Risk lead
Accountable for corporate risk, compliance and legal advice.
- Often held by
- a chief risk officer, general counsel, head of compliance or data protection officer
- Accountable for
- 5 controls
- Contributes to
- 29 controls
- Relies on
- AI governance lead (4), Business owner (3), Security lead (3), Data owner (2), Delivery lead (2)
- Supports
- AI governance lead (11), Executive sponsor (5), Business owner (5), Delivery lead (3), Data owner (3), Security lead (1), People lead (1)
Accountable for
This role answers for each of these controls reaching the level the organisation has set, and holds the evidence.
AI risk assessment method
The organisation uses one consistent, documented method to assess the risks of each use of AI, and the results feed its corporate risk management.
With: AI governance lead, Business owner, Security lead.
Evidence an assessor would expect
- The documented risk assessment method and guidance
- A sample of completed assessments for recent uses of AI
- Corporate or departmental risk registers showing AI risks
- Risk treatment records showing the controls selected for each use and why
- Reassessment records for live uses, with residual risk recorded
Legal and regulatory obligations
The organisation keeps a current view of the laws, regulations and standards that apply to its use of AI, with an owner for each obligation and a way of checking it is met.
With: AI governance lead, Data owner, Security lead.
Evidence an assessor would expect
- The obligations register, with owners and review dates
- Compliance check records or legal sign-off for recent uses of AI
- Regulatory role recorded for each use, with re-check records and the named regulator contact
Risk of AI from suppliers
Before AI in a bought product or service is used, and when it changes, the organisation assesses what it does, how it uses data, how the supplier changes the model, and what assurance the supplier offers.
With: Delivery lead, Security lead, Data owner.
Evidence an assessor would expect
- The supplier AI due diligence questionnaire or process
- Completed due diligence records for recent purchases and updates
- Regulatory status checks and provider instructions for use, held for bought AI
Independent assurance reviews
Uses of AI are reviewed by people independent of their delivery, with the depth and frequency of review proportionate to risk.
With: AI governance lead, Business owner.
Evidence an assessor would expect
- Finding log with owners, remediation dates and status, and the record of the periodic audit of AI governance as a whole
- The assurance plan or schedule by risk tier
- Recent review reports with findings and action tracking
Serious AI incidents and external notification
The organisation defines serious AI incidents, can suspend a use of AI when needed, and tells suppliers, regulators and affected people through set routes and within set deadlines.
With: AI governance lead, Business owner, Delivery lead.
Evidence an assessor would expect
- The serious incident definition and the legal source it follows
- Notification routes and deadlines for suppliers and regulators
- Suspension decision records, with the named decision maker
- The plan for telling affected people about a serious incident
Contributes to
Another role is accountable; this one does part of the work or supplies what it needs.
Where AI will and will not be used
The organisation has decided, and recorded with reasons, the areas of its work where AI is encouraged, where it is allowed only under conditions, and where it is ruled out.
Accountable: Executive sponsor.
Horizon scanning and external expectations
The organisation tracks changes in AI technology, regulation, peer practice and public expectation, and feeds what it finds into its AI strategy.
Accountable: AI governance lead.
AI policy
The organisation has an approved AI policy that states which uses of AI are permitted, which need approval and which are not allowed, and keeps it current.
Accountable: Executive sponsor.
Decision rights proportionate to risk
Decision rights for approving, changing and retiring uses of AI are defined, scaled to risk, and followed.
Accountable: Executive sponsor.
Oversight forum
A cross-functional forum oversees AI use, risk and performance, with terms of reference, the right membership and a clear link to the organisation's main governance.
Accountable: AI governance lead.
Integration with existing governance
AI governance works through the organisation's existing risk, information, data protection, security and procurement governance rather than alongside it.
Accountable: AI governance lead.
Policy compliance and exceptions
Compliance with the AI policy is monitored, and exceptions are requested, approved, recorded and reviewed.
Accountable: AI governance lead.
Review and disclosure of AI-generated content
The organisation has approved rules for reviewing and disclosing AI-generated content that it releases or relies on, so people know when AI was used.
Accountable: AI governance lead.
AI risk appetite
The board or equivalent has approved a statement of how much AI risk the organisation will accept, broken down by kind of risk, and it is used in decisions.
Accountable: Executive sponsor.
Impact assessment before deployment
Before a use of AI goes live, its likely effects on people and groups (including equality, privacy, rights and safety) and on society and the environment are assessed to a depth that matches its risk, and the findings are acted on.
Accountable: Business owner.
Ethical principles in practice
The organisation has adopted ethical principles for AI and applies them through a working review route that can change or stop a use of AI.
Accountable: AI governance lead.
Fairness and bias management
Unfair bias is identified, tested for and reduced at each stage of a use of AI, from design through to live operation.
Accountable: Business owner.
Human oversight proportionate to risk
Each use of AI has human oversight designed to match its risk, stating who reviews, at which point, and with what authority to override or stop it.
Accountable: Business owner.
Explanation and challenge for affected people
People affected by decisions that AI supports can find out that AI was involved, get an explanation they can understand, and challenge the outcome through a route that can change it.
Accountable: Business owner.
Agreed prioritisation criteria
Proposed uses of AI are ranked against published criteria covering value, feasibility, risk, cost and strategic fit, applied the same way to every proposal.
Accountable: AI governance lead.
Stage gates from idea to retirement
Each use of AI passes through defined stages (explore, pilot, scale, operate, retire), with entry and exit criteria checked at each gate.
Accountable: AI governance lead.
AI-aware procurement and contracts
Contracts for AI products and services set clear terms on data rights, intellectual property, notice of model changes, transparency and exit.
Accountable: Delivery lead.
Involving people in AI design and evaluation
Evaluations and research that involve people have their informed consent, ethics review and protection, use participants who represent those the service will serve, and for significant uses draw on the communities affected.
Accountable: Business owner.
Lawful and fair use of data
Before data is used in an AI system, its use is confirmed as lawful, consistent with the purpose for which it was collected, and fair to the people it describes.
Accountable: Data owner.
Records management for AI
Retention and records rules cover what AI systems take in and produce, including prompts, outputs and the decisions they supported, and are applied in practice.
Accountable: Data owner.
Provenance of training and test data
For data used to train, tune or test AI, the organisation knows and records where it came from, what rights it holds over it, and any limits on its use.
Accountable: Data owner.
Hosting and data location
Requirements for where AI is hosted and where its data is processed and stored are defined, and each use of AI is checked against them before and during live use.
Accountable: Delivery lead.
Testing and evaluation before release
Before release, each AI system is tested for accuracy, robustness and behaviour against acceptance criteria agreed in advance, and released only if it meets them.
Accountable: Delivery lead.
Security of the AI supply chain
The security of models, data, code and services obtained from others is assessed before use and managed for as long as they are in use.
Accountable: Security lead.
Workforce planning for AI
The expected effect of AI on roles, numbers and skills is planned for openly, with affected staff and their representatives informed and involved, and decisions made fairly.
Accountable: People lead.
Safe to raise concerns
Anyone can raise a concern or report a problem with AI without fear of blame, and can see what was done about it.
Accountable: AI governance lead.
AI incidents and near misses
AI incidents and near misses that are not security incidents, such as wrong outputs, harm to people or misuse, are reported, investigated and learned from.
Accountable: AI governance lead.
Re-assessing AI maturity
The organisation re-runs this framework's assessment on a set cycle, compares results with earlier ones, and acts on the gaps it finds.
Accountable: AI governance lead.
Reporting to leadership
Leadership and the board receive consolidated, evidence-based reporting on AI use, performance, benefits, incidents and risk, on a set cycle.
Accountable: Executive sponsor.