AI Risk Management and Governance

AI risk management is the process of identifying, assessing, controlling and monitoring the risks that come from using AI, such as biased or unreliable outputs, lack of explainability, data leakage and security attacks. Done well, it sits inside a firm’s existing risk framework, with clear owners, a defined risk appetite and regular reporting, rather than running as a separate compliance exercise.

AI governance is the set of policies, processes, roles and controls that guide how AI is developed, deployed and operated, so that harms are minimised and benefits are realised. Good practice includes defining responsible AI principles and policies, embedding risk management across the AI lifecycle, setting clear roles and accountability, running training and culture programmes, and monitoring systems once they are live.

An AI risk assessment identifies each AI system in use, the data it relies on and the decisions it influences, then scores the likelihood and severity of failure to set a risk tier. The tier decides the controls: logging and a usage policy for low-risk internal tools, through to human oversight, audit trails and formal assessment for high-risk systems such as credit scoring.

There is no single AI risk framework. The most widely referenced are the NIST AI Risk Management Framework, ISO/IEC 42001 for AI management systems, ISO/IEC 23894 for AI risk management, the EU AI Act, and the OECD’s guidance on governing and managing risk across the AI lifecycle. UK financial services firms should also consider PRA SS1/23 on model risk management and the FCA’s expectations under Consumer Duty and the Senior Managers and Certification Regime.

The Act does not require a single universal risk score, but it attaches different obligations to prohibited practices, high-risk systems and systems with transparency duties, so any firm that provides or uses AI in the EU needs to know which category each system falls into. Following the Digital Omnibus, Regulation (EU) 2026/1744, which entered into force on 27 July 2026, high-risk obligations apply from 2 December 2027 for Annex III systems such as credit scoring and recruitment tools, and from 2 August 2028 for AI built into regulated products.

AI risk is best treated as a cross-cutting risk that touches model, operational, conduct, data and third-party risk, rather than as a new silo. In practice that means adding AI systems to your model inventory, setting AI risk tolerances within your existing appetite, defining roles across the three lines of defence, and reporting AI key risk indicators through the committees you already have.

Common controls include clear acceptable use policies and responsible AI terms in vendor contracts; telling users when they are dealing with AI and offering a non-automated alternative where it matters; human oversight through impact assessments, appeal routes and rapid escalation; transparency artefacts such as model cards and system cards; regular fairness testing across customer groups; and ongoing safety evaluation and content filtering.

A typical engagement takes around eight weeks from discovery to controls in place: two weeks to map your AI estate, two to assess and prioritise, and four to design and implement controls. Monitoring and assurance then continue as your systems and the regulations change. Scope depends on the size of your AI estate.