much AI risk the organisation will accept, broken down by kind of risk, and it is used in decisions.
Why it matters
Without a stated appetite, each approver applies their own tolerance, so similar uses get different answers and nobody can say whether the organisation is taking too much risk or too little. A board-approved appetite gives approvers a common reference and makes risk acceptance a deliberate choice.
Levels
| 0 Absent | Confirmed absent: the evidence shows nothing is in place. Not known is recorded as insufficient evidence, not 0. |
|---|---|
| 1 Initial | No statement of AI risk appetite; tolerance depends on whoever is deciding. |
| 2 Developing | AI is mentioned in the general risk appetite, or a draft AI statement exists, but it does not distinguish kinds of risk or is not approved. |
| 3 Defined | A board-approved, owned AI risk appetite sets tolerances by kind of risk, has a review date and is referred to in approval decisions. |
| 4 Managed | Exposure across live and proposed uses is reported against the appetite, and decisions that exceed it are escalated and recorded. |
| 5 Optimising | The appetite is recalibrated from evidence of outcomes, incidents and external change, and the board reviews whether it is enabling the intended use of AI. |
Level 3 criteria
Level 3 is met when every applicable criterion is met. Criteria marked with an overlay apply only to organisations with that characteristic (overlays).
- RSK-01.1 A board-approved AI risk appetite sets a tolerance for each relevant kind of risk, such as harm to people, legal, reputational and operational risk.
- RSK-01.2 The AI risk appetite has a named owner and a review date.
- RSK-01.3 Approval decisions on uses of AI refer to the risk appetite.
Assessment questions
- Has the board approved a statement of how much AI risk the organisation will accept?
- Does it set different tolerances for different kinds of risk?
- How do approvers use it when deciding whether a use of AI can go ahead?
- The approved AI risk appetite statement, with approval record and review date
- Approval records for uses of AI that refer to the appetite
- Risk reports comparing exposure with the appetite
How to reach Level 3
- Agree the kinds of AI risk that matter to the organisation, for example harm to people, legal, reputational and operational.
- For each kind, write a tolerance statement saying what level of risk is acceptable, using the organisation's existing risk scale where possible.
- Name an owner and review date, and get the appetite approved by the board or equivalent.
- Add a reference to the appetite in AI approval templates so approvers must state how each decision fits it (see GOV-03).
Common pitfalls
- Writing one overall tolerance that does not separate different kinds of risk.
- Approving the appetite but never citing it in actual decisions.
Starter artefacts
- AI risk appetite statement by kind of risk
- Approval template section referencing the appetite
Ownership and sequence
- Accountable
- executive sponsor
- Contributors
- risk lead, ai governance lead
- Depends on
- GOV-02
- Roadmap step
- 2
- Lifecycle
- strategy, design
Cross-references
| AI Cyber Security Code of Practice | 3.1 partial; 3.4 partial |
|---|---|
| EU AI Act | Art 9 partial |
| ISO/IEC 42001 | 6.1.1 direct |
| JSP 936 Part 1 | para 93 partial; para 206 partial |
| NIST AI RMF 1.0 | GOVERN 1.3 direct; GOVERN 1.5 partial; GOVERN 2.3 partial; MAP 1.5 direct; MEASURE 2.6 partial; MANAGE 1.2 partial |
| UK Data and AI Ethics Framework | Safety 8 partial |
| UNESCO AI Maturity Framework | 5.3 direct |
direct: this control at Level 3 meets the item. partial: it covers part of it.